GET marketmoversnews.net/rstracking.php?o5AEZC1KT65tzNeS41Uogf9o1aIBjVz0Sjo5ZJZpZ7Hxc2GgWMqKvXI/S9qUQMQ1demM18BuDc9IU9aQLSUUQmdCyOxVDyREsrCVBQK5ny81O0YHx2DrE7RmSXqjnUxkwRPhChKeGaalku5aSSAKr3uYFS7klhV/LsOeXXCn0P0=
302 Found 0 B URL User Request GET HTTP/2 marketmoversnews.net/rstracking.php?o5AEZC1KT65tzNeS41Uogf9o1aIBjVz0Sjo5ZJZpZ7Hxc2GgWMqKvXI/S9qUQMQ1demM18BuDc9IU9aQLSUUQmdCyOxVDyREsrCVBQK5ny81O0YHx2DrE7RmSXqjnUxkwRPhChKeGaalku5aSSAKr3uYFS7klhV/LsOeXXCn0P0=
IP
Certificate IssuerSectigo Limited
Subjectmarketmoversnews.net
Fingerprint33:AC:0B:56:16:66:4D:DE:67:A0:E3:CB:B1:89:A8:DD:D8:11:1B:FB
ValiditySat, 25 May 2024 00:00:00 GMT - Sun, 25 May 2025 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /rstracking.php?o5AEZC1KT65tzNeS41Uogf9o1aIBjVz0Sjo5ZJZpZ7Hxc2GgWMqKvXI/S9qUQMQ1demM18BuDc9IU9aQLSUUQmdCyOxVDyREsrCVBQK5ny81O0YHx2DrE7RmSXqjnUxkwRPhChKeGaalku5aSSAKr3uYFS7klhV/LsOeXXCn0P0= HTTP/1.1
Host: marketmoversnews.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
location: http://mail.marketmoversnews.net/
content-type: text/html; charset=UTF-8
content-length: 0
date: Sat, 07 Dec 2024 15:52:49 GMT
server: LiteSpeed
cache-control: no-cache, no-store, must-revalidate, max-age=0
x-turbo-charged-by: LiteSpeed
X-Firefox-Spdy: h2
GET mail.marketmoversnews.net/
301 Moved Permanently 795 B URL User Request GET HTTP/2 mail.marketmoversnews.net/
IP
Certificate IssuerSectigo Limited
Subjectmail.marketmoversnews.net
Fingerprint91:C9:82:C3:8B:E9:FB:1A:C0:F4:28:3C:E1:D0:DF:76:C8:30:A8:10
ValidityMon, 26 Aug 2024 00:00:00 GMT - Tue, 26 Aug 2025 23:59:59 GMT
File type HTML document, ASCII text, with CRLF, LF line terminators
Hash 5d8d79c3cb9af023240b1be6f5057aaa
df22980677b134e83d878893f7c7984e0d78a240
e8b101a7c7f64aad528cc734513cbeb02243c0af37930dc0f3239749cff184b6
GET / HTTP/1.1
Host: mail.marketmoversnews.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
keep-alive: timeout=5, max=100
content-type: text/html
content-length: 795
date: Sat, 07 Dec 2024 15:52:50 GMT
server: LiteSpeed
location: https://mail.marketmoversnews.net/
x-turbo-charged-by: LiteSpeed
GET mail.marketmoversnews.net/
301 Moved Permanently 795 B URL User Request GET HTTP/2 mail.marketmoversnews.net/
IP
Certificate IssuerSectigo Limited
Subjectmail.marketmoversnews.net
Fingerprint91:C9:82:C3:8B:E9:FB:1A:C0:F4:28:3C:E1:D0:DF:76:C8:30:A8:10
ValidityMon, 26 Aug 2024 00:00:00 GMT - Tue, 26 Aug 2025 23:59:59 GMT
File type HTML document, ASCII text, with CRLF, LF line terminators
Hash 5d8d79c3cb9af023240b1be6f5057aaa
df22980677b134e83d878893f7c7984e0d78a240
e8b101a7c7f64aad528cc734513cbeb02243c0af37930dc0f3239749cff184b6
GET / HTTP/1.1
Host: mail.marketmoversnews.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
content-type: text/html
content-length: 795
date: Sat, 07 Dec 2024 15:52:50 GMT
server: LiteSpeed
location: https://www.npvnt7trk.com/3J67C/79C6G4/?sub1=mail.marketmoversnews.net
x-turbo-charged-by: LiteSpeed
X-Firefox-Spdy: h2
GET www.npvnt7trk.com/3J67C/79C6G4/?sub1=mail.marketmoversnews.net
302 Found 127 B URL User Request GET HTTP/2 www.npvnt7trk.com/3J67C/79C6G4/?sub1=mail.marketmoversnews.net
IP
ASN #396982 GOOGLE-CLOUD-PLATFORM
Certificate IssuerStarfield Technologies, Inc.
Subjectnpvnt7trk.com
FingerprintD5:FB:4C:EA:5B:C7:55:6A:19:69:0B:38:94:F0:1D:4F:70:CE:F2:A6
ValidityThu, 29 Aug 2024 20:36:35 GMT - Sun, 19 Jan 2025 19:01:26 GMT
File type HTML document, ASCII text
Hash 571735c0e2c0e7e07a8ff5db40c0cfd1
5ef8b48331b339b0d713cd2801976ac9b7781c81
81a180c9c952deda1b13d4a7ca1adb9d66a0f583941be1525be2346053373cae
GET /3J67C/79C6G4/?sub1=mail.marketmoversnews.net HTTP/1.1
Host: www.npvnt7trk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: nginx
date: Sat, 07 Dec 2024 15:52:51 GMT
content-type: text/html; charset=utf-8
content-length: 127
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
location: https://www.lmbahsj2.com/29PD1BG/FGXLG/?source_id=9&sub1=2&sub2=080c5617ee2e4cf7b5eb3c85e6b2ad0b
set-cookie: uniqueClick_79C6G4=bf97bbee-c7c8-4ee2-be33-d3f66133873f:1733586771; Path=/; Expires=Sun, 08 Dec 2024 21:52:51 GMT; Secure; SameSite=None
transaction_id=080c5617ee2e4cf7b5eb3c85e6b2ad0b; Path=/; Expires=Fri, 07 Mar 2025 15:52:51 GMT; Secure; SameSite=None
vary: Origin
x-eflow-request-id: 6347ed53-f9e8-4f7c-8c16-c8bfa1658724
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET www.lmbahsj2.com/29PD1BG/FGXLG/?source_id=9&sub1=2&sub2=080c5617ee2e4cf7b5eb3c85e6b2ad0b
302 Found 260 B URL User Request GET HTTP/2 www.lmbahsj2.com/29PD1BG/FGXLG/?source_id=9&sub1=2&sub2=080c5617ee2e4cf7b5eb3c85e6b2ad0b
IP
ASN #396982 GOOGLE-CLOUD-PLATFORM
Certificate IssuerStarfield Technologies, Inc.
Subjectlmbahsj2.com
FingerprintA1:7A:C4:FC:AC:8D:B7:8D:5A:15:64:81:79:E7:87:53:DB:D0:A2:1B
ValidityThu, 14 Mar 2024 13:49:10 GMT - Tue, 15 Apr 2025 13:49:10 GMT
File type HTML document, ASCII text
Hash f60a519a1d3a2abaf69f29230fe3f175
c3139225ea47b96e4f7fe0e28266f73beb8c2177
a264bb1cd67d138050b8e5b792519f8869defc2107b8c28a7c260211c7088968
GET /29PD1BG/FGXLG/?source_id=9&sub1=2&sub2=080c5617ee2e4cf7b5eb3c85e6b2ad0b HTTP/1.1
Host: www.lmbahsj2.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: nginx
date: Sat, 07 Dec 2024 15:52:51 GMT
content-type: text/html; charset=utf-8
content-length: 260
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
location: https://www.lmbahsj2.com/29PD1BG/9K7SB2/?__rpt=0&__po=9&__ptid=c34e948178be4fd0b4481cb7b87bb351&__rpa=0&__rc=1&sub1=2&sub2=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sub3=&sub4=&sub5=&source_id=9&__pcd=9
set-cookie: uniqueClick_FGXLG=dabcd2b5-664b-4871-a3fa-acfe7ff4eadc:1733586771; Path=/; Expires=Sun, 08 Dec 2024 15:52:51 GMT; Secure; SameSite=None
vary: Origin
x-eflow-request-id: 63b0da2e-d660-41fc-b6d5-2b711ac81ecb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET www.lmbahsj2.com/29PD1BG/9K7SB2/?__rpt=0&__po=9&__ptid=c34e948178be4fd0b4481cb7b87bb351&__rpa=0&__rc=1&sub1=2&sub2=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sub3=&sub4=&sub5=&source_id=9&__pcd=9
302 Found 408 B URL User Request GET HTTP/2 www.lmbahsj2.com/29PD1BG/9K7SB2/?__rpt=0&__po=9&__ptid=c34e948178be4fd0b4481cb7b87bb351&__rpa=0&__rc=1&sub1=2&sub2=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sub3=&sub4=&sub5=&source_id=9&__pcd=9
IP
ASN #396982 GOOGLE-CLOUD-PLATFORM
Certificate IssuerStarfield Technologies, Inc.
Subjectlmbahsj2.com
FingerprintA1:7A:C4:FC:AC:8D:B7:8D:5A:15:64:81:79:E7:87:53:DB:D0:A2:1B
ValidityThu, 14 Mar 2024 13:49:10 GMT - Tue, 15 Apr 2025 13:49:10 GMT
File type HTML document, ASCII text, with very long lines (406)
Hash 674a327c63e6bee01a9444bd230e7563
a9c23dc9c0a6a2437ae196b1893c36281d9f1089
1bbc0707ff97342f251d506bb7b7a541ae65acf937e7a730a5f8b1f5babec5e0
GET /29PD1BG/9K7SB2/?__rpt=0&__po=9&__ptid=c34e948178be4fd0b4481cb7b87bb351&__rpa=0&__rc=1&sub1=2&sub2=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sub3=&sub4=&sub5=&source_id=9&__pcd=9 HTTP/1.1
Host: www.lmbahsj2.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: uniqueClick_FGXLG=dabcd2b5-664b-4871-a3fa-acfe7ff4eadc:1733586771
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 302 Found
server: nginx
date: Sat, 07 Dec 2024 15:52:51 GMT
content-type: text/html; charset=utf-8
content-length: 408
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
location: https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
set-cookie: uniqueClick_9K7SB2=7fbd359e-309d-4bc6-8909-7a1761271eeb:1733586771; Path=/; Expires=Sun, 08 Dec 2024 15:52:51 GMT; Secure; SameSite=None
transaction_id=204b55d1f93041fabac6b8ff921ba4c3; Path=/; Expires=Fri, 07 Mar 2025 15:52:51 GMT; Secure; SameSite=None
vary: Origin
x-eflow-request-id: 3177a980-0d32-434b-b673-e32304ba9638
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
301 Moved Permanently 795 B IP
Certificate IssuerSectigo Limited
Subjectmarketmoversnews.net
Fingerprint33:AC:0B:56:16:66:4D:DE:67:A0:E3:CB:B1:89:A8:DD:D8:11:1B:FB
ValiditySat, 25 May 2024 00:00:00 GMT - Sun, 25 May 2025 23:59:59 GMT
File type HTML document, ASCII text, with CRLF, LF line terminators
Hash 5d8d79c3cb9af023240b1be6f5057aaa
df22980677b134e83d878893f7c7984e0d78a240
e8b101a7c7f64aad528cc734513cbeb02243c0af37930dc0f3239749cff184b6
GET / HTTP/1.1
Host: marketmoversnews.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
keep-alive: timeout=5, max=100
content-type: text/html
content-length: 795
date: Sat, 07 Dec 2024 15:52:52 GMT
server: LiteSpeed
location: https://marketmoversnews.net/
x-turbo-charged-by: LiteSpeed
GET widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js
200 OK 7.4 kB URL GET HTTP/2 widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerAmazon
Subject*.trustpilot.com
Fingerprint5C:AB:2E:95:E4:51:10:BB:40:25:C7:8D:ED:DC:24:1E:43:F0:65:23
ValidityTue, 03 Dec 2024 00:00:00 GMT - Thu, 01 Jan 2026 23:59:59 GMT
File type JavaScript source, Unicode text, UTF-8 (with BOM) text, with very long lines (23588)
Hash aaede52b3eb338a4c40a92d3dbe23826
230358c6626a991066aa9d0a759961ddf864be8a
682ab4c8be1cb38cf575dddee00463eb0a6b4c21c322c9be24eb76ca899117f2
GET /bootstrap/v5/tp.widget.bootstrap.min.js HTTP/1.1
Host: widget.trustpilot.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/x-javascript
content-length: 7350
last-modified: Wed, 09 Oct 2024 12:04:38 GMT
x-amz-server-side-encryption: AES256
content-encoding: gzip
accept-ranges: bytes
server: AmazonS3
date: Sat, 07 Dec 2024 02:42:54 GMT
cache-control: max-age=86400
etag: "7d4644d89e45fe92623bdd628e60e8dd"
x-cache: Hit from cloudfront
via: 1.1 76c917e0bb0ba45eb834d25d76ee125e.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 4N88Bpl8OMKDirp4XE88eE7jeVgpk5SfG7RXz1RU9QwLZbv5CDZh8g==
age: 47400
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
GET widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js
200 OK 7.4 kB URL GET HTTP/2 widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerAmazon
Subject*.trustpilot.com
Fingerprint5C:AB:2E:95:E4:51:10:BB:40:25:C7:8D:ED:DC:24:1E:43:F0:65:23
ValidityTue, 03 Dec 2024 00:00:00 GMT - Thu, 01 Jan 2026 23:59:59 GMT
File type JavaScript source, Unicode text, UTF-8 (with BOM) text, with very long lines (23588)
Hash aaede52b3eb338a4c40a92d3dbe23826
230358c6626a991066aa9d0a759961ddf864be8a
682ab4c8be1cb38cf575dddee00463eb0a6b4c21c322c9be24eb76ca899117f2
GET /bootstrap/v5/tp.widget.bootstrap.min.js HTTP/1.1
Host: widget.trustpilot.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/x-javascript
content-length: 7350
last-modified: Wed, 09 Oct 2024 12:04:38 GMT
x-amz-server-side-encryption: AES256
content-encoding: gzip
accept-ranges: bytes
server: AmazonS3
date: Sat, 07 Dec 2024 02:42:54 GMT
cache-control: max-age=86400
etag: "7d4644d89e45fe92623bdd628e60e8dd"
x-cache: Hit from cloudfront
via: 1.1 76c917e0bb0ba45eb834d25d76ee125e.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: RMii0JfXHOeuuHnQh4LZUVFcdjT75gpIFijBODKH6uIvpy-OvDvHmA==
age: 47400
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
GET use.typekit.net/dcq8kbe.css
200 OK 884 B URL GET HTTP/2 use.typekit.net/dcq8kbe.css
IP
ASN #20940 Akamai International B.V.
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subjectuse.typekit.net
Fingerprint04:25:F2:63:F0:2D:54:4F:A7:7E:22:4C:71:E6:9B:01:DD:73:73:97
ValidityThu, 17 Oct 2024 00:00:00 GMT - Mon, 17 Nov 2025 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (516)
Hash 9b7429309aa7a509fe0d3d59ea932823
7c3e80bf04bb19f17ceda1e62b1e3be59be73c85
9afdd14bf99da6623d565f70abb79f9e9e865c0b632e53e96db05d9b7f1113b8
GET /dcq8kbe.css HTTP/1.1
Host: use.typekit.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: text/css;charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains;
cache-control: private, max-age=600, stale-while-revalidate=604800
timing-allow-origin: *
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
content-length: 884
date: Sat, 07 Dec 2024 15:52:53 GMT
X-Firefox-Spdy: h2
200 OK 28 kB IP
Certificate IssuerSectigo Limited
Subjectmarketmoversnews.net
Fingerprint33:AC:0B:56:16:66:4D:DE:67:A0:E3:CB:B1:89:A8:DD:D8:11:1B:FB
ValiditySat, 25 May 2024 00:00:00 GMT - Sun, 25 May 2025 23:59:59 GMT
File type HTML document, ASCII text, with very long lines (14449)
Hash 65b47a3bce9602ae4ed329384b17d2d3
e85246df5e2dbc86a4a47c7a9dc4e9b4ad3f57eb
aec20532b4fc6a7f3b96f3af412ac9323b2adfd3a83918d11ef3100e8dfe09f7
GET / HTTP/1.1
Host: marketmoversnews.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
link: <https://marketmoversnews.net/wp-json/>; rel="https://api.w.org/", <https://marketmoversnews.net/wp-json/wp/v2/pages/10212>; rel="alternate"; title="JSON"; type="application/json", <https://marketmoversnews.net/>; rel=shortlink
etag: "55671-1733586764;br"
x-litespeed-cache: hit
content-encoding: br
vary: Accept-Encoding
content-length: 28023
date: Sat, 07 Dec 2024 15:52:53 GMT
server: LiteSpeed
x-turbo-charged-by: LiteSpeed
X-Firefox-Spdy: h2
GET p.typekit.net/p.css?s=1&k=dcq8kbe&ht=tk&f=6844.6845.6846.6847.6848.6851.6852.6853&a=176595194&app=typekit&e=css
200 OK 5 B URL GET HTTP/2 p.typekit.net/p.css?s=1&k=dcq8kbe&ht=tk&f=6844.6845.6846.6847.6848.6851.6852.6853&a=176595194&app=typekit&e=css
IP
ASN #20940 Akamai International B.V.
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subjectuse.typekit.net
Fingerprint04:25:F2:63:F0:2D:54:4F:A7:7E:22:4C:71:E6:9B:01:DD:73:73:97
ValidityThu, 17 Oct 2024 00:00:00 GMT - Mon, 17 Nov 2025 23:59:59 GMT
Hash 83d24d4b43cc7eef2b61e66c95f3d158
f0cafc285ee23bb6c28c5166f305493c4331c84d
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb
GET /p.css?s=1&k=dcq8kbe&ht=tk&f=6844.6845.6846.6847.6848.6851.6852.6853&a=176595194&app=typekit&e=css HTTP/1.1
Host: p.typekit.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://use.typekit.net/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: text/css
content-length: 5
last-modified: Sun, 01 Dec 2024 12:58:09 GMT
etag: "674c5d61-5"
cache-control: public, max-age=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
date: Sat, 07 Dec 2024 15:52:53 GMT
X-Firefox-Spdy: h2
GET www.googletagmanager.com/gtm.js?id=GTM-5B82MZ73
200 OK 108 kB URL GET HTTP/2 www.googletagmanager.com/gtm.js?id=GTM-5B82MZ73
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subject*.google-analytics.com
Fingerprint8F:6D:67:20:75:1C:E2:F2:C3:65:DF:AC:EA:22:D8:AD:ED:0A:08:BA
ValidityMon, 21 Oct 2024 08:36:57 GMT - Mon, 13 Jan 2025 08:36:56 GMT
File type JavaScript source, ASCII text, with very long lines (18150)
Size 108 kB (108490 bytes)
Hash 4737f203045c35b51b59863e8805f443
40fc775c4548c4ca2744df1731b51b343f8b6582
3eef375dd574fb564f2029c15606d0e6ea1af07cead6007bf6ce6e00be46b701
GET /gtm.js?id=GTM-5B82MZ73 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sat, 07 Dec 2024 15:52:53 GMT
expires: Sat, 07 Dec 2024 15:52:53 GMT
cache-control: private, max-age=900
last-modified: Sat, 07 Dec 2024 15:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
server: Google Tag Manager
content-length: 108490
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET www.googletagmanager.com/gtag/js?id=G-RXLL9Z7XBK&l=dataLayer&cx=c>m=45He4c40v9137104487za200
200 OK 112 kB URL GET HTTP/3 www.googletagmanager.com/gtag/js?id=G-RXLL9Z7XBK&l=dataLayer&cx=c>m=45He4c40v9137104487za200
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subject*.google-analytics.com
Fingerprint8F:6D:67:20:75:1C:E2:F2:C3:65:DF:AC:EA:22:D8:AD:ED:0A:08:BA
ValidityMon, 21 Oct 2024 08:36:57 GMT - Mon, 13 Jan 2025 08:36:56 GMT
File type JavaScript source, ASCII text, with very long lines (7726)
Size 112 kB (112390 bytes)
Hash debb761dc83026b694439e1bd8c6002f
57104fa07768bd1e7b441d6b282759865f76619c
ccb70204c3b1bc2f978ba9c8c957fe803319c6945d379c67a870e8a363ba41ea
GET /gtag/js?id=G-RXLL9Z7XBK&l=dataLayer&cx=c>m=45He4c40v9137104487za200 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sat, 07 Dec 2024 15:52:53 GMT
expires: Sat, 07 Dec 2024 15:52:53 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
server: Google Tag Manager
content-length: 112390
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
POST www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Floans.quickenloans.com%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=408682164.1733586774&auid=1212055104.1733586774&npa=1>m=45He4c40v9137104487za200&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485&tft=1733586773632&tfd=4492&apve=1
200 OK 0 B URL POST HTTP/2 www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Floans.quickenloans.com%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=408682164.1733586774&auid=1212055104.1733586774&npa=1>m=45He4c40v9137104487za200&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485&tft=1733586773632&tfd=4492&apve=1
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectwww.google.com
FingerprintC1:5D:47:A6:B2:09:5F:1C:78:06:A8:63:D5:80:5A:A2:73:83:A3:B3
ValidityMon, 21 Oct 2024 08:38:45 GMT - Mon, 13 Jan 2025 08:38:44 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /ccm/collect?en=page_view&dl=https%3A%2F%2Floans.quickenloans.com%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=408682164.1733586774&auid=1212055104.1733586774&npa=1>m=45He4c40v9137104487za200&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485&tft=1733586773632&tfd=4492&apve=1 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
HTTP/2 200 OK
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
date: Sat, 07 Dec 2024 15:52:54 GMT
content-type: text/plain
vary: Origin, X-Origin, Referer
server: scaffolding on HTTPServer2
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
access-control-allow-origin: null
access-control-expose-headers: date,vary,vary,vary,server,content-length
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
200 OK 22 kB URL GET HTTP/2 www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subject*.datadoghq-browser-agent.com
Fingerprint9E:40:A3:B8:F8:5F:43:15:5B:BB:AF:99:5C:07:D1:39:23:59:1F:51
ValidityTue, 30 Jul 2024 00:00:00 GMT - Sun, 03 Aug 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (57247), with no line terminators
Hash eb7db3f75b7ab0900bf0872bfb57de75
417519fcf359c94c26694d1e074e4d80b95696f9
6b519b5f347fe22a3264004380b06baed16948c508790e6e9e52ed17d7c2468d
GET /us1/v5/datadog-logs.js HTTP/1.1
Host: www.datadoghq-browser-agent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: text/javascript
last-modified: Tue, 26 Nov 2024 15:58:07 GMT
content-encoding: br
x-amz-server-side-encryption: AES256
server: AmazonS3
date: Sat, 07 Dec 2024 15:52:53 GMT
cache-control: max-age=14400, s-maxage=60
etag: W/"eb7db3f75b7ab0900bf0872bfb57de75"
vary: accept-encoding
x-cache: Hit from cloudfront
via: 1.1 ee04daa979e7a02cc5ca472521bc18a6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: dFZnu-uGXgqHKF9mstGFZl_6NQwHxvskkRuHpU2ko3aNGsyZxkz8tA==
age: 3
timing-allow-origin: *
X-Firefox-Spdy: h2
GET region1.analytics.google.com/g/s/collect?dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1>m=45j91e4c50h2v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485&_gsid=RXLL9Z7XBKo88PCrJlRsSedIY5AJTWMg
204 No Content 0 B URL GET HTTP/2 region1.analytics.google.com/g/s/collect?dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1>m=45j91e4c50h2v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485&_gsid=RXLL9Z7XBKo88PCrJlRsSedIY5AJTWMg
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subject*.google-analytics.com
Fingerprint8F:6D:67:20:75:1C:E2:F2:C3:65:DF:AC:EA:22:D8:AD:ED:0A:08:BA
ValidityMon, 21 Oct 2024 08:36:57 GMT - Mon, 13 Jan 2025 08:36:56 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /g/s/collect?dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1>m=45j91e4c50h2v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485&_gsid=RXLL9Z7XBKo88PCrJlRsSedIY5AJTWMg HTTP/1.1
Host: region1.analytics.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
access-control-allow-origin: *
date: Sat, 07 Dec 2024 15:52:55 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: text/plain
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:194:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:194:0"}],}
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET loans.quickenloans.com/main.036fc29f9b13f2db7a72.js
200 OK 706 kB URL GET HTTP/2 loans.quickenloans.com/main.036fc29f9b13f2db7a72.js
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectloans.quickenloans.com
Fingerprint9B:58:4A:65:BD:EC:A5:31:73:3E:E2:82:74:12:E2:BD:67:80:66:0D
ValiditySat, 30 Nov 2024 14:32:02 GMT - Fri, 28 Feb 2025 14:32:01 GMT
File type JavaScript source, ASCII text, with very long lines (65453)
Size 706 kB (706383 bytes)
Hash d24df9a96b35755e4982d97f06d6e4d3
6e34c74dc356d4aacc253f3cd702279f07d1b61e
85d1a9f55ac6879043f1e88425765f234c493265f0c15e380d7b20347a30e562
GET /main.036fc29f9b13f2db7a72.js HTTP/1.1
Host: loans.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: AWSALBTG=pm/Su8V5VgtckloekXYk4ealJ1wWAmq8LyKoTlP8yeDIWxZqp13Wj6HJE4d8M4P2zaVfn5HrKKReutKSt83nfQc2uxb/WTSLEcIrpk3xwwPtoVKjO8u7dxcr+7rFXAaA9uYf2Jrr+EbCu37JkhmwoAXhdTZTRrMOlMq3/VTGtn3aw/IY2dk=; AWSALBTGCORS=pm/Su8V5VgtckloekXYk4ealJ1wWAmq8LyKoTlP8yeDIWxZqp13Wj6HJE4d8M4P2zaVfn5HrKKReutKSt83nfQc2uxb/WTSLEcIrpk3xwwPtoVKjO8u7dxcr+7rFXAaA9uYf2Jrr+EbCu37JkhmwoAXhdTZTRrMOlMq3/VTGtn3aw/IY2dk=; __cf_bm=RvscG9u2rNzcYNEGl9Z6WKPNQgOhELP.pujV1pArQW4-1733586772-1.0.1.1-CkWnx1j1r5V2HPum2.WGpsPkui00RBQ.Jan_D3kGmegrjHSQ_5662xIHsaBysDSjHZlk4LlqFLnh9HPG2Xy_tg
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:54 GMT
content-type: application/javascript; charset=UTF-8
x-powered-by: Express
cache-control: public, max-age=14400
last-modified: Thu, 05 Dec 2024 11:57:54 GMT
etag: W/"30756c-19396af09d0"
cf-cache-status: MISS
expires: Sat, 07 Dec 2024 19:52:54 GMT
vary: Accept-Encoding
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8ee5af745970b4ee-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
GET www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1237810024.1733586774>m=45j91e4c50h2v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485&aip=1&z=1110252313
200 OK 42 B URL GET HTTP/2 www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1237810024.1733586774>m=45j91e4c50h2v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485&aip=1&z=1110252313
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subject*.google.no
Fingerprint10:4D:45:7C:EB:8E:2F:4F:30:F1:84:1D:AB:53:C4:35:E0:FD:59:C3
ValidityMon, 21 Oct 2024 08:39:45 GMT - Mon, 13 Jan 2025 08:39:44 GMT
File type GIF image data, version 89a, 1 x 1
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1237810024.1733586774>m=45j91e4c50h2v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485&aip=1&z=1110252313 HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 07 Dec 2024 15:52:56 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET sgtm.quickenloans.com/g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4c40v9169491831z89137104487za200zb9137104487&_p=1733586773132&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485&cid=1237810024.1733586774&ecid=1619340942&ul=en-us&sr=1280x1024&_fplc=0&ur=NO-03&frm=0&pscdl=noapi&sst.etld=google.no&sst.gcsub=region1&sst.tft=1733586773132&sst.ude=0&_s=2&sid=1733586773&sct=1&seg=1&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D204b55d1f93041fabac6b8ff921ba4c3%26pkey%3D080c5617ee2e4cf7b5eb3c85e6b2ad0b%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D204b55d1f93041fabac6b8ff921ba4c3%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&en=page_view&tfd=4821&richsstsse
200 OK 751 B URL GET HTTP/2 sgtm.quickenloans.com/g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4c40v9169491831z89137104487za200zb9137104487&_p=1733586773132&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485&cid=1237810024.1733586774&ecid=1619340942&ul=en-us&sr=1280x1024&_fplc=0&ur=NO-03&frm=0&pscdl=noapi&sst.etld=google.no&sst.gcsub=region1&sst.tft=1733586773132&sst.ude=0&_s=2&sid=1733586773&sct=1&seg=1&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D204b55d1f93041fabac6b8ff921ba4c3%26pkey%3D080c5617ee2e4cf7b5eb3c85e6b2ad0b%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D204b55d1f93041fabac6b8ff921ba4c3%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&en=page_view&tfd=4821&richsstsse
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectsgtm.quickenloans.com
Fingerprint4E:86:D8:38:35:2F:10:58:51:04:6D:AF:7F:BE:F9:A5:A6:A8:AA:4E
ValidityThu, 21 Nov 2024 05:40:09 GMT - Wed, 19 Feb 2025 06:30:20 GMT
Hash 1bf643181539c111865a01db8c2d3a97
c8a47bcd5b72601221cf53e7900a8c94444d5378
ed139258cfbe6ba7f04432421e836e2c0da371592cbc175ff85407fcce45b1f6
GET /g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4c40v9169491831z89137104487za200zb9137104487&_p=1733586773132&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485&cid=1237810024.1733586774&ecid=1619340942&ul=en-us&sr=1280x1024&_fplc=0&ur=NO-03&frm=0&pscdl=noapi&sst.etld=google.no&sst.gcsub=region1&sst.tft=1733586773132&sst.ude=0&_s=2&sid=1733586773&sct=1&seg=1&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D204b55d1f93041fabac6b8ff921ba4c3%26pkey%3D080c5617ee2e4cf7b5eb3c85e6b2ad0b%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D204b55d1f93041fabac6b8ff921ba4c3%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&en=page_view&tfd=4821&richsstsse HTTP/1.1
Host: sgtm.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Cookie: _gcl_au=1.1.1212055104.1733586774; _ga_RXLL9Z7XBK=GS1.1.1733586773.1.1.1733586773.0.0.1619340942; _ga=GA1.1.1237810024.1733586774
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
set-cookie: FPID=FPID2.2.nRhVFPTt%2Bd%2BrRL9JQtDujoVAdVL7Vyg%2FnlczdutR17M%3D.1733586774; Max-Age=63072000; Domain=quickenloans.com; Path=/; Secure; HttpOnly
FPLC=UD1L4U3IJVFjQd6bP8xhhKOSmZzO%2B3YpAWJ5cV46or%2Fbkz9zSLRDl5WKplXyOSsbfus7tJ2nKNqMapCIAO4GwZqU4VjiFwMI91PDiDOb5djU6gxxFqbJTJSO2ygtAA%3D%3D; Max-Age=72000; Domain=quickenloans.com; Path=/; Secure
FPAU=1.1.1212055104.1733586774; Max-Age=7776000; Domain=quickenloans.com; Path=/; Secure
FPGSID=1.1733586774.1733586774.G-RXLL9Z7XBK.S36PUJb9dXHuulo3v_btFA; Max-Age=1800; Domain=quickenloans.com; Path=/; SameSite=strict; Secure
cache-control: no-cache
content-type: text/plain
x-content-type-options: nosniff
x-accel-buffering: no
access-control-allow-origin: https://loans.quickenloans.com
access-control-allow-credentials: true
date: Sat, 07 Dec 2024 15:52:54 GMT
server: Google Frontend
expires: Sat, 07 Dec 2024 15:52:54 GMT
X-Firefox-Spdy: h2
GET use.typekit.net/af/cafa63/00000000000000000001709a/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
200 OK 24 kB URL GET HTTP/2 use.typekit.net/af/cafa63/00000000000000000001709a/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
IP
ASN #20940 Akamai International B.V.
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subjectuse.typekit.net
Fingerprint04:25:F2:63:F0:2D:54:4F:A7:7E:22:4C:71:E6:9B:01:DD:73:73:97
ValidityThu, 17 Oct 2024 00:00:00 GMT - Mon, 17 Nov 2025 23:59:59 GMT
File type Web Open Font Format (Version 2), TrueType, length 24272, version 1.0
Hash 33150f36436b3a686d25d599762d6974
084c5cdedbfa82ce1dba3ae94d35ad1d1ebbe586
5461e0722bbe365dfa0df4652c60a6ced5f83c840d03021c4abd04ae9f9c6980
GET /af/cafa63/00000000000000000001709a/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3 HTTP/1.1
Host: use.typekit.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Referer: https://use.typekit.net/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: application/font-woff2
content-length: 24272
etag: "1500587fffa9a4bb64d06e988493ea23a02a484a"
timing-allow-origin: *
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cache-control: public, max-age=31536000
date: Sat, 07 Dec 2024 15:52:56 GMT
X-Firefox-Spdy: h2
GET content.quickencompare.com/qlpln/favicon.ico
200 OK 8.1 kB URL GET content.quickencompare.com/qlpln/favicon.ico
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectquickencompare.com
Fingerprint91:CF:56:CF:08:92:B6:4B:4D:58:82:62:70:2A:51:8C:F0:F4:49:03
ValidityMon, 11 Nov 2024 06:14:11 GMT - Sun, 09 Feb 2025 06:14:10 GMT
File type gzip compressed data, from Unix
Hash 0099a4bb4c8d97f80152e39a8a193aa8
87f45d11b225d2a03dfd88a964464b9cedaa8e41
812db2c348a224303ac182e479e11ae4efd353bbda78417cb8e57b6fbd5c489a
GET /qlpln/favicon.ico HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:56 GMT
content-type: image/vnd.microsoft.icon
last-modified: Thu, 08 Aug 2024 07:51:06 GMT
etag: W/"0be220b17dcbe52bb4a1c4af89b0a2b5"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
via: 1.1 ab68583a58d574d6a9e5fca1fb1e6316.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P6
x-amz-cf-id: yDeO2fZs-llVg011F0RLXRjn4kp-uJQ6VIN7mNThWaQ_-9RXO5YytQ==
cf-cache-status: HIT
age: 1911
expires: Sat, 07 Dec 2024 19:52:56 GMT
cache-control: public, max-age=14400
set-cookie: __cf_bm=PwWAjrShBGu_RAq3zSpYh0qMr8_xRtEfPFKWuPVVR2c-1733586776-1.0.1.1-o8Q51BvK1gst_Gh9_6x3jnd4slocKdvHf2r9fZcaavCjsH8lrYVokoFBTJJBn.hyIKKGyHVtSCpCwoMEIL08hw; path=/; expires=Sat, 07-Dec-24 16:22:56 GMT; domain=.quickencompare.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8ee5af8629c556a3-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
GET fonts.cdnfonts.com/css/stack-ssi
200 OK 215 B URL GET HTTP/2 fonts.cdnfonts.com/css/stack-ssi
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectcdnfonts.com
FingerprintAF:E7:69:AA:A3:CA:45:49:BE:E8:15:3B:BD:D3:22:6C:86:18:C1:C2
ValidityMon, 18 Nov 2024 09:38:53 GMT - Sun, 16 Feb 2025 09:38:52 GMT
Hash 789f95548e027aa77fe291b729df7adf
2c84749f84de22576774277019787f4387c59200
c6659e8919d1cde02448dce70dfd9ef0d9b3ba4d416fd904ab564baff472c1ca
GET /css/stack-ssi HTTP/1.1
Host: fonts.cdnfonts.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:56 GMT
content-type: text/css;charset=UTF-8
vary: Accept-Encoding
cache-control: max-age=2678400
cf-cache-status: HIT
age: 1128395
last-modified: Sun, 24 Nov 2024 14:26:21 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3bkopeL9FGH8i2McmF%2BZiIh9wawJF11SGGh3aHOWAARACG%2BoKGJGEw4bGlsoAJb92YhgYdPA5Y3YDjHO3yY%2Bdh6S4NJMWxg6wHS77lWAkfNG4mfm4pyeucl9NR76vU7BK%2BlYiVY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-origin: *
server: cloudflare
cf-ray: 8ee5af867e2d5684-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=8024&min_rtt=7966&rtt_var=1328&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3200&recv_bytes=1053&delivery_rate=532810&cwnd=253&unsent_bytes=0&cid=e3c0b9b1330bfab0&ts=50&x=0"
X-Firefox-Spdy: h2
GET www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1237810024.1733586774>m=45j91e4c50h2v9169491831z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485&aip=1&z=1843891315
200 OK 42 B URL GET HTTP/3 www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1237810024.1733586774>m=45j91e4c50h2v9169491831z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485&aip=1&z=1843891315
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subject*.google.no
Fingerprint10:4D:45:7C:EB:8E:2F:4F:30:F1:84:1D:AB:53:C4:35:E0:FD:59:C3
ValidityMon, 21 Oct 2024 08:39:45 GMT - Mon, 13 Jan 2025 08:39:44 GMT
File type GIF image data, version 89a, 1 x 1
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1237810024.1733586774>m=45j91e4c50h2v9169491831z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485&aip=1&z=1843891315 HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 07 Dec 2024 15:52:57 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
POST session-replay.browser-intake-datadoghq.com/api/v2/replay?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Apersonal-loans-webapp%2Cversion%3A1.0.0%20undefined&dd-api-key=pub7338472aab069e71fb1763621d542e2d&dd-evp-origin-version=3.11.0&dd-evp-origin=browser&dd-request-id=5aba6985-9684-48fc-aae1-fed3baee15fb
202 Accepted 53 B URL POST HTTP/2 session-replay.browser-intake-datadoghq.com/api/v2/replay?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Apersonal-loans-webapp%2Cversion%3A1.0.0%20undefined&dd-api-key=pub7338472aab069e71fb1763621d542e2d&dd-evp-origin-version=3.11.0&dd-evp-origin=browser&dd-request-id=5aba6985-9684-48fc-aae1-fed3baee15fb
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subject*.browser-intake-datadoghq.com
FingerprintA5:35:6C:08:38:11:47:18:E3:47:D1:C3:02:96:A1:9D:F0:42:EA:64
ValidityTue, 14 May 2024 00:00:00 GMT - Sat, 17 May 2025 23:59:59 GMT
Hash fb9012eb0aaef98d5791111bd4787451
9e9404d2b6003411d72893355ed197feb684399b
87534d53499b199e199a9aa4b8f2a983651172f549caf3e364b986489099aed2
POST /api/v2/replay?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Apersonal-loans-webapp%2Cversion%3A1.0.0%20undefined&dd-api-key=pub7338472aab069e71fb1763621d542e2d&dd-evp-origin-version=3.11.0&dd-evp-origin=browser&dd-request-id=5aba6985-9684-48fc-aae1-fed3baee15fb HTTP/1.1
Host: session-replay.browser-intake-datadoghq.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data; boundary=---------------------------15090116964491335532885752949
Content-Length: 20832
Origin: null
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 202 Accepted
content-type: application/json
content-length: 53
dd-request-id: 5aba6985-9684-48fc-aae1-fed3baee15fb
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 07 Dec 2024 15:52:56 GMT
X-Firefox-Spdy: h2
POST browser-intake-datadoghq.com/api/v2/logs?ddsource=browser&ddtags=sdk_version%3A5.32.0%2Capi%3Axhr%2Cenv%3Aprod%2Cservice%3Aql&dd-api-key=pub4d5c615be9e91858ed9e115fd855570c&dd-evp-origin-version=5.32.0&dd-evp-origin=browser&dd-request-id=625c1353-08b9-4517-a379-e43f58eb1508
202 Accepted 53 B URL POST HTTP/2 browser-intake-datadoghq.com/api/v2/logs?ddsource=browser&ddtags=sdk_version%3A5.32.0%2Capi%3Axhr%2Cenv%3Aprod%2Cservice%3Aql&dd-api-key=pub4d5c615be9e91858ed9e115fd855570c&dd-evp-origin-version=5.32.0&dd-evp-origin=browser&dd-request-id=625c1353-08b9-4517-a379-e43f58eb1508
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subject*.browser-intake-datadoghq.com
FingerprintA5:35:6C:08:38:11:47:18:E3:47:D1:C3:02:96:A1:9D:F0:42:EA:64
ValidityTue, 14 May 2024 00:00:00 GMT - Sat, 17 May 2025 23:59:59 GMT
Hash 0b071e95f2640325ae418472467052c1
42ef0e27e1481834c094cec4b295343ad9c5a742
1b204de4a3d29f5b9754af8413420deebfd74ccf4067adcc7756fc43ac853fa3
POST /api/v2/logs?ddsource=browser&ddtags=sdk_version%3A5.32.0%2Capi%3Axhr%2Cenv%3Aprod%2Cservice%3Aql&dd-api-key=pub4d5c615be9e91858ed9e115fd855570c&dd-evp-origin-version=5.32.0&dd-evp-origin=browser&dd-request-id=625c1353-08b9-4517-a379-e43f58eb1508 HTTP/1.1
Host: browser-intake-datadoghq.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 4803
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 202 Accepted
content-type: application/json
content-length: 53
dd-request-id: 625c1353-08b9-4517-a379-e43f58eb1508
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 07 Dec 2024 15:52:56 GMT
X-Firefox-Spdy: h2
POST rum-http-intake.logs.datadoghq.com/v1/input/pub7338472aab069e71fb1763621d542e2d?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Apersonal-loans-webapp%2Cversion%3A1.0.0%20undefined&batch_time=1733586777041
200 OK 2 B URL POST HTTP/2 rum-http-intake.logs.datadoghq.com/v1/input/pub7338472aab069e71fb1763621d542e2d?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Apersonal-loans-webapp%2Cversion%3A1.0.0%20undefined&batch_time=1733586777041
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subject*.logs.datadoghq.com
FingerprintAE:B1:45:0E:45:D3:2C:CD:3D:4A:48:54:26:D2:96:A4:F2:AF:2F:3E
ValidityFri, 16 Feb 2024 00:00:00 GMT - Mon, 17 Feb 2025 23:59:59 GMT
Hash 99914b932bd37a50b983c5e7c90ae93b
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
POST /v1/input/pub7338472aab069e71fb1763621d542e2d?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Apersonal-loans-webapp%2Cversion%3A1.0.0%20undefined&batch_time=1733586777041 HTTP/1.1
Host: rum-http-intake.logs.datadoghq.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 15506
Origin: null
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: application/json
content-length: 2
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 07 Dec 2024 15:52:56 GMT
X-Firefox-Spdy: h2
GET loans.quickenloans.com/api/vertical/MON_LP?optimConfigData=%7B%7D&sourceId=affl_everflow_ql-mon_173_809&moid=321646
200 OK 13 kB URL GET HTTP/2 loans.quickenloans.com/api/vertical/MON_LP?optimConfigData=%7B%7D&sourceId=affl_everflow_ql-mon_173_809&moid=321646
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectloans.quickenloans.com
Fingerprint9B:58:4A:65:BD:EC:A5:31:73:3E:E2:82:74:12:E2:BD:67:80:66:0D
ValiditySat, 30 Nov 2024 14:32:02 GMT - Fri, 28 Feb 2025 14:32:01 GMT
File type gzip compressed data, from Unix
Hash fe047e7dc4514c6431f79ccf527d345c
37912602048091af166dbe271b95c987b71f11e7
852807e37a567ab418af74df34319dc7d4ee8a20474447bcea64196deb2e563b
GET /api/vertical/MON_LP?optimConfigData=%7B%7D&sourceId=affl_everflow_ql-mon_173_809&moid=321646 HTTP/1.1
Host: loans.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-datadog-origin: rum
x-datadog-parent-id: 2401205768606594888
x-datadog-sampled: 1
x-datadog-sampling-priority: 1
x-datadog-trace-id: 2553981479568772703
DNT: 1
Connection: keep-alive
Cookie: AWSALBTG=pm/Su8V5VgtckloekXYk4ealJ1wWAmq8LyKoTlP8yeDIWxZqp13Wj6HJE4d8M4P2zaVfn5HrKKReutKSt83nfQc2uxb/WTSLEcIrpk3xwwPtoVKjO8u7dxcr+7rFXAaA9uYf2Jrr+EbCu37JkhmwoAXhdTZTRrMOlMq3/VTGtn3aw/IY2dk; AWSALBTGCORS=pm/Su8V5VgtckloekXYk4ealJ1wWAmq8LyKoTlP8yeDIWxZqp13Wj6HJE4d8M4P2zaVfn5HrKKReutKSt83nfQc2uxb/WTSLEcIrpk3xwwPtoVKjO8u7dxcr+7rFXAaA9uYf2Jrr+EbCu37JkhmwoAXhdTZTRrMOlMq3/VTGtn3aw/IY2dk; __cf_bm=RvscG9u2rNzcYNEGl9Z6WKPNQgOhELP.pujV1pArQW4-1733586772-1.0.1.1-CkWnx1j1r5V2HPum2.WGpsPkui00RBQ.Jan_D3kGmegrjHSQ_5662xIHsaBysDSjHZlk4LlqFLnh9HPG2Xy_tg; _dd_s=rum; _gcl_au=1.1.1212055104.1733586774; _ga_RXLL9Z7XBK=GS1.1.1733586773.1.1.1733586775.0.0.1619340942; _ga=GA1.1.1237810024.1733586774; FPID=FPID2.2.nRhVFPTt%2Bd%2BrRL9JQtDujoVAdVL7Vyg%2FnlczdutR17M%3D.1733586774; FPLC=UD1L4U3IJVFjQd6bP8xhhKOSmZzO%2B3YpAWJ5cV46or%2Fbkz9zSLRDl5WKplXyOSsbfus7tJ2nKNqMapCIAO4GwZqU4VjiFwMI91PDiDOb5djU6gxxFqbJTJSO2ygtAA%3D%3D; FPAU=1.1.1212055104.1733586774; FPGSID=1.1733586774.1733586774.G-RXLL9Z7XBK.S36PUJb9dXHuulo3v_btFA; _gcl_au=1.1.1212055104.1733586774; _ga=GA1.1.1237810024.1733586774; _ga_RXLL9Z7XBK=GS1.1.1733586773.1.1.1733586773.0.0.1619340942; FPLC=UD1L4U3IJVFjQd6bP8xhhKOSmZzO%2B3YpAWJ5cV46or%2Fbkz9zSLRDl5WKplXyOSsbfus7tJ2nKNqMapCIAO4GwZqU4VjiFwMI91PDiDOb5djU6gxxFqbJTJSO2ygtAA%3D%3D; FPAU=1.1.1212055104.1733586774; FPGSID=1.1733586774.1733586774.G-RXLL9Z7XBK.S36PUJb9dXHuulo3v_btFA; visitorId=cc300729-b400-43a4-a9d9-24add0226b7f
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:57 GMT
content-type: application/json; charset=utf-8
set-cookie: AWSALBTG=ukRctGZypI4NiimaCjkIOyrzfLPaydsrJYkrgoUP/DeqelqeEqS9k58CRF45hyijkCMm9QzOKOQu58DT84m3xSim+nIbv0zFLRTJsGUslrsz0uLtFRCmPIMTsLvuNICh1tDGMmDYL97qOlynD63w0r8T9BUl76TAm3Avt8sF2PXu2r5sQKU=; Expires=Sat, 14 Dec 2024 15:52:56 GMT; Path=/
AWSALBTGCORS=ukRctGZypI4NiimaCjkIOyrzfLPaydsrJYkrgoUP/DeqelqeEqS9k58CRF45hyijkCMm9QzOKOQu58DT84m3xSim+nIbv0zFLRTJsGUslrsz0uLtFRCmPIMTsLvuNICh1tDGMmDYL97qOlynD63w0r8T9BUl76TAm3Avt8sF2PXu2r5sQKU=; Expires=Sat, 14 Dec 2024 15:52:56 GMT; Path=/; SameSite=None; Secure
x-dns-prefetch-control: off
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
origin-agent-cluster: ?1
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
etag: W/"4938-6CP24qxvmZxb68GKri4V0FVwMLg"
cf-cache-status: DYNAMIC
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8ee5af870fccb4ee-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
POST loans.quickenloans.com/api/tracking/event
204 No Content 0 B URL POST HTTP/2 loans.quickenloans.com/api/tracking/event
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectloans.quickenloans.com
Fingerprint9B:58:4A:65:BD:EC:A5:31:73:3E:E2:82:74:12:E2:BD:67:80:66:0D
ValiditySat, 30 Nov 2024 14:32:02 GMT - Fri, 28 Feb 2025 14:32:01 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /api/tracking/event HTTP/1.1
Host: loans.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJtYXJrZXRpbmdDbGlja0lkIjoiNTM3ZTgwMWEtNmM1Yy01MmE2LTg5MGEtYTZhYzBkYjgzYWFhIiwidmlzaXRvcklkIjoiY2MzMDA3MjktYjQwMC00M2E0LWE5ZDktMjRhZGQwMjI2YjdmIiwic2Vzc2lvbklkIjoiOGE5MTYwODMtMmNiNC00ZDI2LWE5NDktZTFhNjgyZTYwNTUzIiwibWFya2V0aW5nT2ZmZXJJZCI6IjMyMTY0NiIsInNvdXJjZUlkIjoiYWZmbF9ldmVyZmxvd19xbC1tb25fMTczXzgwOSIsInRpbWVPbkZvcm1TdGFydFRpbWUiOiIyMDI0LTEyLTA3VDE1OjUyOjU3LjUwNVoiLCJvcmlnaW5SZXF1ZXN0ZWRVcmkiOiJodHRwczovL2xvYW5zLnF1aWNrZW5sb2Fucy5jb20vP21vaWQ9MzIxNjQ2JnNvdXJjZWlkPWFmZmxfZXZlcmZsb3dfcWwtbW9uXzE3M184MDkmcGtleTE9ODA5JnBrZXkyPTImcGtleTM9MjA0YjU1ZDFmOTMwNDFmYWJhYzZiOGZmOTIxYmE0YzMmcGtleT0wODBjNTYxN2VlMmU0Y2Y3YjVlYjNjODVlNmIyYWQwYiZzaWQ9MTczJmNtcGlkPTE3MyZjcnRpZD0mb2lkPTE3MyZhZmZpZD04MDkmX2VmX3RyYW5zYWN0aW9uX2lkPTIwNGI1NWQxZjkzMDQxZmFiYWM2YjhmZjkyMWJhNGMzJnV0bV9tZWRpdW09YWZmaWxpYXRlJnV0bV9zb3VyY2U9bm9jYXBhZHMuY29tJnV0bV9jb250ZW50PSIsInByZXNlbnRhdGlvbk5hbWUiOiIyOTMyNTI4X01PTl9MUF9QUkVTX0NPTlNFTlRfRERfVjEiLCJkZXN0aW5hdGlvblVybCI6Imh0dHBzOi8vbG9hbnMucXVpY2tlbmxvYW5zLmNvbS8_bW9pZD0zMjE2NDYmc291cmNlaWQ9YWZmbF9ldmVyZmxvd19xbC1tb25fMTczXzgwOSZwa2V5MT04MDkmcGtleTI9MiZwa2V5Mz0yMDRiNTVkMWY5MzA0MWZhYmFjNmI4ZmY5MjFiYTRjMyZwa2V5PTA4MGM1NjE3ZWUyZTRjZjdiNWViM2M4NWU2YjJhZDBiJnNpZD0xNzMmY21waWQ9MTczJmNydGlkPSZvaWQ9MTczJmFmZmlkPTgwOSZfZWZfdHJhbnNhY3Rpb25faWQ9MjA0YjU1ZDFmOTMwNDFmYWJhYzZiOGZmOTIxYmE0YzMmdXRtX21lZGl1bT1hZmZpbGlhdGUmdXRtX3NvdXJjZT1ub2NhcGFkcy5jb20mdXRtX2NvbnRlbnQ9IiwidmVydGljYWxOYW1lIjoiTU9OX0xQIiwicmVmZXJyaW5nVXJpIjoiIiwidGVzdElkIjoyMTg3MTc1LCJtb2lkIjoiMzIxNjQ2IiwiY2xpZW50SXBBZGRyZXNzIjoiOTEuOTAuNDIuMTU0IiwicHVibGlzaGVyRGV2aWNlIjoiIiwicmVzb2x1dGlvbiI6IiIsInVzZXJBZ2VudCI6Ik1vemlsbGEvNS4wIChYMTE7IExpbnV4IHg4Nl82NDsgcnY6OTYuMCkgR2Vja28vMjAxMDAxMDEgRmlyZWZveC85Ni4wIiwiYm90IjpmYWxzZSwiaWF0IjoxNzMzNTg2Nzc3fQ.PYJca6hz9g7v1A094W7PV23Lj6e8Yp7dfxHg2huZoi_nB0rZy4COzocriyZMmvXlR4mfPjd77EpmhG2VN8_B59Q6Qs2Zmv5_jlRrnssYYpQhjhw31pOqqHAVLPON3z8h4mrTcEBcc9ydQWzSs2VS-E3poAWfNetXdaKaJSF4Jh45FXTJAM2rfCgohwLViJo-pyzgMa8oVw8eXGwXCINxNh0EverYTKBuVFnX_FiZX3tfJZu2vtOTQi1zT-ERpb32OIQhrDwrxQveuab3BjaIbGsh5cCo26qu1_KvJHhDwgQcZJqoGxi8De7BF5H4zoB3HvTRU0L8-thkU9i6C4vDVg
Content-Length: 72
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Cookie: AWSALBTG=pm/Su8V5VgtckloekXYk4ealJ1wWAmq8LyKoTlP8yeDIWxZqp13Wj6HJE4d8M4P2zaVfn5HrKKReutKSt83nfQc2uxb/WTSLEcIrpk3xwwPtoVKjO8u7dxcr+7rFXAaA9uYf2Jrr+EbCu37JkhmwoAXhdTZTRrMOlMq3/VTGtn3aw/IY2dk; AWSALBTGCORS=pm/Su8V5VgtckloekXYk4ealJ1wWAmq8LyKoTlP8yeDIWxZqp13Wj6HJE4d8M4P2zaVfn5HrKKReutKSt83nfQc2uxb/WTSLEcIrpk3xwwPtoVKjO8u7dxcr+7rFXAaA9uYf2Jrr+EbCu37JkhmwoAXhdTZTRrMOlMq3/VTGtn3aw/IY2dk; __cf_bm=RvscG9u2rNzcYNEGl9Z6WKPNQgOhELP.pujV1pArQW4-1733586772-1.0.1.1-CkWnx1j1r5V2HPum2.WGpsPkui00RBQ.Jan_D3kGmegrjHSQ_5662xIHsaBysDSjHZlk4LlqFLnh9HPG2Xy_tg; _dd_s=rum; _gcl_au=1.1.1212055104.1733586774; _ga_RXLL9Z7XBK=GS1.1.1733586773.1.1.1733586776.0.0.1619340942; _ga=GA1.1.1237810024.1733586774; FPID=FPID2.2.nRhVFPTt%2Bd%2BrRL9JQtDujoVAdVL7Vyg%2FnlczdutR17M%3D.1733586774; FPLC=81%2FuqDZAK3rAFR0G14PB2uqLn6NiEbXpbd2%2Bdn9NbxHAGTp5CILJV9rXvVtqgdeutxeiEaEWxKyd%2BDBOIBBeDCttc9WfXNJFIe612xoukhqG%2FhSfyTqPxS1%2FuaL99A%3D%3D; FPAU=1.1.1212055104.1733586774; FPGSID=1.1733586774.1733586774.G-RXLL9Z7XBK.S36PUJb9dXHuulo3v_btFA; _gcl_au=1.1.1212055104.1733586774; _ga=GA1.1.1237810024.1733586774; _ga_RXLL9Z7XBK=GS1.1.1733586773.1.1.1733586773.0.0.1619340942; FPLC=UD1L4U3IJVFjQd6bP8xhhKOSmZzO%2B3YpAWJ5cV46or%2Fbkz9zSLRDl5WKplXyOSsbfus7tJ2nKNqMapCIAO4GwZqU4VjiFwMI91PDiDOb5djU6gxxFqbJTJSO2ygtAA%3D%3D; FPAU=1.1.1212055104.1733586774; FPGSID=1.1733586774.1733586774.G-RXLL9Z7XBK.S36PUJb9dXHuulo3v_btFA; visitorId=cc300729-b400-43a4-a9d9-24add0226b7f; click=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJtYXJrZXRpbmdDbGlja0lkIjoiNTM3ZTgwMWEtNmM1Yy01MmE2LTg5MGEtYTZhYzBkYjgzYWFhIiwidmlzaXRvcklkIjoiY2MzMDA3MjktYjQwMC00M2E0LWE5ZDktMjRhZGQwMjI2YjdmIiwic2Vzc2lvbklkIjoiOGE5MTYwODMtMmNiNC00ZDI2LWE5NDktZTFhNjgyZTYwNTUzIiwibWFya2V0aW5nT2ZmZXJJZCI6IjMyMTY0NiIsInNvdXJjZUlkIjoiYWZmbF9ldmVyZmxvd19xbC1tb25fMTczXzgwOSIsInRpbWVPbkZvcm1TdGFydFRpbWUiOiIyMDI0LTEyLTA3VDE1OjUyOjU3LjUwNVoiLCJvcmlnaW5SZXF1ZXN0ZWRVcmkiOiJodHRwczovL2xvYW5zLnF1aWNrZW5sb2Fucy5jb20vP21vaWQ9MzIxNjQ2JnNvdXJjZWlkPWFmZmxfZXZlcmZsb3dfcWwtbW9uXzE3M184MDkmcGtleTE9ODA5JnBrZXkyPTImcGtleTM9MjA0YjU1ZDFmOTMwNDFmYWJhYzZiOGZmOTIxYmE0YzMmcGtleT0wODBjNTYxN2VlMmU0Y2Y3YjVlYjNjODVlNmIyYWQwYiZzaWQ9MTczJmNtcGlkPTE3MyZjcnRpZD0mb2lkPTE3MyZhZmZpZD04MDkmX2VmX3RyYW5zYWN0aW9uX2lkPTIwNGI1NWQxZjkzMDQxZmFiYWM2YjhmZjkyMWJhNGMzJnV0bV9tZWRpdW09YWZmaWxpYXRlJnV0bV9zb3VyY2U9bm9jYXBhZHMuY29tJnV0bV9jb250ZW50PSIsInByZXNlbnRhdGlvbk5hbWUiOiIyOTMyNTI4X01PTl9MUF9QUkVTX0NPTlNFTlRfRERfVjEiLCJkZXN0aW5hdGlvblVybCI6Imh0dHBzOi8vbG9hbnMucXVpY2tlbmxvYW5zLmNvbS8_bW9pZD0zMjE2NDYmc291cmNlaWQ9YWZmbF9ldmVyZmxvd19xbC1tb25fMTczXzgwOSZwa2V5MT04MDkmcGtleTI9MiZwa2V5Mz0yMDRiNTVkMWY5MzA0MWZhYmFjNmI4ZmY5MjFiYTRjMyZwa2V5PTA4MGM1NjE3ZWUyZTRjZjdiNWViM2M4NWU2YjJhZDBiJnNpZD0xNzMmY21waWQ9MTczJmNydGlkPSZvaWQ9MTczJmFmZmlkPTgwOSZfZWZfdHJhbnNhY3Rpb25faWQ9MjA0YjU1ZDFmOTMwNDFmYWJhYzZiOGZmOTIxYmE0YzMmdXRtX21lZGl1bT1hZmZpbGlhdGUmdXRtX3NvdXJjZT1ub2NhcGFkcy5jb20mdXRtX2NvbnRlbnQ9IiwidmVydGljYWxOYW1lIjoiTU9OX0xQIiwicmVmZXJyaW5nVXJpIjoiIiwidGVzdElkIjoyMTg3MTc1LCJtb2lkIjoiMzIxNjQ2IiwiY2xpZW50SXBBZGRyZXNzIjoiOTEuOTAuNDIuMTU0IiwicHVibGlzaGVyRGV2aWNlIjoiIiwicmVzb2x1dGlvbiI6IiIsInVzZXJBZ2VudCI6Ik1vemlsbGEvNS4wIChYMTE7IExpbnV4IHg4Nl82NDsgcnY6OTYuMCkgR2Vja28vMjAxMDAxMDEgRmlyZWZveC85Ni4wIiwiYm90IjpmYWxzZSwiaWF0IjoxNzMzNTg2Nzc3fQ.PYJca6hz9g7v1A094W7PV23Lj6e8Yp7dfxHg2huZoi_nB0rZy4COzocriyZMmvXlR4mfPjd77EpmhG2VN8_B59Q6Qs2Zmv5_jlRrnssYYpQhjhw31pOqqHAVLPON3z8h4mrTcEBcc9ydQWzSs2VS-E3poAWfNetXdaKaJSF4Jh45FXTJAM2rfCgohwLViJo-pyzgMa8oVw8eXGwXCINxNh0EverYTKBuVFnX_FiZX3tfJZu2vtOTQi1zT-ERpb32OIQhrDwrxQveuab3BjaIbGsh5cCo26qu1_KvJHhDwgQcZJqoGxi8De7BF5H4zoB3HvTRU0L8-thkU9i6C4vDVg
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 204 No Content
date: Sat, 07 Dec 2024 15:52:58 GMT
x-dns-prefetch-control: off
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
access-control-allow-origin: *
cf-cache-status: DYNAMIC
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8ee5af91ef7db4ee-OSL
X-Firefox-Spdy: h2
GET use.typekit.net/af/1b1b1e/00000000000000000001709e/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
200 OK 24 kB URL GET HTTP/2 use.typekit.net/af/1b1b1e/00000000000000000001709e/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
IP
ASN #20940 Akamai International B.V.
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subjectuse.typekit.net
Fingerprint04:25:F2:63:F0:2D:54:4F:A7:7E:22:4C:71:E6:9B:01:DD:73:73:97
ValidityThu, 17 Oct 2024 00:00:00 GMT - Mon, 17 Nov 2025 23:59:59 GMT
File type Web Open Font Format (Version 2), TrueType, length 24180, version 1.0
Hash a077d487ed95691f5343f69eac4417db
a606a40b605563afb9b7ab1452258ae9f9c49d09
9bacad71ca24f6147c4b72a6c0f351b07ba93b70f992082b812681fb3b46d9b6
GET /af/1b1b1e/00000000000000000001709e/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3 HTTP/1.1
Host: use.typekit.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Referer: https://use.typekit.net/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: application/font-woff2
content-length: 24180
etag: "f507d4945327bf77fa226b6fef0f1c6a6af3bf09"
timing-allow-origin: *
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cache-control: public, max-age=31536000
date: Sat, 07 Dec 2024 15:52:58 GMT
X-Firefox-Spdy: h2
GET use.typekit.net/af/80c5d0/00000000000000000001709c/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n6&v=3
200 OK 24 kB URL GET HTTP/2 use.typekit.net/af/80c5d0/00000000000000000001709c/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n6&v=3
IP
ASN #20940 Akamai International B.V.
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subjectuse.typekit.net
Fingerprint04:25:F2:63:F0:2D:54:4F:A7:7E:22:4C:71:E6:9B:01:DD:73:73:97
ValidityThu, 17 Oct 2024 00:00:00 GMT - Mon, 17 Nov 2025 23:59:59 GMT
File type Web Open Font Format (Version 2), TrueType, length 24264, version 1.0
Hash a2956c5b75d3f28bc938b57b98491fb7
8c8564da8dd7073047fc7513cb5a0ac261035984
cc62200b7ffb4acffa5ced44e916789729b903e9a39bf86bb6175577500c9fc7
GET /af/80c5d0/00000000000000000001709c/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n6&v=3 HTTP/1.1
Host: use.typekit.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Referer: https://use.typekit.net/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: application/font-woff2
content-length: 24264
etag: "9852112d8099a97564f64224e106ceeffff9e7c4"
timing-allow-origin: *
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cache-control: public, max-age=31536000
date: Sat, 07 Dec 2024 15:52:58 GMT
X-Firefox-Spdy: h2
GET use.typekit.net/af/d32e26/00000000000000000001709b/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i4&v=3
200 OK 25 kB URL GET HTTP/2 use.typekit.net/af/d32e26/00000000000000000001709b/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i4&v=3
IP
ASN #20940 Akamai International B.V.
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subjectuse.typekit.net
Fingerprint04:25:F2:63:F0:2D:54:4F:A7:7E:22:4C:71:E6:9B:01:DD:73:73:97
ValidityThu, 17 Oct 2024 00:00:00 GMT - Mon, 17 Nov 2025 23:59:59 GMT
File type Web Open Font Format (Version 2), TrueType, length 25016, version 1.0
Hash f3b01a591c6cdfac684714571fd098c1
0c485f50893ce349c83a06a044f697a8960a310c
6069bebbfc9a535fa8bf81fa81ce8741f6cef9e5fefd807aa1710a365cfed798
GET /af/d32e26/00000000000000000001709b/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i4&v=3 HTTP/1.1
Host: use.typekit.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Referer: https://use.typekit.net/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: application/font-woff2
content-length: 25016
etag: "9689d00c5dfd98cdda07ad0f85b16f1599038e27"
timing-allow-origin: *
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cache-control: public, max-age=31536000
date: Sat, 07 Dec 2024 15:52:58 GMT
X-Firefox-Spdy: h2
GET content.quickencompare.com/qc/refi-images/BG-BLUE-ICON-WHITE.png
200 OK 60 kB URL GET HTTP/2 content.quickencompare.com/qc/refi-images/BG-BLUE-ICON-WHITE.png
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectquickencompare.com
Fingerprint91:CF:56:CF:08:92:B6:4B:4D:58:82:62:70:2A:51:8C:F0:F4:49:03
ValidityMon, 11 Nov 2024 06:14:11 GMT - Sun, 09 Feb 2025 06:14:10 GMT
File type PNG image data, 2980 x 820, 8-bit/color RGBA, non-interlaced
Hash 0b525d003df460ee3ef27bb82defdb43
0e1f1b12bc01d745e847d91f64727e1bde0cf019
78f6112cc353f90b0f71f3b1c2a5571b1b620290dd2048dc073eb91217c590e7
GET /qc/refi-images/BG-BLUE-ICON-WHITE.png HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=_u6dzNe4v3VN1c772eTqRk7SFcV2pVINQtGq_.qo3eo-1733586776-1.0.1.1-9vRb7Tv8tdHQptlvfJWopjGuvBPq8SXpYe0z4itk.J4eqUm1sJ.orDuU9m8aCko1kLnl2gC9sUA4BHAXeDyraA
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:58 GMT
content-type: image/png
content-length: 60242
last-modified: Tue, 19 Nov 2024 19:24:46 GMT
etag: "0b525d003df460ee3ef27bb82defdb43"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
via: 1.1 3aedbf31650352660fd3a878f7b791c8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P9
x-amz-cf-id: AAt4s7vekogwX9den0QQrMBS_GAUWVc2sGXc6z_9vaXa7tluEoiTTw==
cf-cache-status: HIT
age: 1912
expires: Sat, 07 Dec 2024 19:52:58 GMT
cache-control: public, max-age=14400
accept-ranges: bytes
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8ee5af939fcb56a3-OSL
X-Firefox-Spdy: h2
GET content.quickencompare.com/nmn/logo/qc-financial-control.png
200 OK 13 kB URL GET HTTP/2 content.quickencompare.com/nmn/logo/qc-financial-control.png
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectquickencompare.com
Fingerprint91:CF:56:CF:08:92:B6:4B:4D:58:82:62:70:2A:51:8C:F0:F4:49:03
ValidityMon, 11 Nov 2024 06:14:11 GMT - Sun, 09 Feb 2025 06:14:10 GMT
File type PNG image data, 281 x 168, 8-bit/color RGBA, non-interlaced
Hash d9164fb30114b13fdb91bd8011b5f71b
45307fb107b9e0ec642b98d3b2153467cb00b633
442b0856c633c8a41e1566de5aea94873cfa27b85e74e2fb2df4c92b55ab5608
GET /nmn/logo/qc-financial-control.png HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=_u6dzNe4v3VN1c772eTqRk7SFcV2pVINQtGq_.qo3eo-1733586776-1.0.1.1-9vRb7Tv8tdHQptlvfJWopjGuvBPq8SXpYe0z4itk.J4eqUm1sJ.orDuU9m8aCko1kLnl2gC9sUA4BHAXeDyraA
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:58 GMT
content-type: image/png
content-length: 12630
last-modified: Thu, 26 Sep 2024 20:39:13 GMT
etag: "d9164fb30114b13fdb91bd8011b5f71b"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
via: 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P6
x-amz-cf-id: 8O2tLjjEksteTAAY-1lCPG5jLd0D53FIOi8XmAYU37f--on3NTF9dA==
cf-cache-status: HIT
age: 1911
expires: Sat, 07 Dec 2024 19:52:58 GMT
cache-control: public, max-age=14400
accept-ranges: bytes
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8ee5af939fc856a3-OSL
X-Firefox-Spdy: h2
GET fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2
200 OK 7.8 kB URL GET HTTP/2 fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subject*.gstatic.com
Fingerprint2A:56:7F:C1:73:8D:7A:48:D9:E7:52:83:15:27:9D:C3:C9:23:71:52
ValidityMon, 21 Oct 2024 08:37:59 GMT - Mon, 13 Jan 2025 08:37:58 GMT
File type Web Open Font Format (Version 2), TrueType, length 7840, version 1.0
Hash 8d91ec1ca2d8b56640a47117e313a3e9
a9e9bafe64666f4595051a0e895b47a5fa39e67e
78bc3aa78faec288bbb3bf26c9a0fa4eb67b1e69da94a17233c5cab60525efdb
GET /s/poppins/v22/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 7840
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 07 Dec 2024 10:56:51 GMT
expires: Sun, 07 Dec 2025 10:56:51 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 04 Dec 2024 06:53:49 GMT
content-type: font/woff2
age: 17767
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET d2m2wsoho8qq12.cloudfront.net/iframe.html?token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D
200 OK 1.4 kB URL GET HTTP/1.1 d2m2wsoho8qq12.cloudfront.net/iframe.html?token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerAmazon
Subject*.cloudfront.net
Fingerprint28:D3:87:79:3C:E8:8B:3C:D9:10:45:E5:F7:64:7A:6D:44:4E:5A:62
ValidityTue, 30 Jul 2024 00:00:00 GMT - Thu, 03 Jul 2025 23:59:59 GMT
File type HTML document, ASCII text
Hash f383924b4df21ad2fe7e8882c61bd5ce
465f78b89eaf1a5aaea70d27ddef8bd19b72fee5
e3ad82a69faf9ec1b298a080ce5974322a33cc501e1455071cf8db58c7f2462f
GET /iframe.html?token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D HTTP/1.1
Host: d2m2wsoho8qq12.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Last-Modified: Thu, 10 Oct 2024 16:20:35 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Encoding: gzip
Date: Sat, 07 Dec 2024 02:51:04 GMT
Etag: W/"6707fed3-dbb"
Via: 1.1 f44b0401aa25ee4759a1c3f13a10909a.cloudfront.net (CloudFront)
Age: 46914
Access-Control-Allow-Headers: *
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
X-Amz-Cf-Pop: HEL50-C2
X-Amz-Cf-Id: Y2Y9NRGM82T-l_PD0y6Y-uM9eFvEULAksjCjwQhkqDhjjrW-VWbWPQ==
GET create.lidstatic.com/campaign/b87eed3a-5f1d-1ea4-b60b-fcc3f180b22d.js?snippet_version=2&callback=leadIdCallback
200 OK 40 kB URL GET HTTP/2 create.lidstatic.com/campaign/b87eed3a-5f1d-1ea4-b60b-fcc3f180b22d.js?snippet_version=2&callback=leadIdCallback
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerLet's Encrypt
Subjectlidstatic.com
Fingerprint5A:73:45:8A:A2:BF:1F:87:A7:4D:71:38:98:89:D2:6D:E4:AA:FB:E0
ValidityMon, 18 Nov 2024 20:11:20 GMT - Sun, 16 Feb 2025 20:11:19 GMT
File type JavaScript source, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators
Hash 74fff60050bea01596b57b94ae6983db
d9f9fa2aea9b444a22e0da7b4c3cae1c3c936b1e
e596f12f57b9a9c6182ed14695044a3a64c5773dfc2b04c8a632444c76c8e001
GET /campaign/b87eed3a-5f1d-1ea4-b60b-fcc3f180b22d.js?snippet_version=2&callback=leadIdCallback HTTP/1.1
Host: create.lidstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:57 GMT
content-type: text/javascript
x-amz-id-2: Dus14YXY+LiojjUPpCSroqhXZUEsg9DEqMjc22OAEimYp87YNcmGEjIceGHGjOVLpvmruxb7Wk4=
x-amz-request-id: 2DGB1M9EM92TP7MG
x-amz-replication-status: COMPLETED
last-modified: Fri, 11 Oct 2024 11:56:09 GMT
etag: W/"74fff60050bea01596b57b94ae6983db"
x-amz-server-side-encryption: AES256
cache-control: max-age=1800
x-amz-version-id: 2ZPIAE6ANN70rHcR4_LolYMsk2rVzUr0
cf-cache-status: HIT
age: 1501
vary: Accept-Encoding
access-control-allow-origin: *
server: cloudflare
cf-ray: 8ee5af8fa8fbb4f1-OSL
content-encoding: br
X-Firefox-Spdy: h2
GET loans.quickenloans.com/api/vertical/MON_LP?optimConfigData=%7B%7D&sourceId=affl_everflow_ql-mon_173_809&moid=321646
200 OK 5.9 kB URL GET HTTP/2 loans.quickenloans.com/api/vertical/MON_LP?optimConfigData=%7B%7D&sourceId=affl_everflow_ql-mon_173_809&moid=321646
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectloans.quickenloans.com
Fingerprint9B:58:4A:65:BD:EC:A5:31:73:3E:E2:82:74:12:E2:BD:67:80:66:0D
ValiditySat, 30 Nov 2024 14:32:02 GMT - Fri, 28 Feb 2025 14:32:01 GMT
Hash 601740299c39884fba56ad5d8514d9db
ed7dd6dfe643e9d1f1c9321fcb34f0ce99d8e680
1935b395bfde5a1ba3ae1755283863c6ede276c78b70c2cf303273ceb0850a2d
GET /api/vertical/MON_LP?optimConfigData=%7B%7D&sourceId=affl_everflow_ql-mon_173_809&moid=321646 HTTP/1.1
Host: loans.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-datadog-origin: rum
x-datadog-parent-id: 8504347441390886604
x-datadog-sampled: 1
x-datadog-sampling-priority: 1
x-datadog-trace-id: 70756654229414473
DNT: 1
Connection: keep-alive
Cookie: AWSALBTG=pm/Su8V5VgtckloekXYk4ealJ1wWAmq8LyKoTlP8yeDIWxZqp13Wj6HJE4d8M4P2zaVfn5HrKKReutKSt83nfQc2uxb/WTSLEcIrpk3xwwPtoVKjO8u7dxcr+7rFXAaA9uYf2Jrr+EbCu37JkhmwoAXhdTZTRrMOlMq3/VTGtn3aw/IY2dk; AWSALBTGCORS=pm/Su8V5VgtckloekXYk4ealJ1wWAmq8LyKoTlP8yeDIWxZqp13Wj6HJE4d8M4P2zaVfn5HrKKReutKSt83nfQc2uxb/WTSLEcIrpk3xwwPtoVKjO8u7dxcr+7rFXAaA9uYf2Jrr+EbCu37JkhmwoAXhdTZTRrMOlMq3/VTGtn3aw/IY2dk; __cf_bm=RvscG9u2rNzcYNEGl9Z6WKPNQgOhELP.pujV1pArQW4-1733586772-1.0.1.1-CkWnx1j1r5V2HPum2.WGpsPkui00RBQ.Jan_D3kGmegrjHSQ_5662xIHsaBysDSjHZlk4LlqFLnh9HPG2Xy_tg; _dd_s=rum; _gcl_au=1.1.1212055104.1733586774; _ga_RXLL9Z7XBK=GS1.1.1733586773.1.1.1733586776.0.0.1619340942; _ga=GA1.1.1237810024.1733586774; FPID=FPID2.2.nRhVFPTt%2Bd%2BrRL9JQtDujoVAdVL7Vyg%2FnlczdutR17M%3D.1733586774; FPLC=UD1L4U3IJVFjQd6bP8xhhKOSmZzO%2B3YpAWJ5cV46or%2Fbkz9zSLRDl5WKplXyOSsbfus7tJ2nKNqMapCIAO4GwZqU4VjiFwMI91PDiDOb5djU6gxxFqbJTJSO2ygtAA%3D%3D; FPAU=1.1.1212055104.1733586774; FPGSID=1.1733586774.1733586774.G-RXLL9Z7XBK.S36PUJb9dXHuulo3v_btFA; _gcl_au=1.1.1212055104.1733586774; _ga=GA1.1.1237810024.1733586774; _ga_RXLL9Z7XBK=GS1.1.1733586773.1.1.1733586773.0.0.1619340942; FPLC=UD1L4U3IJVFjQd6bP8xhhKOSmZzO%2B3YpAWJ5cV46or%2Fbkz9zSLRDl5WKplXyOSsbfus7tJ2nKNqMapCIAO4GwZqU4VjiFwMI91PDiDOb5djU6gxxFqbJTJSO2ygtAA%3D%3D; FPAU=1.1.1212055104.1733586774; FPGSID=1.1733586774.1733586774.G-RXLL9Z7XBK.S36PUJb9dXHuulo3v_btFA; visitorId=cc300729-b400-43a4-a9d9-24add0226b7f
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:57 GMT
content-type: application/json; charset=utf-8
set-cookie: AWSALBTG=0W0YEyI28FKyCtXB4FrXwthpIgVlHZ1RgRPLvblHmv5x64zJrLGE6fY95YwVjo21HzBppxliyRfQFiHcLpX6prwNQOACp8+5d2aWkQa6zaU4N7lw5EUWZOj7nLI91KZKR595GSMlk2J/D6EWgnhKc0LSuU0WLI6q85RxDtWT+8JGNOB2P8I=; Expires=Sat, 14 Dec 2024 15:52:56 GMT; Path=/
AWSALBTGCORS=0W0YEyI28FKyCtXB4FrXwthpIgVlHZ1RgRPLvblHmv5x64zJrLGE6fY95YwVjo21HzBppxliyRfQFiHcLpX6prwNQOACp8+5d2aWkQa6zaU4N7lw5EUWZOj7nLI91KZKR595GSMlk2J/D6EWgnhKc0LSuU0WLI6q85RxDtWT+8JGNOB2P8I=; Expires=Sat, 14 Dec 2024 15:52:56 GMT; Path=/; SameSite=None; Secure
x-dns-prefetch-control: off
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
origin-agent-cluster: ?1
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
etag: W/"4a54-7X3W3+ZD6dHxyTIfyzTwzpnY5oA"
cf-cache-status: DYNAMIC
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8ee5af871fe8b4ee-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
GET deviceid.trueleadid.com/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=1921523841
200 OK 20 kB URL GET HTTP/2 deviceid.trueleadid.com/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=1921523841
IP
Requested by https://deviceid.trueleadid.com/iframe.html?token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D
Certificate IssuerGlobalSign nv-sa
Subjectimperva.com
Fingerprint01:B4:BB:C2:E4:D2:08:99:B9:DC:7E:2A:46:00:7C:75:07:D0:E9:D0
ValidityWed, 10 Jul 2024 14:31:23 GMT - Mon, 06 Jan 2025 14:31:23 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Hash bde5189268af01ff1a9f90b0dfd849a0
510267afa9a70d7386cb62e1044ce2ff11fe472c
c6530477d06923f201cbb94ee7b3ebdfc4674c98b13d163563013c7ec11dd51a
GET /_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=1921523841 HTTP/1.1
Host: deviceid.trueleadid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://deviceid.trueleadid.com/iframe.html?token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D
Cookie: nlbi_3051494=p4/BbJrodVMBnUVcC30iGwAAAAA7YxcsJ3JgLSfp8m33k98y; visid_incap_3051494=J3jlSNlhQfGolCqPSe/rYlpvVGcAAAAAQUIPAAAAAAAFve0Lqk0Btub9I2Uk2meG; incap_ses_7233_3051494=QFQfbUse3VSHTb7RWcdgZFpvVGcAAAAAzNP5D3ZUgg09beYe0X5k6A==
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
cache-control: no-cache, no-store
content-type: application/javascript
content-encoding: gzip
x-robots-tag: noindex
content-length: 19686
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
GET deviceid.trueleadid.com/_Incapsula_Resource?SWKMTFSR=1&e=0.7045104032751491
200 OK 1 B URL GET HTTP/2 deviceid.trueleadid.com/_Incapsula_Resource?SWKMTFSR=1&e=0.7045104032751491
IP
Requested by https://deviceid.trueleadid.com/iframe.html?token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D
Certificate IssuerGlobalSign nv-sa
Subjectimperva.com
Fingerprint01:B4:BB:C2:E4:D2:08:99:B9:DC:7E:2A:46:00:7C:75:07:D0:E9:D0
ValidityWed, 10 Jul 2024 14:31:23 GMT - Mon, 06 Jan 2025 14:31:23 GMT
File type very short file (no magic)
Hash c4ca4238a0b923820dcc509a6f75849b
356a192b7913b04c54574d18c28d46e6395428ab
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
GET /_Incapsula_Resource?SWKMTFSR=1&e=0.7045104032751491 HTTP/1.1
Host: deviceid.trueleadid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://deviceid.trueleadid.com/iframe.html?token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D
Cookie: nlbi_3051494=p4/BbJrodVMBnUVcC30iGwAAAAA7YxcsJ3JgLSfp8m33k98y; visid_incap_3051494=J3jlSNlhQfGolCqPSe/rYlpvVGcAAAAAQUIPAAAAAAAFve0Lqk0Btub9I2Uk2meG; incap_ses_7233_3051494=QFQfbUse3VSHTb7RWcdgZFpvVGcAAAAAzNP5D3ZUgg09beYe0X5k6A==; uuid=da675ac9a92447a1b7709a4549ff3868
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
cache-control: no-cache, no-store
content-type: text/plain
x-robots-tag: noindex
content-length: 1
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
POST script.anura.io/response.json?909806575167
200 OK 9.5 kB URL POST HTTP/2 script.anura.io/response.json?909806575167
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerAmazon
Subjectscript.anura.io
FingerprintCC:B4:48:82:BF:CC:04:FB:C7:35:8F:3F:D3:69:3F:10:96:9A:EF:C8
ValiditySun, 15 Sep 2024 00:00:00 GMT - Wed, 15 Oct 2025 23:59:59 GMT
File type gzip compressed data, max speed, from Unix
Hash af1efff6ced13ac4de6d796be8890639
1380d9e26fe4b874066bac35bac49d227e0d282d
f5d9d80dd0893ef30237e1ab36e5da59530737b4f9179175770213789c59960e
POST /response.json?909806575167 HTTP/1.1
Host: script.anura.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 6040
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:59 GMT
content-type: application/json; charset=utf-8
server: nginx
vary: Accept-Encoding
access-control-allow-origin: *
access-control-allow-methods: POST
expires: Sun, 28 Dec 1980 18:57:00 EST
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
X-Firefox-Spdy: h2
GET www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1237810024.1733586774>m=45j91e4c41v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485&aip=1&z=235022522
200 OK 42 B URL GET HTTP/3 www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1237810024.1733586774>m=45j91e4c41v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485&aip=1&z=235022522
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subject*.google.no
Fingerprint10:4D:45:7C:EB:8E:2F:4F:30:F1:84:1D:AB:53:C4:35:E0:FD:59:C3
ValidityMon, 21 Oct 2024 08:39:45 GMT - Mon, 13 Jan 2025 08:39:44 GMT
File type GIF image data, version 89a, 1 x 1
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1237810024.1733586774>m=45j91e4c41v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485&aip=1&z=235022522 HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 07 Dec 2024 15:53:01 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
POST sgtm.quickenloans.com/g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4c40v9169491831z89137104487za200zb9137104487&_p=1733586773132&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485&cid=1237810024.1733586774&ecid=1619340942&ul=en-us&sr=1280x1024&ur=NO-03&frm=0&pscdl=noapi&sst.etld=google.no&sst.gcsub=region1&sst.tft=1733586773132&sst.ude=0&sid=1733586773&sct=1&seg=1&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D204b55d1f93041fabac6b8ff921ba4c3%26pkey%3D080c5617ee2e4cf7b5eb3c85e6b2ad0b%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D204b55d1f93041fabac6b8ff921ba4c3%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&_s=4&tfd=11855&richsstsse
200 OK 781 B URL POST HTTP/2 sgtm.quickenloans.com/g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4c40v9169491831z89137104487za200zb9137104487&_p=1733586773132&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485&cid=1237810024.1733586774&ecid=1619340942&ul=en-us&sr=1280x1024&ur=NO-03&frm=0&pscdl=noapi&sst.etld=google.no&sst.gcsub=region1&sst.tft=1733586773132&sst.ude=0&sid=1733586773&sct=1&seg=1&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D204b55d1f93041fabac6b8ff921ba4c3%26pkey%3D080c5617ee2e4cf7b5eb3c85e6b2ad0b%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D204b55d1f93041fabac6b8ff921ba4c3%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&_s=4&tfd=11855&richsstsse
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectsgtm.quickenloans.com
Fingerprint4E:86:D8:38:35:2F:10:58:51:04:6D:AF:7F:BE:F9:A5:A6:A8:AA:4E
ValidityThu, 21 Nov 2024 05:40:09 GMT - Wed, 19 Feb 2025 06:30:20 GMT
Hash 3a6494744685c81620b5e3535a65a572
fae652174bae239fbdf9ba9f00e03a41638374af
65647a3b9bbd47f8afc7df8d31d58049c597c3c2fe83a5cc4c4eead4b946ff46
POST /g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4c40v9169491831z89137104487za200zb9137104487&_p=1733586773132&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485&cid=1237810024.1733586774&ecid=1619340942&ul=en-us&sr=1280x1024&ur=NO-03&frm=0&pscdl=noapi&sst.etld=google.no&sst.gcsub=region1&sst.tft=1733586773132&sst.ude=0&sid=1733586773&sct=1&seg=1&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D204b55d1f93041fabac6b8ff921ba4c3%26pkey%3D080c5617ee2e4cf7b5eb3c85e6b2ad0b%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D204b55d1f93041fabac6b8ff921ba4c3%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&_s=4&tfd=11855&richsstsse HTTP/1.1
Host: sgtm.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 69
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Cookie: _gcl_au=1.1.1212055104.1733586774; _ga_RXLL9Z7XBK=GS1.1.1733586773.1.1.1733586776.0.0.1619340942; _ga=GA1.1.1237810024.1733586774; FPID=FPID2.2.nRhVFPTt%2Bd%2BrRL9JQtDujoVAdVL7Vyg%2FnlczdutR17M%3D.1733586774; FPLC=81%2FuqDZAK3rAFR0G14PB2uqLn6NiEbXpbd2%2Bdn9NbxHAGTp5CILJV9rXvVtqgdeutxeiEaEWxKyd%2BDBOIBBeDCttc9WfXNJFIe612xoukhqG%2FhSfyTqPxS1%2FuaL99A%3D%3D; FPAU=1.1.1212055104.1733586774; FPGSID=1.1733586774.1733586774.G-RXLL9Z7XBK.S36PUJb9dXHuulo3v_btFA
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
set-cookie: FPID=FPID2.2.nRhVFPTt%2Bd%2BrRL9JQtDujoVAdVL7Vyg%2FnlczdutR17M%3D.1733586774; Max-Age=63072000; Domain=quickenloans.com; Path=/; Secure; HttpOnly
FPAU=1.1.1212055104.1733586774; Max-Age=7775993; Domain=quickenloans.com; Path=/; Secure
cache-control: no-cache
content-type: text/plain
x-content-type-options: nosniff
x-accel-buffering: no
access-control-allow-origin: https://loans.quickenloans.com
access-control-allow-credentials: true
date: Sat, 07 Dec 2024 15:53:01 GMT
server: Google Frontend
expires: Sat, 07 Dec 2024 15:53:01 GMT
X-Firefox-Spdy: h2
GET sgtm.quickenloans.com/g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4c40v9169491831z89137104487za200zb9137104487&_p=1733586773132&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485&cid=1237810024.1733586774&ecid=1619340942&ul=en-us&sr=1280x1024&_fplc=0&ur=NO-03&frm=0&pscdl=noapi&sst.etld=google.no&sst.gcsub=region1&sst.tft=1733586773132&sst.ude=0&_s=1&sid=1733586773&sct=1&seg=0&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D204b55d1f93041fabac6b8ff921ba4c3%26pkey%3D080c5617ee2e4cf7b5eb3c85e6b2ad0b%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D204b55d1f93041fabac6b8ff921ba4c3%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=4756&richsstsse
200 OK 1.0 kB URL GET HTTP/2 sgtm.quickenloans.com/g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4c40v9169491831z89137104487za200zb9137104487&_p=1733586773132&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485&cid=1237810024.1733586774&ecid=1619340942&ul=en-us&sr=1280x1024&_fplc=0&ur=NO-03&frm=0&pscdl=noapi&sst.etld=google.no&sst.gcsub=region1&sst.tft=1733586773132&sst.ude=0&_s=1&sid=1733586773&sct=1&seg=0&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D204b55d1f93041fabac6b8ff921ba4c3%26pkey%3D080c5617ee2e4cf7b5eb3c85e6b2ad0b%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D204b55d1f93041fabac6b8ff921ba4c3%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=4756&richsstsse
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectsgtm.quickenloans.com
Fingerprint4E:86:D8:38:35:2F:10:58:51:04:6D:AF:7F:BE:F9:A5:A6:A8:AA:4E
ValidityThu, 21 Nov 2024 05:40:09 GMT - Wed, 19 Feb 2025 06:30:20 GMT
File type ASCII text, with very long lines (1058), with no line terminators
Hash b241d99445c1291725d524cc1e6f2dd8
984e77233cb693423e4fb1543431cef35cce816a
5ed8ecc0615333052af6338bbc789f6cd9ce06deb4d1d3a807fa4e1e5aca0460
GET /g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4c40v9169491831z89137104487za200zb9137104487&_p=1733586773132&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485&cid=1237810024.1733586774&ecid=1619340942&ul=en-us&sr=1280x1024&_fplc=0&ur=NO-03&frm=0&pscdl=noapi&sst.etld=google.no&sst.gcsub=region1&sst.tft=1733586773132&sst.ude=0&_s=1&sid=1733586773&sct=1&seg=0&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D204b55d1f93041fabac6b8ff921ba4c3%26pkey%3D080c5617ee2e4cf7b5eb3c85e6b2ad0b%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D204b55d1f93041fabac6b8ff921ba4c3%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=4756&richsstsse HTTP/1.1
Host: sgtm.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Cookie: _gcl_au=1.1.1212055104.1733586774; _ga_RXLL9Z7XBK=GS1.1.1733586773.1.0.1733586773.0.0.1619340942; _ga=GA1.1.1237810024.1733586774
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
set-cookie: FPID=FPID2.2.nRhVFPTt%2Bd%2BrRL9JQtDujoVAdVL7Vyg%2FnlczdutR17M%3D.1733586774; Max-Age=63072000; Domain=quickenloans.com; Path=/; Secure; HttpOnly
FPLC=bc6X0tAFJ5fl5Mr4VYBKMPKYCedv7pHcro5Q539D1bhWtrR4gfFHNpot2XCvOO%2FW%2FiVyRb7sYi%2BzscJnOUjopVbKyPYs5rIzk%2Fr9VUzoCtTLDer2OHXyAIBS7ATGgA%3D%3D; Max-Age=72000; Domain=quickenloans.com; Path=/; Secure
FPAU=1.1.1212055104.1733586774; Max-Age=7776000; Domain=quickenloans.com; Path=/; Secure
FPGSID=1.1733586774.1733586774.G-RXLL9Z7XBK.o88PCrJlRsSedIY5AJTWMg; Max-Age=1800; Domain=quickenloans.com; Path=/; SameSite=strict; Secure
cache-control: no-cache
content-type: text/plain
x-content-type-options: nosniff
x-accel-buffering: no
access-control-allow-origin: https://loans.quickenloans.com
access-control-allow-credentials: true
date: Sat, 07 Dec 2024 15:52:54 GMT
server: Google Frontend
expires: Sat, 07 Dec 2024 15:52:54 GMT
X-Firefox-Spdy: h2
GET loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
200 OK 7.0 kB URL User Request GET HTTP/2 loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
IP
Certificate IssuerGoogle Trust Services
Subjectloans.quickenloans.com
Fingerprint9B:58:4A:65:BD:EC:A5:31:73:3E:E2:82:74:12:E2:BD:67:80:66:0D
ValiditySat, 30 Nov 2024 14:32:02 GMT - Fri, 28 Feb 2025 14:32:01 GMT
File type HTML document, ASCII text, with very long lines (7310), with no line terminators
Hash c02ed139a96fcbf666f4c660dc5fae8e
d6335ea326ed0bc66ed864a44440aad0f2012bec
8a350a4cb5bc16666225273e3e46cefd4d03487520403b1b2eb05800a978e59d
GET /?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content= HTTP/1.1
Host: loans.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:52 GMT
content-type: text/html; charset=utf-8
x-dns-prefetch-control: off
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
origin-agent-cluster: ?1
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
cf-cache-status: DYNAMIC
set-cookie: AWSALBTG=pm/Su8V5VgtckloekXYk4ealJ1wWAmq8LyKoTlP8yeDIWxZqp13Wj6HJE4d8M4P2zaVfn5HrKKReutKSt83nfQc2uxb/WTSLEcIrpk3xwwPtoVKjO8u7dxcr+7rFXAaA9uYf2Jrr+EbCu37JkhmwoAXhdTZTRrMOlMq3/VTGtn3aw/IY2dk=; Expires=Sat, 14 Dec 2024 15:52:52 GMT; Path=/
AWSALBTGCORS=pm/Su8V5VgtckloekXYk4ealJ1wWAmq8LyKoTlP8yeDIWxZqp13Wj6HJE4d8M4P2zaVfn5HrKKReutKSt83nfQc2uxb/WTSLEcIrpk3xwwPtoVKjO8u7dxcr+7rFXAaA9uYf2Jrr+EbCu37JkhmwoAXhdTZTRrMOlMq3/VTGtn3aw/IY2dk=; Expires=Sat, 14 Dec 2024 15:52:52 GMT; Path=/; SameSite=None; Secure
__cf_bm=RvscG9u2rNzcYNEGl9Z6WKPNQgOhELP.pujV1pArQW4-1733586772-1.0.1.1-CkWnx1j1r5V2HPum2.WGpsPkui00RBQ.Jan_D3kGmegrjHSQ_5662xIHsaBysDSjHZlk4LlqFLnh9HPG2Xy_tg; path=/; expires=Sat, 07-Dec-24 16:22:52 GMT; domain=.loans.quickenloans.com; HttpOnly; Secure; SameSite=None
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8ee5af6cfedab4ee-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
GET www.datadoghq-browser-agent.com/datadog-rum-v3.js
200 OK 118 kB URL GET HTTP/2 www.datadoghq-browser-agent.com/datadog-rum-v3.js
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subject*.datadoghq-browser-agent.com
Fingerprint9E:40:A3:B8:F8:5F:43:15:5B:BB:AF:99:5C:07:D1:39:23:59:1F:51
ValidityTue, 30 Jul 2024 00:00:00 GMT - Sun, 03 Aug 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (65536), with no line terminators
Size 118 kB (117677 bytes)
Hash 647fda9a4d3d74344732d76cf1fff47c
01720d421ce3373f1a1958a1d85edfae5ab5f442
4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b
GET /datadog-rum-v3.js HTTP/1.1
Host: www.datadoghq-browser-agent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript
last-modified: Mon, 03 Jan 2022 16:36:14 GMT
content-encoding: gzip
server: AmazonS3
date: Sat, 07 Dec 2024 15:52:34 GMT
cache-control: max-age=14400, s-maxage=60
etag: W/"647fda9a4d3d74344732d76cf1fff47c"
vary: accept-encoding
x-cache: Hit from cloudfront
via: 1.1 ee04daa979e7a02cc5ca472521bc18a6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: 99CJ5PFTefp73ItHw7znTdZK6W3HX3ARt7GQp54jNSjPW-p4160U3g==
age: 20
timing-allow-origin: *
X-Firefox-Spdy: h2
GET content.quickencompare.com/qc/refi-images/icon-debit-conslidation.svg
200 OK 6.8 kB URL GET HTTP/2 content.quickencompare.com/qc/refi-images/icon-debit-conslidation.svg
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectquickencompare.com
Fingerprint91:CF:56:CF:08:92:B6:4B:4D:58:82:62:70:2A:51:8C:F0:F4:49:03
ValidityMon, 11 Nov 2024 06:14:11 GMT - Sun, 09 Feb 2025 06:14:10 GMT
File type SVG Scalable Vector Graphics image
Hash 867a4b76326d28ca4e66d0dad878ff2a
b1b30b97bebc904458bc128e35bb86ca02f36436
1358476a59e2ec18100e3e9a35eb8aa6b0e86761b28f050e6b5fe1f7ebf8c03d
GET /qc/refi-images/icon-debit-conslidation.svg HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=_u6dzNe4v3VN1c772eTqRk7SFcV2pVINQtGq_.qo3eo-1733586776-1.0.1.1-9vRb7Tv8tdHQptlvfJWopjGuvBPq8SXpYe0z4itk.J4eqUm1sJ.orDuU9m8aCko1kLnl2gC9sUA4BHAXeDyraA
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:58 GMT
content-type: image/svg+xml
last-modified: Mon, 16 Sep 2024 20:44:42 GMT
etag: W/"28246f3e4007fedf73e208da971c046f"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
via: 1.1 b5831686bbaffa69458853f1db0eca2a.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS1-P3
x-amz-cf-id: kG7sPn39d2WmLhMVC9fof57RM62m5tsbQzDW4uctrUqt4oEPik2b2w==
cf-cache-status: HIT
age: 1911
expires: Sat, 07 Dec 2024 19:52:58 GMT
cache-control: public, max-age=14400
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8ee5af938fb856a3-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
GET content.quickencompare.com/qc/refi-images/down-arrow.svg
200 OK 342 B URL GET HTTP/2 content.quickencompare.com/qc/refi-images/down-arrow.svg
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectquickencompare.com
Fingerprint91:CF:56:CF:08:92:B6:4B:4D:58:82:62:70:2A:51:8C:F0:F4:49:03
ValidityMon, 11 Nov 2024 06:14:11 GMT - Sun, 09 Feb 2025 06:14:10 GMT
File type SVG Scalable Vector Graphics image
Hash 7d74f0c25043ec662f07f5da333eb80e
a0d0df3e66638c73937ef246bc959c170d403b0e
dc63d2e7cabb505304526f4ff2bdd28d5a5f2eb4621ec2450fd6f4e48a54f33f
GET /qc/refi-images/down-arrow.svg HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=_u6dzNe4v3VN1c772eTqRk7SFcV2pVINQtGq_.qo3eo-1733586776-1.0.1.1-9vRb7Tv8tdHQptlvfJWopjGuvBPq8SXpYe0z4itk.J4eqUm1sJ.orDuU9m8aCko1kLnl2gC9sUA4BHAXeDyraA
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:58 GMT
content-type: image/svg+xml
last-modified: Wed, 16 Oct 2024 00:06:01 GMT
etag: W/"333552d29a8cd60fdd2459b641a774a1"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
via: 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P6
x-amz-cf-id: zNuZDNq-vTE-c17Tkd1hSpvTkUnT7EpxHtwVPF75WpYkuBSj4HhUtA==
cf-cache-status: HIT
age: 1911
expires: Sat, 07 Dec 2024 19:52:58 GMT
cache-control: public, max-age=14400
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8ee5af939fc356a3-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
POST create.leadid.com/2.15.1/Snap?msn=4&pid=6fcc9c7e-6584-44b3-abda-0089eb5f1384&token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&_=160340267
200 OK 0 B URL POST HTTP/2 create.leadid.com/2.15.1/Snap?msn=4&pid=6fcc9c7e-6584-44b3-abda-0089eb5f1384&token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&_=160340267
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerAmazon
Subjectcreate.leadid.com
FingerprintF1:00:1E:2C:3D:E1:0C:3C:9F:6C:A4:8C:6B:2F:4A:AA:A5:65:E0:13
ValiditySat, 20 Jul 2024 00:00:00 GMT - Mon, 18 Aug 2025 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /2.15.1/Snap?msn=4&pid=6fcc9c7e-6584-44b3-abda-0089eb5f1384&token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&_=160340267 HTTP/1.1
Host: create.leadid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 319111
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:53:08 GMT
content-type: text/plain;charset=UTF-8
server: nginx
set-cookie: rgisanonymous=false; expires=Mon, 06 Jan 2025 15:53:08 GMT; Max-Age=2592000; path=/
rguserid=d75256be-500c-4209-a955-28fcce7a6c58; expires=Mon, 06 Jan 2025 15:53:08 GMT; Max-Age=2592000; path=/
rguuid=true; expires=Mon, 06 Jan 2025 15:53:08 GMT; Max-Age=2592000; path=/
rgisanonymous=true; expires=Mon, 06 Jan 2025 15:53:08 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2
POST loans.quickenloans.com/api/tracking/click
200 OK 3.4 kB URL POST HTTP/2 loans.quickenloans.com/api/tracking/click
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectloans.quickenloans.com
Fingerprint9B:58:4A:65:BD:EC:A5:31:73:3E:E2:82:74:12:E2:BD:67:80:66:0D
ValiditySat, 30 Nov 2024 14:32:02 GMT - Fri, 28 Feb 2025 14:32:01 GMT
File type troff or preprocessor input, ASCII text, with very long lines (3477), with no line terminators
Hash fc111b2dfce314d5ef9a9bf60db00137
bc992833e1cf0fc5aa4c8c46f529481ad35278dd
c1c6b129807706905e70d35890a69d761f9bfb7ffd875bc0f662e1ee9397d61b
POST /api/tracking/click HTTP/1.1
Host: loans.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 1015
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Cookie: AWSALBTG=0W0YEyI28FKyCtXB4FrXwthpIgVlHZ1RgRPLvblHmv5x64zJrLGE6fY95YwVjo21HzBppxliyRfQFiHcLpX6prwNQOACp8+5d2aWkQa6zaU4N7lw5EUWZOj7nLI91KZKR595GSMlk2J/D6EWgnhKc0LSuU0WLI6q85RxDtWT+8JGNOB2P8I=; AWSALBTGCORS=0W0YEyI28FKyCtXB4FrXwthpIgVlHZ1RgRPLvblHmv5x64zJrLGE6fY95YwVjo21HzBppxliyRfQFiHcLpX6prwNQOACp8+5d2aWkQa6zaU4N7lw5EUWZOj7nLI91KZKR595GSMlk2J/D6EWgnhKc0LSuU0WLI6q85RxDtWT+8JGNOB2P8I=; __cf_bm=RvscG9u2rNzcYNEGl9Z6WKPNQgOhELP.pujV1pArQW4-1733586772-1.0.1.1-CkWnx1j1r5V2HPum2.WGpsPkui00RBQ.Jan_D3kGmegrjHSQ_5662xIHsaBysDSjHZlk4LlqFLnh9HPG2Xy_tg; _dd_s=rum; _gcl_au=1.1.1212055104.1733586774; _ga_RXLL9Z7XBK=GS1.1.1733586773.1.1.1733586776.0.0.1619340942; _ga=GA1.1.1237810024.1733586774; FPID=FPID2.2.nRhVFPTt%2Bd%2BrRL9JQtDujoVAdVL7Vyg%2FnlczdutR17M%3D.1733586774; FPLC=81%2FuqDZAK3rAFR0G14PB2uqLn6NiEbXpbd2%2Bdn9NbxHAGTp5CILJV9rXvVtqgdeutxeiEaEWxKyd%2BDBOIBBeDCttc9WfXNJFIe612xoukhqG%2FhSfyTqPxS1%2FuaL99A%3D%3D; FPAU=1.1.1212055104.1733586774; FPGSID=1.1733586774.1733586774.G-RXLL9Z7XBK.S36PUJb9dXHuulo3v_btFA; _gcl_au=1.1.1212055104.1733586774; _ga=GA1.1.1237810024.1733586774; _ga_RXLL9Z7XBK=GS1.1.1733586773.1.1.1733586773.0.0.1619340942; FPLC=UD1L4U3IJVFjQd6bP8xhhKOSmZzO%2B3YpAWJ5cV46or%2Fbkz9zSLRDl5WKplXyOSsbfus7tJ2nKNqMapCIAO4GwZqU4VjiFwMI91PDiDOb5djU6gxxFqbJTJSO2ygtAA%3D%3D; FPAU=1.1.1212055104.1733586774; FPGSID=1.1733586774.1733586774.G-RXLL9Z7XBK.S36PUJb9dXHuulo3v_btFA; visitorId=cc300729-b400-43a4-a9d9-24add0226b7f
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:57 GMT
content-type: application/json; charset=utf-8
x-dns-prefetch-control: off
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
access-control-allow-origin: *
etag: W/"d4b-P7JD0KCVm256ibI2COXE199XO4U"
cf-cache-status: DYNAMIC
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8ee5af8f7c3bb4ee-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
POST create.leadid.com/2.15.1/GenerateToken?msn=1&pid=6fcc9c7e-6584-44b3-abda-0089eb5f1384&_=160340264
200 OK 36 B URL POST HTTP/2 create.leadid.com/2.15.1/GenerateToken?msn=1&pid=6fcc9c7e-6584-44b3-abda-0089eb5f1384&_=160340264
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerAmazon
Subjectcreate.leadid.com
FingerprintF1:00:1E:2C:3D:E1:0C:3C:9F:6C:A4:8C:6B:2F:4A:AA:A5:65:E0:13
ValiditySat, 20 Jul 2024 00:00:00 GMT - Mon, 18 Aug 2025 23:59:59 GMT
File type ASCII text, with no line terminators
Hash c7cb3bba897857f5232e71d19b9ef7c4
988063f069c2bc64cfb8f5fc3f2db17057499b40
5f7ae6d8dee93372bbab84805388b8615f52c4c3c6e38d3f421cc9478d456d08
POST /2.15.1/GenerateToken?msn=1&pid=6fcc9c7e-6584-44b3-abda-0089eb5f1384&_=160340264 HTTP/1.1
Host: create.leadid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 528
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:58 GMT
content-type: text/plain;charset=UTF-8
server: nginx
set-cookie: rgisanonymous=false; expires=Mon, 06 Jan 2025 15:52:57 GMT; Max-Age=2592000; path=/
rguserid=1e0ff33d-6d0c-4ab6-9bbd-7d077acc10f1; expires=Mon, 06 Jan 2025 15:52:57 GMT; Max-Age=2592000; path=/
rguuid=true; expires=Mon, 06 Jan 2025 15:52:57 GMT; Max-Age=2592000; path=/
rgisanonymous=true; expires=Mon, 06 Jan 2025 15:52:57 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2
GET region1.analytics.google.com/g/s/collect?dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1>m=45j91e4c50h2v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485&_gsid=RXLL9Z7XBKS36PUJb9dXHuulo3v_btFA
204 No Content 0 B URL GET HTTP/2 region1.analytics.google.com/g/s/collect?dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1>m=45j91e4c50h2v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485&_gsid=RXLL9Z7XBKS36PUJb9dXHuulo3v_btFA
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subject*.google-analytics.com
Fingerprint8F:6D:67:20:75:1C:E2:F2:C3:65:DF:AC:EA:22:D8:AD:ED:0A:08:BA
ValidityMon, 21 Oct 2024 08:36:57 GMT - Mon, 13 Jan 2025 08:36:56 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /g/s/collect?dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1>m=45j91e4c50h2v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485&_gsid=RXLL9Z7XBKS36PUJb9dXHuulo3v_btFA HTTP/1.1
Host: region1.analytics.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
access-control-allow-origin: *
date: Sat, 07 Dec 2024 15:52:55 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: text/plain
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:194:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:194:0"}],}
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET content.quickencompare.com/qc/refi-images/icon-home-improvement.svg
200 OK 6.9 kB URL GET HTTP/2 content.quickencompare.com/qc/refi-images/icon-home-improvement.svg
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectquickencompare.com
Fingerprint91:CF:56:CF:08:92:B6:4B:4D:58:82:62:70:2A:51:8C:F0:F4:49:03
ValidityMon, 11 Nov 2024 06:14:11 GMT - Sun, 09 Feb 2025 06:14:10 GMT
File type SVG Scalable Vector Graphics image
Hash 33bf2cd1a1c4e590710c5e013fe31e5d
0426f0221dc74e1b5aefd45dac0a49955b180226
b36ee9fc82c750b01cbc646f4187025dae138c2f81792fe7cec941d76d2a3385
GET /qc/refi-images/icon-home-improvement.svg HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=_u6dzNe4v3VN1c772eTqRk7SFcV2pVINQtGq_.qo3eo-1733586776-1.0.1.1-9vRb7Tv8tdHQptlvfJWopjGuvBPq8SXpYe0z4itk.J4eqUm1sJ.orDuU9m8aCko1kLnl2gC9sUA4BHAXeDyraA
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:58 GMT
content-type: image/svg+xml
last-modified: Wed, 16 Oct 2024 00:06:02 GMT
etag: W/"9c325b815530ac139ba546a0edfa7c91"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
via: 1.1 d32aedbfbc53db77ab1daf44d017f5ba.cloudfront.net (CloudFront)
x-amz-cf-pop: VIE50-P3
x-amz-cf-id: I-u8mEbe3_xBarY2hMf0L26x4-AV1q1oTbXTsZLlZ9banbS6Po76bA==
cf-cache-status: HIT
age: 1911
expires: Sat, 07 Dec 2024 19:52:58 GMT
cache-control: public, max-age=14400
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8ee5af938fb956a3-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
GET loans.quickenloans.com/undefined
200 OK 0 B URL GET HTTP/2 loans.quickenloans.com/undefined
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectloans.quickenloans.com
Fingerprint9B:58:4A:65:BD:EC:A5:31:73:3E:E2:82:74:12:E2:BD:67:80:66:0D
ValiditySat, 30 Nov 2024 14:32:02 GMT - Fri, 28 Feb 2025 14:32:01 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /undefined HTTP/1.1
Host: loans.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: AWSALBTG=pm/Su8V5VgtckloekXYk4ealJ1wWAmq8LyKoTlP8yeDIWxZqp13Wj6HJE4d8M4P2zaVfn5HrKKReutKSt83nfQc2uxb/WTSLEcIrpk3xwwPtoVKjO8u7dxcr+7rFXAaA9uYf2Jrr+EbCu37JkhmwoAXhdTZTRrMOlMq3/VTGtn3aw/IY2dk=; AWSALBTGCORS=pm/Su8V5VgtckloekXYk4ealJ1wWAmq8LyKoTlP8yeDIWxZqp13Wj6HJE4d8M4P2zaVfn5HrKKReutKSt83nfQc2uxb/WTSLEcIrpk3xwwPtoVKjO8u7dxcr+7rFXAaA9uYf2Jrr+EbCu37JkhmwoAXhdTZTRrMOlMq3/VTGtn3aw/IY2dk=; __cf_bm=RvscG9u2rNzcYNEGl9Z6WKPNQgOhELP.pujV1pArQW4-1733586772-1.0.1.1-CkWnx1j1r5V2HPum2.WGpsPkui00RBQ.Jan_D3kGmegrjHSQ_5662xIHsaBysDSjHZlk4LlqFLnh9HPG2Xy_tg; _dd_s=rum=1&id=628c3c80-a55c-4ea2-9ba7-a587cd078da8&created=1733586773370&expire=1733587673683&logs=1; _gcl_au=1.1.1212055104.1733586774; _ga_RXLL9Z7XBK=GS1.1.1733586773.1.1.1733586775.0.0.1619340942; _ga=GA1.1.1237810024.1733586774; FPID=FPID2.2.nRhVFPTt%2Bd%2BrRL9JQtDujoVAdVL7Vyg%2FnlczdutR17M%3D.1733586774; FPLC=UD1L4U3IJVFjQd6bP8xhhKOSmZzO%2B3YpAWJ5cV46or%2Fbkz9zSLRDl5WKplXyOSsbfus7tJ2nKNqMapCIAO4GwZqU4VjiFwMI91PDiDOb5djU6gxxFqbJTJSO2ygtAA%3D%3D; FPAU=1.1.1212055104.1733586774; FPGSID=1.1733586774.1733586774.G-RXLL9Z7XBK.S36PUJb9dXHuulo3v_btFA
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:56 GMT
content-type: text/html; charset=utf-8
set-cookie: AWSALBTG=K88x1/GIJGmw9CQifuao+Y891TbQEszdP4iTyNK4dlbkdGKPA8RoVNHRCiWX2uuVQNpsw8r2vjkqaimy8D8cPRQLRSz88LSPeXO1XD/D2y1Gv2cnC2JgstVT2f7EOO2qTX0HDLI/1QhumfT0eN5UR3Sg7fBC9hgnIpkzZ5seXmzx0ureUSk=; Expires=Sat, 14 Dec 2024 15:52:56 GMT; Path=/
AWSALBTGCORS=K88x1/GIJGmw9CQifuao+Y891TbQEszdP4iTyNK4dlbkdGKPA8RoVNHRCiWX2uuVQNpsw8r2vjkqaimy8D8cPRQLRSz88LSPeXO1XD/D2y1Gv2cnC2JgstVT2f7EOO2qTX0HDLI/1QhumfT0eN5UR3Sg7fBC9hgnIpkzZ5seXmzx0ureUSk=; Expires=Sat, 14 Dec 2024 15:52:56 GMT; Path=/; SameSite=None; Secure
x-dns-prefetch-control: off
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
origin-agent-cluster: ?1
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
cf-cache-status: DYNAMIC
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8ee5af860e54b4ee-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
POST rum-http-intake.logs.datadoghq.com/v1/input/pub7338472aab069e71fb1763621d542e2d?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Apersonal-loans-webapp%2Cversion%3A1.0.0%20undefined&batch_time=1733586776035
200 OK 0 B URL POST HTTP/2 rum-http-intake.logs.datadoghq.com/v1/input/pub7338472aab069e71fb1763621d542e2d?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Apersonal-loans-webapp%2Cversion%3A1.0.0%20undefined&batch_time=1733586776035
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subject*.logs.datadoghq.com
FingerprintAE:B1:45:0E:45:D3:2C:CD:3D:4A:48:54:26:D2:96:A4:F2:AF:2F:3E
ValidityFri, 16 Feb 2024 00:00:00 GMT - Mon, 17 Feb 2025 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /v1/input/pub7338472aab069e71fb1763621d542e2d?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Apersonal-loans-webapp%2Cversion%3A1.0.0%20undefined&batch_time=1733586776035 HTTP/1.1
Host: rum-http-intake.logs.datadoghq.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 16382
Origin: null
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/json
content-length: 2
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 07 Dec 2024 15:52:56 GMT
X-Firefox-Spdy: h2
POST create.leadid.com/2.15.1/SaveDom?msn=2&pid=6fcc9c7e-6584-44b3-abda-0089eb5f1384&token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&_=160340265
200 OK 0 B URL POST HTTP/2 create.leadid.com/2.15.1/SaveDom?msn=2&pid=6fcc9c7e-6584-44b3-abda-0089eb5f1384&token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&_=160340265
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerAmazon
Subjectcreate.leadid.com
FingerprintF1:00:1E:2C:3D:E1:0C:3C:9F:6C:A4:8C:6B:2F:4A:AA:A5:65:E0:13
ValiditySat, 20 Jul 2024 00:00:00 GMT - Mon, 18 Aug 2025 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /2.15.1/SaveDom?msn=2&pid=6fcc9c7e-6584-44b3-abda-0089eb5f1384&token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&_=160340265 HTTP/1.1
Host: create.leadid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 494
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:58 GMT
content-type: text/plain;charset=UTF-8
server: nginx
set-cookie: rgisanonymous=false; expires=Mon, 06 Jan 2025 15:52:58 GMT; Max-Age=2592000; path=/
rguserid=e89ee6e5-3869-4390-9f12-1ca35276a036; expires=Mon, 06 Jan 2025 15:52:58 GMT; Max-Age=2592000; path=/
rguuid=true; expires=Mon, 06 Jan 2025 15:52:58 GMT; Max-Age=2592000; path=/
rgisanonymous=true; expires=Mon, 06 Jan 2025 15:52:58 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2
GET www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1237810024.1733586774>m=45j91e4c41v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485&aip=1&z=798918413
200 OK 42 B URL GET HTTP/3 www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1237810024.1733586774>m=45j91e4c41v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485&aip=1&z=798918413
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subject*.google.no
Fingerprint10:4D:45:7C:EB:8E:2F:4F:30:F1:84:1D:AB:53:C4:35:E0:FD:59:C3
ValidityMon, 21 Oct 2024 08:39:45 GMT - Mon, 13 Jan 2025 08:39:44 GMT
File type GIF image data, version 89a, 1 x 1
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1237810024.1733586774>m=45j91e4c41v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485&aip=1&z=798918413 HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 07 Dec 2024 15:53:01 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET loans.quickenloans.com/main.036fc29f9b13f2db7a72.css
200 OK 82 kB URL GET HTTP/2 loans.quickenloans.com/main.036fc29f9b13f2db7a72.css
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectloans.quickenloans.com
Fingerprint9B:58:4A:65:BD:EC:A5:31:73:3E:E2:82:74:12:E2:BD:67:80:66:0D
ValiditySat, 30 Nov 2024 14:32:02 GMT - Fri, 28 Feb 2025 14:32:01 GMT
Hash 2b5d604c4fbbd3f688f9474a1a98d29f
b6915733162ab7bc6a40f8085f7e4762f908cc0f
05e11fa2b02877d8970375aace37ac729d05f5fc093492fdb2578ba2cb2cffda
GET /main.036fc29f9b13f2db7a72.css HTTP/1.1
Host: loans.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: AWSALBTG=pm/Su8V5VgtckloekXYk4ealJ1wWAmq8LyKoTlP8yeDIWxZqp13Wj6HJE4d8M4P2zaVfn5HrKKReutKSt83nfQc2uxb/WTSLEcIrpk3xwwPtoVKjO8u7dxcr+7rFXAaA9uYf2Jrr+EbCu37JkhmwoAXhdTZTRrMOlMq3/VTGtn3aw/IY2dk=; AWSALBTGCORS=pm/Su8V5VgtckloekXYk4ealJ1wWAmq8LyKoTlP8yeDIWxZqp13Wj6HJE4d8M4P2zaVfn5HrKKReutKSt83nfQc2uxb/WTSLEcIrpk3xwwPtoVKjO8u7dxcr+7rFXAaA9uYf2Jrr+EbCu37JkhmwoAXhdTZTRrMOlMq3/VTGtn3aw/IY2dk=; __cf_bm=RvscG9u2rNzcYNEGl9Z6WKPNQgOhELP.pujV1pArQW4-1733586772-1.0.1.1-CkWnx1j1r5V2HPum2.WGpsPkui00RBQ.Jan_D3kGmegrjHSQ_5662xIHsaBysDSjHZlk4LlqFLnh9HPG2Xy_tg
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:54 GMT
content-type: text/css; charset=UTF-8
x-powered-by: Express
cache-control: public, max-age=14400
last-modified: Thu, 05 Dec 2024 11:57:54 GMT
etag: W/"13f05-19396af09d0"
cf-cache-status: MISS
expires: Sat, 07 Dec 2024 19:52:54 GMT
vary: Accept-Encoding
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8ee5af744966b4ee-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
GET fonts.googleapis.com/css?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
200 OK 8.4 kB URL GET HTTP/2 fonts.googleapis.com/css?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectupload.video.google.com
FingerprintE8:18:86:79:89:2E:F0:7C:66:1F:C3:43:81:D2:6D:9E:0C:9C:AB:05
ValidityMon, 21 Oct 2024 08:38:00 GMT - Mon, 13 Jan 2025 08:37:59 GMT
File type ASCII text, with very long lines (8626), with no line terminators
Hash 1bde6ff1ed2a13cc67858732bcf05d4c
7d514b3e7ee11f379b7ce00adc75ede1ac3e46e5
e1029ff08a13be903090b71223bc676d3511bf01e41104b2501022ae16ff7a6d
GET /css?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 07 Dec 2024 15:52:56 GMT
date: Sat, 07 Dec 2024 15:52:56 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/bcfae741e379a885f2ab2cf83ebe6d32/mr
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
POST create.leadid.com/2.15.1/Snap?msn=5&pid=6fcc9c7e-6584-44b3-abda-0089eb5f1384&token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&_=160340268
200 OK 0 B URL POST HTTP/2 create.leadid.com/2.15.1/Snap?msn=5&pid=6fcc9c7e-6584-44b3-abda-0089eb5f1384&token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&_=160340268
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerAmazon
Subjectcreate.leadid.com
FingerprintF1:00:1E:2C:3D:E1:0C:3C:9F:6C:A4:8C:6B:2F:4A:AA:A5:65:E0:13
ValiditySat, 20 Jul 2024 00:00:00 GMT - Mon, 18 Aug 2025 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /2.15.1/Snap?msn=5&pid=6fcc9c7e-6584-44b3-abda-0089eb5f1384&token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&_=160340268 HTTP/1.1
Host: create.leadid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 319111
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:53:08 GMT
content-type: text/plain;charset=UTF-8
server: nginx
set-cookie: rgisanonymous=false; expires=Mon, 06 Jan 2025 15:53:08 GMT; Max-Age=2592000; path=/
rguserid=e36df95b-6f7a-4112-91e1-980d18065df4; expires=Mon, 06 Jan 2025 15:53:08 GMT; Max-Age=2592000; path=/
rguuid=true; expires=Mon, 06 Jan 2025 15:53:08 GMT; Max-Age=2592000; path=/
rgisanonymous=true; expires=Mon, 06 Jan 2025 15:53:08 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2
GET deviceid.trueleadid.com/iframe.html?token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D
200 OK 4.8 kB URL GET HTTP/2 deviceid.trueleadid.com/iframe.html?token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D
IP
Requested by https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D
Certificate IssuerGlobalSign nv-sa
Subjectimperva.com
Fingerprint01:B4:BB:C2:E4:D2:08:99:B9:DC:7E:2A:46:00:7C:75:07:D0:E9:D0
ValidityWed, 10 Jul 2024 14:31:23 GMT - Mon, 06 Jan 2025 14:31:23 GMT
File type HTML document, ASCII text, with very long lines (4881), with no line terminators
Hash 512085d38cf619a13b4749d24b8ff215
abbdf3c5fbe854346e06dc44d73e06d73806a0cb
5bf59e19be84742f67a8172a36602f36abc12aa6add59652c6c6ff1485fc262a
GET /iframe.html?token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D HTTP/1.1
Host: deviceid.trueleadid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://d2m2wsoho8qq12.cloudfront.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:58 GMT
content-type: text/html
server: nginx
last-modified: Thu, 31 Oct 2024 14:48:02 GMT
etag: W/"672398a2-1209"
expires: Sun, 08 Dec 2024 15:52:58 GMT
p3p: CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
cache-control: max-age=86400, public
content-encoding: gzip
set-cookie: nlbi_3051494=p4/BbJrodVMBnUVcC30iGwAAAAA7YxcsJ3JgLSfp8m33k98y; HttpOnly; path=/; Domain=.trueleadid.com; Secure; SameSite=None
visid_incap_3051494=J3jlSNlhQfGolCqPSe/rYlpvVGcAAAAAQUIPAAAAAAAFve0Lqk0Btub9I2Uk2meG; expires=Sat, 06 Dec 2025 22:21:54 GMT; HttpOnly; path=/; Domain=.trueleadid.com; Secure; SameSite=None
incap_ses_7233_3051494=QFQfbUse3VSHTb7RWcdgZFpvVGcAAAAAzNP5D3ZUgg09beYe0X5k6A==; path=/; Domain=.trueleadid.com; Secure; SameSite=None
strict-transport-security: max-age=31536000
x-cdn: Imperva
x-iinfo: 14-85056441-85051272 pNNy RT(1733586778077 32) q(0 0 0 0) r(1 1) U24
X-Firefox-Spdy: h2
GET fonts.googleapis.com/css?family=Work+Sans:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
200 OK 12 kB URL GET HTTP/2 fonts.googleapis.com/css?family=Work+Sans:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectupload.video.google.com
FingerprintE8:18:86:79:89:2E:F0:7C:66:1F:C3:43:81:D2:6D:9E:0C:9C:AB:05
ValidityMon, 21 Oct 2024 08:38:00 GMT - Mon, 13 Jan 2025 08:37:59 GMT
Hash 5ba4a3ed009300adfee10ffbcf0ec98d
00858650903c8deace5e0cb3266dc1f5c437e22a
a7d9d066818d14071483fb738ada07980e96f9f418b0314fbfe4d3102d589316
GET /css?family=Work+Sans:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 07 Dec 2024 15:52:56 GMT
date: Sat, 07 Dec 2024 15:52:56 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET content.quickencompare.com/qc/refi-images/icon-emergency-new.svg
200 OK 2.3 kB URL GET HTTP/2 content.quickencompare.com/qc/refi-images/icon-emergency-new.svg
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectquickencompare.com
Fingerprint91:CF:56:CF:08:92:B6:4B:4D:58:82:62:70:2A:51:8C:F0:F4:49:03
ValidityMon, 11 Nov 2024 06:14:11 GMT - Sun, 09 Feb 2025 06:14:10 GMT
File type SVG Scalable Vector Graphics image
Hash 4e9fc01d8cc3adaf37255c4e42c4c178
e37574d49f5598821ae1067b99b48755f7184d26
058a86d1a0b0fb3f2f8369403f0d877bddaa59f26a50970974d0589f05f4db19
GET /qc/refi-images/icon-emergency-new.svg HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=_u6dzNe4v3VN1c772eTqRk7SFcV2pVINQtGq_.qo3eo-1733586776-1.0.1.1-9vRb7Tv8tdHQptlvfJWopjGuvBPq8SXpYe0z4itk.J4eqUm1sJ.orDuU9m8aCko1kLnl2gC9sUA4BHAXeDyraA
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:58 GMT
content-type: image/svg+xml
last-modified: Tue, 19 Nov 2024 19:24:46 GMT
etag: W/"59be918441b8de2c5b4969ac39764148"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
via: 1.1 b26b931354407da013ac53d2c1c55034.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P6
x-amz-cf-id: QiUgMA5Fb9oKI0ElTTJuvJ5ofBY_1Rc3zWMIuEBuGW4C7dV-K41hzA==
cf-cache-status: HIT
age: 1912
expires: Sat, 07 Dec 2024 19:52:58 GMT
cache-control: public, max-age=14400
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8ee5af939fbc56a3-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
GET content.quickencompare.com/qc/5_stars.svg
200 OK 1.1 kB URL GET HTTP/2 content.quickencompare.com/qc/5_stars.svg
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectquickencompare.com
Fingerprint91:CF:56:CF:08:92:B6:4B:4D:58:82:62:70:2A:51:8C:F0:F4:49:03
ValidityMon, 11 Nov 2024 06:14:11 GMT - Sun, 09 Feb 2025 06:14:10 GMT
File type SVG Scalable Vector Graphics image
Hash 1e164ed52904830a88b78aac1e66cf77
b77b50ea075ec0eaa3022e3500b7e0803d0fbaa6
e856909cf5edb5e720122af599a4e2c1a992e76d203e33562a57bad45ac4873c
GET /qc/5_stars.svg HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=_u6dzNe4v3VN1c772eTqRk7SFcV2pVINQtGq_.qo3eo-1733586776-1.0.1.1-9vRb7Tv8tdHQptlvfJWopjGuvBPq8SXpYe0z4itk.J4eqUm1sJ.orDuU9m8aCko1kLnl2gC9sUA4BHAXeDyraA
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:58 GMT
content-type: image/svg+xml
last-modified: Fri, 30 Aug 2024 13:22:40 GMT
etag: W/"dfdb39404473a99ec98aa98426dd98df"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
via: 1.1 25c0ae8b5b888081618bca2ea4f27faa.cloudfront.net (CloudFront)
x-amz-cf-pop: MXP63-P1
x-amz-cf-id: -ivqFfpV8r9y2aMKCO0g-RxRThiOeAzvxvvOKk82Zz_5rQJxJRnO2Q==
cf-cache-status: HIT
age: 1911
expires: Sat, 07 Dec 2024 19:52:58 GMT
cache-control: public, max-age=14400
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8ee5af939fc456a3-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
POST create.leadid.com/2.15.1/InitFormData?msn=3&pid=6fcc9c7e-6584-44b3-abda-0089eb5f1384&token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&_=160340266
200 OK 0 B URL POST HTTP/2 create.leadid.com/2.15.1/InitFormData?msn=3&pid=6fcc9c7e-6584-44b3-abda-0089eb5f1384&token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&_=160340266
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerAmazon
Subjectcreate.leadid.com
FingerprintF1:00:1E:2C:3D:E1:0C:3C:9F:6C:A4:8C:6B:2F:4A:AA:A5:65:E0:13
ValiditySat, 20 Jul 2024 00:00:00 GMT - Mon, 18 Aug 2025 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /2.15.1/InitFormData?msn=3&pid=6fcc9c7e-6584-44b3-abda-0089eb5f1384&token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&_=160340266 HTTP/1.1
Host: create.leadid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 2940
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:58 GMT
content-type: text/plain;charset=UTF-8
server: nginx
set-cookie: rgisanonymous=false; expires=Mon, 06 Jan 2025 15:52:58 GMT; Max-Age=2592000; path=/
rguserid=10fcfe06-8405-44f8-b345-e43fd80710d8; expires=Mon, 06 Jan 2025 15:52:58 GMT; Max-Age=2592000; path=/
rguuid=true; expires=Mon, 06 Jan 2025 15:52:58 GMT; Max-Age=2592000; path=/
rgisanonymous=true; expires=Mon, 06 Jan 2025 15:52:58 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2
GET script.anura.io/request.js?instance=3439535758&exid=537e801a-6c5c-52a6-890a-a6ac0db83aaa&source=affl_everflow_ql-mon_173_809&campaign=2&44272988973
200 OK 75 kB URL GET HTTP/2 script.anura.io/request.js?instance=3439535758&exid=537e801a-6c5c-52a6-890a-a6ac0db83aaa&source=affl_everflow_ql-mon_173_809&campaign=2&44272988973
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerAmazon
Subjectscript.anura.io
FingerprintCC:B4:48:82:BF:CC:04:FB:C7:35:8F:3F:D3:69:3F:10:96:9A:EF:C8
ValiditySun, 15 Sep 2024 00:00:00 GMT - Wed, 15 Oct 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (2089)
Hash 8d561a578c61f29e2b185337894edc42
24e3d653807ac659999fd846aa8b13d964818dcc
556f7cebfc462d2463556e5782e4de81f62b54a57fe50d248701f945e4108265
GET /request.js?instance=3439535758&exid=537e801a-6c5c-52a6-890a-a6ac0db83aaa&source=affl_everflow_ql-mon_173_809&campaign=2&44272988973 HTTP/1.1
Host: script.anura.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:58 GMT
content-type: application/javascript; charset=utf-8
server: nginx
vary: Accept-Encoding
expires: Sun, 28 Dec 1980 18:57:00 EST
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
X-Firefox-Spdy: h2
GET sgtm.quickenloans.com/g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4c40v9169491831za200zb9137104487&_p=1733586773132&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485&cid=1237810024.1733586774&ecid=1619340942&ul=en-us&sr=1280x1024&_fplc=0&ur=NO-03&frm=0&pscdl=noapi&_eu=AEA&sst.etld=google.no&sst.gcsub=region1&sst.tft=1733586773132&sst.sp=1&sst.em_event=1&sst.ude=0&_s=3&sid=1733586773&sct=1&seg=1&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D204b55d1f93041fabac6b8ff921ba4c3%26pkey%3D080c5617ee2e4cf7b5eb3c85e6b2ad0b%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D204b55d1f93041fabac6b8ff921ba4c3%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&en=scroll&epn.percent_scrolled=90&tfd=6840&richsstsse
200 OK 393 B URL GET HTTP/2 sgtm.quickenloans.com/g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4c40v9169491831za200zb9137104487&_p=1733586773132&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485&cid=1237810024.1733586774&ecid=1619340942&ul=en-us&sr=1280x1024&_fplc=0&ur=NO-03&frm=0&pscdl=noapi&_eu=AEA&sst.etld=google.no&sst.gcsub=region1&sst.tft=1733586773132&sst.sp=1&sst.em_event=1&sst.ude=0&_s=3&sid=1733586773&sct=1&seg=1&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D204b55d1f93041fabac6b8ff921ba4c3%26pkey%3D080c5617ee2e4cf7b5eb3c85e6b2ad0b%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D204b55d1f93041fabac6b8ff921ba4c3%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&en=scroll&epn.percent_scrolled=90&tfd=6840&richsstsse
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectsgtm.quickenloans.com
Fingerprint4E:86:D8:38:35:2F:10:58:51:04:6D:AF:7F:BE:F9:A5:A6:A8:AA:4E
ValidityThu, 21 Nov 2024 05:40:09 GMT - Wed, 19 Feb 2025 06:30:20 GMT
File type ASCII text, with very long lines (413), with no line terminators
Hash 704e1b18a004dfbaa6027d573628b4d1
34db03534ab452b9832529db50c234a0f65e1111
82496753116116d3423478d9cf08bcca5181797fd23d0f4cf60f804026ac5a63
GET /g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4c40v9169491831za200zb9137104487&_p=1733586773132&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485&cid=1237810024.1733586774&ecid=1619340942&ul=en-us&sr=1280x1024&_fplc=0&ur=NO-03&frm=0&pscdl=noapi&_eu=AEA&sst.etld=google.no&sst.gcsub=region1&sst.tft=1733586773132&sst.sp=1&sst.em_event=1&sst.ude=0&_s=3&sid=1733586773&sct=1&seg=1&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D204b55d1f93041fabac6b8ff921ba4c3%26pkey%3D080c5617ee2e4cf7b5eb3c85e6b2ad0b%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D204b55d1f93041fabac6b8ff921ba4c3%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&en=scroll&epn.percent_scrolled=90&tfd=6840&richsstsse HTTP/1.1
Host: sgtm.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Cookie: _gcl_au=1.1.1212055104.1733586774; _ga_RXLL9Z7XBK=GS1.1.1733586773.1.1.1733586775.0.0.1619340942; _ga=GA1.1.1237810024.1733586774; FPID=FPID2.2.nRhVFPTt%2Bd%2BrRL9JQtDujoVAdVL7Vyg%2FnlczdutR17M%3D.1733586774; FPLC=UD1L4U3IJVFjQd6bP8xhhKOSmZzO%2B3YpAWJ5cV46or%2Fbkz9zSLRDl5WKplXyOSsbfus7tJ2nKNqMapCIAO4GwZqU4VjiFwMI91PDiDOb5djU6gxxFqbJTJSO2ygtAA%3D%3D; FPAU=1.1.1212055104.1733586774; FPGSID=1.1733586774.1733586774.G-RXLL9Z7XBK.S36PUJb9dXHuulo3v_btFA
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
set-cookie: FPID=FPID2.2.nRhVFPTt%2Bd%2BrRL9JQtDujoVAdVL7Vyg%2FnlczdutR17M%3D.1733586774; Max-Age=63072000; Domain=quickenloans.com; Path=/; Secure; HttpOnly
FPLC=81%2FuqDZAK3rAFR0G14PB2uqLn6NiEbXpbd2%2Bdn9NbxHAGTp5CILJV9rXvVtqgdeutxeiEaEWxKyd%2BDBOIBBeDCttc9WfXNJFIe612xoukhqG%2FhSfyTqPxS1%2FuaL99A%3D%3D; Max-Age=72000; Domain=quickenloans.com; Path=/; Secure
cache-control: no-cache
content-type: text/plain
x-content-type-options: nosniff
x-accel-buffering: no
access-control-allow-origin: https://loans.quickenloans.com
access-control-allow-credentials: true
date: Sat, 07 Dec 2024 15:52:56 GMT
server: Google Frontend
expires: Sat, 07 Dec 2024 15:52:56 GMT
X-Firefox-Spdy: h2
GET content.quickencompare.com/nmn/logo/dollar-money-icon-small.svg
200 OK 7.6 kB URL GET HTTP/2 content.quickencompare.com/nmn/logo/dollar-money-icon-small.svg
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectquickencompare.com
Fingerprint91:CF:56:CF:08:92:B6:4B:4D:58:82:62:70:2A:51:8C:F0:F4:49:03
ValidityMon, 11 Nov 2024 06:14:11 GMT - Sun, 09 Feb 2025 06:14:10 GMT
File type SVG Scalable Vector Graphics image
Hash 9c7fa5ca9ac7adf457a83b5aed9fe269
d527d4db3df8b0adb6af6408d9ab45c3ec67dc02
f647b5bacc626969604abca8928075eb34accf47048b1ffa58e2cc56c08b0d3a
GET /nmn/logo/dollar-money-icon-small.svg HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=_u6dzNe4v3VN1c772eTqRk7SFcV2pVINQtGq_.qo3eo-1733586776-1.0.1.1-9vRb7Tv8tdHQptlvfJWopjGuvBPq8SXpYe0z4itk.J4eqUm1sJ.orDuU9m8aCko1kLnl2gC9sUA4BHAXeDyraA
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:58 GMT
content-type: image/svg+xml
last-modified: Fri, 30 Aug 2024 13:22:40 GMT
etag: W/"3b280fb1b5f603b076383e1ca6ea531f"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
via: 1.1 89af70582a9dc92c4998266dcd5025bc.cloudfront.net (CloudFront)
x-amz-cf-pop: BUD50-P2
x-amz-cf-id: o00l0tRNaamjzRXaNzKaoVMTHg0WqI-VxetC_hgIO4_RVTiq9lxnyg==
cf-cache-status: HIT
age: 1911
expires: Sat, 07 Dec 2024 19:52:58 GMT
cache-control: public, max-age=14400
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8ee5af938fb456a3-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
GET content.quickencompare.com/qc/refi-images/icon-household-expenses.svg
200 OK 3.3 kB URL GET HTTP/2 content.quickencompare.com/qc/refi-images/icon-household-expenses.svg
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectquickencompare.com
Fingerprint91:CF:56:CF:08:92:B6:4B:4D:58:82:62:70:2A:51:8C:F0:F4:49:03
ValidityMon, 11 Nov 2024 06:14:11 GMT - Sun, 09 Feb 2025 06:14:10 GMT
File type SVG Scalable Vector Graphics image
Hash 4d32c50a9d7aa6d115b35358ed4be05b
c96d8ffe2002ccf3c1582f06f2f09a8bf5e1a37c
f3cfbe305fef9fb1324afbf9b0f00df49f2f8d31f2930cc0fec57c61ab521440
GET /qc/refi-images/icon-household-expenses.svg HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=_u6dzNe4v3VN1c772eTqRk7SFcV2pVINQtGq_.qo3eo-1733586776-1.0.1.1-9vRb7Tv8tdHQptlvfJWopjGuvBPq8SXpYe0z4itk.J4eqUm1sJ.orDuU9m8aCko1kLnl2gC9sUA4BHAXeDyraA
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:58 GMT
content-type: image/svg+xml
last-modified: Thu, 10 Oct 2024 06:38:42 GMT
etag: W/"4bc93ca8cf8ddca9dab4a7fe5b09e4a4"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
via: 1.1 5dc1bff22b40f5004224ef547b1a9a7c.cloudfront.net (CloudFront)
x-amz-cf-pop: MXP63-P1
x-amz-cf-id: bWnm64CC1i6SX9UlZzKdccxjVr16Utkuf1CZui-k6mmJM_I0UqIi1w==
cf-cache-status: HIT
age: 1911
expires: Sat, 07 Dec 2024 19:52:58 GMT
cache-control: public, max-age=14400
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8ee5af939fc056a3-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
GET content.online.rocketmortgage.com/wham/ql_logo.svg
200 OK 4.5 kB URL GET HTTP/2 content.online.rocketmortgage.com/wham/ql_logo.svg
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectonline.rocketmortgage.com
Fingerprint40:8D:63:7A:73:CD:FC:C3:25:FE:8D:60:15:35:CD:D8:8F:67:33:6F
ValidityThu, 07 Nov 2024 23:12:13 GMT - Wed, 05 Feb 2025 23:12:12 GMT
File type SVG Scalable Vector Graphics image
Hash dde4d24e842798eb7f97f1640245c4ac
f1d11a797ca9c3897f39b88d349275e114d30e91
9b3bcd0e960aafc93fe8bbf97ac07625794130d392b42030723fd8388a562fb8
GET /wham/ql_logo.svg HTTP/1.1
Host: content.online.rocketmortgage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:58 GMT
content-type: image/svg+xml
last-modified: Tue, 19 Nov 2024 19:24:47 GMT
x-amz-server-side-encryption: AES256
etag: W/"eea100e4a26adee86914e2dd622d33ae"
x-cache: Hit from cloudfront
via: 1.1 5153decc9b717ba9e0effc2ce8af4c6e.cloudfront.net (CloudFront)
x-amz-cf-pop: IST50-P3
x-amz-cf-id: _FwtKxhGxywMC86G32-bJRJ9hxvttW9pRVjbFKnKefGmgxiZJZ_lwg==
cf-cache-status: HIT
age: 1911
expires: Sat, 07 Dec 2024 19:52:58 GMT
cache-control: public, max-age=14400
set-cookie: __cf_bm=ubfAfiPlEmK5IcoiylXmCQ04RXdg1kncDlg3sCloLBY-1733586778-1.0.1.1-Np3r9uo_P73ghRyv4HXKsoI8x84Oj.56Ll1pVj7JfALbgYHmxvLvOgDWrhqLDBWOHPLJ3YN1yGt0WvZiHR8rcw; path=/; expires=Sat, 07-Dec-24 16:22:58 GMT; domain=.online.rocketmortgage.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8ee5af941da65699-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
GET create.leadid.com/2.15.1/SaveDeviceId.js?lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&methods=48&token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&uuid=da675ac9a92447a1b7709a4549ff3868
200 OK 0 B URL GET HTTP/2 create.leadid.com/2.15.1/SaveDeviceId.js?lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&methods=48&token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&uuid=da675ac9a92447a1b7709a4549ff3868
IP
Requested by https://deviceid.trueleadid.com/iframe.html?token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D
Certificate IssuerAmazon
Subjectcreate.leadid.com
FingerprintF1:00:1E:2C:3D:E1:0C:3C:9F:6C:A4:8C:6B:2F:4A:AA:A5:65:E0:13
ValiditySat, 20 Jul 2024 00:00:00 GMT - Mon, 18 Aug 2025 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /2.15.1/SaveDeviceId.js?lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&methods=48&token=230ED8A5-4C59-3A30-D9DC-4E2C975218FA&uuid=da675ac9a92447a1b7709a4549ff3868 HTTP/1.1
Host: create.leadid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://deviceid.trueleadid.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 07 Dec 2024 15:52:58 GMT
content-type: text/javascript;charset=UTF-8
server: nginx
set-cookie: rgisanonymous=false; expires=Mon, 06 Jan 2025 15:52:58 GMT; Max-Age=2592000; path=/
rguserid=007233d0-510a-4d16-b87f-a992ff9d1567; expires=Mon, 06 Jan 2025 15:52:58 GMT; Max-Age=2592000; path=/
rguuid=true; expires=Mon, 06 Jan 2025 15:52:58 GMT; Max-Age=2592000; path=/
rgisanonymous=true; expires=Mon, 06 Jan 2025 15:52:58 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2
GET www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1237810024.1733586774>m=45j91e4c50h2v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485&aip=1&z=1746196651
200 OK 42 B URL GET HTTP/2 www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1237810024.1733586774>m=45j91e4c50h2v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485&aip=1&z=1746196651
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subject*.google.no
Fingerprint10:4D:45:7C:EB:8E:2F:4F:30:F1:84:1D:AB:53:C4:35:E0:FD:59:C3
ValidityMon, 21 Oct 2024 08:39:45 GMT - Mon, 13 Jan 2025 08:39:44 GMT
File type GIF image data, version 89a, 1 x 1
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1237810024.1733586774>m=45j91e4c50h2v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485&aip=1&z=1746196651 HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 07 Dec 2024 15:52:56 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET ads.anura.io/showads.js?834658143621
200 OK 0 B URL GET HTTP/2 ads.anura.io/showads.js?834658143621
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerAmazon
Subjectads.anura.io
Fingerprint1D:30:09:B1:D0:2A:A6:E2:1D:B8:C7:0A:60:EB:65:48:AF:05:5E:19
ValidityMon, 29 Apr 2024 00:00:00 GMT - Tue, 27 May 2025 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /showads.js?834658143621 HTTP/1.1
Host: ads.anura.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
date: Sat, 07 Dec 2024 08:56:32 GMT
server: nginx
access-control-allow-origin: *
access-control-allow-methods: GET
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 6a0f63864791329e89a4b233ec4c3a36.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: LZyM1zpFvxXPKnsSd0tqWpIHFekjrygiMl64ljo9L1LsYnE5_yZQ6g==
age: 24986
X-Firefox-Spdy: h2
GET fonts.googleapis.com/css?family=Antic+Didone:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
200 OK 419 B URL GET HTTP/2 fonts.googleapis.com/css?family=Antic+Didone:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectupload.video.google.com
FingerprintE8:18:86:79:89:2E:F0:7C:66:1F:C3:43:81:D2:6D:9E:0C:9C:AB:05
ValidityMon, 21 Oct 2024 08:38:00 GMT - Mon, 13 Jan 2025 08:37:59 GMT
File type ASCII text, with very long lines (428), with no line terminators
Hash 653f7e60afab341572c2e052aa864b97
61bcd4c14ffdaf1f5314b821af30a9b090b97336
c1081228d65efc0268f8f4a6bf489c4789ae7034000cec7b2573a8045cb48cd2
GET /css?family=Antic+Didone:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 07 Dec 2024 15:52:56 GMT
date: Sat, 07 Dec 2024 15:52:56 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
POST loans.quickenloans.com/api/tracking/presentation
409 Conflict 66 B URL POST HTTP/2 loans.quickenloans.com/api/tracking/presentation
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectloans.quickenloans.com
Fingerprint9B:58:4A:65:BD:EC:A5:31:73:3E:E2:82:74:12:E2:BD:67:80:66:0D
ValiditySat, 30 Nov 2024 14:32:02 GMT - Fri, 28 Feb 2025 14:32:01 GMT
File type ASCII text, with no line terminators
Hash 768f157092822ddd39a62cdbd5674379
b8a754545684095a921af0f93c636d259985303d
eec70440bb98889d5c3b3126b7b36846af38d8195c69ca2897fb958898eff295
POST /api/tracking/presentation HTTP/1.1
Host: loans.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJtYXJrZXRpbmdDbGlja0lkIjoiNTM3ZTgwMWEtNmM1Yy01MmE2LTg5MGEtYTZhYzBkYjgzYWFhIiwidmlzaXRvcklkIjoiY2MzMDA3MjktYjQwMC00M2E0LWE5ZDktMjRhZGQwMjI2YjdmIiwic2Vzc2lvbklkIjoiOGE5MTYwODMtMmNiNC00ZDI2LWE5NDktZTFhNjgyZTYwNTUzIiwibWFya2V0aW5nT2ZmZXJJZCI6IjMyMTY0NiIsInNvdXJjZUlkIjoiYWZmbF9ldmVyZmxvd19xbC1tb25fMTczXzgwOSIsInRpbWVPbkZvcm1TdGFydFRpbWUiOiIyMDI0LTEyLTA3VDE1OjUyOjU3LjUwNVoiLCJvcmlnaW5SZXF1ZXN0ZWRVcmkiOiJodHRwczovL2xvYW5zLnF1aWNrZW5sb2Fucy5jb20vP21vaWQ9MzIxNjQ2JnNvdXJjZWlkPWFmZmxfZXZlcmZsb3dfcWwtbW9uXzE3M184MDkmcGtleTE9ODA5JnBrZXkyPTImcGtleTM9MjA0YjU1ZDFmOTMwNDFmYWJhYzZiOGZmOTIxYmE0YzMmcGtleT0wODBjNTYxN2VlMmU0Y2Y3YjVlYjNjODVlNmIyYWQwYiZzaWQ9MTczJmNtcGlkPTE3MyZjcnRpZD0mb2lkPTE3MyZhZmZpZD04MDkmX2VmX3RyYW5zYWN0aW9uX2lkPTIwNGI1NWQxZjkzMDQxZmFiYWM2YjhmZjkyMWJhNGMzJnV0bV9tZWRpdW09YWZmaWxpYXRlJnV0bV9zb3VyY2U9bm9jYXBhZHMuY29tJnV0bV9jb250ZW50PSIsInByZXNlbnRhdGlvbk5hbWUiOiIyOTMyNTI4X01PTl9MUF9QUkVTX0NPTlNFTlRfRERfVjEiLCJkZXN0aW5hdGlvblVybCI6Imh0dHBzOi8vbG9hbnMucXVpY2tlbmxvYW5zLmNvbS8_bW9pZD0zMjE2NDYmc291cmNlaWQ9YWZmbF9ldmVyZmxvd19xbC1tb25fMTczXzgwOSZwa2V5MT04MDkmcGtleTI9MiZwa2V5Mz0yMDRiNTVkMWY5MzA0MWZhYmFjNmI4ZmY5MjFiYTRjMyZwa2V5PTA4MGM1NjE3ZWUyZTRjZjdiNWViM2M4NWU2YjJhZDBiJnNpZD0xNzMmY21waWQ9MTczJmNydGlkPSZvaWQ9MTczJmFmZmlkPTgwOSZfZWZfdHJhbnNhY3Rpb25faWQ9MjA0YjU1ZDFmOTMwNDFmYWJhYzZiOGZmOTIxYmE0YzMmdXRtX21lZGl1bT1hZmZpbGlhdGUmdXRtX3NvdXJjZT1ub2NhcGFkcy5jb20mdXRtX2NvbnRlbnQ9IiwidmVydGljYWxOYW1lIjoiTU9OX0xQIiwicmVmZXJyaW5nVXJpIjoiIiwidGVzdElkIjoyMTg3MTc1LCJtb2lkIjoiMzIxNjQ2IiwiY2xpZW50SXBBZGRyZXNzIjoiOTEuOTAuNDIuMTU0IiwicHVibGlzaGVyRGV2aWNlIjoiIiwicmVzb2x1dGlvbiI6IiIsInVzZXJBZ2VudCI6Ik1vemlsbGEvNS4wIChYMTE7IExpbnV4IHg4Nl82NDsgcnY6OTYuMCkgR2Vja28vMjAxMDAxMDEgRmlyZWZveC85Ni4wIiwiYm90IjpmYWxzZSwiaWF0IjoxNzMzNTg2Nzc3fQ.PYJca6hz9g7v1A094W7PV23Lj6e8Yp7dfxHg2huZoi_nB0rZy4COzocriyZMmvXlR4mfPjd77EpmhG2VN8_B59Q6Qs2Zmv5_jlRrnssYYpQhjhw31pOqqHAVLPON3z8h4mrTcEBcc9ydQWzSs2VS-E3poAWfNetXdaKaJSF4Jh45FXTJAM2rfCgohwLViJo-pyzgMa8oVw8eXGwXCINxNh0EverYTKBuVFnX_FiZX3tfJZu2vtOTQi1zT-ERpb32OIQhrDwrxQveuab3BjaIbGsh5cCo26qu1_KvJHhDwgQcZJqoGxi8De7BF5H4zoB3HvTRU0L8-thkU9i6C4vDVg
Content-Length: 141
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Cookie: AWSALBTG=0W0YEyI28FKyCtXB4FrXwthpIgVlHZ1RgRPLvblHmv5x64zJrLGE6fY95YwVjo21HzBppxliyRfQFiHcLpX6prwNQOACp8+5d2aWkQa6zaU4N7lw5EUWZOj7nLI91KZKR595GSMlk2J/D6EWgnhKc0LSuU0WLI6q85RxDtWT+8JGNOB2P8I=; AWSALBTGCORS=0W0YEyI28FKyCtXB4FrXwthpIgVlHZ1RgRPLvblHmv5x64zJrLGE6fY95YwVjo21HzBppxliyRfQFiHcLpX6prwNQOACp8+5d2aWkQa6zaU4N7lw5EUWZOj7nLI91KZKR595GSMlk2J/D6EWgnhKc0LSuU0WLI6q85RxDtWT+8JGNOB2P8I=; __cf_bm=RvscG9u2rNzcYNEGl9Z6WKPNQgOhELP.pujV1pArQW4-1733586772-1.0.1.1-CkWnx1j1r5V2HPum2.WGpsPkui00RBQ.Jan_D3kGmegrjHSQ_5662xIHsaBysDSjHZlk4LlqFLnh9HPG2Xy_tg; _dd_s=rum; _gcl_au=1.1.1212055104.1733586774; _ga_RXLL9Z7XBK=GS1.1.1733586773.1.1.1733586776.0.0.1619340942; _ga=GA1.1.1237810024.1733586774; FPID=FPID2.2.nRhVFPTt%2Bd%2BrRL9JQtDujoVAdVL7Vyg%2FnlczdutR17M%3D.1733586774; FPLC=81%2FuqDZAK3rAFR0G14PB2uqLn6NiEbXpbd2%2Bdn9NbxHAGTp5CILJV9rXvVtqgdeutxeiEaEWxKyd%2BDBOIBBeDCttc9WfXNJFIe612xoukhqG%2FhSfyTqPxS1%2FuaL99A%3D%3D; FPAU=1.1.1212055104.1733586774; FPGSID=1.1733586774.1733586774.G-RXLL9Z7XBK.S36PUJb9dXHuulo3v_btFA; _gcl_au=1.1.1212055104.1733586774; _ga=GA1.1.1237810024.1733586774; _ga_RXLL9Z7XBK=GS1.1.1733586773.1.1.1733586773.0.0.1619340942; FPLC=UD1L4U3IJVFjQd6bP8xhhKOSmZzO%2B3YpAWJ5cV46or%2Fbkz9zSLRDl5WKplXyOSsbfus7tJ2nKNqMapCIAO4GwZqU4VjiFwMI91PDiDOb5djU6gxxFqbJTJSO2ygtAA%3D%3D; FPAU=1.1.1212055104.1733586774; FPGSID=1.1733586774.1733586774.G-RXLL9Z7XBK.S36PUJb9dXHuulo3v_btFA; visitorId=cc300729-b400-43a4-a9d9-24add0226b7f
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 409 Conflict
date: Sat, 07 Dec 2024 15:52:58 GMT
content-type: text/html; charset=utf-8
x-dns-prefetch-control: off
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
access-control-allow-origin: *
cf-cache-status: DYNAMIC
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8ee5af91df69b4ee-OSL
X-Firefox-Spdy: h2
POST loans.quickenloans.com/api/tracking/presentation
409 Conflict 66 B URL POST HTTP/2 loans.quickenloans.com/api/tracking/presentation
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=204b55d1f93041fabac6b8ff921ba4c3&pkey=080c5617ee2e4cf7b5eb3c85e6b2ad0b&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=204b55d1f93041fabac6b8ff921ba4c3&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectloans.quickenloans.com
Fingerprint9B:58:4A:65:BD:EC:A5:31:73:3E:E2:82:74:12:E2:BD:67:80:66:0D
ValiditySat, 30 Nov 2024 14:32:02 GMT - Fri, 28 Feb 2025 14:32:01 GMT
File type ASCII text, with no line terminators
Hash 768f157092822ddd39a62cdbd5674379
b8a754545684095a921af0f93c636d259985303d
eec70440bb98889d5c3b3126b7b36846af38d8195c69ca2897fb958898eff295
POST /api/tracking/presentation HTTP/1.1
Host: loans.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJtYXJrZXRpbmdDbGlja0lkIjoiNTM3ZTgwMWEtNmM1Yy01MmE2LTg5MGEtYTZhYzBkYjgzYWFhIiwidmlzaXRvcklkIjoiY2MzMDA3MjktYjQwMC00M2E0LWE5ZDktMjRhZGQwMjI2YjdmIiwic2Vzc2lvbklkIjoiOGE5MTYwODMtMmNiNC00ZDI2LWE5NDktZTFhNjgyZTYwNTUzIiwibWFya2V0aW5nT2ZmZXJJZCI6IjMyMTY0NiIsInNvdXJjZUlkIjoiYWZmbF9ldmVyZmxvd19xbC1tb25fMTczXzgwOSIsInRpbWVPbkZvcm1TdGFydFRpbWUiOiIyMDI0LTEyLTA3VDE1OjUyOjU3LjUwNVoiLCJvcmlnaW5SZXF1ZXN0ZWRVcmkiOiJodHRwczovL2xvYW5zLnF1aWNrZW5sb2Fucy5jb20vP21vaWQ9MzIxNjQ2JnNvdXJjZWlkPWFmZmxfZXZlcmZsb3dfcWwtbW9uXzE3M184MDkmcGtleTE9ODA5JnBrZXkyPTImcGtleTM9MjA0YjU1ZDFmOTMwNDFmYWJhYzZiOGZmOTIxYmE0YzMmcGtleT0wODBjNTYxN2VlMmU0Y2Y3YjVlYjNjODVlNmIyYWQwYiZzaWQ9MTczJmNtcGlkPTE3MyZjcnRpZD0mb2lkPTE3MyZhZmZpZD04MDkmX2VmX3RyYW5zYWN0aW9uX2lkPTIwNGI1NWQxZjkzMDQxZmFiYWM2YjhmZjkyMWJhNGMzJnV0bV9tZWRpdW09YWZmaWxpYXRlJnV0bV9zb3VyY2U9bm9jYXBhZHMuY29tJnV0bV9jb250ZW50PSIsInByZXNlbnRhdGlvbk5hbWUiOiIyOTMyNTI4X01PTl9MUF9QUkVTX0NPTlNFTlRfRERfVjEiLCJkZXN0aW5hdGlvblVybCI6Imh0dHBzOi8vbG9hbnMucXVpY2tlbmxvYW5zLmNvbS8_bW9pZD0zMjE2NDYmc291cmNlaWQ9YWZmbF9ldmVyZmxvd19xbC1tb25fMTczXzgwOSZwa2V5MT04MDkmcGtleTI9MiZwa2V5Mz0yMDRiNTVkMWY5MzA0MWZhYmFjNmI4ZmY5MjFiYTRjMyZwa2V5PTA4MGM1NjE3ZWUyZTRjZjdiNWViM2M4NWU2YjJhZDBiJnNpZD0xNzMmY21waWQ9MTczJmNydGlkPSZvaWQ9MTczJmFmZmlkPTgwOSZfZWZfdHJhbnNhY3Rpb25faWQ9MjA0YjU1ZDFmOTMwNDFmYWJhYzZiOGZmOTIxYmE0YzMmdXRtX21lZGl1bT1hZmZpbGlhdGUmdXRtX3NvdXJjZT1ub2NhcGFkcy5jb20mdXRtX2NvbnRlbnQ9IiwidmVydGljYWxOYW1lIjoiTU9OX0xQIiwicmVmZXJyaW5nVXJpIjoiIiwidGVzdElkIjoyMTg3MTc1LCJtb2lkIjoiMzIxNjQ2IiwiY2xpZW50SXBBZGRyZXNzIjoiOTEuOTAuNDIuMTU0IiwicHVibGlzaGVyRGV2aWNlIjoiIiwicmVzb2x1dGlvbiI6IiIsInVzZXJBZ2VudCI6Ik1vemlsbGEvNS4wIChYMTE7IExpbnV4IHg4Nl82NDsgcnY6OTYuMCkgR2Vja28vMjAxMDAxMDEgRmlyZWZveC85Ni4wIiwiYm90IjpmYWxzZSwiaWF0IjoxNzMzNTg2Nzc3fQ.PYJca6hz9g7v1A094W7PV23Lj6e8Yp7dfxHg2huZoi_nB0rZy4COzocriyZMmvXlR4mfPjd77EpmhG2VN8_B59Q6Qs2Zmv5_jlRrnssYYpQhjhw31pOqqHAVLPON3z8h4mrTcEBcc9ydQWzSs2VS-E3poAWfNetXdaKaJSF4Jh45FXTJAM2rfCgohwLViJo-pyzgMa8oVw8eXGwXCINxNh0EverYTKBuVFnX_FiZX3tfJZu2vtOTQi1zT-ERpb32OIQhrDwrxQveuab3BjaIbGsh5cCo26qu1_KvJHhDwgQcZJqoGxi8De7BF5H4zoB3HvTRU0L8-thkU9i6C4vDVg
Content-Length: 141
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Cookie: AWSALBTG=pm/Su8V5VgtckloekXYk4ealJ1wWAmq8LyKoTlP8yeDIWxZqp13Wj6HJE4d8M4P2zaVfn5HrKKReutKSt83nfQc2uxb/WTSLEcIrpk3xwwPtoVKjO8u7dxcr+7rFXAaA9uYf2Jrr+EbCu37JkhmwoAXhdTZTRrMOlMq3/VTGtn3aw/IY2dk; AWSALBTGCORS=pm/Su8V5VgtckloekXYk4ealJ1wWAmq8LyKoTlP8yeDIWxZqp13Wj6HJE4d8M4P2zaVfn5HrKKReutKSt83nfQc2uxb/WTSLEcIrpk3xwwPtoVKjO8u7dxcr+7rFXAaA9uYf2Jrr+EbCu37JkhmwoAXhdTZTRrMOlMq3/VTGtn3aw/IY2dk; __cf_bm=RvscG9u2rNzcYNEGl9Z6WKPNQgOhELP.pujV1pArQW4-1733586772-1.0.1.1-CkWnx1j1r5V2HPum2.WGpsPkui00RBQ.Jan_D3kGmegrjHSQ_5662xIHsaBysDSjHZlk4LlqFLnh9HPG2Xy_tg; _dd_s=rum; _gcl_au=1.1.1212055104.1733586774; _ga_RXLL9Z7XBK=GS1.1.1733586773.1.1.1733586776.0.0.1619340942; _ga=GA1.1.1237810024.1733586774; FPID=FPID2.2.nRhVFPTt%2Bd%2BrRL9JQtDujoVAdVL7Vyg%2FnlczdutR17M%3D.1733586774; FPLC=81%2FuqDZAK3rAFR0G14PB2uqLn6NiEbXpbd2%2Bdn9NbxHAGTp5CILJV9rXvVtqgdeutxeiEaEWxKyd%2BDBOIBBeDCttc9WfXNJFIe612xoukhqG%2FhSfyTqPxS1%2FuaL99A%3D%3D; FPAU=1.1.1212055104.1733586774; FPGSID=1.1733586774.1733586774.G-RXLL9Z7XBK.S36PUJb9dXHuulo3v_btFA; _gcl_au=1.1.1212055104.1733586774; _ga=GA1.1.1237810024.1733586774; _ga_RXLL9Z7XBK=GS1.1.1733586773.1.1.1733586773.0.0.1619340942; FPLC=UD1L4U3IJVFjQd6bP8xhhKOSmZzO%2B3YpAWJ5cV46or%2Fbkz9zSLRDl5WKplXyOSsbfus7tJ2nKNqMapCIAO4GwZqU4VjiFwMI91PDiDOb5djU6gxxFqbJTJSO2ygtAA%3D%3D; FPAU=1.1.1212055104.1733586774; FPGSID=1.1733586774.1733586774.G-RXLL9Z7XBK.S36PUJb9dXHuulo3v_btFA; visitorId=cc300729-b400-43a4-a9d9-24add0226b7f; click=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJtYXJrZXRpbmdDbGlja0lkIjoiNTM3ZTgwMWEtNmM1Yy01MmE2LTg5MGEtYTZhYzBkYjgzYWFhIiwidmlzaXRvcklkIjoiY2MzMDA3MjktYjQwMC00M2E0LWE5ZDktMjRhZGQwMjI2YjdmIiwic2Vzc2lvbklkIjoiOGE5MTYwODMtMmNiNC00ZDI2LWE5NDktZTFhNjgyZTYwNTUzIiwibWFya2V0aW5nT2ZmZXJJZCI6IjMyMTY0NiIsInNvdXJjZUlkIjoiYWZmbF9ldmVyZmxvd19xbC1tb25fMTczXzgwOSIsInRpbWVPbkZvcm1TdGFydFRpbWUiOiIyMDI0LTEyLTA3VDE1OjUyOjU3LjUwNVoiLCJvcmlnaW5SZXF1ZXN0ZWRVcmkiOiJodHRwczovL2xvYW5zLnF1aWNrZW5sb2Fucy5jb20vP21vaWQ9MzIxNjQ2JnNvdXJjZWlkPWFmZmxfZXZlcmZsb3dfcWwtbW9uXzE3M184MDkmcGtleTE9ODA5JnBrZXkyPTImcGtleTM9MjA0YjU1ZDFmOTMwNDFmYWJhYzZiOGZmOTIxYmE0YzMmcGtleT0wODBjNTYxN2VlMmU0Y2Y3YjVlYjNjODVlNmIyYWQwYiZzaWQ9MTczJmNtcGlkPTE3MyZjcnRpZD0mb2lkPTE3MyZhZmZpZD04MDkmX2VmX3RyYW5zYWN0aW9uX2lkPTIwNGI1NWQxZjkzMDQxZmFiYWM2YjhmZjkyMWJhNGMzJnV0bV9tZWRpdW09YWZmaWxpYXRlJnV0bV9zb3VyY2U9bm9jYXBhZHMuY29tJnV0bV9jb250ZW50PSIsInByZXNlbnRhdGlvbk5hbWUiOiIyOTMyNTI4X01PTl9MUF9QUkVTX0NPTlNFTlRfRERfVjEiLCJkZXN0aW5hdGlvblVybCI6Imh0dHBzOi8vbG9hbnMucXVpY2tlbmxvYW5zLmNvbS8_bW9pZD0zMjE2NDYmc291cmNlaWQ9YWZmbF9ldmVyZmxvd19xbC1tb25fMTczXzgwOSZwa2V5MT04MDkmcGtleTI9MiZwa2V5Mz0yMDRiNTVkMWY5MzA0MWZhYmFjNmI4ZmY5MjFiYTRjMyZwa2V5PTA4MGM1NjE3ZWUyZTRjZjdiNWViM2M4NWU2YjJhZDBiJnNpZD0xNzMmY21waWQ9MTczJmNydGlkPSZvaWQ9MTczJmFmZmlkPTgwOSZfZWZfdHJhbnNhY3Rpb25faWQ9MjA0YjU1ZDFmOTMwNDFmYWJhYzZiOGZmOTIxYmE0YzMmdXRtX21lZGl1bT1hZmZpbGlhdGUmdXRtX3NvdXJjZT1ub2NhcGFkcy5jb20mdXRtX2NvbnRlbnQ9IiwidmVydGljYWxOYW1lIjoiTU9OX0xQIiwicmVmZXJyaW5nVXJpIjoiIiwidGVzdElkIjoyMTg3MTc1LCJtb2lkIjoiMzIxNjQ2IiwiY2xpZW50SXBBZGRyZXNzIjoiOTEuOTAuNDIuMTU0IiwicHVibGlzaGVyRGV2aWNlIjoiIiwicmVzb2x1dGlvbiI6IiIsInVzZXJBZ2VudCI6Ik1vemlsbGEvNS4wIChYMTE7IExpbnV4IHg4Nl82NDsgcnY6OTYuMCkgR2Vja28vMjAxMDAxMDEgRmlyZWZveC85Ni4wIiwiYm90IjpmYWxzZSwiaWF0IjoxNzMzNTg2Nzc3fQ.PYJca6hz9g7v1A094W7PV23Lj6e8Yp7dfxHg2huZoi_nB0rZy4COzocriyZMmvXlR4mfPjd77EpmhG2VN8_B59Q6Qs2Zmv5_jlRrnssYYpQhjhw31pOqqHAVLPON3z8h4mrTcEBcc9ydQWzSs2VS-E3poAWfNetXdaKaJSF4Jh45FXTJAM2rfCgohwLViJo-pyzgMa8oVw8eXGwXCINxNh0EverYTKBuVFnX_FiZX3tfJZu2vtOTQi1zT-ERpb32OIQhrDwrxQveuab3BjaIbGsh5cCo26qu1_KvJHhDwgQcZJqoGxi8De7BF5H4zoB3HvTRU0L8-thkU9i6C4vDVg
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 409 Conflict
date: Sat, 07 Dec 2024 15:52:58 GMT
content-type: text/html; charset=utf-8
x-dns-prefetch-control: off
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
access-control-allow-origin: *
cf-cache-status: DYNAMIC
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8ee5af91ef77b4ee-OSL
X-Firefox-Spdy: h2
66.29.146.44
104.18.28.109
23.36.77.115
35.176.216.82
18.159.105.57