www.lmbahsj2.com/29PD1BG/FGXLG/?source_id=9&sub1=2&sub2=c729363e30794173bbc674bb980d3939
35.201.76.131302 Found 260 B URL User Request GET HTTP/2 www.lmbahsj2.com/29PD1BG/FGXLG/?source_id=9&sub1=2&sub2=c729363e30794173bbc674bb980d3939
IP 35.201.76.131:443
Certificate IssuerStarfield Technologies, Inc.
Subjectlmbahsj2.com
Fingerprint19:8A:1C:6D:15:5F:1E:82:A2:B6:F3:E1:A8:82:E4:C5:EE:3C:46:53
ValidityFri, 28 Apr 2023 21:05:02 GMT - Mon, 13 May 2024 15:10:13 GMT
File type HTML document, ASCII text
Hash d3f55f60bed374bc9da15abea9ca58ec
034874186312f9ba7011d1d5e223a2f11c209d69
0ac4783cd3f8ec91a4bbc8e10b580fa7cae412892c28884a5d12e8d6d660d8eb
GET /29PD1BG/FGXLG/?source_id=9&sub1=2&sub2=c729363e30794173bbc674bb980d3939 HTTP/1.1
Host: www.lmbahsj2.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: nginx
date: Thu, 07 Dec 2023 20:17:37 GMT
content-type: text/html; charset=utf-8
content-length: 260
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
location: https://www.lmbahsj2.com/29PD1BG/8N7X34/?__rpt=0&__po=9&__ptid=e93dbc56371042efa6f8a7af9a076fd0&__rpa=0&__rc=1&sub1=2&sub2=c729363e30794173bbc674bb980d3939&sub3=&sub4=&sub5=&source_id=9&__pcd=9
set-cookie: uniqueClick_FGXLG=cb1142fe-7be1-4ab4-81ec-dd498eea89ca:1701980257; Path=/; Expires=Fri, 08 Dec 2023 20:17:37 GMT; Secure; SameSite=None
vary: Origin
x-eflow-request-id: 0d0ed630-8c5d-4fed-a34b-8bd75a25da0f
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.starfieldtech.com/
192.124.249.24 2.1 kB IP 192.124.249.24:0
Hash 4f63e20e6c85c3420ae4d0084f77231b
32956a1ad35804a56d5263848065be8bc4baeac3
4f6b22b39482307757a9cb879219b6104bb277c1ee487f3a19dfb55bb96e8c0f
POST / HTTP/1.1
Host: ocsp.starfieldtech.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 76
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Thu, 07 Dec 2023 20:17:37 GMT
Content-Type: application/ocsp-response
Content-Length: 2149
Connection: keep-alive
X-Sucuri-ID: 19024
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Thu, 07 Dec 2023 07:56:09 GMT
Expires: Fri, 08 Dec 2023 07:56:09 GMT
ETag: "32956a1ad35804a56d5263848065be8bc4baeac3"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
www.lmbahsj2.com/29PD1BG/8N7X34/?__rpt=0&__po=9&__ptid=e93dbc56371042efa6f8a7af9a076fd0&__rpa=0&__rc=1&sub1=2&sub2=c729363e30794173bbc674bb980d3939&sub3=&sub4=&sub5=&source_id=9&__pcd=9
35.201.76.131302 Found 290 B URL User Request GET HTTP/2 www.lmbahsj2.com/29PD1BG/8N7X34/?__rpt=0&__po=9&__ptid=e93dbc56371042efa6f8a7af9a076fd0&__rpa=0&__rc=1&sub1=2&sub2=c729363e30794173bbc674bb980d3939&sub3=&sub4=&sub5=&source_id=9&__pcd=9
IP 35.201.76.131:443
Certificate IssuerStarfield Technologies, Inc.
Subjectlmbahsj2.com
Fingerprint19:8A:1C:6D:15:5F:1E:82:A2:B6:F3:E1:A8:82:E4:C5:EE:3C:46:53
ValidityFri, 28 Apr 2023 21:05:02 GMT - Mon, 13 May 2024 15:10:13 GMT
File type HTML document, ASCII text
Hash f5f110b77b20d4415935dfc6916f8dad
a9635a951eabe22e0ddfa19ac05d29504f958444
bb8096a157ddc52ec07a89127bec54fca13d5eab93c6caca8f7e9d26613e8bd2
GET /29PD1BG/8N7X34/?__rpt=0&__po=9&__ptid=e93dbc56371042efa6f8a7af9a076fd0&__rpa=0&__rc=1&sub1=2&sub2=c729363e30794173bbc674bb980d3939&sub3=&sub4=&sub5=&source_id=9&__pcd=9 HTTP/1.1
Host: www.lmbahsj2.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: uniqueClick_FGXLG=cb1142fe-7be1-4ab4-81ec-dd498eea89ca:1701980257
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 302 Found
server: nginx
date: Thu, 07 Dec 2023 20:17:37 GMT
content-type: text/html; charset=utf-8
content-length: 290
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
location: https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
set-cookie: uniqueClick_8N7X34=38d6a6af-ed3c-4228-ac5e-0f44358c443f:1701980257; Path=/; Expires=Fri, 08 Dec 2023 20:17:37 GMT; Secure; SameSite=None
transaction_id=5233081346044726978a6c321208c15e; Path=/; Expires=Wed, 06 Mar 2024 20:17:37 GMT; Secure; SameSite=None
vary: Origin
x-eflow-request-id: 310e7ae2-ac0c-46c4-9f2c-ca37c6132890
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.lmbahsj2.com/
35.201.76.131 1.1 kB IP 35.201.76.131:0
Certificate IssuerStarfield Technologies, Inc.
Subjectlmbahsj2.com
Fingerprint19:8A:1C:6D:15:5F:1E:82:A2:B6:F3:E1:A8:82:E4:C5:EE:3C:46:53
ValidityFri, 28 Apr 2023 21:05:02 GMT - Mon, 13 May 2024 15:10:13 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 06c162752eb53f3f96cf521841403e83
aedb7942897df887dd782679853af317743b230d
b5e774a2b98f0517db8c2938b05d51249897d4b853c39f62a5daa5e2f61cddfc
GET / HTTP/1.1
Host: www.lmbahsj2.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
server: nginx
date: Thu, 07 Dec 2023 20:17:39 GMT
content-type: text/html; charset=utf-8
Content-Length: 1093
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
vary: Origin
x-eflow-request-id: 720f8feb-2014-49b0-94c2-88fe500b44e7
Via: 1.1 google
content.quickencompare.com/refily/Refily.png
104.18.28.109200 OK 6.5 kB URL GET HTTP/2 content.quickencompare.com/refily/Refily.png
IP 104.18.28.109:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint8A:4F:F5:9D:CC:0B:84:6F:19:29:53:3F:57:FA:AF:13:47:78:8C:D4
ValidityMon, 20 Feb 2023 00:00:00 GMT - Tue, 20 Feb 2024 23:59:59 GMT
File type PNG image data, 151 x 100, 8-bit/color RGBA, non-interlaced\012- data
Hash df9a33f17dfc149b279fd77bc757293d
74c8a5433300453cd14a64bf3983ffc040465741
ad5d2a35d85361d7a35f97cb98fbffb2e831bd0ada4e603d381f89c636e5f1cd
GET /refily/Refily.png HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:39 GMT
content-type: image/png
content-length: 6523
last-modified: Thu, 23 Nov 2023 14:00:50 GMT
x-amz-server-side-encryption: AES256
etag: "df9a33f17dfc149b279fd77bc757293d"
x-cache: Hit from cloudfront
via: 1.1 a0ed8ab9bdb194ac51725369653b3802.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN54-C1
x-amz-cf-id: CeLf3BZIwBmYT6d3z9J-RSfxpxTO1PUdnftwZTWCDqVVyuPuqbUzAg==
cf-cache-status: HIT
age: 3935
expires: Fri, 08 Dec 2023 00:17:39 GMT
cache-control: public, max-age=14400
accept-ranges: bytes
set-cookie: __cf_bm=sj4X2fe3jme_wr7Ox1z57MdgbIRI.46r.o9il5GEOVM-1701980259-0-AXW18Eu6cLAii8SIGWOvyn9+Gsl1/FrU68lqh/lhmZ2WyRHmvWzEfiGW6/GCQ/aOHD/rV879Rjmcbdoz4XhWoJ8=; path=/; expires=Thu, 07-Dec-23 20:47:39 GMT; domain=.quickencompare.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 831f74105878b505-OSL
X-Firefox-Spdy: h2
content.quickencompare.com/refily/starts.png
104.18.28.109200 OK 551 B URL GET HTTP/2 content.quickencompare.com/refily/starts.png
IP 104.18.28.109:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint8A:4F:F5:9D:CC:0B:84:6F:19:29:53:3F:57:FA:AF:13:47:78:8C:D4
ValidityMon, 20 Feb 2023 00:00:00 GMT - Tue, 20 Feb 2024 23:59:59 GMT
File type PNG image data, 100 x 20, 8-bit/color RGBA, non-interlaced\012- data
Hash 90732fd581b4624530c995d70d3f17a8
6704549936ece70f840129dcca57a5e56ff0cac5
8bda4c30752b1529c25cf00cc9049534a89ad2428ed35c5000038ea81a08be6a
GET /refily/starts.png HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:40 GMT
content-type: image/png
content-length: 551
last-modified: Mon, 27 Nov 2023 15:34:00 GMT
etag: "90732fd581b4624530c995d70d3f17a8"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
via: 1.1 a30105057fbcc8761b99df13f333a9ea.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN54-C1
x-amz-cf-id: ZFTMHOD0pJt0m32mTrG3ujHF450tDLtJrjYRnzXz-ynJ7YDCCPeLwg==
cf-cache-status: REVALIDATED
expires: Fri, 08 Dec 2023 00:17:40 GMT
cache-control: public, max-age=14400
accept-ranges: bytes
set-cookie: __cf_bm=1oDF7Sq3WwH0jvomh.lGUPRVgidvr9hrbU18SOkoprI-1701980260-0-AbKvTADwYYv7KgzO584n18Zu8NhSNF/Q4wHQp2EMgvy14tf4krP9FK6BMF576n9WFB1l+R3BwiGvGjkZdqHcvHM=; path=/; expires=Thu, 07-Dec-23 20:47:40 GMT; domain=.quickencompare.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 831f74105872b505-OSL
X-Firefox-Spdy: h2
content.quickencompare.com/refily/property_progress_percent.png
104.18.28.109200 OK 13 kB URL GET HTTP/2 content.quickencompare.com/refily/property_progress_percent.png
IP 104.18.28.109:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint8A:4F:F5:9D:CC:0B:84:6F:19:29:53:3F:57:FA:AF:13:47:78:8C:D4
ValidityMon, 20 Feb 2023 00:00:00 GMT - Tue, 20 Feb 2024 23:59:59 GMT
File type PNG image data, 320 x 320, 8-bit/color RGBA, non-interlaced\012- data
Hash 1cc128d542f50dda4737c738da7d124d
10675eab6e3f889f04a8947e55199a86091c4204
652047df21d9319ec5c7b89552ecfa361c941cc946efcade45ab211ffe20cddd
GET /refily/property_progress_percent.png HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:40 GMT
content-type: image/png
content-length: 12593
last-modified: Thu, 23 Nov 2023 14:00:51 GMT
x-amz-server-side-encryption: AES256
etag: "1cc128d542f50dda4737c738da7d124d"
x-cache: Hit from cloudfront
via: 1.1 3a4d5aad46ae3a82da414d69565389aa.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN54-C1
x-amz-cf-id: v16Ga_OptQsDVmaO3-wUksmG1-QMYhAtKNI5PdmvqIrI5P6T249ZOQ==
cf-cache-status: REVALIDATED
expires: Fri, 08 Dec 2023 00:17:40 GMT
cache-control: public, max-age=14400
accept-ranges: bytes
set-cookie: __cf_bm=6tFZy.Wtx5ClfuNBt2FtUHRtS8Gvq.gndowoWW_uBjI-1701980260-0-ASNgFnoap3Qq8ssXBUBp3Q9vXfYJrHPfYUnn0tgqDkxFjkROOKAAS05qsDbSum30UOw25LnV2p1RbCArksz9bsI=; path=/; expires=Thu, 07-Dec-23 20:47:40 GMT; domain=.quickencompare.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 831f74105876b505-OSL
X-Firefox-Spdy: h2
content.quickencompare.com/qc/refi-images/ICON-Homeowner.png
104.18.28.109200 OK 10 kB URL GET HTTP/2 content.quickencompare.com/qc/refi-images/ICON-Homeowner.png
IP 104.18.28.109:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint8A:4F:F5:9D:CC:0B:84:6F:19:29:53:3F:57:FA:AF:13:47:78:8C:D4
ValidityMon, 20 Feb 2023 00:00:00 GMT - Tue, 20 Feb 2024 23:59:59 GMT
File type PNG image data, 400 x 401, 8-bit/color RGBA, non-interlaced\012- data
Hash 6b6fdfba73cbc7cad1164a06e7ba471b
394e3ce560675dccc0c8606c2a53cf52c054436d
392696f65e2b746dd55fd3f11ce54c04e0ec51249b06f75bfdf0bbab370cf983
GET /qc/refi-images/ICON-Homeowner.png HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:40 GMT
content-type: image/png
content-length: 10196
last-modified: Fri, 27 Oct 2023 21:07:32 GMT
x-amz-server-side-encryption: AES256
etag: "6b6fdfba73cbc7cad1164a06e7ba471b"
x-cache: Hit from cloudfront
via: 1.1 bccded73b8b9a1d038e5d874cf586402.cloudfront.net (CloudFront)
x-amz-cf-pop: HEL50-C1
x-amz-cf-id: Ui8BTiBrNVsAYgpFtKhN-gBtnp6inGkwHZNdUBfu20dApkEsN4bfJA==
cf-cache-status: REVALIDATED
expires: Fri, 08 Dec 2023 00:17:40 GMT
cache-control: public, max-age=14400
accept-ranges: bytes
set-cookie: __cf_bm=qvFyBujE0oMpqDcsAT.GkAGjfiI7ULEPNmIPmYxWnGg-1701980260-0-AbxaJ1s+OlDjnVWWDfthoPUv3XKwHQpqHDPmwkX2aUHJpF8WHLPR76nUAYAyB39/dtGZJVBGeXexNvvmz7tAMYE=; path=/; expires=Thu, 07-Dec-23 20:47:40 GMT; domain=.quickencompare.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 831f74105874b505-OSL
X-Firefox-Spdy: h2
use.typekit.net/msd8xng.css
23.36.76.186200 OK 680 B URL GET HTTP/2 use.typekit.net/msd8xng.css
IP 23.36.76.186:443
ASN #20940 Akamai International B.V.
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerDigiCert Inc
Subjectuse.typekit.net
Fingerprint42:82:CA:A5:EA:30:8F:60:60:37:2D:24:17:3D:52:62:54:D7:03:5B
ValidityThu, 21 Sep 2023 00:00:00 GMT - Mon, 21 Oct 2024 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (516)
Hash 20203a97a8fb7c1ce2353ecc67ea540d
69dd242bcc9927260938d83c99e59453871ebba4
56af1865c3c674da77191c0c3f9c9a01789e64b2851675d878cb03b5bc57a353
GET /msd8xng.css HTTP/1.1
Host: use.typekit.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: text/css;charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains;
cache-control: private, max-age=600, stale-while-revalidate=604800
timing-allow-origin: *
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
content-length: 680
date: Thu, 07 Dec 2023 20:17:40 GMT
X-Firefox-Spdy: h2
cs-cdn.deviceatlas.com/dacs.js
52.58.191.183200 OK 22 kB URL GET HTTP/2 cs-cdn.deviceatlas.com/dacs.js
IP 52.58.191.183:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerGoDaddy.com, Inc.
Subject*.deviceatlas.com
Fingerprint24:8E:6E:64:30:97:51:E1:A5:07:DB:42:13:5B:15:27:BA:6F:10:C2
ValiditySat, 04 Mar 2023 07:26:21 GMT - Thu, 04 Apr 2024 07:26:21 GMT
File type ASCII text, with very long lines (21816)
Hash 610a4ab640dd5cfa6750aa2623357f51
6f425451f0dffa8b2a418857da82c5d28e2db9e8
fe49fc14b70cfc4f3edbc08e58087ca0f6e948a953c3eaeabdc7e78f512e5a22
GET /dacs.js HTTP/1.1
Host: cs-cdn.deviceatlas.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx/1.17.9
date: Thu, 07 Dec 2023 20:17:40 GMT
content-type: application/javascript
content-length: 21909
last-modified: Thu, 09 Nov 2023 13:50:26 GMT
etag: "610a4ab640dd5cfa6750aa2623357f51"
expires: Thu, 07 Dec 2023 20:17:39 GMT
cache-control: no-cache
x-cache: HIT
accept-ch: DPR,Width,Viewport-Width,Viewport-Height,Device-Memory,RTT,Downlink,ECT,Lang,Sec-CH-DPR,Sec-CH-Width,Sec-CH-Viewport-Width,Sec-CH-Viewport-Height,Sec-CH-Device-Memory,Sec-CH-RTT,Sec-CH-Downlink,Sec-CH-ECT,Sec-CH-Lang,Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Mobile,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Bitness,Sec-CH-UA-WoW64,Sec-CH-Prefers-Reduced-Motion,Sec-CH-Prefers-Reduced-Transparency,Sec-CH-Prefers-Contrast,Sec-CH-Forced-Colors,Sec-CH-Prefers-Color-Scheme,Sec-CH-Prefers-Reduced-Data
accept-ranges: bytes
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
static-lre.refinance.enhancedrefinow.com/vendor.67a1d66e4ad0509192e9.js
104.18.4.105200 OK 197 kB URL GET HTTP/2 static-lre.refinance.enhancedrefinow.com/vendor.67a1d66e4ad0509192e9.js
IP 104.18.4.105:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerCloudflare, Inc.
Subjectenhancedrefinow.com
FingerprintCC:38:9A:93:4C:BD:74:FE:30:18:77:1F:80:24:AF:9E:02:FA:AB:56
ValidityFri, 03 Mar 2023 00:00:00 GMT - Fri, 01 Mar 2024 23:59:59 GMT
File type gzip compressed data, from Unix\012- data
Size 197 kB (197336 bytes)
Hash af6349f4c32ba3c91c24c427bdbacbc0
1563256da36c7ad66418d765be98421750d4d447
d94ea0bc30d8e1ccbba258dcf282ae1db1071795b3caf38903c8b4cb577db1bb
GET /vendor.67a1d66e4ad0509192e9.js HTTP/1.1
Host: static-lre.refinance.enhancedrefinow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=odxt.1w4GnrRAHDI5d6MjZDpKxMv_3ueeQr_DvNMnOg-1701980259-0-AdZNgPq9uFx3VcLR0VrJeCwhxzNQRo4GOeUYOSfkmC4LhXt2YhB9rgKU7qITuQAcE5e3SZCRm5lDeLL1DQ4CPhw=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:39 GMT
content-type: application/javascript
last-modified: Thu, 16 Nov 2023 10:47:04 GMT
x-amz-server-side-encryption: AES256
content-encoding: gzip
etag: W/"0e80b2b8d6f895c55fb9aefe511479b6"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 5a96272b81254403ef5ef083d36ce62a.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN54-C1
x-amz-cf-id: VEL_ZSoR_Lsi5mfBiIbZUYwyJ8gM1-0s3fly79AqbuPeB9p5H3tAVA==
cf-cache-status: HIT
age: 6275
expires: Fri, 08 Dec 2023 00:17:39 GMT
cache-control: public, max-age=14400
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 831f74109c8c0afa-OSL
X-Firefox-Spdy: h2
ocsp.starfieldtech.com/
192.124.249.24 2.1 kB IP 192.124.249.24:0
Hash 4f63e20e6c85c3420ae4d0084f77231b
32956a1ad35804a56d5263848065be8bc4baeac3
4f6b22b39482307757a9cb879219b6104bb277c1ee487f3a19dfb55bb96e8c0f
POST / HTTP/1.1
Host: ocsp.starfieldtech.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 76
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Thu, 07 Dec 2023 20:17:40 GMT
Content-Type: application/ocsp-response
Content-Length: 2149
Connection: keep-alive
X-Sucuri-ID: 19024
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Thu, 07 Dec 2023 07:56:09 GMT
Expires: Fri, 08 Dec 2023 07:56:09 GMT
ETag: "32956a1ad35804a56d5263848065be8bc4baeac3"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
216.58.207.227200 OK 33 kB URL GET HTTP/2 fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
IP 216.58.207.227:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type Web Open Font Format (Version 2), TrueType, length 33092, version 1.0\012- data
Hash 057478083c1d55ea0c2182b24f6dd72f
caf557cd276a76992084efc4c8857b66791a6b7f
bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b
GET /s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://home.refily.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 33092
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 30 Nov 2023 23:21:56 GMT
expires: Fri, 29 Nov 2024 23:21:56 GMT
cache-control: public, max-age=31536000
age: 593745
last-modified: Wed, 13 Sep 2023 22:51:58 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.cdnfonts.com/s/72205/FuturaCyrillicDemi.woff
172.64.133.22200 OK 30 kB URL GET HTTP/3 fonts.cdnfonts.com/s/72205/FuturaCyrillicDemi.woff
IP 172.64.133.22:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerGoogle Trust Services LLC
Subjectcdnfonts.com
FingerprintAF:03:53:24:37:10:1D:B8:DA:B1:DD:17:BE:42:25:62:12:15:20:CC
ValidityThu, 30 Nov 2023 10:28:37 GMT - Wed, 28 Feb 2024 10:28:36 GMT
File type Web Open Font Format, TrueType, length 29868, version 0.0\012- data
Hash af4ca8b77e1cd08670e9fcc5f94116ac
17ba82a9d4613b333f44005440c1b9961110b619
f8d4d73bd5812288b086f0ae4fdc81905e25c4b994cdff5f46b973fc74fdf00e
GET /s/72205/FuturaCyrillicDemi.woff HTTP/1.1
Host: fonts.cdnfonts.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://home.refily.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.cdnfonts.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 07 Dec 2023 20:17:41 GMT
content-type: font/woff
content-length: 29868
last-modified: Sat, 05 Feb 2022 02:00:58 GMT
etag: "74ac-5d73bbd14dee6"
cache-control: max-age=2678400
cf-cache-status: HIT
age: 148186
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HsCVE9i8ippAbQOe%2Fe1wjmxjk8XMYeevt%2FVoTbuSzR5xObLH66meIMw%2BvMhbK3pTkVJuAKWbc6uwhL%2Frq2kZmeO2V0y3doz84Ig9H4Qm4TI9ywHooOEhWxffqxI%2Ba0%2FmVPN8cfU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
access-control-allow-origin: *
server: cloudflare
cf-ray: 831f741b980976d5-LHR
alt-svc: h3=":443"; ma=86400
fonts.cdnfonts.com/s/72205/FuturaCyrillicBook.woff
172.64.133.22200 OK 29 kB URL GET HTTP/3 fonts.cdnfonts.com/s/72205/FuturaCyrillicBook.woff
IP 172.64.133.22:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerGoogle Trust Services LLC
Subjectcdnfonts.com
FingerprintAF:03:53:24:37:10:1D:B8:DA:B1:DD:17:BE:42:25:62:12:15:20:CC
ValidityThu, 30 Nov 2023 10:28:37 GMT - Wed, 28 Feb 2024 10:28:36 GMT
File type Web Open Font Format, TrueType, length 28744, version 0.0\012- data
Hash 97cce36d2c97b9a022976f1396eb0c5a
477d4e994f9f28f5f0542c6129c3d91c7608a901
f6a30969633fb0124959f5af4efd78b6fd5fe36d5901f36b8d34cf4c33a90b6a
GET /s/72205/FuturaCyrillicBook.woff HTTP/1.1
Host: fonts.cdnfonts.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://home.refily.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.cdnfonts.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 07 Dec 2023 20:17:41 GMT
content-type: font/woff
content-length: 28744
last-modified: Sat, 05 Feb 2022 02:00:58 GMT
etag: "7048-5d73bbd14dee6"
cache-control: max-age=2678400
cf-cache-status: HIT
age: 148186
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6SBWBounU8HQWJwsaAa%2BRc3dAEi0aGgYRONWTB3F3x2KFXshXGvJq0aD98dpdhMDadugIdE9%2FO6bEe%2FI4nX9S7F4tNR8ug44iBYs3LZd%2BRdSM9iy1ko%2F1hmPz9ANyNaS1ij0RaA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
access-control-allow-origin: *
server: cloudflare
cf-ray: 831f741b980c76d5-LHR
alt-svc: h3=":443"; ma=86400
fonts.cdnfonts.com/s/72205/FuturaCyrillicHeavy.woff
172.64.133.22200 OK 29 kB URL GET HTTP/3 fonts.cdnfonts.com/s/72205/FuturaCyrillicHeavy.woff
IP 172.64.133.22:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerGoogle Trust Services LLC
Subjectcdnfonts.com
FingerprintAF:03:53:24:37:10:1D:B8:DA:B1:DD:17:BE:42:25:62:12:15:20:CC
ValidityThu, 30 Nov 2023 10:28:37 GMT - Wed, 28 Feb 2024 10:28:36 GMT
File type Web Open Font Format, TrueType, length 28872, version 0.0\012- data
Hash 9769913239251188330d1e78e233433f
3516c88f276c67a2956e9d8d41916fbdade98df1
4a13903693073d8eefd2bd5bef99029e65013e049aed683d01b65de1930eb58f
GET /s/72205/FuturaCyrillicHeavy.woff HTTP/1.1
Host: fonts.cdnfonts.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://home.refily.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.cdnfonts.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 07 Dec 2023 20:17:41 GMT
content-type: font/woff
content-length: 28872
last-modified: Sat, 05 Feb 2022 02:00:58 GMT
etag: "70c8-5d73bbd14e2ce"
cache-control: max-age=2678400
cf-cache-status: HIT
age: 148186
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K3Vha5LX5rkF0sRW3rM3FEU%2BVmR0dVcSpE%2F6lL9G%2FfkCt3eueVBQtx9awTt8IRa8h66i5YI%2FagmWH1ZhfnCdtaPBGsYXH0laAtko%2FQFzRrNW%2BPSBJIkHQ0A%2BQ6blGfo3VpdKW%2Bw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
access-control-allow-origin: *
server: cloudflare
cf-ray: 831f741b980e76d5-LHR
alt-svc: h3=":443"; ma=86400
fonts.cdnfonts.com/s/72205/FuturaCyrillicBold.woff
172.64.133.22200 OK 30 kB URL GET HTTP/3 fonts.cdnfonts.com/s/72205/FuturaCyrillicBold.woff
IP 172.64.133.22:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerGoogle Trust Services LLC
Subjectcdnfonts.com
FingerprintAF:03:53:24:37:10:1D:B8:DA:B1:DD:17:BE:42:25:62:12:15:20:CC
ValidityThu, 30 Nov 2023 10:28:37 GMT - Wed, 28 Feb 2024 10:28:36 GMT
File type Web Open Font Format, TrueType, length 29480, version 0.0\012- data
Hash dbba4f772f875d0f2076cda9feffe2a5
75a35cd7a0ccae0f9083c5808eacbd6cd5960ed0
9d490e0db498039d18b0e482fab817ffea3c14e95dcc21fd4ff1a03b5c265038
GET /s/72205/FuturaCyrillicBold.woff HTTP/1.1
Host: fonts.cdnfonts.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://home.refily.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.cdnfonts.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 07 Dec 2023 20:17:41 GMT
content-type: font/woff
content-length: 29480
last-modified: Sat, 05 Feb 2022 02:00:58 GMT
etag: "7328-5d73bbd14dee6"
cache-control: max-age=2678400
cf-cache-status: HIT
age: 148186
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Bli80hv%2Fn7LG4M1THtHX8PUNBnmILm9fv5XLs%2BvMCY8tB2kVm8f%2B81ArT%2FQ5ppTDDyrO%2FHLGd%2FGgpgoORpBOdBJtLGpPI5xTRYng%2FsmnXDOeYquzginCKk5wT60TY4eVOWF9zgs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
access-control-allow-origin: *
server: cloudflare
cf-ray: 831f741b980f76d5-LHR
alt-svc: h3=":443"; ma=86400
www.redditstatic.com/ads/pixel.js
151.101.193.140200 OK 7.4 kB URL GET HTTP/2 www.redditstatic.com/ads/pixel.js
IP 151.101.193.140:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerDigiCert Inc
Subjectwww.redditstatic.com
Fingerprint5B:10:93:15:D0:06:B8:27:DD:C8:15:7C:8A:49:4B:AD:06:D3:8E:15
ValidityFri, 25 Aug 2023 00:00:00 GMT - Wed, 21 Feb 2024 23:59:59 GMT
File type ASCII text, with very long lines (23776)
Hash 78b6c68984a6ce5b3fcac1c6a9cad00c
02e1d366a17506cea8adfe5a15949aca89719a02
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f
GET /ads/pixel.js HTTP/1.1
Host: www.redditstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
last-modified: Thu, 15 Jun 2023 20:49:59 GMT
etag: "4a205643a240cb95fa82289d62b5af7e"
x-amz-server-side-encryption: AES256
cache-control: public, max-age=60
content-encoding: gzip
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Thu, 07 Dec 2023 20:17:42 GMT
vary: Accept-Encoding,Origin
server: snooserv
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
content-length: 7409
X-Firefox-Spdy: h2
ocsp.starfieldtech.com/
192.124.249.24 2.1 kB IP 192.124.249.24:0
Hash 4f63e20e6c85c3420ae4d0084f77231b
32956a1ad35804a56d5263848065be8bc4baeac3
4f6b22b39482307757a9cb879219b6104bb277c1ee487f3a19dfb55bb96e8c0f
POST / HTTP/1.1
Host: ocsp.starfieldtech.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 76
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Thu, 07 Dec 2023 20:17:41 GMT
Content-Type: application/ocsp-response
Content-Length: 2149
Connection: keep-alive
X-Sucuri-ID: 19024
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Thu, 07 Dec 2023 07:56:09 GMT
Expires: Fri, 08 Dec 2023 07:56:09 GMT
ETag: "32956a1ad35804a56d5263848065be8bc4baeac3"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
home.refily.com/cdn-cgi/rum?
104.18.8.131204 No Content 0 B URL POST HTTP/2 home.refily.com/cdn-cgi/rum?
IP 104.18.8.131:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerCloudflare, Inc.
Subjectrefily.com
Fingerprint4E:B0:EF:C2:BE:0A:7A:01:DD:D1:07:A8:B3:6D:E0:A6:3F:84:85:37
ValidityWed, 11 Oct 2023 00:00:00 GMT - Thu, 10 Oct 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /cdn-cgi/rum? HTTP/1.1
Host: home.refily.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
content-type: application/json
Content-Length: 6437
Origin: https://home.refily.com
DNT: 1
Connection: keep-alive
Cookie: visitorId=1ee7aefd-ac9a-49df-b071-217ebbc16294; sourceId=affl_everflow_lre-rfl_155_809; connect.sid=s%3AKWDtx8al4JWCHA8ZLisSFLssiYjFBL1O.qokiTHZPJuZ78uT1iRGVJIysk8HwQdjDwpP0xID1JtM; __cf_bm=QiHNjRTOiBLb8xkd7oUUY_kBrOV34ayzPVRIgdx3ZcU-1701980259-0-ATqkR3DsMblRyZ41ReHny2boEjHY+qF98be3Ux4n2+RNhOdsl7hIRDTpoc9/F3QZb7nYzx9NQlXhChdQRdQvIVA=; DAPROPS="bS:0|scsVersion:2.4.5|bcookieSupport:1|bcss.animations:1|bcss.columns:1|bcss.transforms:1|bcss.transitions:1|sdeviceAspectRatio:1280/1024|sdevicePixelRatio:1|idisplayColorDepth:24|bflashCapable:0|bhtml.audio.ogg:1|bhtml.audio.mp3:1|bhtml.audio.wav:1|bhtml.audio.m4a:1|bhtml.canvas:1|bhtml.inlinesvg:1|bhtml.svg:1|bhtml.video.ap4x:0|bhtml.video.av1:1|bhtml.video.ogg:1|bhtml.video.h264:1|bhtml.video.webm:1|bjs.accessDom:1|bjs.applicationCache:0|bjs.deviceMotion:1|bjs.geoLocation:1|bjs.indexedDB:1|bjs.json:1|bjs.localStorage:1|bjs.modifyCss:1|bjs.modifyDom:1|bjs.querySelector:1|bjs.sessionStorage:1|bjs.supportBasicJavaScript:1|bjs.supportConsoleLog:1|bjs.supportEventListener:1|bjs.supportEvents:1|bjs.webGl:1|bjs.webSockets:1|bjs.webSqlDatabase:0|bjs.webWorkers:1|bjs.xhr:1|srendererRef:02919241789|sscreenWidthHeight:1280/1024|stimeZone:UTC|buserMedia:1|saudioRef:25450949bE:0"; _dd_s=rum=1&id=f142091e-3d82-4ac0-906f-2305e0ee4496&created=1701980268269&expire=1701981168269; _rdt_uuid=1701980268553.79917a77-8b84-400d-bc4d-9a69f5d2dd83
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 204 No Content
date: Thu, 07 Dec 2023 20:17:42 GMT
access-control-allow-origin: https://home.refily.com
access-control-allow-methods: POST,OPTIONS
access-control-max-age: 86400
vary: Origin
access-control-allow-credentials: true
server: cloudflare
cf-ray: 831f741dfb3a712d-OSL
x-frame-options: DENY
x-content-type-options: nosniff
X-Firefox-Spdy: h2
cdn-refinance.enhancedrefinow.com/pixel-616e834028d94a75ecaf.js
104.18.4.105200 OK 94 kB URL GET HTTP/2 cdn-refinance.enhancedrefinow.com/pixel-616e834028d94a75ecaf.js
IP 104.18.4.105:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerCloudflare, Inc.
Subjectenhancedrefinow.com
FingerprintCC:38:9A:93:4C:BD:74:FE:30:18:77:1F:80:24:AF:9E:02:FA:AB:56
ValidityFri, 03 Mar 2023 00:00:00 GMT - Fri, 01 Mar 2024 23:59:59 GMT
File type gzip compressed data, from Unix\012- data
Hash c1e9209f67694598669a63a2fee67bba
7df5b242ce792d5ffc002e04301a6855f120980d
e23f0afee010ae5625ced764446c714a87965cc1696cd91b4a46a7dfbf191ee9
GET /pixel-616e834028d94a75ecaf.js HTTP/1.1
Host: cdn-refinance.enhancedrefinow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:41 GMT
content-type: application/javascript; charset=UTF-8
x-dns-prefetch-control: off
strict-transport-security: max-age=2592000
x-download-options: noopen
referrer-policy: same-origin
cache-control: public, max-age=14400
last-modified: Tue, 05 Dec 2023 23:27:35 GMT
etag: W/"258d6-18c3c4eef05"
cf-cache-status: MISS
expires: Fri, 08 Dec 2023 00:17:40 GMT
set-cookie: __cf_bm=Tqy3A9jvf1Uyfwl0ZxkfMw.RfucWRi_y2awHagoOz0A-1701980260-0-Aaw/va6K9HXNXhUI0JTsD2+jCnN+FEuX2Lwyq6lUZh/uMMH4CYZ9PeUhp6hddTGpOBarEL2Hm17G63M6iUzjq0w=; path=/; expires=Thu, 07-Dec-23 20:47:40 GMT; domain=.enhancedrefinow.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 831f74103c250afa-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
www.googletagmanager.com/gtag/js?id=AW-320492720
142.250.74.168200 OK 76 kB URL GET HTTP/2 www.googletagmanager.com/gtag/js?id=AW-320492720
IP 142.250.74.168:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint37:42:10:B7:89:70:45:51:80:81:66:CE:95:21:72:5D:46:0B:E2:34
ValidityMon, 23 Oct 2023 11:18:19 GMT - Mon, 15 Jan 2024 11:18:18 GMT
File type ASCII text, with very long lines (4179)
Hash 1b8d42fb4add5133e7807ad29fb4afb9
a6cfd7032dccdec02c18ab83161ee5efabd67a13
f80e3d1554eff6fde8d495be0a9bb1acbe7133466c9cbd765109892bf6f92f96
GET /gtag/js?id=AW-320492720 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Thu, 07 Dec 2023 20:17:42 GMT
expires: Thu, 07 Dec 2023 20:17:42 GMT
cache-control: private, max-age=900
last-modified: Thu, 07 Dec 2023 18:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 75546
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.googletagmanager.com/gtag/js?id=AW-11411986938
142.250.74.168200 OK 81 kB URL GET HTTP/2 www.googletagmanager.com/gtag/js?id=AW-11411986938
IP 142.250.74.168:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint37:42:10:B7:89:70:45:51:80:81:66:CE:95:21:72:5D:46:0B:E2:34
ValidityMon, 23 Oct 2023 11:18:19 GMT - Mon, 15 Jan 2024 11:18:18 GMT
File type ASCII text, with very long lines (4179)
Hash 75fe4ab5583307ce219357da1966ce92
9d528f898de53044111aa89d8c9c9470a59acbc7
78b72944cd15a92622efbd6436531fc3f2002f858f7c88f5a8fa0318bd7ec69a
GET /gtag/js?id=AW-11411986938 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Thu, 07 Dec 2023 20:17:42 GMT
expires: Thu, 07 Dec 2023 20:17:42 GMT
cache-control: private, max-age=900
last-modified: Thu, 07 Dec 2023 18:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 80988
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.googletagmanager.com/gtag/js?id=AW-10865694633
142.250.74.168200 OK 75 kB URL GET HTTP/2 www.googletagmanager.com/gtag/js?id=AW-10865694633
IP 142.250.74.168:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint37:42:10:B7:89:70:45:51:80:81:66:CE:95:21:72:5D:46:0B:E2:34
ValidityMon, 23 Oct 2023 11:18:19 GMT - Mon, 15 Jan 2024 11:18:18 GMT
File type ASCII text, with very long lines (4179)
Hash 9e20880a1929cf4ca04ae0b0507c57f5
afd28925be714bf4e0e030b761227e0df4978d88
78c3e58b669b2b966b5c08217adc8e900834854050e2f431c5041a0398a20b60
GET /gtag/js?id=AW-10865694633 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Thu, 07 Dec 2023 20:17:42 GMT
expires: Thu, 07 Dec 2023 20:17:42 GMT
cache-control: private, max-age=900
last-modified: Thu, 07 Dec 2023 18:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 75384
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.lmbahsj2.com/scripts/sdk/everflow.js
35.201.76.131200 OK 95 kB URL GET HTTP/2 www.lmbahsj2.com/scripts/sdk/everflow.js
IP 35.201.76.131:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerStarfield Technologies, Inc.
Subjectlmbahsj2.com
Fingerprint19:8A:1C:6D:15:5F:1E:82:A2:B6:F3:E1:A8:82:E4:C5:EE:3C:46:53
ValidityFri, 28 Apr 2023 21:05:02 GMT - Mon, 13 May 2024 15:10:13 GMT
File type gzip compressed data, from Unix\012- data
Hash 02ae45890893901bf57c1ef4f1a42b7c
66db44accb9f8b37b64e55c1ea31a3141841a0c7
e80f35d1d092e3bd58873eab11f87dc6a8903ff627160e8f11e67888a59a63f3
GET /scripts/sdk/everflow.js HTTP/1.1
Host: www.lmbahsj2.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Thu, 07 Dec 2023 20:17:42 GMT
content-type: text/javascript
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
cache-control: max-age=14400
vary: Origin
x-eflow-request-id: 6dc61060-44b9-46cb-9ddf-51cf89d0b831
content-encoding: gzip
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.datadoghq-browser-agent.com/datadog-rum-v3.js
54.230.111.221200 OK 38 kB URL GET HTTP/2 www.datadoghq-browser-agent.com/datadog-rum-v3.js
IP 54.230.111.221:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerDigiCert Inc
Subject*.datadoghq-browser-agent.com
FingerprintFC:83:1B:FF:12:98:28:60:E5:F1:DC:73:0D:BC:6F:81:22:A7:F1:6D
ValiditySat, 14 Jan 2023 00:00:00 GMT - Tue, 16 Jan 2024 23:59:59 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Hash 647fda9a4d3d74344732d76cf1fff47c
01720d421ce3373f1a1958a1d85edfae5ab5f442
4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b
GET /datadog-rum-v3.js HTTP/1.1
Host: www.datadoghq-browser-agent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript
last-modified: Mon, 03 Jan 2022 16:36:14 GMT
server: AmazonS3
content-encoding: br
date: Thu, 07 Dec 2023 20:17:15 GMT
cache-control: max-age=14400, s-maxage=60
etag: W/"647fda9a4d3d74344732d76cf1fff47c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 60929bddfcfe8b3a510a9502ad6d8742.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: O98Rr8ZRDvnFFost5jElCupzXrUp63P4nLn6d_l5pQ_YpGHRCQZq0Q==
age: 33
timing-allow-origin: *
X-Firefox-Spdy: h2
a44325.actonservice.com/cdnr/forpci43/acton/bn/tracker/44325
207.189.124.43200 4.9 kB URL GET HTTP/1.1 a44325.actonservice.com/cdnr/forpci43/acton/bn/tracker/44325
IP 207.189.124.43:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerSectigo Limited
Subject*.actonservice.com
FingerprintEE:F0:2F:E8:AA:FB:08:13:5C:9C:84:FB:04:6E:60:5B:4D:EB:B0:2E
ValidityWed, 31 May 2023 00:00:00 GMT - Sat, 29 Jun 2024 23:59:59 GMT
Hash 5aa36241568b3d0bbac6feaed933d276
fb9a8089213b5c992a2fc18fb5ccbcbdf37eec51
38b328a3f1aa1ccc780b2110f44690efc345a0e8c52b2d9e8e8b9b471e3c470a
GET /cdnr/forpci43/acton/bn/tracker/44325 HTTP/1.1
Host: a44325.actonservice.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
P3P: CP="Act-On does not have a P3P policy. Learn why here: https://act-on.com/p3p-policy/"
Set-Cookie: wp44325="XXWVYDDDDDDZBIBCLAA-BZHU-XJLL-BLBW-CJHUZVLBHBBYDgNssDDD"; Path=/; Max-Age=31536000; Domain=.actonservice.com; SameSite=None; Secure; Version=1
Content-Type: application/javascript;charset=utf-8
Content-Length: 4850
Date: Thu, 07 Dec 2023 20:17:42 GMT
X-Cnection: close
Strict-Transport-Security: max-age=16070400
home.refily.com/app-configuration/?path=/lendingLeadGen/fraud/anura/enabled
104.18.8.131200 OK 32 B URL GET HTTP/2 home.refily.com/app-configuration/?path=/lendingLeadGen/fraud/anura/enabled
IP 104.18.8.131:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerCloudflare, Inc.
Subjectrefily.com
Fingerprint4E:B0:EF:C2:BE:0A:7A:01:DD:D1:07:A8:B3:6D:E0:A6:3F:84:85:37
ValidityWed, 11 Oct 2023 00:00:00 GMT - Thu, 10 Oct 2024 23:59:59 GMT
File type gzip compressed data, from Unix\012- data
Hash 484d0d116488ddc7e542b59613076ed1
f136737663a58140490e962e52e38c3459ff2147
40da93ec6a4bb20bd4eb18c26baf9ae1fbde643bd0dff8db782fbafffa228e19
GET /app-configuration/?path=/lendingLeadGen/fraud/anura/enabled HTTP/1.1
Host: home.refily.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
DNT: 1
Connection: keep-alive
Cookie: visitorId=1ee7aefd-ac9a-49df-b071-217ebbc16294; sourceId=affl_everflow_lre-rfl_155_809; connect.sid=s%3AKWDtx8al4JWCHA8ZLisSFLssiYjFBL1O.qokiTHZPJuZ78uT1iRGVJIysk8HwQdjDwpP0xID1JtM; __cf_bm=QiHNjRTOiBLb8xkd7oUUY_kBrOV34ayzPVRIgdx3ZcU-1701980259-0-ATqkR3DsMblRyZ41ReHny2boEjHY+qF98be3Ux4n2+RNhOdsl7hIRDTpoc9/F3QZb7nYzx9NQlXhChdQRdQvIVA=; DAPROPS="bS:0|scsVersion:2.4.5|bcookieSupport:1|bcss.animations:1|bcss.columns:1|bcss.transforms:1|bcss.transitions:1|sdeviceAspectRatio:1280/1024|sdevicePixelRatio:1|idisplayColorDepth:24|bflashCapable:0|bhtml.audio.ogg:1|bhtml.audio.mp3:1|bhtml.audio.wav:1|bhtml.audio.m4a:1|bhtml.canvas:1|bhtml.inlinesvg:1|bhtml.svg:1|bhtml.video.ap4x:0|bhtml.video.av1:1|bhtml.video.ogg:1|bhtml.video.h264:1|bhtml.video.webm:1|bjs.accessDom:1|bjs.applicationCache:0|bjs.deviceMotion:1|bjs.geoLocation:1|bjs.indexedDB:1|bjs.json:1|bjs.localStorage:1|bjs.modifyCss:1|bjs.modifyDom:1|bjs.querySelector:1|bjs.sessionStorage:1|bjs.supportBasicJavaScript:1|bjs.supportConsoleLog:1|bjs.supportEventListener:1|bjs.supportEvents:1|bjs.webGl:1|bjs.webSockets:1|bjs.webSqlDatabase:0|bjs.webWorkers:1|bjs.xhr:1|srendererRef:02919241789|sscreenWidthHeight:1280/1024|stimeZone:UTC|buserMedia:1bE:0"
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:42 GMT
content-type: text/html; charset=utf-8
x-dns-prefetch-control: off
strict-transport-security: max-age=2592000
x-download-options: noopen
referrer-policy: same-origin
cache-control: no-store
cf-cache-status: DYNAMIC
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 831f741af854712d-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
pix.revjet.com/track/pd3521?__noscript=false&__cbf=revjet.callbacks.cb1701980268946&location=https%3A%2F%2Fhome.refily.com%2F%3Fmoid%3D314646%26sourceid%3Daffl_everflow_lre-rfl_155_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D5233081346044726978a6c321208c15e%26sid%3D155%26cmpid%3D155%26crtid%3D%26oid%3D155%26affid%3D809%26_ef_transaction_id%3D5233081346044726978a6c321208c15e&referrer=&creditProfile=&firstMortgageBalance=&firstMortgageInterestRate=&hasFHALoan=&homeValue=&loanToValue=&propertyCity=&propertyDescription=&propertyState=&propertyZipCode=&rateType=&typeOfLoan=&loanRefiPurpose=
46.4.76.120200 OK 46 B URL GET HTTP/2 pix.revjet.com/track/pd3521?__noscript=false&__cbf=revjet.callbacks.cb1701980268946&location=https%3A%2F%2Fhome.refily.com%2F%3Fmoid%3D314646%26sourceid%3Daffl_everflow_lre-rfl_155_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D5233081346044726978a6c321208c15e%26sid%3D155%26cmpid%3D155%26crtid%3D%26oid%3D155%26affid%3D809%26_ef_transaction_id%3D5233081346044726978a6c321208c15e&referrer=&creditProfile=&firstMortgageBalance=&firstMortgageInterestRate=&hasFHALoan=&homeValue=&loanToValue=&propertyCity=&propertyDescription=&propertyState=&propertyZipCode=&rateType=&typeOfLoan=&loanRefiPurpose=
IP 46.4.76.120:443
ASN #24940 Hetzner Online GmbH
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerSectigo Limited
Subject*.revjet.com
Fingerprint03:20:65:55:CD:08:1C:F0:68:28:E7:A4:5F:21:09:76:87:BF:9D:81
ValidityMon, 20 Mar 2023 00:00:00 GMT - Thu, 11 Apr 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash c8beb64b6e1ca9fc068eb8e7ddbebd1e
54a8870eb2f5adc7f36148dfe2f8267005d0ebdc
3265252a5bb9d3b6f5ffda223e488bb98e29c09dc0dc79ad699e1bc8632d9846
GET /track/pd3521?__noscript=false&__cbf=revjet.callbacks.cb1701980268946&location=https%3A%2F%2Fhome.refily.com%2F%3Fmoid%3D314646%26sourceid%3Daffl_everflow_lre-rfl_155_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D5233081346044726978a6c321208c15e%26sid%3D155%26cmpid%3D155%26crtid%3D%26oid%3D155%26affid%3D809%26_ef_transaction_id%3D5233081346044726978a6c321208c15e&referrer=&creditProfile=&firstMortgageBalance=&firstMortgageInterestRate=&hasFHALoan=&homeValue=&loanToValue=&propertyCity=&propertyDescription=&propertyState=&propertyZipCode=&rateType=&typeOfLoan=&loanRefiPurpose= HTTP/1.1
Host: pix.revjet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://home.refily.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:42 GMT
content-type: text/javascript
content-length: 46
set-cookie: trx=6529647731993858230; Max-Age=63072000; Expires=Sat, 06 Dec 2025 20:17:42 GMT; Path=/; Domain=.revjet.com; Secure; SameSite=None
X-Firefox-Spdy: h2
a44325.actonservice.com/acton/bn/44325?target=https%3A%2F%2Fhome.refily.com%2F%3Fmoid%3D314646%26sourceid%3Daffl_everflow_lre-rfl_155_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D5233081346044726978a6c321208c15e%26sid%3D155%26cmpid%3D155%26crtid%3D%26oid%3D155%26affid%3D809%26_ef_transaction_id%3D5233081346044726978a6c321208c15e&ref=&v=2&ts=1701980268473&nc=0
207.189.124.43200 43 B URL GET HTTP/1.1 a44325.actonservice.com/acton/bn/44325?target=https%3A%2F%2Fhome.refily.com%2F%3Fmoid%3D314646%26sourceid%3Daffl_everflow_lre-rfl_155_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D5233081346044726978a6c321208c15e%26sid%3D155%26cmpid%3D155%26crtid%3D%26oid%3D155%26affid%3D809%26_ef_transaction_id%3D5233081346044726978a6c321208c15e&ref=&v=2&ts=1701980268473&nc=0
IP 207.189.124.43:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerSectigo Limited
Subject*.actonservice.com
FingerprintEE:F0:2F:E8:AA:FB:08:13:5C:9C:84:FB:04:6E:60:5B:4D:EB:B0:2E
ValidityWed, 31 May 2023 00:00:00 GMT - Sat, 29 Jun 2024 23:59:59 GMT
File type GIF image data, version 89a, 1 x 1\012- data
Hash f7f26805de1a1f270e665bf7873d7e19
c32085898c6e36d361d4b8017087de90e1b8465c
2188414d64d2930eb54f4731b6eb9a931358ba625d1cd7535a889409218609d2
GET /acton/bn/44325?target=https%3A%2F%2Fhome.refily.com%2F%3Fmoid%3D314646%26sourceid%3Daffl_everflow_lre-rfl_155_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D5233081346044726978a6c321208c15e%26sid%3D155%26cmpid%3D155%26crtid%3D%26oid%3D155%26affid%3D809%26_ef_transaction_id%3D5233081346044726978a6c321208c15e&ref=&v=2&ts=1701980268473&nc=0 HTTP/1.1
Host: a44325.actonservice.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: wp44325="XXWVYDDDDDDZBIBCLAA-BZHU-XJLL-BLBW-CJHUZVLBHBBYDgNssDDD"
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Set-Cookie: wp44325="XXWVYDDDDDDZBIBCLAA-BZHU-XJLL-BLBW-CJHUZVLBHBBYDYVWHWYLI-HZIT-XYTW-CHLT-WHHLUXIHVCXZDkLMpsR_JhtDD"; Path=/; Max-Age=31536000; Domain=.actonservice.com; SameSite=None; Secure; Version=1
P3P: CP="Act-On does not have a P3P policy. Learn why here: https://act-on.com/p3p-policy/"
Content-Type: image/gif
Content-Length: 43
Date: Thu, 07 Dec 2023 20:17:41 GMT
X-Cnection: close
Strict-Transport-Security: max-age=16070400
Vary: Accept-Encoding
bat.bing.com/bat.js
13.107.21.200200 OK 13 kB IP 13.107.21.200:443
ASN #8068 MICROSOFT-CORP-MSN-AS-BLOCK
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerMicrosoft Corporation
Subjectwww.bing.com
FingerprintA5:EC:34:1F:AB:B3:69:71:54:88:69:BA:64:CC:E2:9B:32:B6:65:CD
ValidityTue, 24 Oct 2023 07:42:22 GMT - Sun, 21 Apr 2024 07:42:22 GMT
File type Unicode text, UTF-8 text, with very long lines (46103), with no line terminators
Hash 7f75f159026f3a2c8cccda487b43157b
021cf5c854db063cd79bf0394c24eb994e095640
5e319852607809336b2534ffeb96f6933f26994dd040f535302c84f59cc0a214
GET /bat.js HTTP/1.1
Host: bat.bing.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
cache-control: private,max-age=1800
content-length: 13175
content-type: application/javascript
content-encoding: gzip
last-modified: Fri, 10 Nov 2023 20:09:55 GMT
accept-ranges: bytes
etag: "80abcdf1114da1:0"
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 777D269EFCE14E40A24B6CA72C421335 Ref B: OSL30EDGE0108 Ref C: 2023-12-07T20:17:42Z
date: Thu, 07 Dec 2023 20:17:42 GMT
X-Firefox-Spdy: h2
www.google.com/pagead/1p-conversion/320492720/?random=1701980268796&cv=11&fst=1701980268796&bg=ffffff&guid=ON&async=1>m=45be3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1280&u_h=1024&url=https%3A%2F%2Fhome.refily.com%2F%3Fmoid%3D314646%26sourceid%3Daffl_everflow_lre-rfl_155_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D5233081346044726978a6c321208c15e%26sid%3D155%26cmpid%3D155%26crtid%3D%26oid%3D155%26affid%3D809%26_ef_transaction_id%3D5233081346044726978a6c321208c15e&label=xSwBCJum9PsCELCp6ZgB&hn=www.google.com&frm=0&tiba=Refily>m_ee=1&auid=509716374.1701980269&data=event%3Dconversion&gcp=1&sscte=1&ct_cookie_present=1&rfmt=3&fmt=4
142.250.74.100302 Found 63 B URL GET HTTP/2 www.google.com/pagead/1p-conversion/320492720/?random=1701980268796&cv=11&fst=1701980268796&bg=ffffff&guid=ON&async=1>m=45be3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1280&u_h=1024&url=https%3A%2F%2Fhome.refily.com%2F%3Fmoid%3D314646%26sourceid%3Daffl_everflow_lre-rfl_155_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D5233081346044726978a6c321208c15e%26sid%3D155%26cmpid%3D155%26crtid%3D%26oid%3D155%26affid%3D809%26_ef_transaction_id%3D5233081346044726978a6c321208c15e&label=xSwBCJum9PsCELCp6ZgB&hn=www.google.com&frm=0&tiba=Refily>m_ee=1&auid=509716374.1701980269&data=event%3Dconversion&gcp=1&sscte=1&ct_cookie_present=1&rfmt=3&fmt=4
IP 142.250.74.100:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerGoogle Trust Services LLC
Subjectwww.google.com
FingerprintB0:8E:97:10:7E:30:90:F6:42:A1:32:63:5C:78:27:D3:A8:F1:05:D1
ValidityMon, 23 Oct 2023 11:24:57 GMT - Mon, 15 Jan 2024 11:24:56 GMT
File type ASCII text, with no line terminators
Hash ad8b6f08655797587cdec719a94efe59
182adf5a140796f81e930649d05654dbf22fd5b7
77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6
GET /pagead/1p-conversion/320492720/?random=1701980268796&cv=11&fst=1701980268796&bg=ffffff&guid=ON&async=1>m=45be3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1280&u_h=1024&url=https%3A%2F%2Fhome.refily.com%2F%3Fmoid%3D314646%26sourceid%3Daffl_everflow_lre-rfl_155_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D5233081346044726978a6c321208c15e%26sid%3D155%26cmpid%3D155%26crtid%3D%26oid%3D155%26affid%3D809%26_ef_transaction_id%3D5233081346044726978a6c321208c15e&label=xSwBCJum9PsCELCp6ZgB&hn=www.google.com&frm=0&tiba=Refily>m_ee=1&auid=509716374.1701980269&data=event%3Dconversion&gcp=1&sscte=1&ct_cookie_present=1&rfmt=3&fmt=4 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 07 Dec 2023 20:17:42 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
location: https://www.google.no/pagead/1p-conversion/320492720/?random=1701980268796&cv=11&fst=1701980268796&bg=ffffff&guid=ON&async=1>m=45be3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1280&u_h=1024&url=https%3A%2F%2Fhome.refily.com%2F%3Fmoid%3D314646%26sourceid%3Daffl_everflow_lre-rfl_155_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D5233081346044726978a6c321208c15e%26sid%3D155%26cmpid%3D155%26crtid%3D%26oid%3D155%26affid%3D809%26_ef_transaction_id%3D5233081346044726978a6c321208c15e&label=xSwBCJum9PsCELCp6ZgB&hn=www.google.com&frm=0&tiba=Refily>m_ee=1&auid=509716374.1701980269&data=event%3Dconversion&gcp=1&sscte=1&ct_cookie_present=1&rfmt=3&fmt=4&ipr=y
content-type: text/javascript; charset=UTF-8
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: gzip
server: cafe
content-length: 63
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.cdnfonts.com/s/72205/FuturaCyrillicDemi.woff
172.64.133.22200 OK 30 kB URL GET HTTP/3 fonts.cdnfonts.com/s/72205/FuturaCyrillicDemi.woff
IP 172.64.133.22:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerGoogle Trust Services LLC
Subjectcdnfonts.com
FingerprintAF:03:53:24:37:10:1D:B8:DA:B1:DD:17:BE:42:25:62:12:15:20:CC
ValidityThu, 30 Nov 2023 10:28:37 GMT - Wed, 28 Feb 2024 10:28:36 GMT
File type Web Open Font Format, TrueType, length 29868, version 0.0\012- data
Hash af4ca8b77e1cd08670e9fcc5f94116ac
17ba82a9d4613b333f44005440c1b9961110b619
f8d4d73bd5812288b086f0ae4fdc81905e25c4b994cdff5f46b973fc74fdf00e
GET /s/72205/FuturaCyrillicDemi.woff HTTP/1.1
Host: fonts.cdnfonts.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://home.refily.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.cdnfonts.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 07 Dec 2023 20:17:42 GMT
content-type: font/woff
content-length: 29868
last-modified: Sat, 05 Feb 2022 02:00:58 GMT
etag: "74ac-5d73bbd14dee6"
cache-control: max-age=2678400
cf-cache-status: HIT
age: 148187
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ti%2F8VlGm9oDH%2BZwaWqh3jewjYWCJWoIsGaAn9TiDBks74rGfqeNwIuvbqX0McuVMJzHsMHu62v7%2B6rUcgNeiKqfQdeaGiHtNs5tY5lpeNI0IwLmXIllBoGRxtWZcGTKHSbs%2BXgM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
access-control-allow-origin: *
server: cloudflare
cf-ray: 831f7423993876d5-LHR
alt-svc: h3=":443"; ma=86400
fonts.cdnfonts.com/s/72205/FuturaCyrillicBook.woff
172.64.133.22200 OK 29 kB URL GET HTTP/3 fonts.cdnfonts.com/s/72205/FuturaCyrillicBook.woff
IP 172.64.133.22:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerGoogle Trust Services LLC
Subjectcdnfonts.com
FingerprintAF:03:53:24:37:10:1D:B8:DA:B1:DD:17:BE:42:25:62:12:15:20:CC
ValidityThu, 30 Nov 2023 10:28:37 GMT - Wed, 28 Feb 2024 10:28:36 GMT
File type Web Open Font Format, TrueType, length 28744, version 0.0\012- data
Hash 97cce36d2c97b9a022976f1396eb0c5a
477d4e994f9f28f5f0542c6129c3d91c7608a901
f6a30969633fb0124959f5af4efd78b6fd5fe36d5901f36b8d34cf4c33a90b6a
GET /s/72205/FuturaCyrillicBook.woff HTTP/1.1
Host: fonts.cdnfonts.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://home.refily.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.cdnfonts.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 07 Dec 2023 20:17:42 GMT
content-type: font/woff
content-length: 28744
last-modified: Sat, 05 Feb 2022 02:00:58 GMT
etag: "7048-5d73bbd14dee6"
cache-control: max-age=2678400
cf-cache-status: HIT
age: 148187
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B2QCfIgGzDI%2Bm0Dh4EjdbWOnXMUdBu3IYlXIqYhh1soG9cqf%2BFc1c5QjL7jtNb5HJdL7V2yTKdm8EXtPMuKRGdi06gFP4GTGZCqsBWvBwmiBNcgu1GoO5FWskEnYuI1yIR9F4wE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
access-control-allow-origin: *
server: cloudflare
cf-ray: 831f7423893176d5-LHR
alt-svc: h3=":443"; ma=86400
fonts.cdnfonts.com/s/72205/FuturaCyrillicHeavy.woff
172.64.133.22200 OK 29 kB URL GET HTTP/3 fonts.cdnfonts.com/s/72205/FuturaCyrillicHeavy.woff
IP 172.64.133.22:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerGoogle Trust Services LLC
Subjectcdnfonts.com
FingerprintAF:03:53:24:37:10:1D:B8:DA:B1:DD:17:BE:42:25:62:12:15:20:CC
ValidityThu, 30 Nov 2023 10:28:37 GMT - Wed, 28 Feb 2024 10:28:36 GMT
File type Web Open Font Format, TrueType, length 28872, version 0.0\012- data
Hash 9769913239251188330d1e78e233433f
3516c88f276c67a2956e9d8d41916fbdade98df1
4a13903693073d8eefd2bd5bef99029e65013e049aed683d01b65de1930eb58f
GET /s/72205/FuturaCyrillicHeavy.woff HTTP/1.1
Host: fonts.cdnfonts.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://home.refily.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.cdnfonts.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 07 Dec 2023 20:17:42 GMT
content-type: font/woff
content-length: 28872
last-modified: Sat, 05 Feb 2022 02:00:58 GMT
etag: "70c8-5d73bbd14e2ce"
cache-control: max-age=2678400
cf-cache-status: HIT
age: 148187
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fToZbZkVoE1xwFlMIgn0losWD3ffqsIBjUxZKR13sPjOF7Xhjw%2BPWMm2wNlCLNVAD8nbENgKIgDtCUkBWHUKqSDW8jueCzjho6c22SqmCZIHjeOKr9HKKEXRKGnVoM3pC7Bexao%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
access-control-allow-origin: *
server: cloudflare
cf-ray: 831f7423994476d5-LHR
alt-svc: h3=":443"; ma=86400
fonts.cdnfonts.com/s/72205/FuturaCyrillicBold.woff
172.64.133.22200 OK 30 kB URL GET HTTP/3 fonts.cdnfonts.com/s/72205/FuturaCyrillicBold.woff
IP 172.64.133.22:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerGoogle Trust Services LLC
Subjectcdnfonts.com
FingerprintAF:03:53:24:37:10:1D:B8:DA:B1:DD:17:BE:42:25:62:12:15:20:CC
ValidityThu, 30 Nov 2023 10:28:37 GMT - Wed, 28 Feb 2024 10:28:36 GMT
File type Web Open Font Format, TrueType, length 29480, version 0.0\012- data
Hash dbba4f772f875d0f2076cda9feffe2a5
75a35cd7a0ccae0f9083c5808eacbd6cd5960ed0
9d490e0db498039d18b0e482fab817ffea3c14e95dcc21fd4ff1a03b5c265038
GET /s/72205/FuturaCyrillicBold.woff HTTP/1.1
Host: fonts.cdnfonts.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://home.refily.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.cdnfonts.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 07 Dec 2023 20:17:42 GMT
content-type: font/woff
content-length: 29480
last-modified: Sat, 05 Feb 2022 02:00:58 GMT
etag: "7328-5d73bbd14dee6"
cache-control: max-age=2678400
cf-cache-status: HIT
age: 148187
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o8t6Y%2BhjCJwFJ2v1plcp%2BC825y%2Fbw9wq5vG1zlWQEkaRfCxqEjQf4CdPUPDTjEfhVQnzFM0PUFhVYFgakQdXDr1ngqXa4EX23VFytVu3U1goyCjghEpUCoxj8K2vw3mbOjWyL%2Bo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
access-control-allow-origin: *
server: cloudflare
cf-ray: 831f7423994976d5-LHR
alt-svc: h3=":443"; ma=86400
content.enhancedrefinow.com/lre/favicon.ico
104.18.4.105 1.0 kB URL GET content.enhancedrefinow.com/lre/favicon.ico
IP 104.18.4.105:0
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerCloudflare, Inc.
Subjectenhancedrefinow.com
FingerprintCC:38:9A:93:4C:BD:74:FE:30:18:77:1F:80:24:AF:9E:02:FA:AB:56
ValidityFri, 03 Mar 2023 00:00:00 GMT - Fri, 01 Mar 2024 23:59:59 GMT
File type gzip compressed data, from Unix\012- data
Hash 0a6b680b3adceb07f4bd92af77863cd5
95b69e65bda9a14598a9da83ba31133b35433b6a
a5e12edab9a98e91a97fd9d9f701440c923a001f4db5e99755a9eb9d3b5d7818
GET /lre/favicon.ico HTTP/1.1
Host: content.enhancedrefinow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=Tqy3A9jvf1Uyfwl0ZxkfMw.RfucWRi_y2awHagoOz0A-1701980260-0-Aaw/va6K9HXNXhUI0JTsD2+jCnN+FEuX2Lwyq6lUZh/uMMH4CYZ9PeUhp6hddTGpOBarEL2Hm17G63M6iUzjq0w=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:42 GMT
content-type: image/vnd.microsoft.icon
last-modified: Thu, 23 Nov 2023 14:00:49 GMT
etag: W/"89bc42e3115e844dd692674ac4de5429"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
via: 1.1 6cb1d4b545e7beb4ead790454f4807c6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: FHm8OrsmFcYUlxzp3DwmcX-yNzcEZ8BWdg-y8gjmRjvCbHVNszhLVw==
cf-cache-status: HIT
age: 3937
expires: Fri, 08 Dec 2023 00:17:42 GMT
cache-control: public, max-age=14400
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 831f7422bdb00afa-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
home.refily.com/app-configuration/?path=/lendingLeadGen/fraud/anura/enabled
104.18.8.131200 OK 50 B URL GET HTTP/2 home.refily.com/app-configuration/?path=/lendingLeadGen/fraud/anura/enabled
IP 104.18.8.131:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerCloudflare, Inc.
Subjectrefily.com
Fingerprint4E:B0:EF:C2:BE:0A:7A:01:DD:D1:07:A8:B3:6D:E0:A6:3F:84:85:37
ValidityWed, 11 Oct 2023 00:00:00 GMT - Thu, 10 Oct 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash b326b5062b2f0e69046810717534cb09
5ffe533b830f08a0326348a9160afafc8ada44db
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b
GET /app-configuration/?path=/lendingLeadGen/fraud/anura/enabled HTTP/1.1
Host: home.refily.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
DNT: 1
Connection: keep-alive
Cookie: visitorId=1ee7aefd-ac9a-49df-b071-217ebbc16294; sourceId=affl_everflow_lre-rfl_155_809; connect.sid=s%3AKWDtx8al4JWCHA8ZLisSFLssiYjFBL1O.qokiTHZPJuZ78uT1iRGVJIysk8HwQdjDwpP0xID1JtM; __cf_bm=QiHNjRTOiBLb8xkd7oUUY_kBrOV34ayzPVRIgdx3ZcU-1701980259-0-ATqkR3DsMblRyZ41ReHny2boEjHY+qF98be3Ux4n2+RNhOdsl7hIRDTpoc9/F3QZb7nYzx9NQlXhChdQRdQvIVA=; DAPROPS="bS:0|scsVersion:2.4.5|bcookieSupport:1|bcss.animations:1|bcss.columns:1|bcss.transforms:1|bcss.transitions:1|sdeviceAspectRatio:1280/1024|sdevicePixelRatio:1|idisplayColorDepth:24|bflashCapable:0|bhtml.audio.ogg:1|bhtml.audio.mp3:1|bhtml.audio.wav:1|bhtml.audio.m4a:1|bhtml.canvas:1|bhtml.inlinesvg:1|bhtml.svg:1|bhtml.video.ap4x:0|bhtml.video.av1:1|bhtml.video.ogg:1|bhtml.video.h264:1|bhtml.video.webm:1|bjs.accessDom:1|bjs.applicationCache:0|bjs.deviceMotion:1|bjs.geoLocation:1|bjs.indexedDB:1|bjs.json:1|bjs.localStorage:1|bjs.modifyCss:1|bjs.modifyDom:1|bjs.querySelector:1|bjs.sessionStorage:1|bjs.supportBasicJavaScript:1|bjs.supportConsoleLog:1|bjs.supportEventListener:1|bjs.supportEvents:1|bjs.webGl:1|bjs.webSockets:1|bjs.webSqlDatabase:0|bjs.webWorkers:1|bjs.xhr:1|srendererRef:02919241789|sscreenWidthHeight:1280/1024|stimeZone:UTC|buserMedia:1|saudioRef:25450949bE:0"; _dd_s=rum=1&id=f142091e-3d82-4ac0-906f-2305e0ee4496&created=1701980268269&expire=1701981168269; _rdt_uuid=1701980268553.79917a77-8b84-400d-bc4d-9a69f5d2dd83; _gcl_au=1.1.509716374.1701980269
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:42 GMT
content-type: text/html; charset=utf-8
x-dns-prefetch-control: off
strict-transport-security: max-age=2592000
x-download-options: noopen
referrer-policy: same-origin
cache-control: no-store
cf-cache-status: DYNAMIC
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 831f74209eaf712d-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
www.google.no/pagead/1p-conversion/320492720/?random=1701980268796&cv=11&fst=1701980268796&bg=ffffff&guid=ON&async=1>m=45be3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1280&u_h=1024&url=https%3A%2F%2Fhome.refily.com%2F%3Fmoid%3D314646%26sourceid%3Daffl_everflow_lre-rfl_155_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D5233081346044726978a6c321208c15e%26sid%3D155%26cmpid%3D155%26crtid%3D%26oid%3D155%26affid%3D809%26_ef_transaction_id%3D5233081346044726978a6c321208c15e&label=xSwBCJum9PsCELCp6ZgB&hn=www.google.com&frm=0&tiba=Refily>m_ee=1&auid=509716374.1701980269&data=event%3Dconversion&gcp=1&sscte=1&ct_cookie_present=1&rfmt=3&fmt=4&ipr=y
142.250.74.163200 OK 63 B URL GET HTTP/2 www.google.no/pagead/1p-conversion/320492720/?random=1701980268796&cv=11&fst=1701980268796&bg=ffffff&guid=ON&async=1>m=45be3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1280&u_h=1024&url=https%3A%2F%2Fhome.refily.com%2F%3Fmoid%3D314646%26sourceid%3Daffl_everflow_lre-rfl_155_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D5233081346044726978a6c321208c15e%26sid%3D155%26cmpid%3D155%26crtid%3D%26oid%3D155%26affid%3D809%26_ef_transaction_id%3D5233081346044726978a6c321208c15e&label=xSwBCJum9PsCELCp6ZgB&hn=www.google.com&frm=0&tiba=Refily>m_ee=1&auid=509716374.1701980269&data=event%3Dconversion&gcp=1&sscte=1&ct_cookie_present=1&rfmt=3&fmt=4&ipr=y
IP 142.250.74.163:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerGoogle Trust Services LLC
Subject*.google.no
Fingerprint6E:E4:BC:4A:67:5E:46:6A:B3:E4:CA:61:A7:C0:97:AB:14:F0:34:32
ValidityMon, 23 Oct 2023 11:27:27 GMT - Mon, 15 Jan 2024 11:27:26 GMT
File type ASCII text, with no line terminators
Hash ad8b6f08655797587cdec719a94efe59
182adf5a140796f81e930649d05654dbf22fd5b7
77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6
GET /pagead/1p-conversion/320492720/?random=1701980268796&cv=11&fst=1701980268796&bg=ffffff&guid=ON&async=1>m=45be3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1280&u_h=1024&url=https%3A%2F%2Fhome.refily.com%2F%3Fmoid%3D314646%26sourceid%3Daffl_everflow_lre-rfl_155_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D5233081346044726978a6c321208c15e%26sid%3D155%26cmpid%3D155%26crtid%3D%26oid%3D155%26affid%3D809%26_ef_transaction_id%3D5233081346044726978a6c321208c15e&label=xSwBCJum9PsCELCp6ZgB&hn=www.google.com&frm=0&tiba=Refily>m_ee=1&auid=509716374.1701980269&data=event%3Dconversion&gcp=1&sscte=1&ct_cookie_present=1&rfmt=3&fmt=4&ipr=y HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 07 Dec 2023 20:17:43 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: text/javascript; charset=UTF-8
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: gzip
server: cafe
content-length: 63
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
bat.bing.com/action/0?ti=146000783&Ver=2&mid=ec72789f-5e8e-4267-9a2b-4b31f0dd2f94&sid=b152a8e0953d11eeb4716b3673c9f768&vid=b152ad10953d11eea5bfd7396fd7ef31&vids=1&msclkid=N&pi=918639831&lg=en-US&sw=1280&sh=1024&sc=24&tl=Refily&kw=refinance,%20mortgage,%20mortgages,%20refinancing,%20mortgage%20rates,%20refinance%20mortgage,%20refinance%20rates,%20refinancing%20rates,%20refinancing%20home,%20home%20loan,%20home%20loans,%20equity%20loans,%20home%20equity%20loans,%20home%20equity%20loan,%20second%20mortgage,%20home%20equity%20loan%20rates,%20credit%20card%20consolidation,%20debt%20loans,%20credit%20card%20debt%20consolidation,%20bad%20credit%20loans,%20debt%20free,%20bad%20credit,%20debt%20help,%20debt%20solutions,%20money%20management,%20credit%20card%20debt,%20personal%20loan,%20bad%20credit%20mortgage,%20mortgage%20calculator&p=https%3A%2F%2Fhome.refily.com%2F%3Fmoid%3D314646%26sourceid%3Daffl_everflow_lre-rfl_155_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D5233081346044726978a6c321208c15e%26sid%3D155%26cmpid%3D155%26crtid%3D%26oid%3D155%26affid%3D809%26_ef_transaction_id%3D5233081346044726978a6c321208c15e&r=<=5694&evt=pageLoad&sv=1&rn=76671
13.107.21.200204 No Content 0 B URL GET HTTP/2 bat.bing.com/action/0?ti=146000783&Ver=2&mid=ec72789f-5e8e-4267-9a2b-4b31f0dd2f94&sid=b152a8e0953d11eeb4716b3673c9f768&vid=b152ad10953d11eea5bfd7396fd7ef31&vids=1&msclkid=N&pi=918639831&lg=en-US&sw=1280&sh=1024&sc=24&tl=Refily&kw=refinance,%20mortgage,%20mortgages,%20refinancing,%20mortgage%20rates,%20refinance%20mortgage,%20refinance%20rates,%20refinancing%20rates,%20refinancing%20home,%20home%20loan,%20home%20loans,%20equity%20loans,%20home%20equity%20loans,%20home%20equity%20loan,%20second%20mortgage,%20home%20equity%20loan%20rates,%20credit%20card%20consolidation,%20debt%20loans,%20credit%20card%20debt%20consolidation,%20bad%20credit%20loans,%20debt%20free,%20bad%20credit,%20debt%20help,%20debt%20solutions,%20money%20management,%20credit%20card%20debt,%20personal%20loan,%20bad%20credit%20mortgage,%20mortgage%20calculator&p=https%3A%2F%2Fhome.refily.com%2F%3Fmoid%3D314646%26sourceid%3Daffl_everflow_lre-rfl_155_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D5233081346044726978a6c321208c15e%26sid%3D155%26cmpid%3D155%26crtid%3D%26oid%3D155%26affid%3D809%26_ef_transaction_id%3D5233081346044726978a6c321208c15e&r=<=5694&evt=pageLoad&sv=1&rn=76671
IP 13.107.21.200:443
ASN #8068 MICROSOFT-CORP-MSN-AS-BLOCK
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerMicrosoft Corporation
Subjectwww.bing.com
FingerprintA5:EC:34:1F:AB:B3:69:71:54:88:69:BA:64:CC:E2:9B:32:B6:65:CD
ValidityTue, 24 Oct 2023 07:42:22 GMT - Sun, 21 Apr 2024 07:42:22 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /action/0?ti=146000783&Ver=2&mid=ec72789f-5e8e-4267-9a2b-4b31f0dd2f94&sid=b152a8e0953d11eeb4716b3673c9f768&vid=b152ad10953d11eea5bfd7396fd7ef31&vids=1&msclkid=N&pi=918639831&lg=en-US&sw=1280&sh=1024&sc=24&tl=Refily&kw=refinance,%20mortgage,%20mortgages,%20refinancing,%20mortgage%20rates,%20refinance%20mortgage,%20refinance%20rates,%20refinancing%20rates,%20refinancing%20home,%20home%20loan,%20home%20loans,%20equity%20loans,%20home%20equity%20loans,%20home%20equity%20loan,%20second%20mortgage,%20home%20equity%20loan%20rates,%20credit%20card%20consolidation,%20debt%20loans,%20credit%20card%20debt%20consolidation,%20bad%20credit%20loans,%20debt%20free,%20bad%20credit,%20debt%20help,%20debt%20solutions,%20money%20management,%20credit%20card%20debt,%20personal%20loan,%20bad%20credit%20mortgage,%20mortgage%20calculator&p=https%3A%2F%2Fhome.refily.com%2F%3Fmoid%3D314646%26sourceid%3Daffl_everflow_lre-rfl_155_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D5233081346044726978a6c321208c15e%26sid%3D155%26cmpid%3D155%26crtid%3D%26oid%3D155%26affid%3D809%26_ef_transaction_id%3D5233081346044726978a6c321208c15e&r=<=5694&evt=pageLoad&sv=1&rn=76671 HTTP/1.1
Host: bat.bing.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 204 No Content
cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=18FFFD808A7A68B518BEEE608B8F6955; domain=.bing.com; expires=Tue, 31-Dec-2024 20:17:43 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9D2BF52ABBFE46FE8E3CF5273A2E8710 Ref B: OSL30EDGE0108 Ref C: 2023-12-07T20:17:43Z
date: Thu, 07 Dec 2023 20:17:42 GMT
X-Firefox-Spdy: h2
s.yimg.com/wi/ytc.js
188.125.94.206200 OK 6.3 kB IP 188.125.94.206:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerDigiCert Inc
Subject*.api.fantasysports.yahoo.com
Fingerprint73:32:A8:90:C9:6F:41:1C:ED:AA:2A:95:41:24:4E:E2:B2:AB:FB:D6
ValidityMon, 06 Nov 2023 00:00:00 GMT - Wed, 27 Dec 2023 23:59:59 GMT
File type ASCII text, with very long lines (18187), with no line terminators
Hash 5c6ed25dce803fd84288922b8928409e
3ccc10546ae12f160bacac1e9e422af091ea4a41
480b06b23e574b4bf386fde1a91145a4171f97aeb5ee800e4be1850f29b1ad91
GET /wi/ytc.js HTTP/1.1
Host: s.yimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://home.refily.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
x-amz-id-2: 89jCmd0qSdh6XPECVdQjGL6U52MF2keNyJG5xe0H3GRy1olY8l7kM636YOA9p5uEbsLBPC2yd1g=
x-amz-request-id: TQCSNENP9FE5H4SP
date: Thu, 07 Dec 2023 19:23:54 GMT
last-modified: Mon, 26 Jun 2023 09:26:35 GMT
x-amz-expiration: expiry-date="Wed, 31 Jul 2024 00:00:00 GMT", rule-id="oath-standard-lifecycle"
etag: "5c6ed25dce803fd84288922b8928409e-df"
x-amz-server-side-encryption: AES256
cache-control: public,max-age=3600
x-amz-version-id: xC6OTTJGIjCqkMTkbrZpmtbXHK5oaZhW
accept-ranges: bytes
content-type: application/javascript
server: ATS
referrer-policy: no-referrer-when-downgrade
vary: Origin, Accept-Encoding
age: 3230
content-encoding: gzip
content-length: 6262
strict-transport-security: max-age=31536000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
ats-carp-promotion: 1, 1
X-Firefox-Spdy: h2
rum-http-intake.logs.datadoghq.com/v1/input/pub6a529f19365581f6a44df4d3740084c6?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Alre-ern-webapp%2Cversion%3A1.0.3%20d-HKBIDL032&batch_time=1701980269619
3.233.155.164200 OK 2 B URL POST HTTP/2 rum-http-intake.logs.datadoghq.com/v1/input/pub6a529f19365581f6a44df4d3740084c6?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Alre-ern-webapp%2Cversion%3A1.0.3%20d-HKBIDL032&batch_time=1701980269619
IP 3.233.155.164:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerDigiCert Inc
Subject*.logs.datadoghq.com
Fingerprint29:24:46:A8:06:E2:F4:15:BE:A6:74:80:B3:36:D5:3D:E7:D5:15:99
ValidityWed, 22 Mar 2023 00:00:00 GMT - Fri, 22 Mar 2024 23:59:59 GMT
File type JSON data\012- , ASCII text, with no line terminators
Hash 99914b932bd37a50b983c5e7c90ae93b
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
POST /v1/input/pub6a529f19365581f6a44df4d3740084c6?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Alre-ern-webapp%2Cversion%3A1.0.3%20d-HKBIDL032&batch_time=1701980269619 HTTP/1.1
Host: rum-http-intake.logs.datadoghq.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 16236
Origin: null
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:43 GMT
content-type: application/json
content-length: 2
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
s.yimg.com/wi/config/10194306.json
188.125.94.206200 OK 46 B URL GET HTTP/2 s.yimg.com/wi/config/10194306.json
IP 188.125.94.206:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerDigiCert Inc
Subject*.api.fantasysports.yahoo.com
Fingerprint73:32:A8:90:C9:6F:41:1C:ED:AA:2A:95:41:24:4E:E2:B2:AB:FB:D6
ValidityMon, 06 Nov 2023 00:00:00 GMT - Wed, 27 Dec 2023 23:59:59 GMT
File type JSON data\012- , ASCII text, with no line terminators
Hash 87d7a3e6ca5844729c849e28a1fdffda
cf1c60dd594971896ff423177ad4991403928429
e8a12726ee07f3a17f43d5715b0f1c49c2548baf3ce450d2880701034c75700b
GET /wi/config/10194306.json HTTP/1.1
Host: s.yimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://home.refily.com
DNT: 1
Connection: keep-alive
Referer: https://home.refily.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
x-amz-id-2: S147oo9TeEzgGg9BMAb8a58ZKn4ictV2rSdLnknSuvPla73MLVs91Te+R+xzh7qeVEpL8OvKlXupq0XNUH4Bng==
x-amz-request-id: JMN15VCK8GQ5NTD4
date: Thu, 07 Dec 2023 20:17:44 GMT
access-control-allow-origin: *
access-control-allow-methods: GET
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
last-modified: Thu, 07 Dec 2023 19:45:03 GMT
x-amz-expiration: expiry-date="Sat, 11 Jan 2025 00:00:00 GMT", rule-id="oath-standard-lifecycle"
x-amz-server-side-encryption: AES256
x-amz-version-id: x5iIqTPp_BYZt7s4PMlrGxlIOhvGh9V8
accept-ranges: bytes
content-type: application/json
server: ATS
content-length: 46
referrer-policy: no-referrer-when-downgrade
etag: "87d7a3e6ca5844729c849e28a1fdffda"
age: 0
strict-transport-security: max-age=31536000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
X-Firefox-Spdy: h2
ads.anura.io/showads.js?919195634190
54.230.111.16200 OK 0 B URL GET HTTP/2 ads.anura.io/showads.js?919195634190
IP 54.230.111.16:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerAmazon
Subjectads.anura.io
Fingerprint69:66:FA:26:E2:E4:89:00:9A:F7:DE:2C:F6:5A:C2:B9:58:04:5D:E6
ValidityTue, 30 May 2023 00:00:00 GMT - Thu, 27 Jun 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /showads.js?919195634190 HTTP/1.1
Host: ads.anura.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://home.refily.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
date: Thu, 07 Dec 2023 19:40:31 GMT
server: nginx
access-control-allow-origin: *
access-control-allow-methods: GET
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 60929bddfcfe8b3a510a9502ad6d8742.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: KrjdBpKIgPPngJUXvILHkHAeWqKdT6fqdxUF8ggWkMhtTGL82pcCog==
age: 2232
X-Firefox-Spdy: h2
static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317
104.16.56.101200 OK 20 kB URL GET HTTP/2 static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317
IP 104.16.56.101:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint89:79:35:ED:04:A2:CA:50:F7:9A:B8:FE:DF:A5:0C:B1:F2:E6:DD:E8
ValidityMon, 10 Apr 2023 00:00:00 GMT - Tue, 09 Apr 2024 23:59:59 GMT
File type ASCII text, with very long lines (19986), with no line terminators
Hash dd1d068fdb5fe90b6c05a5b3940e088c
0d96f9df8772633a9df4c81cf323a4ef8998ba59
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
GET /beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317 HTTP/1.1
Host: static.cloudflareinsights.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://home.refily.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:40 GMT
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
etag: W/"2023.10.0"
last-modified: Tue, 10 Oct 2023 21:38:13 GMT
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 831f7410cbf2b527-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
rum-http-intake.logs.datadoghq.com/v1/input/pub6a529f19365581f6a44df4d3740084c6?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Alre-ern-webapp%2Cversion%3A1.0.3%20d-HKBIDL032&batch_time=1701980268416
3.233.155.164200 OK 0 B URL POST HTTP/2 rum-http-intake.logs.datadoghq.com/v1/input/pub6a529f19365581f6a44df4d3740084c6?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Alre-ern-webapp%2Cversion%3A1.0.3%20d-HKBIDL032&batch_time=1701980268416
IP 3.233.155.164:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerDigiCert Inc
Subject*.logs.datadoghq.com
Fingerprint29:24:46:A8:06:E2:F4:15:BE:A6:74:80:B3:36:D5:3D:E7:D5:15:99
ValidityWed, 22 Mar 2023 00:00:00 GMT - Fri, 22 Mar 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /v1/input/pub6a529f19365581f6a44df4d3740084c6?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Alre-ern-webapp%2Cversion%3A1.0.3%20d-HKBIDL032&batch_time=1701980268416 HTTP/1.1
Host: rum-http-intake.logs.datadoghq.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 15998
Origin: null
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:42 GMT
content-type: application/json
content-length: 2
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
fonts.googleapis.com/css2?family=Montserrat:wght@400;500;700&display=swap
142.250.74.106200 OK 5.5 kB URL GET HTTP/2 fonts.googleapis.com/css2?family=Montserrat:wght@400;500;700&display=swap
IP 142.250.74.106:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
FingerprintCC:96:E0:52:E0:9B:EA:A9:A0:F8:88:9A:90:20:11:47:61:00:3C:42
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type ASCII text, with very long lines (5625), with no line terminators
Hash db3b610f5ab8cdea5be1ad9fa47519f1
c710ba8ac3a125f761f0e44ad037e5d9e425712f
6f71beaff992a2b43f2bc51bf09fb1c6b24dc32fca6626fea202a474333900fc
GET /css2?family=Montserrat:wght@400;500;700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 07 Dec 2023 20:17:40 GMT
date: Thu, 07 Dec 2023 20:17:40 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ads.revjet.com/analytics?acu=6680
5.9.138.41200 OK 20 kB URL GET HTTP/2 ads.revjet.com/analytics?acu=6680
IP 5.9.138.41:443
ASN #24940 Hetzner Online GmbH
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerSectigo Limited
Subject*.revjet.com
Fingerprint03:20:65:55:CD:08:1C:F0:68:28:E7:A4:5F:21:09:76:87:BF:9D:81
ValidityMon, 20 Mar 2023 00:00:00 GMT - Thu, 11 Apr 2024 23:59:59 GMT
File type ASCII text, with very long lines (1311)
Hash 26ec352468322f70910e03feb9b8b8fb
18878e8adcd809ad7a4850c8698efd24b22c04e5
2d84cdbfaf9b2bc0ba30bc5f67e45d03b265b52c3cfe24353e09175b1fb0fdfb
GET /analytics?acu=6680 HTTP/1.1
Host: ads.revjet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://home.refily.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Thu, 07 Dec 2023 20:17:42 GMT
content-type: application/javascript
last-modified: Fri, 14 Apr 2023 10:35:36 GMT
etag: W/"64392c78-4c14"
expires: Thu, 07 Dec 2023 20:27:42 GMT
cache-control: max-age=600
access-control-allow-origin: *
content-encoding: gzip
X-Firefox-Spdy: h2
bat.bing.com/p/action/146000783.js
13.107.21.200204 No Content 0 B URL GET HTTP/2 bat.bing.com/p/action/146000783.js
IP 13.107.21.200:443
ASN #8068 MICROSOFT-CORP-MSN-AS-BLOCK
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerMicrosoft Corporation
Subjectwww.bing.com
FingerprintA5:EC:34:1F:AB:B3:69:71:54:88:69:BA:64:CC:E2:9B:32:B6:65:CD
ValidityTue, 24 Oct 2023 07:42:22 GMT - Sun, 21 Apr 2024 07:42:22 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /p/action/146000783.js HTTP/1.1
Host: bat.bing.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
cache-control: private,max-age=1800
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 72EF580C4D914544B59E50963A17E12B Ref B: OSL30EDGE0108 Ref C: 2023-12-07T20:17:43Z
date: Thu, 07 Dec 2023 20:17:42 GMT
X-Firefox-Spdy: h2
home.refily.com/visitor
104.18.8.131200 OK 232 B IP 104.18.8.131:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerCloudflare, Inc.
Subjectrefily.com
Fingerprint4E:B0:EF:C2:BE:0A:7A:01:DD:D1:07:A8:B3:6D:E0:A6:3F:84:85:37
ValidityWed, 11 Oct 2023 00:00:00 GMT - Thu, 10 Oct 2024 23:59:59 GMT
File type troff or preprocessor input, ASCII text, with no line terminators
Hash 3bfcb7fb45823939f3019a64cc106bc9
e401f9c20638c39edad13fee1bb73837e06c6e2b
36d83df5454517b5972076711fb1fad7a6d734ad13d5f9b302d368030d42594a
POST /visitor HTTP/1.1
Host: home.refily.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Content-Type: application/json
Content-Length: 1467
Origin: https://home.refily.com
DNT: 1
Connection: keep-alive
Cookie: visitorId=1ee7aefd-ac9a-49df-b071-217ebbc16294; sourceId=affl_everflow_lre-rfl_155_809; connect.sid=s%3AKWDtx8al4JWCHA8ZLisSFLssiYjFBL1O.qokiTHZPJuZ78uT1iRGVJIysk8HwQdjDwpP0xID1JtM; __cf_bm=QiHNjRTOiBLb8xkd7oUUY_kBrOV34ayzPVRIgdx3ZcU-1701980259-0-ATqkR3DsMblRyZ41ReHny2boEjHY+qF98be3Ux4n2+RNhOdsl7hIRDTpoc9/F3QZb7nYzx9NQlXhChdQRdQvIVA=; DAPROPS="bS:0|scsVersion:2.4.5|bcookieSupport:1|bcss.animations:1|bcss.columns:1|bcss.transforms:1|bcss.transitions:1|sdeviceAspectRatio:1280/1024|sdevicePixelRatio:1|idisplayColorDepth:24|bflashCapable:0|bhtml.audio.ogg:1|bhtml.audio.mp3:1|bhtml.audio.wav:1|bhtml.audio.m4a:1|bhtml.canvas:1|bhtml.inlinesvg:1|bhtml.svg:1|bhtml.video.ap4x:0|bhtml.video.av1:1|bhtml.video.ogg:1|bhtml.video.h264:1|bhtml.video.webm:1|bjs.accessDom:1|bjs.applicationCache:0|bjs.deviceMotion:1|bjs.geoLocation:1|bjs.indexedDB:1|bjs.json:1|bjs.localStorage:1|bjs.modifyCss:1|bjs.modifyDom:1|bjs.querySelector:1|bjs.sessionStorage:1|bjs.supportBasicJavaScript:1|bjs.supportConsoleLog:1|bjs.supportEventListener:1|bjs.supportEvents:1|bjs.webGl:1|bjs.webSockets:1|bjs.webSqlDatabase:0|bjs.webWorkers:1|bjs.xhr:1|srendererRef:02919241789|sscreenWidthHeight:1280/1024|stimeZone:UTC|buserMedia:1bE:0"
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:41 GMT
content-type: application/json; charset=utf-8
x-dns-prefetch-control: off
strict-transport-security: max-age=2592000
x-download-options: noopen
referrer-policy: same-origin
cache-control: no-store
etag: W/"e8-fkxtixQLfpsLHMieJJJYJ7Kc/WI"
cf-cache-status: DYNAMIC
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 831f741b085d712d-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
static-lre.refinance.enhancedrefinow.com/manifest.d7f9016d0e5da5649c5f.js
104.18.4.105200 OK 13 kB URL GET HTTP/2 static-lre.refinance.enhancedrefinow.com/manifest.d7f9016d0e5da5649c5f.js
IP 104.18.4.105:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerCloudflare, Inc.
Subjectenhancedrefinow.com
FingerprintCC:38:9A:93:4C:BD:74:FE:30:18:77:1F:80:24:AF:9E:02:FA:AB:56
ValidityFri, 03 Mar 2023 00:00:00 GMT - Fri, 01 Mar 2024 23:59:59 GMT
File type ASCII text, with very long lines (12636), with no line terminators
Hash ab05865229c4be0e25398c314b00a787
ffabd971a1d77d782aec1370f52e8f1d83769c82
a261d93839339ffe4e77dead49be5380abb6b61fdbd67d735e01ccd17bae918f
GET /manifest.d7f9016d0e5da5649c5f.js HTTP/1.1
Host: static-lre.refinance.enhancedrefinow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=odxt.1w4GnrRAHDI5d6MjZDpKxMv_3ueeQr_DvNMnOg-1701980259-0-AdZNgPq9uFx3VcLR0VrJeCwhxzNQRo4GOeUYOSfkmC4LhXt2YhB9rgKU7qITuQAcE5e3SZCRm5lDeLL1DQ4CPhw=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:39 GMT
content-type: application/javascript
last-modified: Mon, 13 Nov 2023 19:49:34 GMT
etag: W/"ab05865229c4be0e25398c314b00a787"
x-amz-server-side-encryption: AES256
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 9ede9483eb891e14681c7c693b47c862.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: j6xQDrVNaIhrWO44n7p_cS7sPJVO2HTWlWu5NqGBxiq0BcirAWMkGA==
cf-cache-status: HIT
age: 6275
expires: Fri, 08 Dec 2023 00:17:39 GMT
cache-control: public, max-age=14400
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 831f74109c890afa-OSL
X-Firefox-Spdy: h2
rum-http-intake.logs.datadoghq.com/v1/input/pub6a529f19365581f6a44df4d3740084c6?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Alre-ern-webapp%2Cversion%3A1.0.3%20d-HKBIDL032&batch_time=1701980268937
3.233.155.164200 OK 0 B URL POST HTTP/2 rum-http-intake.logs.datadoghq.com/v1/input/pub6a529f19365581f6a44df4d3740084c6?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Alre-ern-webapp%2Cversion%3A1.0.3%20d-HKBIDL032&batch_time=1701980268937
IP 3.233.155.164:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerDigiCert Inc
Subject*.logs.datadoghq.com
Fingerprint29:24:46:A8:06:E2:F4:15:BE:A6:74:80:B3:36:D5:3D:E7:D5:15:99
ValidityWed, 22 Mar 2023 00:00:00 GMT - Fri, 22 Mar 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /v1/input/pub6a529f19365581f6a44df4d3740084c6?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Alre-ern-webapp%2Cversion%3A1.0.3%20d-HKBIDL032&batch_time=1701980268937 HTTP/1.1
Host: rum-http-intake.logs.datadoghq.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 14359
Origin: null
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:42 GMT
content-type: application/json
content-length: 2
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2
static-lre.refinance.enhancedrefinow.com/main.93e3cac8409e105ab51a.css
104.18.4.105200 OK 176 kB URL GET HTTP/2 static-lre.refinance.enhancedrefinow.com/main.93e3cac8409e105ab51a.css
IP 104.18.4.105:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerCloudflare, Inc.
Subjectenhancedrefinow.com
FingerprintCC:38:9A:93:4C:BD:74:FE:30:18:77:1F:80:24:AF:9E:02:FA:AB:56
ValidityFri, 03 Mar 2023 00:00:00 GMT - Fri, 01 Mar 2024 23:59:59 GMT
File type ASCII text, with very long lines (45544)
Size 176 kB (175557 bytes)
Hash 51281ef41f6e2e58b368816515b69b7b
0c82a25d8cc39e108175154e244bcb2490b18b0d
64cc6c3ae44025a0b21f96431acbdc5fe1601b19e27cfd4dfa0651dbb6776f33
GET /main.93e3cac8409e105ab51a.css HTTP/1.1
Host: static-lre.refinance.enhancedrefinow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:39 GMT
content-type: text/css
last-modified: Mon, 13 Nov 2023 19:49:34 GMT
etag: W/"51281ef41f6e2e58b368816515b69b7b"
x-amz-server-side-encryption: AES256
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 1d8cf7c8865ed1078c19a98771ad34ca.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: cQWHkrqEyqhTeJXjNNmvwKJQWJN5-Z9Ogl1iTx76tVdfXcT0CRjncw==
cf-cache-status: HIT
age: 6275
expires: Fri, 08 Dec 2023 00:17:39 GMT
cache-control: public, max-age=14400
set-cookie: __cf_bm=odxt.1w4GnrRAHDI5d6MjZDpKxMv_3ueeQr_DvNMnOg-1701980259-0-AdZNgPq9uFx3VcLR0VrJeCwhxzNQRo4GOeUYOSfkmC4LhXt2YhB9rgKU7qITuQAcE5e3SZCRm5lDeLL1DQ4CPhw=; path=/; expires=Thu, 07-Dec-23 20:47:39 GMT; domain=.enhancedrefinow.com; HttpOnly; Secure; SameSite=None
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 831f74102c150afa-OSL
X-Firefox-Spdy: h2
www.googletagmanager.com/gtag/js?id=AW-319191520
142.250.74.168200 OK 211 kB URL GET HTTP/2 www.googletagmanager.com/gtag/js?id=AW-319191520
IP 142.250.74.168:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint37:42:10:B7:89:70:45:51:80:81:66:CE:95:21:72:5D:46:0B:E2:34
ValidityMon, 23 Oct 2023 11:18:19 GMT - Mon, 15 Jan 2024 11:18:18 GMT
File type ASCII text, with very long lines (4179)
Size 211 kB (211177 bytes)
Hash 08e14abc4ec03e78b0872b1dbe655941
20a2ef9b7ae545c4893c6e1a5201ce439940f573
791bd44dff7d2c1bd5585d1cc3474fcb490a78512fb633197636df3ca037f801
GET /gtag/js?id=AW-319191520 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Thu, 07 Dec 2023 20:17:42 GMT
expires: Thu, 07 Dec 2023 20:17:42 GMT
cache-control: private, max-age=900
last-modified: Thu, 07 Dec 2023 18:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 75419
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
home.refily.com/track
104.18.8.131200 OK 246 B IP 104.18.8.131:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerCloudflare, Inc.
Subjectrefily.com
Fingerprint4E:B0:EF:C2:BE:0A:7A:01:DD:D1:07:A8:B3:6D:E0:A6:3F:84:85:37
ValidityWed, 11 Oct 2023 00:00:00 GMT - Thu, 10 Oct 2024 23:59:59 GMT
File type troff or preprocessor input, ASCII text, with no line terminators
Hash 9f8779e606dd5d2d283c2f86f220428a
eb0ef26fe9e96e2ac9f24db74a0c3c7a6bfef7ae
fd8b5256b0e8c12f6cb51e4f1d9c0f5ace8c1bd8f4109c10bbb0fdc21e6f04c3
POST /track HTTP/1.1
Host: home.refily.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Content-Type: application/json
Content-Length: 465
Origin: https://home.refily.com
DNT: 1
Connection: keep-alive
Cookie: visitorId=1ee7aefd-ac9a-49df-b071-217ebbc16294; sourceId=affl_everflow_lre-rfl_155_809; connect.sid=s%3AKWDtx8al4JWCHA8ZLisSFLssiYjFBL1O.qokiTHZPJuZ78uT1iRGVJIysk8HwQdjDwpP0xID1JtM; __cf_bm=QiHNjRTOiBLb8xkd7oUUY_kBrOV34ayzPVRIgdx3ZcU-1701980259-0-ATqkR3DsMblRyZ41ReHny2boEjHY+qF98be3Ux4n2+RNhOdsl7hIRDTpoc9/F3QZb7nYzx9NQlXhChdQRdQvIVA=; DAPROPS="bS:0|scsVersion:2.4.5|bcookieSupport:1|bcss.animations:1|bcss.columns:1|bcss.transforms:1|bcss.transitions:1|sdeviceAspectRatio:1280/1024|sdevicePixelRatio:1|idisplayColorDepth:24|bflashCapable:0|bhtml.audio.ogg:1|bhtml.audio.mp3:1|bhtml.audio.wav:1|bhtml.audio.m4a:1|bhtml.canvas:1|bhtml.inlinesvg:1|bhtml.svg:1|bhtml.video.ap4x:0|bhtml.video.av1:1|bhtml.video.ogg:1|bhtml.video.h264:1|bhtml.video.webm:1|bjs.accessDom:1|bjs.applicationCache:0|bjs.deviceMotion:1|bjs.geoLocation:1|bjs.indexedDB:1|bjs.json:1|bjs.localStorage:1|bjs.modifyCss:1|bjs.modifyDom:1|bjs.querySelector:1|bjs.sessionStorage:1|bjs.supportBasicJavaScript:1|bjs.supportConsoleLog:1|bjs.supportEventListener:1|bjs.supportEvents:1|bjs.webGl:1|bjs.webSockets:1|bjs.webSqlDatabase:0|bjs.webWorkers:1|bjs.xhr:1|srendererRef:02919241789|sscreenWidthHeight:1280/1024|stimeZone:UTC|buserMedia:1|saudioRef:25450949bE:0"; _dd_s=rum=1&id=f142091e-3d82-4ac0-906f-2305e0ee4496&created=1701980268269&expire=1701981168269; _rdt_uuid=1701980268553.79917a77-8b84-400d-bc4d-9a69f5d2dd83
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:42 GMT
content-type: application/json; charset=utf-8
x-dns-prefetch-control: off
strict-transport-security: max-age=2592000
x-download-options: noopen
referrer-policy: same-origin
cache-control: no-store
etag: W/"f6-LLBiSyaEXOz92MI4/ZkC+LNKtEs"
cf-cache-status: DYNAMIC
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 831f741deb25712d-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
www.googletagmanager.com/gtag/destination?id=AW-320492720&l=dataLayer&cx=c
142.250.74.168200 OK 212 kB URL GET HTTP/3 www.googletagmanager.com/gtag/destination?id=AW-320492720&l=dataLayer&cx=c
IP 142.250.74.168:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint37:42:10:B7:89:70:45:51:80:81:66:CE:95:21:72:5D:46:0B:E2:34
ValidityMon, 23 Oct 2023 11:18:19 GMT - Mon, 15 Jan 2024 11:18:18 GMT
File type ASCII text, with very long lines (4179)
Size 212 kB (211793 bytes)
Hash 980310495f239b78c779e88fdc5313df
15def4c8dede409dfdd790f10070e12ecb8f333d
c38fa96b1b771ce935b2f7d22ceaa6ed2c11036ee39542becf051a8ac35ca814
GET /gtag/destination?id=AW-320492720&l=dataLayer&cx=c HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Thu, 07 Dec 2023 20:17:42 GMT
expires: Thu, 07 Dec 2023 20:17:42 GMT
cache-control: private, max-age=900
last-modified: Thu, 07 Dec 2023 18:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 75628
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
script.anura.io/request.js?instance=3439535758&exid=bb530113-ad0e-551a-b1c0-5ab73ea4af1a&source=affl_everflow_lre-rfl_155_809&campaign=2&205052236920
3.8.43.133200 OK 56 kB URL GET HTTP/2 script.anura.io/request.js?instance=3439535758&exid=bb530113-ad0e-551a-b1c0-5ab73ea4af1a&source=affl_everflow_lre-rfl_155_809&campaign=2&205052236920
IP 3.8.43.133:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerAmazon
Subjectscript.anura.io
Fingerprint83:CF:23:67:0B:B9:DB:BB:65:3F:31:44:AD:06:8B:B2:7E:B4:E1:20
ValidityMon, 16 Oct 2023 00:00:00 GMT - Wed, 13 Nov 2024 23:59:59 GMT
File type ASCII text, with very long lines (1912)
Hash c0ebcbae3273a799235b114434df59ff
6310b3d6388b6b3e44c5f42a4b5d54e98f1f0384
4cb75c08ca1e13e09e83e7d1ea16dc868b6d84da5f161bbb4d2e8218555fab2c
GET /request.js?instance=3439535758&exid=bb530113-ad0e-551a-b1c0-5ab73ea4af1a&source=affl_everflow_lre-rfl_155_809&campaign=2&205052236920 HTTP/1.1
Host: script.anura.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:42 GMT
content-type: application/javascript; charset=utf-8
server: nginx
vary: Accept-Encoding
expires: Sun, 28 Dec 1980 18:57:00 EST
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
X-Firefox-Spdy: h2
fonts.cdnfonts.com/css/futura-pt
172.64.133.22200 OK 1.2 kB URL GET HTTP/2 fonts.cdnfonts.com/css/futura-pt
IP 172.64.133.22:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerGoogle Trust Services LLC
Subjectcdnfonts.com
FingerprintAF:03:53:24:37:10:1D:B8:DA:B1:DD:17:BE:42:25:62:12:15:20:CC
ValidityThu, 30 Nov 2023 10:28:37 GMT - Wed, 28 Feb 2024 10:28:36 GMT
File type ASCII text, with very long lines (1192), with no line terminators
Hash 5aef002cbffb3eacc4603ee91ee618e3
bf7a337641916d0e508f081338afdbe63fcea6d3
70e8b95f4865beeb114ddd32fe21337ea0d1b823396a367cfcbd9910edb9648f
GET /css/futura-pt HTTP/1.1
Host: fonts.cdnfonts.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:39 GMT
content-type: text/css;charset=UTF-8
cf-bgj: minify
cf-polished: origSize=1425
vary: Accept-Encoding
cache-control: max-age=2678400
cf-cache-status: HIT
age: 2053727
last-modified: Tue, 14 Nov 2023 01:48:52 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Szt67BmVCTsOFVgJhgtCAQMceQnIlMvp%2FHLUwwQUwe7FCI%2BLS0StW2Ymjgxi86tRxPKM5sUheEQHqv573krJaR739bp0ebvEywHZAOMCuhlmrjsqBjrOsPBfT2h%2B4cFR%2FNF5NCc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-origin: *
server: cloudflare
cf-ray: 831f74108a0460ed-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
home.refily.com/refily/gosPrediction
104.18.8.131200 OK 1.4 kB URL GET HTTP/2 home.refily.com/refily/gosPrediction
IP 104.18.8.131:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerCloudflare, Inc.
Subjectrefily.com
Fingerprint4E:B0:EF:C2:BE:0A:7A:01:DD:D1:07:A8:B3:6D:E0:A6:3F:84:85:37
ValidityWed, 11 Oct 2023 00:00:00 GMT - Thu, 10 Oct 2024 23:59:59 GMT
File type troff or preprocessor input, ASCII text, with very long lines (1688), with no line terminators
Hash 88e03fb3faa12f1f5a3d548d7ee8e17a
d9c126f8fc402bda8ef2b550b784d170cb610ca4
e94c604c72431928245018a33e13aacc5d57fa1ebf42fc6a61a3875709b30f34
GET /refily/gosPrediction HTTP/1.1
Host: home.refily.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
DNT: 1
Connection: keep-alive
Cookie: visitorId=1ee7aefd-ac9a-49df-b071-217ebbc16294; sourceId=affl_everflow_lre-rfl_155_809; connect.sid=s%3AKWDtx8al4JWCHA8ZLisSFLssiYjFBL1O.qokiTHZPJuZ78uT1iRGVJIysk8HwQdjDwpP0xID1JtM; __cf_bm=QiHNjRTOiBLb8xkd7oUUY_kBrOV34ayzPVRIgdx3ZcU-1701980259-0-ATqkR3DsMblRyZ41ReHny2boEjHY+qF98be3Ux4n2+RNhOdsl7hIRDTpoc9/F3QZb7nYzx9NQlXhChdQRdQvIVA=; DAPROPS="bS:0|scsVersion:2.4.5|bcookieSupport:1|bcss.animations:1|bcss.columns:1|bcss.transforms:1|bcss.transitions:1|sdeviceAspectRatio:1280/1024|sdevicePixelRatio:1|idisplayColorDepth:24|bflashCapable:0|bhtml.audio.ogg:1|bhtml.audio.mp3:1|bhtml.audio.wav:1|bhtml.audio.m4a:1|bhtml.canvas:1|bhtml.inlinesvg:1|bhtml.svg:1|bhtml.video.ap4x:0|bhtml.video.av1:1|bhtml.video.ogg:1|bhtml.video.h264:1|bhtml.video.webm:1|bjs.accessDom:1|bjs.applicationCache:0|bjs.deviceMotion:1|bjs.geoLocation:1|bjs.indexedDB:1|bjs.json:1|bjs.localStorage:1|bjs.modifyCss:1|bjs.modifyDom:1|bjs.querySelector:1|bjs.sessionStorage:1|bjs.supportBasicJavaScript:1|bjs.supportConsoleLog:1|bjs.supportEventListener:1|bjs.supportEvents:1|bjs.webGl:1|bjs.webSockets:1|bjs.webSqlDatabase:0|bjs.webWorkers:1|bjs.xhr:1|srendererRef:02919241789|sscreenWidthHeight:1280/1024|stimeZone:UTC|buserMedia:1bE:0"
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:42 GMT
content-type: application/json; charset=utf-8
x-dns-prefetch-control: off
strict-transport-security: max-age=2592000
x-download-options: noopen
referrer-policy: same-origin
cache-control: no-store
etag: W/"596-e49vA7lkKaUtr9KR4Xlbe5b8eh8"
cf-cache-status: DYNAMIC
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 831f741bd911712d-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
script.anura.io/response.json
3.8.43.133200 OK 151 B URL POST HTTP/2 script.anura.io/response.json
IP 3.8.43.133:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerAmazon
Subjectscript.anura.io
Fingerprint83:CF:23:67:0B:B9:DB:BB:65:3F:31:44:AD:06:8B:B2:7E:B4:E1:20
ValidityMon, 16 Oct 2023 00:00:00 GMT - Wed, 13 Nov 2024 23:59:59 GMT
File type troff or preprocessor input, ASCII text, with no line terminators
Hash 80833aab9a3a6347cb1cc4e135791fdd
0d1fb5c6dc10f7db455b73f23c4fba31dda8771e
4479a9a89c551ec77cbc8c0660b61cee7c04334d855c672da4071ed9432d6bb4
POST /response.json HTTP/1.1
Host: script.anura.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 5284
Origin: https://home.refily.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:43 GMT
content-type: application/json; charset=utf-8
server: nginx
vary: Accept-Encoding
access-control-allow-origin: *
access-control-allow-methods: POST
expires: Sun, 28 Dec 1980 18:57:00 EST
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
X-Firefox-Spdy: h2
p.typekit.net/p.css?s=1&k=msd8xng&ht=tk&f=37513.37518.37522&a=121980931&app=typekit&e=css
23.36.76.96200 OK 5 B URL GET HTTP/2 p.typekit.net/p.css?s=1&k=msd8xng&ht=tk&f=37513.37518.37522&a=121980931&app=typekit&e=css
IP 23.36.76.96:443
ASN #20940 Akamai International B.V.
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerDigiCert Inc
Subjectuse.typekit.net
Fingerprint42:82:CA:A5:EA:30:8F:60:60:37:2D:24:17:3D:52:62:54:D7:03:5B
ValidityThu, 21 Sep 2023 00:00:00 GMT - Mon, 21 Oct 2024 23:59:59 GMT
File type ASCII text, with no line terminators
Hash 825e67eeb6b4bfac7536fc639a56ec43
574a45385ae62544c7424e6f06417f0370b1a532
c10ff60fd741e3b2b97479f16f45e5fa57449629f4d032f647fd23041a6ad7b1
GET /p.css?s=1&k=msd8xng&ht=tk&f=37513.37518.37522&a=121980931&app=typekit&e=css HTTP/1.1
Host: p.typekit.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://use.typekit.net/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: text/css
content-length: 5
last-modified: Tue, 07 Mar 2023 19:56:00 GMT
etag: "640796d0-5"
cache-control: public, max-age=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
date: Thu, 07 Dec 2023 20:17:40 GMT
X-Firefox-Spdy: h2
www.lmbahsj2.com/sdk/click?effp=725a9a464860515bcdb576360962c546&_ef_transaction_id=5233081346044726978a6c321208c15e&oid=155&affid=809&__cc=&async=json
35.201.76.131200 OK 87 B URL GET HTTP/3 www.lmbahsj2.com/sdk/click?effp=725a9a464860515bcdb576360962c546&_ef_transaction_id=5233081346044726978a6c321208c15e&oid=155&affid=809&__cc=&async=json
IP 35.201.76.131:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerStarfield Technologies, Inc.
Subjectlmbahsj2.com
Fingerprint19:8A:1C:6D:15:5F:1E:82:A2:B6:F3:E1:A8:82:E4:C5:EE:3C:46:53
ValidityFri, 28 Apr 2023 21:05:02 GMT - Mon, 13 May 2024 15:10:13 GMT
File type troff or preprocessor input, ASCII text, with no line terminators
Hash cda2668d18a1fa5d48d4d99ec1c390d3
81c201b883f7acf85b416e2273963e0173883d84
973e83b839f78ac10dc7a1003246d5af0c5a55a4a38dc46dc259733102b2f47b
GET /sdk/click?effp=725a9a464860515bcdb576360962c546&_ef_transaction_id=5233081346044726978a6c321208c15e&oid=155&affid=809&__cc=&async=json HTTP/1.1
Host: www.lmbahsj2.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://home.refily.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
server: nginx
date: Thu, 07 Dec 2023 20:17:43 GMT
content-type: application/json; charset=utf-8
content-length: 87
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
access-control-allow-credentials: true
access-control-allow-origin: https://home.refily.com
set-cookie: uniqueClick=5552eb14-c54e-4dc6-b3fd-773a55c9913a:1701980263; Path=/; Expires=Fri, 08 Dec 2023 20:17:43 GMT; Secure; SameSite=None
transaction_id=5233081346044726978a6c321208c15e; Path=/; Expires=Wed, 06 Mar 2024 20:17:43 GMT; Secure; SameSite=None
vary: Origin
x-eflow-request-id: b919b125-f375-443d-939b-b67d08b4b3ca
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
104.18.8.131200 OK 21 kB URL User Request GET HTTP/2 home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
IP 104.18.8.131:443
Certificate IssuerCloudflare, Inc.
Subjectrefily.com
Fingerprint4E:B0:EF:C2:BE:0A:7A:01:DD:D1:07:A8:B3:6D:E0:A6:3F:84:85:37
ValidityWed, 11 Oct 2023 00:00:00 GMT - Thu, 10 Oct 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e HTTP/1.1
Host: home.refily.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:39 GMT
content-type: text/html; charset=utf-8
x-dns-prefetch-control: off
strict-transport-security: max-age=2592000
x-download-options: noopen
referrer-policy: same-origin
cache-control: no-store
cf-cache-status: DYNAMIC
set-cookie: visitorId=1ee7aefd-ac9a-49df-b071-217ebbc16294; Path=/; Expires=Fri, 06 Dec 2024 20:17:38 GMT
sourceId=affl_everflow_lre-rfl_155_809; Path=/; Expires=Thu, 14 Dec 2023 20:17:38 GMT
connect.sid=s%3AKWDtx8al4JWCHA8ZLisSFLssiYjFBL1O.qokiTHZPJuZ78uT1iRGVJIysk8HwQdjDwpP0xID1JtM; Path=/; Expires=Thu, 14 Dec 2023 20:17:39 GMT; HttpOnly
__cf_bm=QiHNjRTOiBLb8xkd7oUUY_kBrOV34ayzPVRIgdx3ZcU-1701980259-0-ATqkR3DsMblRyZ41ReHny2boEjHY+qF98be3Ux4n2+RNhOdsl7hIRDTpoc9/F3QZb7nYzx9NQlXhChdQRdQvIVA=; path=/; expires=Thu, 07-Dec-23 20:47:39 GMT; domain=.refily.com; HttpOnly; Secure; SameSite=None
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 831f74029f9c712d-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
static-lre.refinance.enhancedrefinow.com/main.93e3cac8409e105ab51a.js
104.18.4.105200 OK 811 kB URL GET HTTP/2 static-lre.refinance.enhancedrefinow.com/main.93e3cac8409e105ab51a.js
IP 104.18.4.105:443
Requested by https://home.refily.com/?moid=314646&sourceid=affl_everflow_lre-rfl_155_809&pkey1=809&pkey2=2&pkey3=5233081346044726978a6c321208c15e&sid=155&cmpid=155&crtid=&oid=155&affid=809&_ef_transaction_id=5233081346044726978a6c321208c15e
Certificate IssuerCloudflare, Inc.
Subjectenhancedrefinow.com
FingerprintCC:38:9A:93:4C:BD:74:FE:30:18:77:1F:80:24:AF:9E:02:FA:AB:56
ValidityFri, 03 Mar 2023 00:00:00 GMT - Fri, 01 Mar 2024 23:59:59 GMT
Size 811 kB (810885 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /main.93e3cac8409e105ab51a.js HTTP/1.1
Host: static-lre.refinance.enhancedrefinow.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=odxt.1w4GnrRAHDI5d6MjZDpKxMv_3ueeQr_DvNMnOg-1701980259-0-AdZNgPq9uFx3VcLR0VrJeCwhxzNQRo4GOeUYOSfkmC4LhXt2YhB9rgKU7qITuQAcE5e3SZCRm5lDeLL1DQ4CPhw=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 07 Dec 2023 20:17:39 GMT
content-type: application/javascript
last-modified: Mon, 13 Nov 2023 19:49:34 GMT
etag: W/"dec41562bede99a23e8a683bb0b2c7a7"
x-amz-server-side-encryption: AES256
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 f46f7100ad6fc83a021f62212f945830.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: EJy6PytxORPNYh-TGOTN6W-_ThcOjbKUjHTMw5tSApe4obskrYLi1A==
cf-cache-status: HIT
age: 6275
expires: Fri, 08 Dec 2023 00:17:39 GMT
cache-control: public, max-age=14400
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 831f74108c800afa-OSL
X-Firefox-Spdy: h2