GET marketmoversnews.net/rstracking.php?eKfVN5Z3RJw9ofsXna783mAQM4wBz3JiAqi/oOyyBdpNwTq2bMw4z3xqZ3Pdps1cf3UC1TRVfN9dwOejS8HaVFE91LHrhV5n7TvwJE8mfP0CdzmtkOJcpjv8Pcf3I8fCW43wTsMp6LcMr04JFOS3yA==
302 Found 0 B URL User Request GET HTTP/2 marketmoversnews.net/rstracking.php?eKfVN5Z3RJw9ofsXna783mAQM4wBz3JiAqi/oOyyBdpNwTq2bMw4z3xqZ3Pdps1cf3UC1TRVfN9dwOejS8HaVFE91LHrhV5n7TvwJE8mfP0CdzmtkOJcpjv8Pcf3I8fCW43wTsMp6LcMr04JFOS3yA==
IP
Certificate IssuerSectigo Limited
Subjectmarketmoversnews.net
Fingerprint33:AC:0B:56:16:66:4D:DE:67:A0:E3:CB:B1:89:A8:DD:D8:11:1B:FB
ValiditySat, 25 May 2024 00:00:00 GMT - Sun, 25 May 2025 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /rstracking.php?eKfVN5Z3RJw9ofsXna783mAQM4wBz3JiAqi/oOyyBdpNwTq2bMw4z3xqZ3Pdps1cf3UC1TRVfN9dwOejS8HaVFE91LHrhV5n7TvwJE8mfP0CdzmtkOJcpjv8Pcf3I8fCW43wTsMp6LcMr04JFOS3yA== HTTP/1.1
Host: marketmoversnews.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
location: https://alloptin.net
content-type: text/html; charset=UTF-8
content-length: 0
date: Tue, 17 Dec 2024 20:07:38 GMT
server: LiteSpeed
cache-control: no-cache, no-store, must-revalidate, max-age=0
x-turbo-charged-by: LiteSpeed
X-Firefox-Spdy: h2
301 Moved Permanently 795 B URL User Request GET HTTP/2 IP
Certificate IssuerSectigo Limited
Subjectalloptin.net
Fingerprint2B:B8:44:79:F4:68:A3:8B:BE:51:7C:05:57:D4:60:62:00:6A:27:ED
ValidityThu, 29 Aug 2024 00:00:00 GMT - Fri, 29 Aug 2025 23:59:59 GMT
File type HTML document, ASCII text, with CRLF, LF line terminators
Hash 5d8d79c3cb9af023240b1be6f5057aaa
df22980677b134e83d878893f7c7984e0d78a240
e8b101a7c7f64aad528cc734513cbeb02243c0af37930dc0f3239749cff184b6
GET / HTTP/1.1
Host: alloptin.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
content-type: text/html
content-length: 795
date: Tue, 17 Dec 2024 20:07:39 GMT
server: LiteSpeed
location: https://www.npvnt7trk.com/4RQSJ/79C6G4/?sub2=GoldBK
x-turbo-charged-by: LiteSpeed
X-Firefox-Spdy: h2
GET www.npvnt7trk.com/4RQSJ/79C6G4/?sub2=GoldBK
302 Found 127 B URL User Request GET HTTP/2 www.npvnt7trk.com/4RQSJ/79C6G4/?sub2=GoldBK
IP
ASN #396982 GOOGLE-CLOUD-PLATFORM
Certificate IssuerStarfield Technologies, Inc.
Subjectnpvnt7trk.com
FingerprintD5:FB:4C:EA:5B:C7:55:6A:19:69:0B:38:94:F0:1D:4F:70:CE:F2:A6
ValidityThu, 29 Aug 2024 20:36:35 GMT - Sun, 19 Jan 2025 19:01:26 GMT
File type HTML document, ASCII text
Hash 01dea152e21997d7f71b09a5cb375901
72a184c2a59304196bc4ae45732aa1584de4e3cb
2e00bd8d98ee8b4ad65bad87503c4b642563110621c28c30c01c97e02adb7469
GET /4RQSJ/79C6G4/?sub2=GoldBK HTTP/1.1
Host: www.npvnt7trk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: nginx
date: Tue, 17 Dec 2024 20:07:40 GMT
content-type: text/html; charset=utf-8
content-length: 127
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
location: https://www.lmbahsj2.com/29PD1BG/FGXLG/?source_id=9&sub1=2&sub2=b3a0950ec9aa4557a2eb160625966089
set-cookie: uniqueClick_79C6G4=08836edf-cdee-431e-b514-3a5a3d272de6:1734466060; Path=/; Expires=Thu, 19 Dec 2024 02:07:40 GMT; Secure; SameSite=None
transaction_id=b3a0950ec9aa4557a2eb160625966089; Path=/; Expires=Mon, 17 Mar 2025 20:07:40 GMT; Secure; SameSite=None
vary: Origin
x-eflow-request-id: ad50d802-5650-49c4-94e3-7b5cc15a97fc
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET www.lmbahsj2.com/29PD1BG/FGXLG/?source_id=9&sub1=2&sub2=b3a0950ec9aa4557a2eb160625966089
302 Found 260 B URL User Request GET HTTP/2 www.lmbahsj2.com/29PD1BG/FGXLG/?source_id=9&sub1=2&sub2=b3a0950ec9aa4557a2eb160625966089
IP
ASN #396982 GOOGLE-CLOUD-PLATFORM
Certificate IssuerStarfield Technologies, Inc.
Subjectlmbahsj2.com
FingerprintA1:7A:C4:FC:AC:8D:B7:8D:5A:15:64:81:79:E7:87:53:DB:D0:A2:1B
ValidityThu, 14 Mar 2024 13:49:10 GMT - Tue, 15 Apr 2025 13:49:10 GMT
File type HTML document, ASCII text
Hash e31eab3c30a46703900c2a66539b147e
da2187da3a66731679c197d697562eb5e6768679
746e5b2129639c1768c72a75e9a142ed26fbf770841f3ff075386b122b67b20b
GET /29PD1BG/FGXLG/?source_id=9&sub1=2&sub2=b3a0950ec9aa4557a2eb160625966089 HTTP/1.1
Host: www.lmbahsj2.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: nginx
date: Tue, 17 Dec 2024 20:07:40 GMT
content-type: text/html; charset=utf-8
content-length: 260
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
location: https://www.lmbahsj2.com/29PD1BG/9K7SB2/?__rpt=0&__po=9&__ptid=7dee551d427c4e25888c871fa5166504&__rpa=0&__rc=1&sub1=2&sub2=b3a0950ec9aa4557a2eb160625966089&sub3=&sub4=&sub5=&source_id=9&__pcd=9
set-cookie: uniqueClick_FGXLG=9b33400a-72a1-4d51-91c5-fab1a6cb4b54:1734466060; Path=/; Expires=Wed, 18 Dec 2024 20:07:40 GMT; Secure; SameSite=None
vary: Origin
x-eflow-request-id: adddcd80-1a5e-4d42-8b2e-ead4141280c8
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET www.lmbahsj2.com/29PD1BG/9K7SB2/?__rpt=0&__po=9&__ptid=7dee551d427c4e25888c871fa5166504&__rpa=0&__rc=1&sub1=2&sub2=b3a0950ec9aa4557a2eb160625966089&sub3=&sub4=&sub5=&source_id=9&__pcd=9
302 Found 408 B URL User Request GET HTTP/2 www.lmbahsj2.com/29PD1BG/9K7SB2/?__rpt=0&__po=9&__ptid=7dee551d427c4e25888c871fa5166504&__rpa=0&__rc=1&sub1=2&sub2=b3a0950ec9aa4557a2eb160625966089&sub3=&sub4=&sub5=&source_id=9&__pcd=9
IP
ASN #396982 GOOGLE-CLOUD-PLATFORM
Certificate IssuerStarfield Technologies, Inc.
Subjectlmbahsj2.com
FingerprintA1:7A:C4:FC:AC:8D:B7:8D:5A:15:64:81:79:E7:87:53:DB:D0:A2:1B
ValidityThu, 14 Mar 2024 13:49:10 GMT - Tue, 15 Apr 2025 13:49:10 GMT
File type HTML document, ASCII text, with very long lines (406)
Hash 1bab3fa3ba539bdd62c873776bd34292
1aa276f86a594e0311458927b3ace96fb26ebe84
50e4fe01d201dca238d554f3d4281139cdb83b9b7122dbda523a50a9f5302fb9
GET /29PD1BG/9K7SB2/?__rpt=0&__po=9&__ptid=7dee551d427c4e25888c871fa5166504&__rpa=0&__rc=1&sub1=2&sub2=b3a0950ec9aa4557a2eb160625966089&sub3=&sub4=&sub5=&source_id=9&__pcd=9 HTTP/1.1
Host: www.lmbahsj2.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: uniqueClick_FGXLG=9b33400a-72a1-4d51-91c5-fab1a6cb4b54:1734466060
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 302 Found
server: nginx
date: Tue, 17 Dec 2024 20:07:40 GMT
content-type: text/html; charset=utf-8
content-length: 408
accept-ch: Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua-Model
location: https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
set-cookie: uniqueClick_9K7SB2=3941a05d-67a5-487d-b54a-577a975e9c45:1734466060; Path=/; Expires=Wed, 18 Dec 2024 20:07:40 GMT; Secure; SameSite=None
transaction_id=0805f9d09c054bf0bbe2fb66a8491c63; Path=/; Expires=Mon, 17 Mar 2025 20:07:40 GMT; Secure; SameSite=None
vary: Origin
x-eflow-request-id: ac4fd1de-673b-466e-9070-e43078021b03
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
301 Moved Permanently 795 B IP
Certificate IssuerSectigo Limited
Subjectmarketmoversnews.net
Fingerprint33:AC:0B:56:16:66:4D:DE:67:A0:E3:CB:B1:89:A8:DD:D8:11:1B:FB
ValiditySat, 25 May 2024 00:00:00 GMT - Sun, 25 May 2025 23:59:59 GMT
File type HTML document, ASCII text, with CRLF, LF line terminators
Hash 5d8d79c3cb9af023240b1be6f5057aaa
df22980677b134e83d878893f7c7984e0d78a240
e8b101a7c7f64aad528cc734513cbeb02243c0af37930dc0f3239749cff184b6
GET / HTTP/1.1
Host: marketmoversnews.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
keep-alive: timeout=5, max=100
content-type: text/html
content-length: 795
date: Tue, 17 Dec 2024 20:07:41 GMT
server: LiteSpeed
location: https://marketmoversnews.net/
x-turbo-charged-by: LiteSpeed
GET widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js
200 OK 7.4 kB URL GET HTTP/2 widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerAmazon
Subject*.trustpilot.com
Fingerprint5C:AB:2E:95:E4:51:10:BB:40:25:C7:8D:ED:DC:24:1E:43:F0:65:23
ValidityTue, 03 Dec 2024 00:00:00 GMT - Thu, 01 Jan 2026 23:59:59 GMT
File type JavaScript source, Unicode text, UTF-8 (with BOM) text, with very long lines (23588)
Hash aaede52b3eb338a4c40a92d3dbe23826
230358c6626a991066aa9d0a759961ddf864be8a
682ab4c8be1cb38cf575dddee00463eb0a6b4c21c322c9be24eb76ca899117f2
GET /bootstrap/v5/tp.widget.bootstrap.min.js HTTP/1.1
Host: widget.trustpilot.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/x-javascript
content-length: 7350
last-modified: Wed, 09 Oct 2024 12:04:38 GMT
x-amz-server-side-encryption: AES256
content-encoding: gzip
accept-ranges: bytes
server: AmazonS3
date: Tue, 17 Dec 2024 02:12:20 GMT
cache-control: max-age=86400
etag: "7d4644d89e45fe92623bdd628e60e8dd"
x-cache: Hit from cloudfront
via: 1.1 f66e3db0f0449307dba3fbf72bbf3bac.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: Yt06IowLcYMSA_oM9dtrit8iGrGK1Rrj56RPQvHA5Dld8E-Z9kGK4g==
age: 64521
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
GET widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js
200 OK 7.4 kB URL GET HTTP/2 widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerAmazon
Subject*.trustpilot.com
Fingerprint5C:AB:2E:95:E4:51:10:BB:40:25:C7:8D:ED:DC:24:1E:43:F0:65:23
ValidityTue, 03 Dec 2024 00:00:00 GMT - Thu, 01 Jan 2026 23:59:59 GMT
File type JavaScript source, Unicode text, UTF-8 (with BOM) text, with very long lines (23588)
Hash aaede52b3eb338a4c40a92d3dbe23826
230358c6626a991066aa9d0a759961ddf864be8a
682ab4c8be1cb38cf575dddee00463eb0a6b4c21c322c9be24eb76ca899117f2
GET /bootstrap/v5/tp.widget.bootstrap.min.js HTTP/1.1
Host: widget.trustpilot.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/x-javascript
content-length: 7350
last-modified: Wed, 09 Oct 2024 12:04:38 GMT
x-amz-server-side-encryption: AES256
content-encoding: gzip
accept-ranges: bytes
server: AmazonS3
date: Tue, 17 Dec 2024 02:12:20 GMT
cache-control: max-age=86400
etag: "7d4644d89e45fe92623bdd628e60e8dd"
x-cache: Hit from cloudfront
via: 1.1 f66e3db0f0449307dba3fbf72bbf3bac.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: EK9-RQnTPv0WW7nwy_UR0I0aO6Fnkytm09CYf1yd7SwsH-TgT4MtCw==
age: 64521
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
GET www.googletagmanager.com/gtm.js?id=GTM-5B82MZ73
200 OK 109 kB URL GET HTTP/2 www.googletagmanager.com/gtm.js?id=GTM-5B82MZ73
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subject*.google-analytics.com
Fingerprint4B:B1:5A:60:07:55:DD:0C:FA:98:D3:8E:E8:58:9E:E7:6A:0D:60:12
ValidityMon, 04 Nov 2024 08:37:47 GMT - Mon, 27 Jan 2025 08:37:46 GMT
File type JavaScript source, ASCII text, with very long lines (18150)
Size 109 kB (108919 bytes)
Hash 138904266b50d307a8f925ced4353611
fae7c4bed8f85ead5f9b59b0672dbdbc5d2bfd4a
3569c6660db159470a524921442f79f36b06582e9f03f51f3095c0d5f684179e
GET /gtm.js?id=GTM-5B82MZ73 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Tue, 17 Dec 2024 20:07:41 GMT
expires: Tue, 17 Dec 2024 20:07:41 GMT
cache-control: private, max-age=900
last-modified: Tue, 17 Dec 2024 18:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
server: Google Tag Manager
content-length: 108919
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET use.typekit.net/dcq8kbe.css
200 OK 884 B URL GET HTTP/2 use.typekit.net/dcq8kbe.css
IP
ASN #20940 Akamai International B.V.
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subjectuse.typekit.net
FingerprintF3:36:2A:08:11:E8:8C:54:E5:3C:6A:03:53:BF:AA:D7:7A:84:8B:89
ValidityTue, 10 Dec 2024 00:00:00 GMT - Sat, 10 Jan 2026 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (516)
Hash 9b7429309aa7a509fe0d3d59ea932823
7c3e80bf04bb19f17ceda1e62b1e3be59be73c85
9afdd14bf99da6623d565f70abb79f9e9e865c0b632e53e96db05d9b7f1113b8
GET /dcq8kbe.css HTTP/1.1
Host: use.typekit.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: text/css;charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains;
cache-control: private, max-age=600, stale-while-revalidate=604800
timing-allow-origin: *
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
content-length: 884
date: Tue, 17 Dec 2024 20:07:42 GMT
X-Firefox-Spdy: h2
GET loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
200 OK 115 kB URL User Request GET HTTP/2 loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
IP
Certificate IssuerGoogle Trust Services
Subjectloans.quickenloans.com
Fingerprint9B:58:4A:65:BD:EC:A5:31:73:3E:E2:82:74:12:E2:BD:67:80:66:0D
ValiditySat, 30 Nov 2024 14:32:02 GMT - Fri, 28 Feb 2025 14:32:01 GMT
File type gzip compressed data, from Unix
Size 115 kB (115403 bytes)
Hash f0f7d3b89d3d1a3fb75409f2679148e0
988dc76b2ae5d00a8cea261f6252e5186a22e51e
075de4adbf249154edfa297a8a299ca535438390fdb8788ce7c33a404ad5a5bc
GET /?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content= HTTP/1.1
Host: loans.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:41 GMT
content-type: text/html; charset=utf-8
x-dns-prefetch-control: off
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
origin-agent-cluster: ?1
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
cf-cache-status: DYNAMIC
set-cookie: AWSALBTG=e8PL7MKrh49qKtU3+P158XLEhHp+WBlr2+FfBvRTbj38jbLOTaww/cFR+5lbpOsdx4e0yIKErwu8WXEKQc1xwEX0f0vklhvyKZ2F7PZGRdmvXrEd/B7DiSXslSaJaZMGElB3XtU1LKbT1vwTUNBCnob+lF/yXK+WP1meh2dYeZ4mhHpAiyo=; Expires=Tue, 24 Dec 2024 20:07:41 GMT; Path=/
AWSALBTGCORS=e8PL7MKrh49qKtU3+P158XLEhHp+WBlr2+FfBvRTbj38jbLOTaww/cFR+5lbpOsdx4e0yIKErwu8WXEKQc1xwEX0f0vklhvyKZ2F7PZGRdmvXrEd/B7DiSXslSaJaZMGElB3XtU1LKbT1vwTUNBCnob+lF/yXK+WP1meh2dYeZ4mhHpAiyo=; Expires=Tue, 24 Dec 2024 20:07:41 GMT; Path=/; SameSite=None; Secure
__cf_bm=6zj9k6NfC.Dvw_3NYSbKzrNzrdo5MSleN3nF2bS8.xQ-1734466061-1.0.1.1-EVDzBFJmww0dmak7xuAH4FZR9l0DgA_FF77HYpK4mAzLgjxu3i7aV.1TUyH_Th1DQtYc1wpGz4Yszt1qWRv9GQ; path=/; expires=Tue, 17-Dec-24 20:37:41 GMT; domain=.loans.quickenloans.com; HttpOnly; Secure; SameSite=None
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8f398a6e9f8db500-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
GET p.typekit.net/p.css?s=1&k=dcq8kbe&ht=tk&f=6844.6845.6846.6847.6848.6851.6852.6853&a=176595194&app=typekit&e=css
200 OK 5 B URL GET HTTP/2 p.typekit.net/p.css?s=1&k=dcq8kbe&ht=tk&f=6844.6845.6846.6847.6848.6851.6852.6853&a=176595194&app=typekit&e=css
IP
ASN #20940 Akamai International B.V.
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subjectuse.typekit.net
FingerprintF3:36:2A:08:11:E8:8C:54:E5:3C:6A:03:53:BF:AA:D7:7A:84:8B:89
ValidityTue, 10 Dec 2024 00:00:00 GMT - Sat, 10 Jan 2026 23:59:59 GMT
Hash 83d24d4b43cc7eef2b61e66c95f3d158
f0cafc285ee23bb6c28c5166f305493c4331c84d
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb
GET /p.css?s=1&k=dcq8kbe&ht=tk&f=6844.6845.6846.6847.6848.6851.6852.6853&a=176595194&app=typekit&e=css HTTP/1.1
Host: p.typekit.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://use.typekit.net/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: text/css
content-length: 5
last-modified: Sun, 01 Dec 2024 12:58:09 GMT
etag: "674c5d61-5"
cache-control: public, max-age=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
date: Tue, 17 Dec 2024 20:07:42 GMT
X-Firefox-Spdy: h2
200 OK 27 kB IP
Certificate IssuerSectigo Limited
Subjectmarketmoversnews.net
Fingerprint33:AC:0B:56:16:66:4D:DE:67:A0:E3:CB:B1:89:A8:DD:D8:11:1B:FB
ValiditySat, 25 May 2024 00:00:00 GMT - Sun, 25 May 2025 23:59:59 GMT
File type HTML document, ASCII text, with very long lines (14449)
Hash c826693fa37939fdbef5470f63f5888e
d20014c05f6542da487d0b985945f2fa3dec7622
f8880688dcc38016c6031c55e2577b79665c498e6cfeb32664b34274299e1817
GET / HTTP/1.1
Host: marketmoversnews.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
link: <https://marketmoversnews.net/wp-json/>; rel="https://api.w.org/", <https://marketmoversnews.net/wp-json/wp/v2/pages/10212>; rel="alternate"; title="JSON"; type="application/json", <https://marketmoversnews.net/>; rel=shortlink
etag: "352252-1734465864;br"
x-litespeed-cache: hit
content-encoding: br
vary: Accept-Encoding
content-length: 27318
date: Tue, 17 Dec 2024 20:07:42 GMT
server: LiteSpeed
x-turbo-charged-by: LiteSpeed
X-Firefox-Spdy: h2
POST www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Floans.quickenloans.com%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=430582545.1734466062&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&auid=292079720.1734466062&navt=n&npa=1>m=45He4cc1v9137104487za200&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&tft=1734466062098&tfd=3741&apve=1
200 OK 0 B URL POST HTTP/2 www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Floans.quickenloans.com%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=430582545.1734466062&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&auid=292079720.1734466062&navt=n&npa=1>m=45He4cc1v9137104487za200&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&tft=1734466062098&tfd=3741&apve=1
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectwww.google.com
FingerprintC1:EF:1D:9F:32:BB:31:2D:F3:08:D9:D6:97:9C:21:A1:A2:67:F9:C5
ValidityMon, 04 Nov 2024 08:39:37 GMT - Mon, 27 Jan 2025 08:39:36 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /ccm/collect?en=page_view&dl=https%3A%2F%2Floans.quickenloans.com%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=430582545.1734466062&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&auid=292079720.1734466062&navt=n&npa=1>m=45He4cc1v9137104487za200&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&tft=1734466062098&tfd=3741&apve=1 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
HTTP/2 200 OK
content-type: text/plain
date: Tue, 17 Dec 2024 20:07:42 GMT
pragma: no-cache
cache-control: no-cache, no-store, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT
vary: Origin, X-Origin, Referer
server: scaffolding on HTTPServer2
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
access-control-allow-origin: null
access-control-expose-headers: date,vary,vary,vary,server,content-length
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET sgtm.quickenloans.com/g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4cc1v9169491831z89137104487za200zb9137104487&_p=1734466061734&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=1732213836.1734466062&ecid=512155603&ul=en-us&sr=1280x1024&_fplc=0&ur=NO-03&frm=0&pscdl=noapi&sst.etld=google.no&sst.gcsub=region1&sst.tft=1734466061734&sst.ude=0&_s=1&sid=1734466062&sct=1&seg=0&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D0805f9d09c054bf0bbe2fb66a8491c63%26pkey%3Db3a0950ec9aa4557a2eb160625966089%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D0805f9d09c054bf0bbe2fb66a8491c63%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=3994&richsstsse
200 OK 1.5 kB URL GET HTTP/2 sgtm.quickenloans.com/g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4cc1v9169491831z89137104487za200zb9137104487&_p=1734466061734&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=1732213836.1734466062&ecid=512155603&ul=en-us&sr=1280x1024&_fplc=0&ur=NO-03&frm=0&pscdl=noapi&sst.etld=google.no&sst.gcsub=region1&sst.tft=1734466061734&sst.ude=0&_s=1&sid=1734466062&sct=1&seg=0&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D0805f9d09c054bf0bbe2fb66a8491c63%26pkey%3Db3a0950ec9aa4557a2eb160625966089%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D0805f9d09c054bf0bbe2fb66a8491c63%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=3994&richsstsse
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectsgtm.quickenloans.com
Fingerprint4E:86:D8:38:35:2F:10:58:51:04:6D:AF:7F:BE:F9:A5:A6:A8:AA:4E
ValidityThu, 21 Nov 2024 05:40:09 GMT - Wed, 19 Feb 2025 06:30:20 GMT
Hash aaab599d98eef33c4fe995f62a76fa5e
d39e84e6921b7aa07360a0cc85f8bf2d67a2ce13
34b304e91809ba2f26c4974844d1c0fc0001c770ffb586300270ef08dcb21d3d
GET /g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4cc1v9169491831z89137104487za200zb9137104487&_p=1734466061734&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=1732213836.1734466062&ecid=512155603&ul=en-us&sr=1280x1024&_fplc=0&ur=NO-03&frm=0&pscdl=noapi&sst.etld=google.no&sst.gcsub=region1&sst.tft=1734466061734&sst.ude=0&_s=1&sid=1734466062&sct=1&seg=0&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D0805f9d09c054bf0bbe2fb66a8491c63%26pkey%3Db3a0950ec9aa4557a2eb160625966089%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D0805f9d09c054bf0bbe2fb66a8491c63%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=3994&richsstsse HTTP/1.1
Host: sgtm.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Cookie: _gcl_au=1.1.292079720.1734466062; _ga_RXLL9Z7XBK=GS1.1.1734466062.1.0.1734466062.0.0.512155603; _ga=GA1.1.1732213836.1734466062
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
set-cookie: FPID=FPID2.2.7BN82GxkN50PGwJtJgKtT%2B797zZ0rvW9GB%2ByS%2Bwgwcs%3D.1734466062; Max-Age=63072000; Domain=quickenloans.com; Path=/; Secure; HttpOnly
FPLC=m74aSE0dBqBCWUlndHtbfk%2B1MbFWrABgGYwnewpw7WP00VFIfAhDEfw1WaVPTcT%2FbQmuyGfZgakgTBLFal4ECPXWwIKlRbBgkS6pC0WPfvk3Tks%2FTdEbmByj1dJFLQ%3D%3D; Max-Age=72000; Domain=quickenloans.com; Path=/; Secure
FPAU=1.1.292079720.1734466062; Max-Age=7775999; Domain=quickenloans.com; Path=/; Secure
FPGSID=1.1734466062.1734466062.G-RXLL9Z7XBK.yZ0aqn3abjvtwot60Cd-aQ; Max-Age=1800; Domain=quickenloans.com; Path=/; SameSite=strict; Secure
cache-control: no-cache
content-type: text/plain
x-content-type-options: nosniff
x-accel-buffering: no
access-control-allow-origin: https://loans.quickenloans.com
access-control-allow-credentials: true
date: Tue, 17 Dec 2024 20:07:42 GMT
server: Google Frontend
expires: Tue, 17 Dec 2024 20:07:42 GMT
X-Firefox-Spdy: h2
GET use.typekit.net/af/cafa63/00000000000000000001709a/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
200 OK 24 kB URL GET HTTP/2 use.typekit.net/af/cafa63/00000000000000000001709a/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
IP
ASN #20940 Akamai International B.V.
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subjectuse.typekit.net
FingerprintF3:36:2A:08:11:E8:8C:54:E5:3C:6A:03:53:BF:AA:D7:7A:84:8B:89
ValidityTue, 10 Dec 2024 00:00:00 GMT - Sat, 10 Jan 2026 23:59:59 GMT
File type Web Open Font Format (Version 2), TrueType, length 24272, version 1.0
Hash 33150f36436b3a686d25d599762d6974
084c5cdedbfa82ce1dba3ae94d35ad1d1ebbe586
5461e0722bbe365dfa0df4652c60a6ced5f83c840d03021c4abd04ae9f9c6980
GET /af/cafa63/00000000000000000001709a/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3 HTTP/1.1
Host: use.typekit.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Referer: https://use.typekit.net/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: application/font-woff2
content-length: 24272
etag: "1500587fffa9a4bb64d06e988493ea23a02a484a"
timing-allow-origin: *
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cache-control: public, max-age=31536000
date: Tue, 17 Dec 2024 20:07:44 GMT
X-Firefox-Spdy: h2
POST rum-http-intake.logs.datadoghq.com/v1/input/pub7338472aab069e71fb1763621d542e2d?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Apersonal-loans-webapp%2Cversion%3A1.0.0%20undefined&batch_time=1734466064309
200 OK 2 B URL POST HTTP/2 rum-http-intake.logs.datadoghq.com/v1/input/pub7338472aab069e71fb1763621d542e2d?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Apersonal-loans-webapp%2Cversion%3A1.0.0%20undefined&batch_time=1734466064309
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subject*.logs.datadoghq.com
Fingerprint2C:EC:E2:99:9F:AB:D2:83:2C:57:3F:0A:AE:AB:85:75:D7:C5:EA:16
ValiditySat, 14 Dec 2024 00:00:00 GMT - Wed, 17 Dec 2025 23:59:59 GMT
Hash 99914b932bd37a50b983c5e7c90ae93b
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
POST /v1/input/pub7338472aab069e71fb1763621d542e2d?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Apersonal-loans-webapp%2Cversion%3A1.0.0%20undefined&batch_time=1734466064309 HTTP/1.1
Host: rum-http-intake.logs.datadoghq.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 16019
Origin: null
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/json
content-length: 2
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 17 Dec 2024 20:07:44 GMT
X-Firefox-Spdy: h2
POST browser-intake-datadoghq.com/api/v2/logs?ddsource=browser&ddtags=sdk_version%3A5.34.0%2Capi%3Axhr%2Cenv%3Aprod%2Cservice%3Aql&dd-api-key=pub4d5c615be9e91858ed9e115fd855570c&dd-evp-origin-version=5.34.0&dd-evp-origin=browser&dd-request-id=6d2f22c0-756c-4fc0-8f1b-0eca6c185e38
202 Accepted 53 B URL POST HTTP/2 browser-intake-datadoghq.com/api/v2/logs?ddsource=browser&ddtags=sdk_version%3A5.34.0%2Capi%3Axhr%2Cenv%3Aprod%2Cservice%3Aql&dd-api-key=pub4d5c615be9e91858ed9e115fd855570c&dd-evp-origin-version=5.34.0&dd-evp-origin=browser&dd-request-id=6d2f22c0-756c-4fc0-8f1b-0eca6c185e38
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subject*.browser-intake-datadoghq.com
FingerprintA5:35:6C:08:38:11:47:18:E3:47:D1:C3:02:96:A1:9D:F0:42:EA:64
ValidityTue, 14 May 2024 00:00:00 GMT - Sat, 17 May 2025 23:59:59 GMT
Hash 31301d4d17af5b20ae02351944a09dfa
2252c532ee93cf25c827c4359e5d979793222b71
0ba9772fda8d111b75cada4d66a0397160c609fea26f8dc63c4cf1210032c357
POST /api/v2/logs?ddsource=browser&ddtags=sdk_version%3A5.34.0%2Capi%3Axhr%2Cenv%3Aprod%2Cservice%3Aql&dd-api-key=pub4d5c615be9e91858ed9e115fd855570c&dd-evp-origin-version=5.34.0&dd-evp-origin=browser&dd-request-id=6d2f22c0-756c-4fc0-8f1b-0eca6c185e38 HTTP/1.1
Host: browser-intake-datadoghq.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 3108
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 202 Accepted
content-type: application/json
content-length: 53
dd-request-id: 6d2f22c0-756c-4fc0-8f1b-0eca6c185e38
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 17 Dec 2024 20:07:44 GMT
X-Firefox-Spdy: h2
GET region1.analytics.google.com/g/s/collect?dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1>m=45j91e4c50v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485~102198178&_gsid=RXLL9Z7XBKyZ0aqn3abjvtwot60Cd-aQ
204 No Content 0 B URL GET HTTP/2 region1.analytics.google.com/g/s/collect?dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1>m=45j91e4c50v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485~102198178&_gsid=RXLL9Z7XBKyZ0aqn3abjvtwot60Cd-aQ
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subject*.google-analytics.com
Fingerprint4B:B1:5A:60:07:55:DD:0C:FA:98:D3:8E:E8:58:9E:E7:6A:0D:60:12
ValidityMon, 04 Nov 2024 08:37:47 GMT - Mon, 27 Jan 2025 08:37:46 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /g/s/collect?dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1>m=45j91e4c50v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485~102198178&_gsid=RXLL9Z7XBKyZ0aqn3abjvtwot60Cd-aQ HTTP/1.1
Host: region1.analytics.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
access-control-allow-origin: *
date: Tue, 17 Dec 2024 20:07:45 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: text/plain
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:194:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:194:0"}],}
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
200 OK 22 kB URL GET HTTP/2 www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subject*.datadoghq-browser-agent.com
Fingerprint9E:40:A3:B8:F8:5F:43:15:5B:BB:AF:99:5C:07:D1:39:23:59:1F:51
ValidityTue, 30 Jul 2024 00:00:00 GMT - Sun, 03 Aug 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (57717), with no line terminators
Hash 128043f544d32e5dd61fa0fc8c1b4fa4
57131d2cb928c55b30da84b27263743d060ebf45
99e75b418cdd0a7723b17d22628712ef23a65cccc024c5decf42926fc7acc25d
GET /us1/v5/datadog-logs.js HTTP/1.1
Host: www.datadoghq-browser-agent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: text/javascript
last-modified: Mon, 16 Dec 2024 13:03:41 GMT
content-encoding: br
x-amz-server-side-encryption: AES256
server: AmazonS3
date: Tue, 17 Dec 2024 20:07:43 GMT
cache-control: max-age=14400, s-maxage=60
etag: W/"128043f544d32e5dd61fa0fc8c1b4fa4"
vary: accept-encoding
x-cache: Hit from cloudfront
via: 1.1 ab09332bca1a3bd382d2e408f65b98d2.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: Qig8aBk3r-pdmc8LpE3zFoqbaMotlw_vpw3z-3yjtqvsgK0vEwMVJg==
timing-allow-origin: *
X-Firefox-Spdy: h2
POST session-replay.browser-intake-datadoghq.com/api/v2/replay?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Apersonal-loans-webapp%2Cversion%3A1.0.0%20undefined&dd-api-key=pub7338472aab069e71fb1763621d542e2d&dd-evp-origin-version=3.11.0&dd-evp-origin=browser&dd-request-id=16363298-d2f6-4f9d-bf28-e355e93ed206
202 Accepted 53 B URL POST HTTP/2 session-replay.browser-intake-datadoghq.com/api/v2/replay?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Apersonal-loans-webapp%2Cversion%3A1.0.0%20undefined&dd-api-key=pub7338472aab069e71fb1763621d542e2d&dd-evp-origin-version=3.11.0&dd-evp-origin=browser&dd-request-id=16363298-d2f6-4f9d-bf28-e355e93ed206
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subject*.browser-intake-datadoghq.com
FingerprintA5:35:6C:08:38:11:47:18:E3:47:D1:C3:02:96:A1:9D:F0:42:EA:64
ValidityTue, 14 May 2024 00:00:00 GMT - Sat, 17 May 2025 23:59:59 GMT
Hash 4fba6a11f17a5f02591ea2041d34f408
773126c5585a17aa54bfc90631f5c72cc70bc8f8
d9a308a73f6e4ffd94a1853f1b097441af55b8076471133571f3ee4fbac8c6bf
POST /api/v2/replay?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Apersonal-loans-webapp%2Cversion%3A1.0.0%20undefined&dd-api-key=pub7338472aab069e71fb1763621d542e2d&dd-evp-origin-version=3.11.0&dd-evp-origin=browser&dd-request-id=16363298-d2f6-4f9d-bf28-e355e93ed206 HTTP/1.1
Host: session-replay.browser-intake-datadoghq.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data; boundary=---------------------------354675965915046406531570528496
Content-Length: 20845
Origin: null
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 202 Accepted
content-type: application/json
content-length: 53
dd-request-id: 16363298-d2f6-4f9d-bf28-e355e93ed206
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 17 Dec 2024 20:07:45 GMT
X-Firefox-Spdy: h2
GET www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1732213836.1734466062>m=45j91e4c50v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485~102198178&aip=1&z=573747433
200 OK 42 B URL GET HTTP/2 www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1732213836.1734466062>m=45j91e4c50v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485~102198178&aip=1&z=573747433
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subject*.google.no
FingerprintA8:FC:63:57:7C:92:2A:02:1C:BE:71:EF:F7:D9:C9:CD:5F:12:37:9A
ValidityMon, 04 Nov 2024 08:40:36 GMT - Mon, 27 Jan 2025 08:40:35 GMT
File type GIF image data, version 89a, 1 x 1
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1732213836.1734466062>m=45j91e4c50v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485~102198178&aip=1&z=573747433 HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 17 Dec 2024 20:07:45 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET fonts.googleapis.com/css?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
200 OK 608 B URL GET HTTP/2 fonts.googleapis.com/css?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectupload.video.google.com
FingerprintD4:A3:E0:67:E1:FB:D8:0C:7B:58:AE:DA:81:4F:CA:47:9A:07:6E:5B
ValidityMon, 04 Nov 2024 08:38:51 GMT - Mon, 27 Jan 2025 08:38:50 GMT
File type gzip compressed data, max compression
Hash 48ae4e5edc68a256eca621ca89ae1a26
e9a320380f19b5813dcd834b3c2a1d0a5fcc73d4
df1eeec4f3e8c1108ea9318d7abd5a3cef5f07decc0131f0f2097f85f44d2511
GET /css?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Tue, 17 Dec 2024 20:07:44 GMT
date: Tue, 17 Dec 2024 20:07:44 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET loans.quickenloans.com/main.72a5874a8b922f57cdb3.js
200 OK 708 kB URL GET HTTP/2 loans.quickenloans.com/main.72a5874a8b922f57cdb3.js
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectloans.quickenloans.com
Fingerprint9B:58:4A:65:BD:EC:A5:31:73:3E:E2:82:74:12:E2:BD:67:80:66:0D
ValiditySat, 30 Nov 2024 14:32:02 GMT - Fri, 28 Feb 2025 14:32:01 GMT
File type gzip compressed data, from Unix
Size 708 kB (707564 bytes)
Hash 6c6afdafe60c036065ca3694fc42651a
90a5320f9e6760f18597d0f2dc74ec7c8b80d55c
e844208b8bb85db6caf26da09e05d6f3418fca87b7ea844ff6435421cfd5be4a
GET /main.72a5874a8b922f57cdb3.js HTTP/1.1
Host: loans.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: AWSALBTG=e8PL7MKrh49qKtU3+P158XLEhHp+WBlr2+FfBvRTbj38jbLOTaww/cFR+5lbpOsdx4e0yIKErwu8WXEKQc1xwEX0f0vklhvyKZ2F7PZGRdmvXrEd/B7DiSXslSaJaZMGElB3XtU1LKbT1vwTUNBCnob+lF/yXK+WP1meh2dYeZ4mhHpAiyo=; AWSALBTGCORS=e8PL7MKrh49qKtU3+P158XLEhHp+WBlr2+FfBvRTbj38jbLOTaww/cFR+5lbpOsdx4e0yIKErwu8WXEKQc1xwEX0f0vklhvyKZ2F7PZGRdmvXrEd/B7DiSXslSaJaZMGElB3XtU1LKbT1vwTUNBCnob+lF/yXK+WP1meh2dYeZ4mhHpAiyo=; __cf_bm=6zj9k6NfC.Dvw_3NYSbKzrNzrdo5MSleN3nF2bS8.xQ-1734466061-1.0.1.1-EVDzBFJmww0dmak7xuAH4FZR9l0DgA_FF77HYpK4mAzLgjxu3i7aV.1TUyH_Th1DQtYc1wpGz4Yszt1qWRv9GQ
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:43 GMT
content-type: application/javascript; charset=UTF-8
x-powered-by: Express
cache-control: public, max-age=14400
last-modified: Mon, 09 Dec 2024 19:17:07 GMT
etag: W/"309017-193acda9738"
cf-cache-status: MISS
expires: Wed, 18 Dec 2024 00:07:42 GMT
vary: Accept-Encoding
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8f398a7609c1b500-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
POST rum-http-intake.logs.datadoghq.com/v1/input/pub7338472aab069e71fb1763621d542e2d?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Apersonal-loans-webapp%2Cversion%3A1.0.0%20undefined&batch_time=1734466065414
200 OK 2 B URL POST HTTP/2 rum-http-intake.logs.datadoghq.com/v1/input/pub7338472aab069e71fb1763621d542e2d?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Apersonal-loans-webapp%2Cversion%3A1.0.0%20undefined&batch_time=1734466065414
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subject*.logs.datadoghq.com
Fingerprint2C:EC:E2:99:9F:AB:D2:83:2C:57:3F:0A:AE:AB:85:75:D7:C5:EA:16
ValiditySat, 14 Dec 2024 00:00:00 GMT - Wed, 17 Dec 2025 23:59:59 GMT
Hash 99914b932bd37a50b983c5e7c90ae93b
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
POST /v1/input/pub7338472aab069e71fb1763621d542e2d?ddsource=browser&ddtags=sdk_version%3A3.11.0%2Cenv%3Aprod%2Cservice%3Apersonal-loans-webapp%2Cversion%3A1.0.0%20undefined&batch_time=1734466065414 HTTP/1.1
Host: rum-http-intake.logs.datadoghq.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 16000
Origin: null
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
content-type: application/json
content-length: 2
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 17 Dec 2024 20:07:45 GMT
X-Firefox-Spdy: h2
GET use.typekit.net/af/1b1b1e/00000000000000000001709e/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
200 OK 24 kB URL GET HTTP/2 use.typekit.net/af/1b1b1e/00000000000000000001709e/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
IP
ASN #20940 Akamai International B.V.
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subjectuse.typekit.net
FingerprintF3:36:2A:08:11:E8:8C:54:E5:3C:6A:03:53:BF:AA:D7:7A:84:8B:89
ValidityTue, 10 Dec 2024 00:00:00 GMT - Sat, 10 Jan 2026 23:59:59 GMT
File type Web Open Font Format (Version 2), TrueType, length 24180, version 1.0
Hash a077d487ed95691f5343f69eac4417db
a606a40b605563afb9b7ab1452258ae9f9c49d09
9bacad71ca24f6147c4b72a6c0f351b07ba93b70f992082b812681fb3b46d9b6
GET /af/1b1b1e/00000000000000000001709e/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3 HTTP/1.1
Host: use.typekit.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Referer: https://use.typekit.net/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: application/font-woff2
content-length: 24180
etag: "f507d4945327bf77fa226b6fef0f1c6a6af3bf09"
timing-allow-origin: *
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cache-control: public, max-age=31536000
date: Tue, 17 Dec 2024 20:07:46 GMT
X-Firefox-Spdy: h2
GET use.typekit.net/af/d32e26/00000000000000000001709b/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i4&v=3
200 OK 25 kB URL GET HTTP/2 use.typekit.net/af/d32e26/00000000000000000001709b/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i4&v=3
IP
ASN #20940 Akamai International B.V.
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subjectuse.typekit.net
FingerprintF3:36:2A:08:11:E8:8C:54:E5:3C:6A:03:53:BF:AA:D7:7A:84:8B:89
ValidityTue, 10 Dec 2024 00:00:00 GMT - Sat, 10 Jan 2026 23:59:59 GMT
File type Web Open Font Format (Version 2), TrueType, length 25016, version 1.0
Hash f3b01a591c6cdfac684714571fd098c1
0c485f50893ce349c83a06a044f697a8960a310c
6069bebbfc9a535fa8bf81fa81ce8741f6cef9e5fefd807aa1710a365cfed798
GET /af/d32e26/00000000000000000001709b/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i4&v=3 HTTP/1.1
Host: use.typekit.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Referer: https://use.typekit.net/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: application/font-woff2
content-length: 25016
etag: "9689d00c5dfd98cdda07ad0f85b16f1599038e27"
timing-allow-origin: *
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cache-control: public, max-age=31536000
date: Tue, 17 Dec 2024 20:07:46 GMT
X-Firefox-Spdy: h2
POST loans.quickenloans.com/api/tracking/clickV3
200 OK 26 kB URL POST HTTP/2 loans.quickenloans.com/api/tracking/clickV3
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectloans.quickenloans.com
Fingerprint9B:58:4A:65:BD:EC:A5:31:73:3E:E2:82:74:12:E2:BD:67:80:66:0D
ValiditySat, 30 Nov 2024 14:32:02 GMT - Fri, 28 Feb 2025 14:32:01 GMT
File type gzip compressed data, from Unix
Hash d800371e3eea790c13dbb9039be8755c
409317518bd52c4245d9046f929196c935c71c4b
4c452ab0d89449721ebc89d3d05d04acad1f973897d7ea57f0fe63898b3b13f0
POST /api/tracking/clickV3 HTTP/1.1
Host: loans.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 919
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Cookie: AWSALBTG=DvrFF/JIpaMrvUKA0B1fYN/OfgT+/9ElD8eUEEAGnMO/Y3DQd8qiChKRYaNJ6ytRqg8lHIBH/OkI+A7H+vhj11K5O2CGTSUsosws6WT6gjOSd4urigfJ6r6a8czxRRbJ1S74/8hBMERzZ4bouZyDhmZrPSKveFjSD/0sBmy2Bk8dpTQVnHc=; AWSALBTGCORS=DvrFF/JIpaMrvUKA0B1fYN/OfgT+/9ElD8eUEEAGnMO/Y3DQd8qiChKRYaNJ6ytRqg8lHIBH/OkI+A7H+vhj11K5O2CGTSUsosws6WT6gjOSd4urigfJ6r6a8czxRRbJ1S74/8hBMERzZ4bouZyDhmZrPSKveFjSD/0sBmy2Bk8dpTQVnHc=; __cf_bm=6zj9k6NfC.Dvw_3NYSbKzrNzrdo5MSleN3nF2bS8.xQ-1734466061-1.0.1.1-EVDzBFJmww0dmak7xuAH4FZR9l0DgA_FF77HYpK4mAzLgjxu3i7aV.1TUyH_Th1DQtYc1wpGz4Yszt1qWRv9GQ; _dd_s=rum; _gcl_au=1.1.292079720.1734466062; _ga_RXLL9Z7XBK=GS1.1.1734466062.1.1.1734466064.0.0.512155603; _ga=GA1.1.1732213836.1734466062; FPID=FPID2.2.7BN82GxkN50PGwJtJgKtT%2B797zZ0rvW9GB%2ByS%2Bwgwcs%3D.1734466062; FPLC=zYPu5lbctSHGRYYSRW%2FG3lPVEsub81UXdLKSYxZvytebedZQX8obPSvQo2%2FvPsCLlbDuiENfn4lED7baCfRrIA38ZlTkd%2Bh7HfKQ5cfWTC74Rjn%2BgNmeI82TWnBE5Q%3D%3D; FPAU=1.1.292079720.1734466062; FPGSID=1.1734466062.1734466062.G-RXLL9Z7XBK.rzmbptlxh7Qsi2qhaGXhuQ; optimizelyVisitorId=a32998bc-a96b-4f7a-a558-976fc814d0a8; _gcl_au=1.1.292079720.1734466062; _ga=GA1.1.1732213836.1734466062; _ga_RXLL9Z7XBK=GS1.1.1734466062.1.1.1734466062.0.0.512155603; FPLC=BRNam%2BuCHLkbkcz%2Bh31zTo%2BI8IwbLYAyeQJpGVmrPTJEEoOQc%2BcO05yNNMd6N%2BZjdvpG1g0z4Tie7y3JV66OrI40NHUCytfORqMu6cYdJ15N2n7JYpnjCGtG%2BSCu4g%3D%3D; FPAU=1.1.292079720.1734466062; FPGSID=1.1734466062.1734466062.G-RXLL9Z7XBK.rzmbptlxh7Qsi2qhaGXhuQ; visitorId=f8cef1ec-902f-41a0-876b-6306f90ab49e
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:45 GMT
content-type: application/json; charset=utf-8
x-dns-prefetch-control: off
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
access-control-allow-origin: *
etag: W/"c6b-69YbQwNOz+EevvKexgaZ5S+wsN4"
cf-cache-status: DYNAMIC
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8f398a8ecbb3b500-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
GET content.quickencompare.com/qc/refi-images/BG-BLUE-ICON-WHITE.png
200 OK 60 kB URL GET HTTP/2 content.quickencompare.com/qc/refi-images/BG-BLUE-ICON-WHITE.png
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectquickencompare.com
Fingerprint91:CF:56:CF:08:92:B6:4B:4D:58:82:62:70:2A:51:8C:F0:F4:49:03
ValidityMon, 11 Nov 2024 06:14:11 GMT - Sun, 09 Feb 2025 06:14:10 GMT
File type PNG image data, 2980 x 820, 8-bit/color RGBA, non-interlaced
Hash 0b525d003df460ee3ef27bb82defdb43
0e1f1b12bc01d745e847d91f64727e1bde0cf019
78f6112cc353f90b0f71f3b1c2a5571b1b620290dd2048dc073eb91217c590e7
GET /qc/refi-images/BG-BLUE-ICON-WHITE.png HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=oQX8LkRX5zKtdEOfmWAbS_WakXkyuS77uTIz7TN0x6w-1734466065-1.0.1.1-dsZpESvHxKPraq6nDddh7awC_7NiKNf2ZWpVDXixiEb5KTSAaW7ByMqiXTxD96UYEnaujPWwK2kBJI7MBDUNzg
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:46 GMT
content-type: image/png
content-length: 60242
last-modified: Tue, 19 Nov 2024 19:24:46 GMT
etag: "0b525d003df460ee3ef27bb82defdb43"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
via: 1.1 3aedbf31650352660fd3a878f7b791c8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P9
x-amz-cf-id: AAt4s7vekogwX9den0QQrMBS_GAUWVc2sGXc6z_9vaXa7tluEoiTTw==
cf-cache-status: REVALIDATED
expires: Wed, 18 Dec 2024 00:07:46 GMT
cache-control: public, max-age=14400
accept-ranges: bytes
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8f398a926b11b51e-OSL
X-Firefox-Spdy: h2
GET fonts.googleapis.com/css?family=Antic+Didone:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
200 OK 8.1 kB URL GET HTTP/2 fonts.googleapis.com/css?family=Antic+Didone:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectupload.video.google.com
FingerprintD4:A3:E0:67:E1:FB:D8:0C:7B:58:AE:DA:81:4F:CA:47:9A:07:6E:5B
ValidityMon, 04 Nov 2024 08:38:51 GMT - Mon, 27 Jan 2025 08:38:50 GMT
File type gzip compressed data, max compression
Hash 3fd36e6eb24f303b844c15f1dcef9caf
ad1ce0c53a10c88cdf867f917e95602199ae9c87
c70e40663b61227b2adea08a0be391d09214e0680e1241ce5ae33f2fee883541
GET /css?family=Antic+Didone:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Tue, 17 Dec 2024 20:07:44 GMT
date: Tue, 17 Dec 2024 20:07:44 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
POST loans.quickenloans.com/api/tracking/event
204 No Content 0 B URL POST HTTP/2 loans.quickenloans.com/api/tracking/event
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectloans.quickenloans.com
Fingerprint9B:58:4A:65:BD:EC:A5:31:73:3E:E2:82:74:12:E2:BD:67:80:66:0D
ValiditySat, 30 Nov 2024 14:32:02 GMT - Fri, 28 Feb 2025 14:32:01 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /api/tracking/event HTTP/1.1
Host: loans.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJtYXJrZXRpbmdDbGlja0lkIjoiNDEzMzI3YTAtYmZjOC01ZDVmLTllMDctZmY2NDBlZGY5ODVkIiwidmlzaXRvcklkIjoiZjhjZWYxZWMtOTAyZi00MWEwLTg3NmItNjMwNmY5MGFiNDllIiwic2Vzc2lvbklkIjoiOWExMTc1Y2YtYWUzZS00MjdjLThkZWYtOThjMWJlMzVhMTA0IiwibWFya2V0aW5nT2ZmZXJJZCI6IjMyMTY0NiIsInNvdXJjZUlkIjoiYWZmbF9ldmVyZmxvd19xbC1tb25fMTczXzgwOSIsInRpbWVPbkZvcm1TdGFydFRpbWUiOiIyMDI0LTEyLTE3VDIwOjA3OjQ1LjcxMFoiLCJvcmlnaW5SZXF1ZXN0ZWRVcmkiOiJodHRwczovL2xvYW5zLnF1aWNrZW5sb2Fucy5jb20vP21vaWQ9MzIxNjQ2JnNvdXJjZWlkPWFmZmxfZXZlcmZsb3dfcWwtbW9uXzE3M184MDkmcGtleTE9ODA5JnBrZXkyPTImcGtleTM9MDgwNWY5ZDA5YzA1NGJmMGJiZTJmYjY2YTg0OTFjNjMmcGtleT1iM2EwOTUwZWM5YWE0NTU3YTJlYjE2MDYyNTk2NjA4OSZzaWQ9MTczJmNtcGlkPTE3MyZjcnRpZD0mb2lkPTE3MyZhZmZpZD04MDkmX2VmX3RyYW5zYWN0aW9uX2lkPTA4MDVmOWQwOWMwNTRiZjBiYmUyZmI2NmE4NDkxYzYzJnV0bV9tZWRpdW09YWZmaWxpYXRlJnV0bV9zb3VyY2U9bm9jYXBhZHMuY29tJnV0bV9jb250ZW50PSIsImRlc3RpbmF0aW9uVXJsIjoiaHR0cHM6Ly9sb2Fucy5xdWlja2VubG9hbnMuY29tLz9tb2lkPTMyMTY0NiZzb3VyY2VpZD1hZmZsX2V2ZXJmbG93X3FsLW1vbl8xNzNfODA5JnBrZXkxPTgwOSZwa2V5Mj0yJnBrZXkzPTA4MDVmOWQwOWMwNTRiZjBiYmUyZmI2NmE4NDkxYzYzJnBrZXk9YjNhMDk1MGVjOWFhNDU1N2EyZWIxNjA2MjU5NjYwODkmc2lkPTE3MyZjbXBpZD0xNzMmY3J0aWQ9Jm9pZD0xNzMmYWZmaWQ9ODA5Jl9lZl90cmFuc2FjdGlvbl9pZD0wODA1ZjlkMDljMDU0YmYwYmJlMmZiNjZhODQ5MWM2MyZ1dG1fbWVkaXVtPWFmZmlsaWF0ZSZ1dG1fc291cmNlPW5vY2FwYWRzLmNvbSZ1dG1fY29udGVudD0iLCJyZWZlcnJpbmdVcmkiOiIiLCJtb2lkIjoiMzIxNjQ2IiwiY2xpZW50SXBBZGRyZXNzIjoiOTEuOTAuNDIuMTU0IiwicHVibGlzaGVyRGV2aWNlIjoiIiwicmVzb2x1dGlvbiI6IiIsInVzZXJBZ2VudCI6Ik1vemlsbGEvNS4wIChYMTE7IExpbnV4IHg4Nl82NDsgcnY6OTYuMCkgR2Vja28vMjAxMDAxMDEgRmlyZWZveC85Ni4wIiwiYm90IjpmYWxzZSwiaWF0IjoxNzM0NDY2MDY1fQ.d6dAB81ij3XepEnTNZLBKNuX-w0PbQcoEDShZ9bpGZJNr_LgFKJgqztYorgbRAcx4UIJ05rN_vqOTFUthtwJuVRdTJxICmWNdGHtGK-Aob5c1uZ2AWXF2yj4jENqLPvUp6kR8v3bkQsjdw8qgs3BLsaWNIx78O7lPMtZ_KZUbak0L6z9bsOea78PqYzNhGQieTrrYnWXyrmPjzxdxGPj7n4nwQ9kf76kLAevlcrcK_yGShvk1kO5wi76C3HPgq528K4MUkuWMs2CIbBDQfumroxhR6oWlyb5wwf2F86n3Me13VUFS7V3BS8eEQYKNVLgYjp96hcFlggRchnqMYAMmQ
Content-Length: 146
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Cookie: AWSALBTG=e8PL7MKrh49qKtU3+P158XLEhHp+WBlr2+FfBvRTbj38jbLOTaww/cFR+5lbpOsdx4e0yIKErwu8WXEKQc1xwEX0f0vklhvyKZ2F7PZGRdmvXrEd/B7DiSXslSaJaZMGElB3XtU1LKbT1vwTUNBCnob+lF/yXK+WP1meh2dYeZ4mhHpAiyo; AWSALBTGCORS=e8PL7MKrh49qKtU3+P158XLEhHp+WBlr2+FfBvRTbj38jbLOTaww/cFR+5lbpOsdx4e0yIKErwu8WXEKQc1xwEX0f0vklhvyKZ2F7PZGRdmvXrEd/B7DiSXslSaJaZMGElB3XtU1LKbT1vwTUNBCnob+lF/yXK+WP1meh2dYeZ4mhHpAiyo; __cf_bm=6zj9k6NfC.Dvw_3NYSbKzrNzrdo5MSleN3nF2bS8.xQ-1734466061-1.0.1.1-EVDzBFJmww0dmak7xuAH4FZR9l0DgA_FF77HYpK4mAzLgjxu3i7aV.1TUyH_Th1DQtYc1wpGz4Yszt1qWRv9GQ; _dd_s=rum; _gcl_au=1.1.292079720.1734466062; _ga_RXLL9Z7XBK=GS1.1.1734466062.1.1.1734466064.0.0.512155603; _ga=GA1.1.1732213836.1734466062; FPID=FPID2.2.7BN82GxkN50PGwJtJgKtT%2B797zZ0rvW9GB%2ByS%2Bwgwcs%3D.1734466062; FPLC=zYPu5lbctSHGRYYSRW%2FG3lPVEsub81UXdLKSYxZvytebedZQX8obPSvQo2%2FvPsCLlbDuiENfn4lED7baCfRrIA38ZlTkd%2Bh7HfKQ5cfWTC74Rjn%2BgNmeI82TWnBE5Q%3D%3D; FPAU=1.1.292079720.1734466062; FPGSID=1.1734466062.1734466062.G-RXLL9Z7XBK.rzmbptlxh7Qsi2qhaGXhuQ; optimizelyVisitorId=a32998bc-a96b-4f7a-a558-976fc814d0a8; _gcl_au=1.1.292079720.1734466062; _ga=GA1.1.1732213836.1734466062; _ga_RXLL9Z7XBK=GS1.1.1734466062.1.1.1734466062.0.0.512155603; FPLC=BRNam%2BuCHLkbkcz%2Bh31zTo%2BI8IwbLYAyeQJpGVmrPTJEEoOQc%2BcO05yNNMd6N%2BZjdvpG1g0z4Tie7y3JV66OrI40NHUCytfORqMu6cYdJ15N2n7JYpnjCGtG%2BSCu4g%3D%3D; FPAU=1.1.292079720.1734466062; FPGSID=1.1734466062.1734466062.G-RXLL9Z7XBK.rzmbptlxh7Qsi2qhaGXhuQ; visitorId=f8cef1ec-902f-41a0-876b-6306f90ab49e; click=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJtYXJrZXRpbmdDbGlja0lkIjoiNDEzMzI3YTAtYmZjOC01ZDVmLTllMDctZmY2NDBlZGY5ODVkIiwidmlzaXRvcklkIjoiZjhjZWYxZWMtOTAyZi00MWEwLTg3NmItNjMwNmY5MGFiNDllIiwic2Vzc2lvbklkIjoiOWExMTc1Y2YtYWUzZS00MjdjLThkZWYtOThjMWJlMzVhMTA0IiwibWFya2V0aW5nT2ZmZXJJZCI6IjMyMTY0NiIsInNvdXJjZUlkIjoiYWZmbF9ldmVyZmxvd19xbC1tb25fMTczXzgwOSIsInRpbWVPbkZvcm1TdGFydFRpbWUiOiIyMDI0LTEyLTE3VDIwOjA3OjQ1LjcxMFoiLCJvcmlnaW5SZXF1ZXN0ZWRVcmkiOiJodHRwczovL2xvYW5zLnF1aWNrZW5sb2Fucy5jb20vP21vaWQ9MzIxNjQ2JnNvdXJjZWlkPWFmZmxfZXZlcmZsb3dfcWwtbW9uXzE3M184MDkmcGtleTE9ODA5JnBrZXkyPTImcGtleTM9MDgwNWY5ZDA5YzA1NGJmMGJiZTJmYjY2YTg0OTFjNjMmcGtleT1iM2EwOTUwZWM5YWE0NTU3YTJlYjE2MDYyNTk2NjA4OSZzaWQ9MTczJmNtcGlkPTE3MyZjcnRpZD0mb2lkPTE3MyZhZmZpZD04MDkmX2VmX3RyYW5zYWN0aW9uX2lkPTA4MDVmOWQwOWMwNTRiZjBiYmUyZmI2NmE4NDkxYzYzJnV0bV9tZWRpdW09YWZmaWxpYXRlJnV0bV9zb3VyY2U9bm9jYXBhZHMuY29tJnV0bV9jb250ZW50PSIsImRlc3RpbmF0aW9uVXJsIjoiaHR0cHM6Ly9sb2Fucy5xdWlja2VubG9hbnMuY29tLz9tb2lkPTMyMTY0NiZzb3VyY2VpZD1hZmZsX2V2ZXJmbG93X3FsLW1vbl8xNzNfODA5JnBrZXkxPTgwOSZwa2V5Mj0yJnBrZXkzPTA4MDVmOWQwOWMwNTRiZjBiYmUyZmI2NmE4NDkxYzYzJnBrZXk9YjNhMDk1MGVjOWFhNDU1N2EyZWIxNjA2MjU5NjYwODkmc2lkPTE3MyZjbXBpZD0xNzMmY3J0aWQ9Jm9pZD0xNzMmYWZmaWQ9ODA5Jl9lZl90cmFuc2FjdGlvbl9pZD0wODA1ZjlkMDljMDU0YmYwYmJlMmZiNjZhODQ5MWM2MyZ1dG1fbWVkaXVtPWFmZmlsaWF0ZSZ1dG1fc291cmNlPW5vY2FwYWRzLmNvbSZ1dG1fY29udGVudD0iLCJyZWZlcnJpbmdVcmkiOiIiLCJtb2lkIjoiMzIxNjQ2IiwiY2xpZW50SXBBZGRyZXNzIjoiOTEuOTAuNDIuMTU0IiwicHVibGlzaGVyRGV2aWNlIjoiIiwicmVzb2x1dGlvbiI6IiIsInVzZXJBZ2VudCI6Ik1vemlsbGEvNS4wIChYMTE7IExpbnV4IHg4Nl82NDsgcnY6OTYuMCkgR2Vja28vMjAxMDAxMDEgRmlyZWZveC85Ni4wIiwiYm90IjpmYWxzZSwiaWF0IjoxNzM0NDY2MDY1fQ.d6dAB81ij3XepEnTNZLBKNuX-w0PbQcoEDShZ9bpGZJNr_LgFKJgqztYorgbRAcx4UIJ05rN_vqOTFUthtwJuVRdTJxICmWNdGHtGK-Aob5c1uZ2AWXF2yj4jENqLPvUp6kR8v3bkQsjdw8qgs3BLsaWNIx78O7lPMtZ_KZUbak0L6z9bsOea78PqYzNhGQieTrrYnWXyrmPjzxdxGPj7n4nwQ9kf76kLAevlcrcK_yGShvk1kO5wi76C3HPgq528K4MUkuWMs2CIbBDQfumroxhR6oWlyb5wwf2F86n3Me13VUFS7V3BS8eEQYKNVLgYjp96hcFlggRchnqMYAMmQ
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 204 No Content
date: Tue, 17 Dec 2024 20:07:46 GMT
x-dns-prefetch-control: off
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
access-control-allow-origin: *
cf-cache-status: DYNAMIC
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8f398a920ffeb500-OSL
X-Firefox-Spdy: h2
GET loans.quickenloans.com/api/vertical/MON_LP?sourceId=affl_everflow_ql-mon_173_809&moid=321646
200 OK 5.8 kB URL GET HTTP/2 loans.quickenloans.com/api/vertical/MON_LP?sourceId=affl_everflow_ql-mon_173_809&moid=321646
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectloans.quickenloans.com
Fingerprint9B:58:4A:65:BD:EC:A5:31:73:3E:E2:82:74:12:E2:BD:67:80:66:0D
ValiditySat, 30 Nov 2024 14:32:02 GMT - Fri, 28 Feb 2025 14:32:01 GMT
Hash 5daf0b5b2a46ff18cbed52e33dfad243
b4ad8caf7520beecdcf344ee948c78873f3a1168
10012cbf9dd60c46beb8665ece9ee0b1ba1377c8927dbec896c3892a65196dae
GET /api/vertical/MON_LP?sourceId=affl_everflow_ql-mon_173_809&moid=321646 HTTP/1.1
Host: loans.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-datadog-origin: rum
x-datadog-parent-id: 2912818366827366087
x-datadog-sampled: 1
x-datadog-sampling-priority: 1
x-datadog-trace-id: 1197313930597721260
DNT: 1
Connection: keep-alive
Cookie: AWSALBTG=e8PL7MKrh49qKtU3+P158XLEhHp+WBlr2+FfBvRTbj38jbLOTaww/cFR+5lbpOsdx4e0yIKErwu8WXEKQc1xwEX0f0vklhvyKZ2F7PZGRdmvXrEd/B7DiSXslSaJaZMGElB3XtU1LKbT1vwTUNBCnob+lF/yXK+WP1meh2dYeZ4mhHpAiyo; AWSALBTGCORS=e8PL7MKrh49qKtU3+P158XLEhHp+WBlr2+FfBvRTbj38jbLOTaww/cFR+5lbpOsdx4e0yIKErwu8WXEKQc1xwEX0f0vklhvyKZ2F7PZGRdmvXrEd/B7DiSXslSaJaZMGElB3XtU1LKbT1vwTUNBCnob+lF/yXK+WP1meh2dYeZ4mhHpAiyo; __cf_bm=6zj9k6NfC.Dvw_3NYSbKzrNzrdo5MSleN3nF2bS8.xQ-1734466061-1.0.1.1-EVDzBFJmww0dmak7xuAH4FZR9l0DgA_FF77HYpK4mAzLgjxu3i7aV.1TUyH_Th1DQtYc1wpGz4Yszt1qWRv9GQ; _dd_s=rum; _gcl_au=1.1.292079720.1734466062; _ga_RXLL9Z7XBK=GS1.1.1734466062.1.1.1734466064.0.0.512155603; _ga=GA1.1.1732213836.1734466062; FPID=FPID2.2.7BN82GxkN50PGwJtJgKtT%2B797zZ0rvW9GB%2ByS%2Bwgwcs%3D.1734466062; FPLC=BRNam%2BuCHLkbkcz%2Bh31zTo%2BI8IwbLYAyeQJpGVmrPTJEEoOQc%2BcO05yNNMd6N%2BZjdvpG1g0z4Tie7y3JV66OrI40NHUCytfORqMu6cYdJ15N2n7JYpnjCGtG%2BSCu4g%3D%3D; FPAU=1.1.292079720.1734466062; FPGSID=1.1734466062.1734466062.G-RXLL9Z7XBK.rzmbptlxh7Qsi2qhaGXhuQ; optimizelyVisitorId=a32998bc-a96b-4f7a-a558-976fc814d0a8; _gcl_au=1.1.292079720.1734466062; _ga=GA1.1.1732213836.1734466062; _ga_RXLL9Z7XBK=GS1.1.1734466062.1.1.1734466062.0.0.512155603; FPLC=BRNam%2BuCHLkbkcz%2Bh31zTo%2BI8IwbLYAyeQJpGVmrPTJEEoOQc%2BcO05yNNMd6N%2BZjdvpG1g0z4Tie7y3JV66OrI40NHUCytfORqMu6cYdJ15N2n7JYpnjCGtG%2BSCu4g%3D%3D; FPAU=1.1.292079720.1734466062; FPGSID=1.1734466062.1734466062.G-RXLL9Z7XBK.rzmbptlxh7Qsi2qhaGXhuQ; visitorId=f8cef1ec-902f-41a0-876b-6306f90ab49e
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:45 GMT
content-type: application/json; charset=utf-8
set-cookie: AWSALBTG=DvrFF/JIpaMrvUKA0B1fYN/OfgT+/9ElD8eUEEAGnMO/Y3DQd8qiChKRYaNJ6ytRqg8lHIBH/OkI+A7H+vhj11K5O2CGTSUsosws6WT6gjOSd4urigfJ6r6a8czxRRbJ1S74/8hBMERzZ4bouZyDhmZrPSKveFjSD/0sBmy2Bk8dpTQVnHc=; Expires=Tue, 24 Dec 2024 20:07:45 GMT; Path=/
AWSALBTGCORS=DvrFF/JIpaMrvUKA0B1fYN/OfgT+/9ElD8eUEEAGnMO/Y3DQd8qiChKRYaNJ6ytRqg8lHIBH/OkI+A7H+vhj11K5O2CGTSUsosws6WT6gjOSd4urigfJ6r6a8czxRRbJ1S74/8hBMERzZ4bouZyDhmZrPSKveFjSD/0sBmy2Bk8dpTQVnHc=; Expires=Tue, 24 Dec 2024 20:07:45 GMT; Path=/; SameSite=None; Secure
x-dns-prefetch-control: off
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
origin-agent-cluster: ?1
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
etag: W/"4928-tK2Mr3Ugvuzc80TulIx4hz86EWg"
cf-cache-status: DYNAMIC
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8f398a8688d9b500-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
GET create.lidstatic.com/campaign/b87eed3a-5f1d-1ea4-b60b-fcc3f180b22d.js?snippet_version=2&callback=leadIdCallback
200 OK 40 kB URL GET HTTP/2 create.lidstatic.com/campaign/b87eed3a-5f1d-1ea4-b60b-fcc3f180b22d.js?snippet_version=2&callback=leadIdCallback
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerLet's Encrypt
Subjectlidstatic.com
Fingerprint5A:73:45:8A:A2:BF:1F:87:A7:4D:71:38:98:89:D2:6D:E4:AA:FB:E0
ValidityMon, 18 Nov 2024 20:11:20 GMT - Sun, 16 Feb 2025 20:11:19 GMT
File type JavaScript source, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators
Hash 74fff60050bea01596b57b94ae6983db
d9f9fa2aea9b444a22e0da7b4c3cae1c3c936b1e
e596f12f57b9a9c6182ed14695044a3a64c5773dfc2b04c8a632444c76c8e001
GET /campaign/b87eed3a-5f1d-1ea4-b60b-fcc3f180b22d.js?snippet_version=2&callback=leadIdCallback HTTP/1.1
Host: create.lidstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:46 GMT
content-type: text/javascript
x-amz-id-2: lXTGasR6uJuEs0hsY2DMZ/G3oVRUwvci3Y3XI8LEJJAbQEQlqSpZGk3tQWiBDr6Yf27A+jY80e8+i4Do0ZbQOolNcZaaCh7Q
x-amz-request-id: J0Q1DN9Q6819S1DB
x-amz-replication-status: COMPLETED
last-modified: Fri, 11 Oct 2024 11:56:09 GMT
etag: W/"74fff60050bea01596b57b94ae6983db"
x-amz-server-side-encryption: AES256
cache-control: max-age=1800
x-amz-version-id: 2ZPIAE6ANN70rHcR4_LolYMsk2rVzUr0
cf-cache-status: REVALIDATED
vary: Accept-Encoding
access-control-allow-origin: *
server: cloudflare
cf-ray: 8f398a8f79231d0e-CPH
content-encoding: br
X-Firefox-Spdy: h2
POST loans.quickenloans.com/api/tracking/event
204 No Content 0 B URL POST HTTP/2 loans.quickenloans.com/api/tracking/event
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectloans.quickenloans.com
Fingerprint9B:58:4A:65:BD:EC:A5:31:73:3E:E2:82:74:12:E2:BD:67:80:66:0D
ValiditySat, 30 Nov 2024 14:32:02 GMT - Fri, 28 Feb 2025 14:32:01 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /api/tracking/event HTTP/1.1
Host: loans.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJtYXJrZXRpbmdDbGlja0lkIjoiNDEzMzI3YTAtYmZjOC01ZDVmLTllMDctZmY2NDBlZGY5ODVkIiwidmlzaXRvcklkIjoiZjhjZWYxZWMtOTAyZi00MWEwLTg3NmItNjMwNmY5MGFiNDllIiwic2Vzc2lvbklkIjoiOWExMTc1Y2YtYWUzZS00MjdjLThkZWYtOThjMWJlMzVhMTA0IiwibWFya2V0aW5nT2ZmZXJJZCI6IjMyMTY0NiIsInNvdXJjZUlkIjoiYWZmbF9ldmVyZmxvd19xbC1tb25fMTczXzgwOSIsInRpbWVPbkZvcm1TdGFydFRpbWUiOiIyMDI0LTEyLTE3VDIwOjA3OjQ1LjcxMFoiLCJvcmlnaW5SZXF1ZXN0ZWRVcmkiOiJodHRwczovL2xvYW5zLnF1aWNrZW5sb2Fucy5jb20vP21vaWQ9MzIxNjQ2JnNvdXJjZWlkPWFmZmxfZXZlcmZsb3dfcWwtbW9uXzE3M184MDkmcGtleTE9ODA5JnBrZXkyPTImcGtleTM9MDgwNWY5ZDA5YzA1NGJmMGJiZTJmYjY2YTg0OTFjNjMmcGtleT1iM2EwOTUwZWM5YWE0NTU3YTJlYjE2MDYyNTk2NjA4OSZzaWQ9MTczJmNtcGlkPTE3MyZjcnRpZD0mb2lkPTE3MyZhZmZpZD04MDkmX2VmX3RyYW5zYWN0aW9uX2lkPTA4MDVmOWQwOWMwNTRiZjBiYmUyZmI2NmE4NDkxYzYzJnV0bV9tZWRpdW09YWZmaWxpYXRlJnV0bV9zb3VyY2U9bm9jYXBhZHMuY29tJnV0bV9jb250ZW50PSIsImRlc3RpbmF0aW9uVXJsIjoiaHR0cHM6Ly9sb2Fucy5xdWlja2VubG9hbnMuY29tLz9tb2lkPTMyMTY0NiZzb3VyY2VpZD1hZmZsX2V2ZXJmbG93X3FsLW1vbl8xNzNfODA5JnBrZXkxPTgwOSZwa2V5Mj0yJnBrZXkzPTA4MDVmOWQwOWMwNTRiZjBiYmUyZmI2NmE4NDkxYzYzJnBrZXk9YjNhMDk1MGVjOWFhNDU1N2EyZWIxNjA2MjU5NjYwODkmc2lkPTE3MyZjbXBpZD0xNzMmY3J0aWQ9Jm9pZD0xNzMmYWZmaWQ9ODA5Jl9lZl90cmFuc2FjdGlvbl9pZD0wODA1ZjlkMDljMDU0YmYwYmJlMmZiNjZhODQ5MWM2MyZ1dG1fbWVkaXVtPWFmZmlsaWF0ZSZ1dG1fc291cmNlPW5vY2FwYWRzLmNvbSZ1dG1fY29udGVudD0iLCJyZWZlcnJpbmdVcmkiOiIiLCJtb2lkIjoiMzIxNjQ2IiwiY2xpZW50SXBBZGRyZXNzIjoiOTEuOTAuNDIuMTU0IiwicHVibGlzaGVyRGV2aWNlIjoiIiwicmVzb2x1dGlvbiI6IiIsInVzZXJBZ2VudCI6Ik1vemlsbGEvNS4wIChYMTE7IExpbnV4IHg4Nl82NDsgcnY6OTYuMCkgR2Vja28vMjAxMDAxMDEgRmlyZWZveC85Ni4wIiwiYm90IjpmYWxzZSwiaWF0IjoxNzM0NDY2MDY1fQ.d6dAB81ij3XepEnTNZLBKNuX-w0PbQcoEDShZ9bpGZJNr_LgFKJgqztYorgbRAcx4UIJ05rN_vqOTFUthtwJuVRdTJxICmWNdGHtGK-Aob5c1uZ2AWXF2yj4jENqLPvUp6kR8v3bkQsjdw8qgs3BLsaWNIx78O7lPMtZ_KZUbak0L6z9bsOea78PqYzNhGQieTrrYnWXyrmPjzxdxGPj7n4nwQ9kf76kLAevlcrcK_yGShvk1kO5wi76C3HPgq528K4MUkuWMs2CIbBDQfumroxhR6oWlyb5wwf2F86n3Me13VUFS7V3BS8eEQYKNVLgYjp96hcFlggRchnqMYAMmQ
Content-Length: 149
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Cookie: AWSALBTG=e8PL7MKrh49qKtU3+P158XLEhHp+WBlr2+FfBvRTbj38jbLOTaww/cFR+5lbpOsdx4e0yIKErwu8WXEKQc1xwEX0f0vklhvyKZ2F7PZGRdmvXrEd/B7DiSXslSaJaZMGElB3XtU1LKbT1vwTUNBCnob+lF/yXK+WP1meh2dYeZ4mhHpAiyo; AWSALBTGCORS=e8PL7MKrh49qKtU3+P158XLEhHp+WBlr2+FfBvRTbj38jbLOTaww/cFR+5lbpOsdx4e0yIKErwu8WXEKQc1xwEX0f0vklhvyKZ2F7PZGRdmvXrEd/B7DiSXslSaJaZMGElB3XtU1LKbT1vwTUNBCnob+lF/yXK+WP1meh2dYeZ4mhHpAiyo; __cf_bm=6zj9k6NfC.Dvw_3NYSbKzrNzrdo5MSleN3nF2bS8.xQ-1734466061-1.0.1.1-EVDzBFJmww0dmak7xuAH4FZR9l0DgA_FF77HYpK4mAzLgjxu3i7aV.1TUyH_Th1DQtYc1wpGz4Yszt1qWRv9GQ; _dd_s=rum; _gcl_au=1.1.292079720.1734466062; _ga_RXLL9Z7XBK=GS1.1.1734466062.1.1.1734466064.0.0.512155603; _ga=GA1.1.1732213836.1734466062; FPID=FPID2.2.7BN82GxkN50PGwJtJgKtT%2B797zZ0rvW9GB%2ByS%2Bwgwcs%3D.1734466062; FPLC=zYPu5lbctSHGRYYSRW%2FG3lPVEsub81UXdLKSYxZvytebedZQX8obPSvQo2%2FvPsCLlbDuiENfn4lED7baCfRrIA38ZlTkd%2Bh7HfKQ5cfWTC74Rjn%2BgNmeI82TWnBE5Q%3D%3D; FPAU=1.1.292079720.1734466062; FPGSID=1.1734466062.1734466062.G-RXLL9Z7XBK.rzmbptlxh7Qsi2qhaGXhuQ; optimizelyVisitorId=a32998bc-a96b-4f7a-a558-976fc814d0a8; _gcl_au=1.1.292079720.1734466062; _ga=GA1.1.1732213836.1734466062; _ga_RXLL9Z7XBK=GS1.1.1734466062.1.1.1734466062.0.0.512155603; FPLC=BRNam%2BuCHLkbkcz%2Bh31zTo%2BI8IwbLYAyeQJpGVmrPTJEEoOQc%2BcO05yNNMd6N%2BZjdvpG1g0z4Tie7y3JV66OrI40NHUCytfORqMu6cYdJ15N2n7JYpnjCGtG%2BSCu4g%3D%3D; FPAU=1.1.292079720.1734466062; FPGSID=1.1734466062.1734466062.G-RXLL9Z7XBK.rzmbptlxh7Qsi2qhaGXhuQ; visitorId=f8cef1ec-902f-41a0-876b-6306f90ab49e; click=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJtYXJrZXRpbmdDbGlja0lkIjoiNDEzMzI3YTAtYmZjOC01ZDVmLTllMDctZmY2NDBlZGY5ODVkIiwidmlzaXRvcklkIjoiZjhjZWYxZWMtOTAyZi00MWEwLTg3NmItNjMwNmY5MGFiNDllIiwic2Vzc2lvbklkIjoiOWExMTc1Y2YtYWUzZS00MjdjLThkZWYtOThjMWJlMzVhMTA0IiwibWFya2V0aW5nT2ZmZXJJZCI6IjMyMTY0NiIsInNvdXJjZUlkIjoiYWZmbF9ldmVyZmxvd19xbC1tb25fMTczXzgwOSIsInRpbWVPbkZvcm1TdGFydFRpbWUiOiIyMDI0LTEyLTE3VDIwOjA3OjQ1LjcxMFoiLCJvcmlnaW5SZXF1ZXN0ZWRVcmkiOiJodHRwczovL2xvYW5zLnF1aWNrZW5sb2Fucy5jb20vP21vaWQ9MzIxNjQ2JnNvdXJjZWlkPWFmZmxfZXZlcmZsb3dfcWwtbW9uXzE3M184MDkmcGtleTE9ODA5JnBrZXkyPTImcGtleTM9MDgwNWY5ZDA5YzA1NGJmMGJiZTJmYjY2YTg0OTFjNjMmcGtleT1iM2EwOTUwZWM5YWE0NTU3YTJlYjE2MDYyNTk2NjA4OSZzaWQ9MTczJmNtcGlkPTE3MyZjcnRpZD0mb2lkPTE3MyZhZmZpZD04MDkmX2VmX3RyYW5zYWN0aW9uX2lkPTA4MDVmOWQwOWMwNTRiZjBiYmUyZmI2NmE4NDkxYzYzJnV0bV9tZWRpdW09YWZmaWxpYXRlJnV0bV9zb3VyY2U9bm9jYXBhZHMuY29tJnV0bV9jb250ZW50PSIsImRlc3RpbmF0aW9uVXJsIjoiaHR0cHM6Ly9sb2Fucy5xdWlja2VubG9hbnMuY29tLz9tb2lkPTMyMTY0NiZzb3VyY2VpZD1hZmZsX2V2ZXJmbG93X3FsLW1vbl8xNzNfODA5JnBrZXkxPTgwOSZwa2V5Mj0yJnBrZXkzPTA4MDVmOWQwOWMwNTRiZjBiYmUyZmI2NmE4NDkxYzYzJnBrZXk9YjNhMDk1MGVjOWFhNDU1N2EyZWIxNjA2MjU5NjYwODkmc2lkPTE3MyZjbXBpZD0xNzMmY3J0aWQ9Jm9pZD0xNzMmYWZmaWQ9ODA5Jl9lZl90cmFuc2FjdGlvbl9pZD0wODA1ZjlkMDljMDU0YmYwYmJlMmZiNjZhODQ5MWM2MyZ1dG1fbWVkaXVtPWFmZmlsaWF0ZSZ1dG1fc291cmNlPW5vY2FwYWRzLmNvbSZ1dG1fY29udGVudD0iLCJyZWZlcnJpbmdVcmkiOiIiLCJtb2lkIjoiMzIxNjQ2IiwiY2xpZW50SXBBZGRyZXNzIjoiOTEuOTAuNDIuMTU0IiwicHVibGlzaGVyRGV2aWNlIjoiIiwicmVzb2x1dGlvbiI6IiIsInVzZXJBZ2VudCI6Ik1vemlsbGEvNS4wIChYMTE7IExpbnV4IHg4Nl82NDsgcnY6OTYuMCkgR2Vja28vMjAxMDAxMDEgRmlyZWZveC85Ni4wIiwiYm90IjpmYWxzZSwiaWF0IjoxNzM0NDY2MDY1fQ.d6dAB81ij3XepEnTNZLBKNuX-w0PbQcoEDShZ9bpGZJNr_LgFKJgqztYorgbRAcx4UIJ05rN_vqOTFUthtwJuVRdTJxICmWNdGHtGK-Aob5c1uZ2AWXF2yj4jENqLPvUp6kR8v3bkQsjdw8qgs3BLsaWNIx78O7lPMtZ_KZUbak0L6z9bsOea78PqYzNhGQieTrrYnWXyrmPjzxdxGPj7n4nwQ9kf76kLAevlcrcK_yGShvk1kO5wi76C3HPgq528K4MUkuWMs2CIbBDQfumroxhR6oWlyb5wwf2F86n3Me13VUFS7V3BS8eEQYKNVLgYjp96hcFlggRchnqMYAMmQ
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 204 No Content
date: Tue, 17 Dec 2024 20:07:46 GMT
x-dns-prefetch-control: off
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
access-control-allow-origin: *
cf-cache-status: DYNAMIC
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8f398a920804b500-OSL
X-Firefox-Spdy: h2
GET content.quickencompare.com/nmn/logo/qc-financial-control.png
200 OK 13 kB URL GET HTTP/2 content.quickencompare.com/nmn/logo/qc-financial-control.png
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectquickencompare.com
Fingerprint91:CF:56:CF:08:92:B6:4B:4D:58:82:62:70:2A:51:8C:F0:F4:49:03
ValidityMon, 11 Nov 2024 06:14:11 GMT - Sun, 09 Feb 2025 06:14:10 GMT
File type PNG image data, 281 x 168, 8-bit/color RGBA, non-interlaced
Hash d9164fb30114b13fdb91bd8011b5f71b
45307fb107b9e0ec642b98d3b2153467cb00b633
442b0856c633c8a41e1566de5aea94873cfa27b85e74e2fb2df4c92b55ab5608
GET /nmn/logo/qc-financial-control.png HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=oQX8LkRX5zKtdEOfmWAbS_WakXkyuS77uTIz7TN0x6w-1734466065-1.0.1.1-dsZpESvHxKPraq6nDddh7awC_7NiKNf2ZWpVDXixiEb5KTSAaW7ByMqiXTxD96UYEnaujPWwK2kBJI7MBDUNzg
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:46 GMT
content-type: image/png
content-length: 12630
last-modified: Thu, 26 Sep 2024 20:39:13 GMT
etag: "d9164fb30114b13fdb91bd8011b5f71b"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
via: 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P6
x-amz-cf-id: 8O2tLjjEksteTAAY-1lCPG5jLd0D53FIOi8XmAYU37f--on3NTF9dA==
cf-cache-status: REVALIDATED
expires: Wed, 18 Dec 2024 00:07:46 GMT
cache-control: public, max-age=14400
accept-ranges: bytes
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8f398a925af1b51e-OSL
X-Firefox-Spdy: h2
GET ads.anura.io/showads.js?106751449605
200 OK 491 B URL GET HTTP/2 ads.anura.io/showads.js?106751449605
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerAmazon
Subjectads.anura.io
Fingerprint1D:30:09:B1:D0:2A:A6:E2:1D:B8:C7:0A:60:EB:65:48:AF:05:5E:19
ValidityMon, 29 Apr 2024 00:00:00 GMT - Tue, 27 May 2025 23:59:59 GMT
File type gzip compressed data, max speed, from Unix
Hash a8c8385b679d1b151dd382ee224df827
0c3ba4bf4c99299fe87cb1c2fe14f3930e621cdf
f922df1ff2473d15df3465c8fd9910c374d5faab5413dac6a24dd819f278c6d8
GET /showads.js?106751449605 HTTP/1.1
Host: ads.anura.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
date: Tue, 17 Dec 2024 10:20:17 GMT
server: nginx
access-control-allow-origin: *
access-control-allow-methods: GET
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 c2b101e67ac25a2f0013450d56ecac38.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: FsiGDnZSsBC8VV6762LHz9DyxR4pyuupJ9CjWTow8uOC2L2zU9Qm0A==
age: 35249
X-Firefox-Spdy: h2
POST create.leadid.com/2.15.1/GenerateToken?msn=1&pid=2ae0bbcc-9e72-460b-b11a-6363f4a43003&_=680755845
200 OK 1.5 kB URL POST HTTP/2 create.leadid.com/2.15.1/GenerateToken?msn=1&pid=2ae0bbcc-9e72-460b-b11a-6363f4a43003&_=680755845
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerAmazon
Subjectcreate.leadid.com
FingerprintF1:00:1E:2C:3D:E1:0C:3C:9F:6C:A4:8C:6B:2F:4A:AA:A5:65:E0:13
ValiditySat, 20 Jul 2024 00:00:00 GMT - Mon, 18 Aug 2025 23:59:59 GMT
File type JavaScript source, ASCII text
Hash bd890c27ba9291895135dc16b9661e59
b50b73cbfcbed2a3b44f63f4b0a24a7dca9338e5
3b0a8207ddc59890dc3b0ad89e0f5e00da2b4a0a72205ae6040567613947a722
POST /2.15.1/GenerateToken?msn=1&pid=2ae0bbcc-9e72-460b-b11a-6363f4a43003&_=680755845 HTTP/1.1
Host: create.leadid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 528
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:46 GMT
content-type: text/plain;charset=UTF-8
server: nginx
set-cookie: rgisanonymous=false; expires=Thu, 16 Jan 2025 20:07:46 GMT; Max-Age=2592000; path=/
rguserid=e526e7ab-6618-4d42-8bad-7ff96a74ab51; expires=Thu, 16 Jan 2025 20:07:46 GMT; Max-Age=2592000; path=/
rguuid=true; expires=Thu, 16 Jan 2025 20:07:46 GMT; Max-Age=2592000; path=/
rgisanonymous=true; expires=Thu, 16 Jan 2025 20:07:46 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2
GET content.quickencompare.com/qc/refi-images/icon-debit-conslidation.svg
200 OK 22 kB URL GET HTTP/2 content.quickencompare.com/qc/refi-images/icon-debit-conslidation.svg
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectquickencompare.com
Fingerprint91:CF:56:CF:08:92:B6:4B:4D:58:82:62:70:2A:51:8C:F0:F4:49:03
ValidityMon, 11 Nov 2024 06:14:11 GMT - Sun, 09 Feb 2025 06:14:10 GMT
File type SVG Scalable Vector Graphics image
Hash ccddc7e239fe94ab214cabc86a27176f
84170e0fbe5e0b4eb9a398c6310741b2a79c269c
b79a6f2f8cb4c74bc10b50156e041ad31d1b27469160877cd6a0d3a4b9ecf2e6
GET /qc/refi-images/icon-debit-conslidation.svg HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=oQX8LkRX5zKtdEOfmWAbS_WakXkyuS77uTIz7TN0x6w-1734466065-1.0.1.1-dsZpESvHxKPraq6nDddh7awC_7NiKNf2ZWpVDXixiEb5KTSAaW7ByMqiXTxD96UYEnaujPWwK2kBJI7MBDUNzg
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:46 GMT
content-type: image/svg+xml
last-modified: Mon, 09 Dec 2024 18:19:27 GMT
etag: W/"28246f3e4007fedf73e208da971c046f"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
via: 1.1 e49f22f18c16784c0f42291e768d1daa.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: RkrQ8ytSsYSkjv_vR5Gd1aqaXoH2Q8Z6mt-mEpTQreUUIj3Eqwt7uA==
cf-cache-status: REVALIDATED
expires: Wed, 18 Dec 2024 00:07:46 GMT
cache-control: public, max-age=14400
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8f398a923adcb51e-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
GET content.quickencompare.com/qc/refi-images/icon-emergency-new.svg
200 OK 943 B URL GET HTTP/2 content.quickencompare.com/qc/refi-images/icon-emergency-new.svg
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectquickencompare.com
Fingerprint91:CF:56:CF:08:92:B6:4B:4D:58:82:62:70:2A:51:8C:F0:F4:49:03
ValidityMon, 11 Nov 2024 06:14:11 GMT - Sun, 09 Feb 2025 06:14:10 GMT
File type gzip compressed data, from Unix
Hash abb76c9847f6108d9d484ddd541acde3
d56aefc0a6287b8f4163eb5d500f2ae549fcbf4b
57fed23228aee4ddac983717dc4e8e6b46ef1302ef8bef46c3f6487508864871
GET /qc/refi-images/icon-emergency-new.svg HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=oQX8LkRX5zKtdEOfmWAbS_WakXkyuS77uTIz7TN0x6w-1734466065-1.0.1.1-dsZpESvHxKPraq6nDddh7awC_7NiKNf2ZWpVDXixiEb5KTSAaW7ByMqiXTxD96UYEnaujPWwK2kBJI7MBDUNzg
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:46 GMT
content-type: image/svg+xml
last-modified: Mon, 09 Dec 2024 18:19:27 GMT
etag: W/"59be918441b8de2c5b4969ac39764148"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
via: 1.1 a465b0f40ab8b9ef8cd03abba841c4b2.cloudfront.net (CloudFront)
x-amz-cf-pop: BAH53-C1
x-amz-cf-id: _jEP8fsjRgwTxztZcoTByte05249-hmn19G20IwTdqLTQbD4Ylr1LA==
cf-cache-status: REVALIDATED
expires: Wed, 18 Dec 2024 00:07:46 GMT
cache-control: public, max-age=14400
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8f398a924ae8b51e-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
GET www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1732213836.1734466062>m=45j91e4c50v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485~102198178&aip=1&z=17557327
200 OK 42 B URL GET HTTP/3 www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1732213836.1734466062>m=45j91e4c50v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485~102198178&aip=1&z=17557327
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subject*.google.no
FingerprintA8:FC:63:57:7C:92:2A:02:1C:BE:71:EF:F7:D9:C9:CD:5F:12:37:9A
ValidityMon, 04 Nov 2024 08:40:36 GMT - Mon, 27 Jan 2025 08:40:35 GMT
File type GIF image data, version 89a, 1 x 1
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1732213836.1734466062>m=45j91e4c50v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485~102198178&aip=1&z=17557327 HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 17 Dec 2024 20:07:50 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
POST sgtm.quickenloans.com/g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4cc1v9169491831z89137104487za200zb9137104487&_p=1734466061734&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=1732213836.1734466062&ecid=512155603&ul=en-us&sr=1280x1024&ur=NO-03&frm=0&pscdl=noapi&sst.etld=google.no&sst.gcsub=region1&sst.tft=1734466061734&sst.ude=0&sid=1734466062&sct=1&seg=1&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D0805f9d09c054bf0bbe2fb66a8491c63%26pkey%3Db3a0950ec9aa4557a2eb160625966089%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D0805f9d09c054bf0bbe2fb66a8491c63%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&_s=4&tfd=10908&richsstsse
200 OK 799 B URL POST HTTP/2 sgtm.quickenloans.com/g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4cc1v9169491831z89137104487za200zb9137104487&_p=1734466061734&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=1732213836.1734466062&ecid=512155603&ul=en-us&sr=1280x1024&ur=NO-03&frm=0&pscdl=noapi&sst.etld=google.no&sst.gcsub=region1&sst.tft=1734466061734&sst.ude=0&sid=1734466062&sct=1&seg=1&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D0805f9d09c054bf0bbe2fb66a8491c63%26pkey%3Db3a0950ec9aa4557a2eb160625966089%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D0805f9d09c054bf0bbe2fb66a8491c63%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&_s=4&tfd=10908&richsstsse
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectsgtm.quickenloans.com
Fingerprint4E:86:D8:38:35:2F:10:58:51:04:6D:AF:7F:BE:F9:A5:A6:A8:AA:4E
ValidityThu, 21 Nov 2024 05:40:09 GMT - Wed, 19 Feb 2025 06:30:20 GMT
Hash 40381c12bdc2c6842367451f93de7133
66d54827e0cd8d7b25f5f41e03d731faceb4d490
4bc6769125c32ef478d6a95bf5960dd5331608bf13a532f08e1a3e7a9b02def0
POST /g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4cc1v9169491831z89137104487za200zb9137104487&_p=1734466061734&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=1732213836.1734466062&ecid=512155603&ul=en-us&sr=1280x1024&ur=NO-03&frm=0&pscdl=noapi&sst.etld=google.no&sst.gcsub=region1&sst.tft=1734466061734&sst.ude=0&sid=1734466062&sct=1&seg=1&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D0805f9d09c054bf0bbe2fb66a8491c63%26pkey%3Db3a0950ec9aa4557a2eb160625966089%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D0805f9d09c054bf0bbe2fb66a8491c63%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&_s=4&tfd=10908&richsstsse HTTP/1.1
Host: sgtm.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 69
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Cookie: _gcl_au=1.1.292079720.1734466062; _ga_RXLL9Z7XBK=GS1.1.1734466062.1.1.1734466064.0.0.512155603; _ga=GA1.1.1732213836.1734466062; FPID=FPID2.2.7BN82GxkN50PGwJtJgKtT%2B797zZ0rvW9GB%2ByS%2Bwgwcs%3D.1734466062; FPLC=zYPu5lbctSHGRYYSRW%2FG3lPVEsub81UXdLKSYxZvytebedZQX8obPSvQo2%2FvPsCLlbDuiENfn4lED7baCfRrIA38ZlTkd%2Bh7HfKQ5cfWTC74Rjn%2BgNmeI82TWnBE5Q%3D%3D; FPAU=1.1.292079720.1734466062; FPGSID=1.1734466062.1734466062.G-RXLL9Z7XBK.rzmbptlxh7Qsi2qhaGXhuQ
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
set-cookie: FPID=FPID2.2.7BN82GxkN50PGwJtJgKtT%2B797zZ0rvW9GB%2ByS%2Bwgwcs%3D.1734466062; Max-Age=63072000; Domain=quickenloans.com; Path=/; Secure; HttpOnly
FPAU=1.1.292079720.1734466062; Max-Age=7775991; Domain=quickenloans.com; Path=/; Secure
cache-control: no-cache
content-type: text/plain
x-content-type-options: nosniff
x-accel-buffering: no
access-control-allow-origin: https://loans.quickenloans.com
access-control-allow-credentials: true
date: Tue, 17 Dec 2024 20:07:50 GMT
server: Google Frontend
expires: Tue, 17 Dec 2024 20:07:50 GMT
X-Firefox-Spdy: h2
GET content.quickencompare.com/qc/5_stars.svg
200 OK 1.1 kB URL GET HTTP/2 content.quickencompare.com/qc/5_stars.svg
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectquickencompare.com
Fingerprint91:CF:56:CF:08:92:B6:4B:4D:58:82:62:70:2A:51:8C:F0:F4:49:03
ValidityMon, 11 Nov 2024 06:14:11 GMT - Sun, 09 Feb 2025 06:14:10 GMT
File type SVG Scalable Vector Graphics image
Hash 1e164ed52904830a88b78aac1e66cf77
b77b50ea075ec0eaa3022e3500b7e0803d0fbaa6
e856909cf5edb5e720122af599a4e2c1a992e76d203e33562a57bad45ac4873c
GET /qc/5_stars.svg HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=oQX8LkRX5zKtdEOfmWAbS_WakXkyuS77uTIz7TN0x6w-1734466065-1.0.1.1-dsZpESvHxKPraq6nDddh7awC_7NiKNf2ZWpVDXixiEb5KTSAaW7ByMqiXTxD96UYEnaujPWwK2kBJI7MBDUNzg
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:46 GMT
content-type: image/svg+xml
last-modified: Fri, 30 Aug 2024 13:22:40 GMT
etag: W/"dfdb39404473a99ec98aa98426dd98df"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
via: 1.1 25c0ae8b5b888081618bca2ea4f27faa.cloudfront.net (CloudFront)
x-amz-cf-pop: MXP63-P1
x-amz-cf-id: -ivqFfpV8r9y2aMKCO0g-RxRThiOeAzvxvvOKk82Zz_5rQJxJRnO2Q==
cf-cache-status: REVALIDATED
expires: Wed, 18 Dec 2024 00:07:46 GMT
cache-control: public, max-age=14400
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8f398a924aeeb51e-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
GET create.leadid.com/2.15.1/SaveDeviceId.js?lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&methods=48&token=6521732E-19FC-40DA-9CBC-81E3237BF697&uuid=2b8fa29a7b264923ac1c29b5020515dc
200 OK 0 B URL GET HTTP/2 create.leadid.com/2.15.1/SaveDeviceId.js?lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&methods=48&token=6521732E-19FC-40DA-9CBC-81E3237BF697&uuid=2b8fa29a7b264923ac1c29b5020515dc
IP
Requested by https://deviceid.trueleadid.com/iframe.html?token=6521732E-19FC-40DA-9CBC-81E3237BF697&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D
Certificate IssuerAmazon
Subjectcreate.leadid.com
FingerprintF1:00:1E:2C:3D:E1:0C:3C:9F:6C:A4:8C:6B:2F:4A:AA:A5:65:E0:13
ValiditySat, 20 Jul 2024 00:00:00 GMT - Mon, 18 Aug 2025 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /2.15.1/SaveDeviceId.js?lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&methods=48&token=6521732E-19FC-40DA-9CBC-81E3237BF697&uuid=2b8fa29a7b264923ac1c29b5020515dc HTTP/1.1
Host: create.leadid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://deviceid.trueleadid.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:47 GMT
content-type: text/javascript;charset=UTF-8
server: nginx
set-cookie: rgisanonymous=false; expires=Thu, 16 Jan 2025 20:07:47 GMT; Max-Age=2592000; path=/
rguserid=1065232f-1640-4d65-a3fb-b87c6ad3578c; expires=Thu, 16 Jan 2025 20:07:47 GMT; Max-Age=2592000; path=/
rguuid=true; expires=Thu, 16 Jan 2025 20:07:47 GMT; Max-Age=2592000; path=/
rgisanonymous=true; expires=Thu, 16 Jan 2025 20:07:47 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2
GET www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1732213836.1734466062>m=45j91e4c50v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485~102198178&aip=1&z=309032192
200 OK 42 B URL GET HTTP/2 www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1732213836.1734466062>m=45j91e4c50v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485~102198178&aip=1&z=309032192
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subject*.google.no
FingerprintA8:FC:63:57:7C:92:2A:02:1C:BE:71:EF:F7:D9:C9:CD:5F:12:37:9A
ValidityMon, 04 Nov 2024 08:40:36 GMT - Mon, 27 Jan 2025 08:40:35 GMT
File type GIF image data, version 89a, 1 x 1
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1732213836.1734466062>m=45j91e4c50v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485~102198178&aip=1&z=309032192 HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 17 Dec 2024 20:07:45 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1732213836.1734466062>m=45j91e4c50v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485~102198178&aip=1&z=94585030
200 OK 42 B URL GET HTTP/3 www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1732213836.1734466062>m=45j91e4c50v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485~102198178&aip=1&z=94585030
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subject*.google.no
FingerprintA8:FC:63:57:7C:92:2A:02:1C:BE:71:EF:F7:D9:C9:CD:5F:12:37:9A
ValidityMon, 04 Nov 2024 08:40:36 GMT - Mon, 27 Jan 2025 08:40:35 GMT
File type GIF image data, version 89a, 1 x 1
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1732213836.1734466062>m=45j91e4c50v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485~102198178&aip=1&z=94585030 HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 17 Dec 2024 20:07:50 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET fonts.cdnfonts.com/css/stack-ssi
200 OK 1.4 kB URL GET HTTP/2 fonts.cdnfonts.com/css/stack-ssi
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectcdnfonts.com
FingerprintAF:E7:69:AA:A3:CA:45:49:BE:E8:15:3B:BD:D3:22:6C:86:18:C1:C2
ValidityMon, 18 Nov 2024 09:38:53 GMT - Sun, 16 Feb 2025 09:38:52 GMT
File type ASCII text, with very long lines (1429), with no line terminators
Hash 511790887779062a7c2ec32eb81fe001
7e2137a949f04451ceb5b4ef5d92e2aa69f5e5aa
6757c06f55f8cca96f0648432bdcf714cac2f00a593f1bf332d87763c806ab2d
GET /css/stack-ssi HTTP/1.1
Host: fonts.cdnfonts.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:44 GMT
content-type: text/css;charset=UTF-8
vary: Accept-Encoding
cache-control: max-age=2678400
cf-cache-status: HIT
age: 42917
last-modified: Tue, 17 Dec 2024 08:12:27 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TUJ9MLDHbIIIOeo5S5e4Md1sMJpHeYDMAkC%2Ft4EZsTI4riprZ1TcTDd7G%2FOfJg%2FX1LtE1NBPpnPwF33EsVArsveby%2FqcldAU1pmq4Q%2F9DBs1oV%2BR93Z80rk7NNEPhlC5o3ggF08%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-origin: *
server: cloudflare
cf-ray: 8f398a85ef1d1c0e-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=578&min_rtt=454&rtt_var=203&sent=6&recv=10&lost=0&retrans=0&sent_bytes=3275&recv_bytes=1184&delivery_rate=6000000&cwnd=254&unsent_bytes=0&cid=ce7c428d8104327d&ts=28&x=0"
X-Firefox-Spdy: h2
GET content.quickencompare.com/qlpln/favicon.ico
200 OK 0 B URL GET content.quickencompare.com/qlpln/favicon.ico
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectquickencompare.com
Fingerprint91:CF:56:CF:08:92:B6:4B:4D:58:82:62:70:2A:51:8C:F0:F4:49:03
ValidityMon, 11 Nov 2024 06:14:11 GMT - Sun, 09 Feb 2025 06:14:10 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /qlpln/favicon.ico HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:45 GMT
content-type: image/vnd.microsoft.icon
last-modified: Thu, 08 Aug 2024 07:51:06 GMT
etag: W/"0be220b17dcbe52bb4a1c4af89b0a2b5"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
via: 1.1 ab68583a58d574d6a9e5fca1fb1e6316.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P6
x-amz-cf-id: yDeO2fZs-llVg011F0RLXRjn4kp-uJQ6VIN7mNThWaQ_-9RXO5YytQ==
cf-cache-status: REVALIDATED
expires: Wed, 18 Dec 2024 00:07:45 GMT
cache-control: public, max-age=14400
set-cookie: __cf_bm=oQX8LkRX5zKtdEOfmWAbS_WakXkyuS77uTIz7TN0x6w-1734466065-1.0.1.1-dsZpESvHxKPraq6nDddh7awC_7NiKNf2ZWpVDXixiEb5KTSAaW7ByMqiXTxD96UYEnaujPWwK2kBJI7MBDUNzg; path=/; expires=Tue, 17-Dec-24 20:37:45 GMT; domain=.quickencompare.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8f398a8c1b2fb51e-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
GET deviceid.trueleadid.com/_Incapsula_Resource?SWKMTFSR=1&e=0.07228266924996607
200 OK 1 B URL GET HTTP/2 deviceid.trueleadid.com/_Incapsula_Resource?SWKMTFSR=1&e=0.07228266924996607
IP
Requested by https://deviceid.trueleadid.com/iframe.html?token=6521732E-19FC-40DA-9CBC-81E3237BF697&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D
Certificate IssuerGlobalSign nv-sa
Subjectimperva.com
Fingerprint01:B4:BB:C2:E4:D2:08:99:B9:DC:7E:2A:46:00:7C:75:07:D0:E9:D0
ValidityWed, 10 Jul 2024 14:31:23 GMT - Mon, 06 Jan 2025 14:31:23 GMT
File type very short file (no magic)
Hash c4ca4238a0b923820dcc509a6f75849b
356a192b7913b04c54574d18c28d46e6395428ab
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
GET /_Incapsula_Resource?SWKMTFSR=1&e=0.07228266924996607 HTTP/1.1
Host: deviceid.trueleadid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://deviceid.trueleadid.com/iframe.html?token=6521732E-19FC-40DA-9CBC-81E3237BF697&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D
Cookie: nlbi_3051494=he8gDLCvORL3hSLeC30iGwAAAADY5ySbgo8Tlyke7a5lfogp; visid_incap_3051494=8AEi105vTDiqQeAp5OGaDhLaYWcAAAAAQUIPAAAAAACuAe+41JxmQjKf25H4oj8E; incap_ses_7233_3051494=2DdCW5qPNlh6XYshXMdgZBLaYWcAAAAA9xMjjaBpWwe5y1C5c8q0Ig==; uuid=2b8fa29a7b264923ac1c29b5020515dc
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
cache-control: no-cache, no-store
content-type: text/plain
x-robots-tag: noindex
content-length: 1
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
GET loans.quickenloans.com/main.72a5874a8b922f57cdb3.css
200 OK 82 kB URL GET HTTP/2 loans.quickenloans.com/main.72a5874a8b922f57cdb3.css
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectloans.quickenloans.com
Fingerprint9B:58:4A:65:BD:EC:A5:31:73:3E:E2:82:74:12:E2:BD:67:80:66:0D
ValiditySat, 30 Nov 2024 14:32:02 GMT - Fri, 28 Feb 2025 14:32:01 GMT
Hash 2b5d604c4fbbd3f688f9474a1a98d29f
b6915733162ab7bc6a40f8085f7e4762f908cc0f
05e11fa2b02877d8970375aace37ac729d05f5fc093492fdb2578ba2cb2cffda
GET /main.72a5874a8b922f57cdb3.css HTTP/1.1
Host: loans.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: AWSALBTG=e8PL7MKrh49qKtU3+P158XLEhHp+WBlr2+FfBvRTbj38jbLOTaww/cFR+5lbpOsdx4e0yIKErwu8WXEKQc1xwEX0f0vklhvyKZ2F7PZGRdmvXrEd/B7DiSXslSaJaZMGElB3XtU1LKbT1vwTUNBCnob+lF/yXK+WP1meh2dYeZ4mhHpAiyo=; AWSALBTGCORS=e8PL7MKrh49qKtU3+P158XLEhHp+WBlr2+FfBvRTbj38jbLOTaww/cFR+5lbpOsdx4e0yIKErwu8WXEKQc1xwEX0f0vklhvyKZ2F7PZGRdmvXrEd/B7DiSXslSaJaZMGElB3XtU1LKbT1vwTUNBCnob+lF/yXK+WP1meh2dYeZ4mhHpAiyo=; __cf_bm=6zj9k6NfC.Dvw_3NYSbKzrNzrdo5MSleN3nF2bS8.xQ-1734466061-1.0.1.1-EVDzBFJmww0dmak7xuAH4FZR9l0DgA_FF77HYpK4mAzLgjxu3i7aV.1TUyH_Th1DQtYc1wpGz4Yszt1qWRv9GQ
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:42 GMT
content-type: text/css; charset=UTF-8
x-powered-by: Express
cache-control: public, max-age=14400
last-modified: Mon, 09 Dec 2024 19:17:07 GMT
etag: W/"13f05-193acda9738"
cf-cache-status: MISS
expires: Wed, 18 Dec 2024 00:07:42 GMT
vary: Accept-Encoding
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8f398a7609b8b500-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
GET www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1732213836.1734466062>m=45j91e4c50v9169491831z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485~102198178&aip=1&z=2038902744
200 OK 42 B URL GET HTTP/2 www.google.no/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1732213836.1734466062>m=45j91e4c50v9169491831z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485~102198178&aip=1&z=2038902744
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subject*.google.no
FingerprintA8:FC:63:57:7C:92:2A:02:1C:BE:71:EF:F7:D9:C9:CD:5F:12:37:9A
ValidityMon, 04 Nov 2024 08:40:36 GMT - Mon, 27 Jan 2025 08:40:35 GMT
File type GIF image data, version 89a, 1 x 1
Hash d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1&tid=G-RXLL9Z7XBK&cid=1732213836.1734466062>m=45j91e4c50v9169491831z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485~102198178&aip=1&z=2038902744 HTTP/1.1
Host: www.google.no
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 17 Dec 2024 20:07:45 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
x-content-type-options: nosniff
server: cafe
content-length: 42
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET content.quickencompare.com/qc/refi-images/icon-home-improvement.svg
200 OK 6.9 kB URL GET HTTP/2 content.quickencompare.com/qc/refi-images/icon-home-improvement.svg
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectquickencompare.com
Fingerprint91:CF:56:CF:08:92:B6:4B:4D:58:82:62:70:2A:51:8C:F0:F4:49:03
ValidityMon, 11 Nov 2024 06:14:11 GMT - Sun, 09 Feb 2025 06:14:10 GMT
File type SVG Scalable Vector Graphics image
Hash 33bf2cd1a1c4e590710c5e013fe31e5d
0426f0221dc74e1b5aefd45dac0a49955b180226
b36ee9fc82c750b01cbc646f4187025dae138c2f81792fe7cec941d76d2a3385
GET /qc/refi-images/icon-home-improvement.svg HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=oQX8LkRX5zKtdEOfmWAbS_WakXkyuS77uTIz7TN0x6w-1734466065-1.0.1.1-dsZpESvHxKPraq6nDddh7awC_7NiKNf2ZWpVDXixiEb5KTSAaW7ByMqiXTxD96UYEnaujPWwK2kBJI7MBDUNzg
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:46 GMT
content-type: image/svg+xml
last-modified: Wed, 16 Oct 2024 00:06:02 GMT
etag: W/"9c325b815530ac139ba546a0edfa7c91"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
via: 1.1 d32aedbfbc53db77ab1daf44d017f5ba.cloudfront.net (CloudFront)
x-amz-cf-pop: VIE50-P3
x-amz-cf-id: I-u8mEbe3_xBarY2hMf0L26x4-AV1q1oTbXTsZLlZ9banbS6Po76bA==
cf-cache-status: REVALIDATED
expires: Wed, 18 Dec 2024 00:07:46 GMT
cache-control: public, max-age=14400
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8f398a924ae6b51e-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
GET fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2
200 OK 7.8 kB URL GET HTTP/2 fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subject*.gstatic.com
Fingerprint5E:64:A9:4C:59:5A:8F:EC:57:D9:7F:C4:7E:70:AC:88:F2:67:F1:79
ValidityMon, 04 Nov 2024 08:38:50 GMT - Mon, 27 Jan 2025 08:38:49 GMT
File type Web Open Font Format (Version 2), TrueType, length 7840, version 1.0
Hash 8d91ec1ca2d8b56640a47117e313a3e9
a9e9bafe64666f4595051a0e895b47a5fa39e67e
78bc3aa78faec288bbb3bf26c9a0fa4eb67b1e69da94a17233c5cab60525efdb
GET /s/poppins/v22/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 7840
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 14 Dec 2024 04:20:35 GMT
expires: Sun, 14 Dec 2025 04:20:35 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 04 Dec 2024 06:53:49 GMT
content-type: font/woff2
age: 316031
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET deviceid.trueleadid.com/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=200639578
200 OK 83 kB URL GET HTTP/2 deviceid.trueleadid.com/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=200639578
IP
Requested by https://deviceid.trueleadid.com/iframe.html?token=6521732E-19FC-40DA-9CBC-81E3237BF697&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D
Certificate IssuerGlobalSign nv-sa
Subjectimperva.com
Fingerprint01:B4:BB:C2:E4:D2:08:99:B9:DC:7E:2A:46:00:7C:75:07:D0:E9:D0
ValidityWed, 10 Jul 2024 14:31:23 GMT - Mon, 06 Jan 2025 14:31:23 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Hash ad72b5540309006a2cd43e01548744b5
d84557c9dc3b272c1dfc234317c597407115dcef
09dce2ff919ab0d78581b0e6c0153b95bf1a7d2048945b85e9ab9b61981f2dbf
GET /_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=200639578 HTTP/1.1
Host: deviceid.trueleadid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://deviceid.trueleadid.com/iframe.html?token=6521732E-19FC-40DA-9CBC-81E3237BF697&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D
Cookie: nlbi_3051494=he8gDLCvORL3hSLeC30iGwAAAADY5ySbgo8Tlyke7a5lfogp; visid_incap_3051494=8AEi105vTDiqQeAp5OGaDhLaYWcAAAAAQUIPAAAAAACuAe+41JxmQjKf25H4oj8E; incap_ses_7233_3051494=2DdCW5qPNlh6XYshXMdgZBLaYWcAAAAA9xMjjaBpWwe5y1C5c8q0Ig==
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
cache-control: no-cache, no-store
content-type: application/javascript
content-encoding: gzip
x-robots-tag: noindex
content-length: 19940
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
GET loans.quickenloans.com/undefined
200 OK 0 B URL GET HTTP/2 loans.quickenloans.com/undefined
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectloans.quickenloans.com
Fingerprint9B:58:4A:65:BD:EC:A5:31:73:3E:E2:82:74:12:E2:BD:67:80:66:0D
ValiditySat, 30 Nov 2024 14:32:02 GMT - Fri, 28 Feb 2025 14:32:01 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /undefined HTTP/1.1
Host: loans.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: AWSALBTG=e8PL7MKrh49qKtU3+P158XLEhHp+WBlr2+FfBvRTbj38jbLOTaww/cFR+5lbpOsdx4e0yIKErwu8WXEKQc1xwEX0f0vklhvyKZ2F7PZGRdmvXrEd/B7DiSXslSaJaZMGElB3XtU1LKbT1vwTUNBCnob+lF/yXK+WP1meh2dYeZ4mhHpAiyo=; AWSALBTGCORS=e8PL7MKrh49qKtU3+P158XLEhHp+WBlr2+FfBvRTbj38jbLOTaww/cFR+5lbpOsdx4e0yIKErwu8WXEKQc1xwEX0f0vklhvyKZ2F7PZGRdmvXrEd/B7DiSXslSaJaZMGElB3XtU1LKbT1vwTUNBCnob+lF/yXK+WP1meh2dYeZ4mhHpAiyo=; __cf_bm=6zj9k6NfC.Dvw_3NYSbKzrNzrdo5MSleN3nF2bS8.xQ-1734466061-1.0.1.1-EVDzBFJmww0dmak7xuAH4FZR9l0DgA_FF77HYpK4mAzLgjxu3i7aV.1TUyH_Th1DQtYc1wpGz4Yszt1qWRv9GQ; _dd_s=rum=1&id=2ff6b206-d396-482f-a308-55c66f2af9b7&created=1734466061865&expire=1734466962429&logs=1; _gcl_au=1.1.292079720.1734466062; _ga_RXLL9Z7XBK=GS1.1.1734466062.1.1.1734466064.0.0.512155603; _ga=GA1.1.1732213836.1734466062; FPID=FPID2.2.7BN82GxkN50PGwJtJgKtT%2B797zZ0rvW9GB%2ByS%2Bwgwcs%3D.1734466062; FPLC=BRNam%2BuCHLkbkcz%2Bh31zTo%2BI8IwbLYAyeQJpGVmrPTJEEoOQc%2BcO05yNNMd6N%2BZjdvpG1g0z4Tie7y3JV66OrI40NHUCytfORqMu6cYdJ15N2n7JYpnjCGtG%2BSCu4g%3D%3D; FPAU=1.1.292079720.1734466062; FPGSID=1.1734466062.1734466062.G-RXLL9Z7XBK.rzmbptlxh7Qsi2qhaGXhuQ; optimizelyVisitorId=a32998bc-a96b-4f7a-a558-976fc814d0a8
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:44 GMT
content-type: text/html; charset=utf-8
set-cookie: AWSALBTG=lTj7SC5x54WZzWmjwMpH+J+zcdjgnHzixDE9X7m9y9z1evWpL3qEl2Ojhn/7KFf+u/meRUpiI6izUotd/OijiyVSJQu4hDquBp5K73uN5V/7li2Dbz1RPh3SjcAZlchXNDffrX6IshM+Zvg79bNI1NBb+oeBAAqiDdDTKW9B0dt1EB4DCFM=; Expires=Tue, 24 Dec 2024 20:07:44 GMT; Path=/
AWSALBTGCORS=lTj7SC5x54WZzWmjwMpH+J+zcdjgnHzixDE9X7m9y9z1evWpL3qEl2Ojhn/7KFf+u/meRUpiI6izUotd/OijiyVSJQu4hDquBp5K73uN5V/7li2Dbz1RPh3SjcAZlchXNDffrX6IshM+Zvg79bNI1NBb+oeBAAqiDdDTKW9B0dt1EB4DCFM=; Expires=Tue, 24 Dec 2024 20:07:44 GMT; Path=/; SameSite=None; Secure
x-dns-prefetch-control: off
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
origin-agent-cluster: ?1
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
cf-cache-status: DYNAMIC
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8f398a85cf98b500-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
GET content.quickencompare.com/qlpln/favicon.ico
200 OK 0 B URL GET content.quickencompare.com/qlpln/favicon.ico
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectquickencompare.com
Fingerprint91:CF:56:CF:08:92:B6:4B:4D:58:82:62:70:2A:51:8C:F0:F4:49:03
ValidityMon, 11 Nov 2024 06:14:11 GMT - Sun, 09 Feb 2025 06:14:10 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /qlpln/favicon.ico HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:45 GMT
content-type: image/vnd.microsoft.icon
last-modified: Thu, 08 Aug 2024 07:51:06 GMT
etag: W/"0be220b17dcbe52bb4a1c4af89b0a2b5"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
via: 1.1 ab68583a58d574d6a9e5fca1fb1e6316.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P6
x-amz-cf-id: yDeO2fZs-llVg011F0RLXRjn4kp-uJQ6VIN7mNThWaQ_-9RXO5YytQ==
cf-cache-status: REVALIDATED
expires: Wed, 18 Dec 2024 00:07:45 GMT
cache-control: public, max-age=14400
set-cookie: __cf_bm=WQkCADfJ2HRRAbxWBAVyLgWT6AxPaDmSSVL8NVZsRMw-1734466065-1.0.1.1-G30JYPikK9jITdnym.1r1jyIEezZ8NSInWpPXzQ7TcNVwt3inDznLUnZLua_AjJUjLZPLJFwUD_8nnZBNYuwcA; path=/; expires=Tue, 17-Dec-24 20:37:45 GMT; domain=.quickencompare.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8f398a8c1b34b51e-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
POST create.leadid.com/2.15.1/Snap?msn=5&pid=2ae0bbcc-9e72-460b-b11a-6363f4a43003&token=6521732E-19FC-40DA-9CBC-81E3237BF697&_=680755849
200 OK 0 B URL POST HTTP/2 create.leadid.com/2.15.1/Snap?msn=5&pid=2ae0bbcc-9e72-460b-b11a-6363f4a43003&token=6521732E-19FC-40DA-9CBC-81E3237BF697&_=680755849
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerAmazon
Subjectcreate.leadid.com
FingerprintF1:00:1E:2C:3D:E1:0C:3C:9F:6C:A4:8C:6B:2F:4A:AA:A5:65:E0:13
ValiditySat, 20 Jul 2024 00:00:00 GMT - Mon, 18 Aug 2025 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /2.15.1/Snap?msn=5&pid=2ae0bbcc-9e72-460b-b11a-6363f4a43003&token=6521732E-19FC-40DA-9CBC-81E3237BF697&_=680755849 HTTP/1.1
Host: create.leadid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 319103
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:56 GMT
content-type: text/plain;charset=UTF-8
server: nginx
set-cookie: rgisanonymous=false; expires=Thu, 16 Jan 2025 20:07:56 GMT; Max-Age=2592000; path=/
rguserid=ee60774c-914a-4997-b415-c47ff2c12109; expires=Thu, 16 Jan 2025 20:07:56 GMT; Max-Age=2592000; path=/
rguuid=true; expires=Thu, 16 Jan 2025 20:07:56 GMT; Max-Age=2592000; path=/
rgisanonymous=true; expires=Thu, 16 Jan 2025 20:07:56 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2
GET use.typekit.net/af/80c5d0/00000000000000000001709c/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n6&v=3
200 OK 24 kB URL GET HTTP/2 use.typekit.net/af/80c5d0/00000000000000000001709c/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n6&v=3
IP
ASN #20940 Akamai International B.V.
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subjectuse.typekit.net
FingerprintF3:36:2A:08:11:E8:8C:54:E5:3C:6A:03:53:BF:AA:D7:7A:84:8B:89
ValidityTue, 10 Dec 2024 00:00:00 GMT - Sat, 10 Jan 2026 23:59:59 GMT
File type Web Open Font Format (Version 2), TrueType, length 24264, version 1.0
Hash a2956c5b75d3f28bc938b57b98491fb7
8c8564da8dd7073047fc7513cb5a0ac261035984
cc62200b7ffb4acffa5ced44e916789729b903e9a39bf86bb6175577500c9fc7
GET /af/80c5d0/00000000000000000001709c/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n6&v=3 HTTP/1.1
Host: use.typekit.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Referer: https://use.typekit.net/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/font-woff2
content-length: 24264
etag: "9852112d8099a97564f64224e106ceeffff9e7c4"
timing-allow-origin: *
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cache-control: public, max-age=31536000
date: Tue, 17 Dec 2024 20:07:46 GMT
X-Firefox-Spdy: h2
GET d2m2wsoho8qq12.cloudfront.net/iframe.html?token=6521732E-19FC-40DA-9CBC-81E3237BF697&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D
200 OK 3.5 kB URL GET HTTP/1.1 d2m2wsoho8qq12.cloudfront.net/iframe.html?token=6521732E-19FC-40DA-9CBC-81E3237BF697&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerAmazon
Subject*.cloudfront.net
Fingerprint28:D3:87:79:3C:E8:8B:3C:D9:10:45:E5:F7:64:7A:6D:44:4E:5A:62
ValidityTue, 30 Jul 2024 00:00:00 GMT - Thu, 03 Jul 2025 23:59:59 GMT
File type HTML document, ASCII text, with very long lines (3675), with no line terminators
Hash f296cf3fca2786c12a670712ef7f00bc
da1b0e716af4460dcf59ade38450cb62798954d1
eabbab0c6023ae05e66d758837fa85258b724f04781c69ce36225c586a0c8db7
GET /iframe.html?token=6521732E-19FC-40DA-9CBC-81E3237BF697&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D HTTP/1.1
Host: d2m2wsoho8qq12.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Last-Modified: Thu, 10 Oct 2024 16:20:35 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Encoding: gzip
Date: Tue, 17 Dec 2024 05:02:35 GMT
Etag: W/"6707fed3-dbb"
Via: 1.1 80d21802b1b80c40e55ccf83433b8eac.cloudfront.net (CloudFront)
Age: 56832
Access-Control-Allow-Headers: *
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: _Iu4ZnrbbFY-kziQYDzqvr8H47N-EaZqKZa3mwTMU7OCXNuv1Rqq5g==
POST create.leadid.com/2.15.1/InitFormData?msn=3&pid=2ae0bbcc-9e72-460b-b11a-6363f4a43003&token=6521732E-19FC-40DA-9CBC-81E3237BF697&_=680755847
200 OK 0 B URL POST HTTP/2 create.leadid.com/2.15.1/InitFormData?msn=3&pid=2ae0bbcc-9e72-460b-b11a-6363f4a43003&token=6521732E-19FC-40DA-9CBC-81E3237BF697&_=680755847
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerAmazon
Subjectcreate.leadid.com
FingerprintF1:00:1E:2C:3D:E1:0C:3C:9F:6C:A4:8C:6B:2F:4A:AA:A5:65:E0:13
ValiditySat, 20 Jul 2024 00:00:00 GMT - Mon, 18 Aug 2025 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /2.15.1/InitFormData?msn=3&pid=2ae0bbcc-9e72-460b-b11a-6363f4a43003&token=6521732E-19FC-40DA-9CBC-81E3237BF697&_=680755847 HTTP/1.1
Host: create.leadid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 2940
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:46 GMT
content-type: text/plain;charset=UTF-8
server: nginx
set-cookie: rgisanonymous=false; expires=Thu, 16 Jan 2025 20:07:46 GMT; Max-Age=2592000; path=/
rguserid=7217e84e-de3b-495f-b47b-8796606bea2c; expires=Thu, 16 Jan 2025 20:07:46 GMT; Max-Age=2592000; path=/
rguuid=true; expires=Thu, 16 Jan 2025 20:07:46 GMT; Max-Age=2592000; path=/
rgisanonymous=true; expires=Thu, 16 Jan 2025 20:07:46 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2
GET content.quickencompare.com/qc/refi-images/icon-household-expenses.svg
200 OK 3.3 kB URL GET HTTP/2 content.quickencompare.com/qc/refi-images/icon-household-expenses.svg
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectquickencompare.com
Fingerprint91:CF:56:CF:08:92:B6:4B:4D:58:82:62:70:2A:51:8C:F0:F4:49:03
ValidityMon, 11 Nov 2024 06:14:11 GMT - Sun, 09 Feb 2025 06:14:10 GMT
File type SVG Scalable Vector Graphics image
Hash 4d32c50a9d7aa6d115b35358ed4be05b
c96d8ffe2002ccf3c1582f06f2f09a8bf5e1a37c
f3cfbe305fef9fb1324afbf9b0f00df49f2f8d31f2930cc0fec57c61ab521440
GET /qc/refi-images/icon-household-expenses.svg HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=oQX8LkRX5zKtdEOfmWAbS_WakXkyuS77uTIz7TN0x6w-1734466065-1.0.1.1-dsZpESvHxKPraq6nDddh7awC_7NiKNf2ZWpVDXixiEb5KTSAaW7ByMqiXTxD96UYEnaujPWwK2kBJI7MBDUNzg
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:46 GMT
content-type: image/svg+xml
last-modified: Mon, 09 Dec 2024 18:19:27 GMT
x-amz-server-side-encryption: AES256
etag: W/"4bc93ca8cf8ddca9dab4a7fe5b09e4a4"
x-cache: Hit from cloudfront
via: 1.1 7b20af4202adb6ef25a7920ed74908dc.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P6
x-amz-cf-id: YGbThh94Q8K1OFG_8xno4Jo7C4gMxs5emQiK0G1JDd7MzCPeeNZ3CA==
cf-cache-status: REVALIDATED
expires: Wed, 18 Dec 2024 00:07:46 GMT
cache-control: public, max-age=14400
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8f398a924aeab51e-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
POST create.leadid.com/2.15.1/Snap?msn=4&pid=2ae0bbcc-9e72-460b-b11a-6363f4a43003&token=6521732E-19FC-40DA-9CBC-81E3237BF697&_=680755848
200 OK 0 B URL POST HTTP/2 create.leadid.com/2.15.1/Snap?msn=4&pid=2ae0bbcc-9e72-460b-b11a-6363f4a43003&token=6521732E-19FC-40DA-9CBC-81E3237BF697&_=680755848
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerAmazon
Subjectcreate.leadid.com
FingerprintF1:00:1E:2C:3D:E1:0C:3C:9F:6C:A4:8C:6B:2F:4A:AA:A5:65:E0:13
ValiditySat, 20 Jul 2024 00:00:00 GMT - Mon, 18 Aug 2025 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /2.15.1/Snap?msn=4&pid=2ae0bbcc-9e72-460b-b11a-6363f4a43003&token=6521732E-19FC-40DA-9CBC-81E3237BF697&_=680755848 HTTP/1.1
Host: create.leadid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 320250
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:55 GMT
content-type: text/plain;charset=UTF-8
server: nginx
set-cookie: rgisanonymous=false; expires=Thu, 16 Jan 2025 20:07:55 GMT; Max-Age=2592000; path=/
rguserid=7807ba3b-6bd9-4f75-84d1-fff4dd73d4d9; expires=Thu, 16 Jan 2025 20:07:55 GMT; Max-Age=2592000; path=/
rguuid=true; expires=Thu, 16 Jan 2025 20:07:55 GMT; Max-Age=2592000; path=/
rgisanonymous=true; expires=Thu, 16 Jan 2025 20:07:55 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2
GET www.datadoghq-browser-agent.com/datadog-rum-v3.js
200 OK 118 kB URL GET HTTP/2 www.datadoghq-browser-agent.com/datadog-rum-v3.js
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerDigiCert Inc
Subject*.datadoghq-browser-agent.com
Fingerprint9E:40:A3:B8:F8:5F:43:15:5B:BB:AF:99:5C:07:D1:39:23:59:1F:51
ValidityTue, 30 Jul 2024 00:00:00 GMT - Sun, 03 Aug 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (65536), with no line terminators
Size 118 kB (117677 bytes)
Hash 647fda9a4d3d74344732d76cf1fff47c
01720d421ce3373f1a1958a1d85edfae5ab5f442
4375ebb4771e6dbb66555214b78781f96a3f6fc43f26b6e9acc4a4751551706b
GET /datadog-rum-v3.js HTTP/1.1
Host: www.datadoghq-browser-agent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript
last-modified: Mon, 03 Jan 2022 16:36:14 GMT
content-encoding: br
server: AmazonS3
date: Tue, 17 Dec 2024 20:06:59 GMT
cache-control: max-age=14400, s-maxage=60
etag: W/"647fda9a4d3d74344732d76cf1fff47c"
vary: accept-encoding
x-cache: Hit from cloudfront
via: 1.1 ab09332bca1a3bd382d2e408f65b98d2.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: TtU5hk9VJB-kC0LMbyh9LVxLasKzuyUh7Bk_RhVZZCqQ8vnsTiQdCw==
age: 43
timing-allow-origin: *
X-Firefox-Spdy: h2
GET www.googletagmanager.com/gtag/js?id=G-RXLL9Z7XBK&l=dataLayer&cx=c>m=45He4cc1v9137104487za200
200 OK 344 kB URL GET HTTP/3 www.googletagmanager.com/gtag/js?id=G-RXLL9Z7XBK&l=dataLayer&cx=c>m=45He4cc1v9137104487za200
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subject*.google-analytics.com
Fingerprint4B:B1:5A:60:07:55:DD:0C:FA:98:D3:8E:E8:58:9E:E7:6A:0D:60:12
ValidityMon, 04 Nov 2024 08:37:47 GMT - Mon, 27 Jan 2025 08:37:46 GMT
File type JavaScript source, ASCII text, with very long lines (7726)
Size 344 kB (343889 bytes)
Hash 6f01327bc1425a9dd1d3c5eed8be1c4f
a65bd724f03d7b60826674223472f216dbd592e3
4c9c47998bd343b42c8e05baa344969eb78b5643453f6d96e7bbaa67ef380fbd
GET /gtag/js?id=G-RXLL9Z7XBK&l=dataLayer&cx=c>m=45He4cc1v9137104487za200 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Tue, 17 Dec 2024 20:07:42 GMT
expires: Tue, 17 Dec 2024 20:07:42 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
server: Google Tag Manager
content-length: 112683
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET sgtm.quickenloans.com/g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4cc1v9169491831z89137104487za200zb9137104487&_p=1734466061734&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=1732213836.1734466062&ecid=512155603&ul=en-us&sr=1280x1024&_fplc=0&ur=NO-03&frm=0&pscdl=noapi&sst.etld=google.no&sst.gcsub=region1&sst.tft=1734466061734&sst.ude=0&_s=2&sid=1734466062&sct=1&seg=1&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D0805f9d09c054bf0bbe2fb66a8491c63%26pkey%3Db3a0950ec9aa4557a2eb160625966089%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D0805f9d09c054bf0bbe2fb66a8491c63%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&en=page_view&tfd=4051&richsstsse
200 OK 724 B URL GET HTTP/2 sgtm.quickenloans.com/g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4cc1v9169491831z89137104487za200zb9137104487&_p=1734466061734&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=1732213836.1734466062&ecid=512155603&ul=en-us&sr=1280x1024&_fplc=0&ur=NO-03&frm=0&pscdl=noapi&sst.etld=google.no&sst.gcsub=region1&sst.tft=1734466061734&sst.ude=0&_s=2&sid=1734466062&sct=1&seg=1&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D0805f9d09c054bf0bbe2fb66a8491c63%26pkey%3Db3a0950ec9aa4557a2eb160625966089%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D0805f9d09c054bf0bbe2fb66a8491c63%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&en=page_view&tfd=4051&richsstsse
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectsgtm.quickenloans.com
Fingerprint4E:86:D8:38:35:2F:10:58:51:04:6D:AF:7F:BE:F9:A5:A6:A8:AA:4E
ValidityThu, 21 Nov 2024 05:40:09 GMT - Wed, 19 Feb 2025 06:30:20 GMT
File type ASCII text, with very long lines (753), with no line terminators
Hash fa1bf613114dd4da8928245e5beea147
807bbc74335673daeb0ada4f20720dac7694d038
9cdc55e868f0580ce2a988e351b241abc9ac02582a5cd4b3b14180b5fe9c74aa
GET /g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4cc1v9169491831z89137104487za200zb9137104487&_p=1734466061734&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=1732213836.1734466062&ecid=512155603&ul=en-us&sr=1280x1024&_fplc=0&ur=NO-03&frm=0&pscdl=noapi&sst.etld=google.no&sst.gcsub=region1&sst.tft=1734466061734&sst.ude=0&_s=2&sid=1734466062&sct=1&seg=1&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D0805f9d09c054bf0bbe2fb66a8491c63%26pkey%3Db3a0950ec9aa4557a2eb160625966089%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D0805f9d09c054bf0bbe2fb66a8491c63%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&en=page_view&tfd=4051&richsstsse HTTP/1.1
Host: sgtm.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Cookie: _gcl_au=1.1.292079720.1734466062; _ga_RXLL9Z7XBK=GS1.1.1734466062.1.1.1734466062.0.0.512155603; _ga=GA1.1.1732213836.1734466062
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
set-cookie: FPID=FPID2.2.7BN82GxkN50PGwJtJgKtT%2B797zZ0rvW9GB%2ByS%2Bwgwcs%3D.1734466062; Max-Age=63072000; Domain=quickenloans.com; Path=/; Secure; HttpOnly
FPLC=BRNam%2BuCHLkbkcz%2Bh31zTo%2BI8IwbLYAyeQJpGVmrPTJEEoOQc%2BcO05yNNMd6N%2BZjdvpG1g0z4Tie7y3JV66OrI40NHUCytfORqMu6cYdJ15N2n7JYpnjCGtG%2BSCu4g%3D%3D; Max-Age=72000; Domain=quickenloans.com; Path=/; Secure
FPAU=1.1.292079720.1734466062; Max-Age=7775999; Domain=quickenloans.com; Path=/; Secure
FPGSID=1.1734466062.1734466062.G-RXLL9Z7XBK.rzmbptlxh7Qsi2qhaGXhuQ; Max-Age=1800; Domain=quickenloans.com; Path=/; SameSite=strict; Secure
cache-control: no-cache
content-type: text/plain
x-content-type-options: nosniff
x-accel-buffering: no
access-control-allow-origin: https://loans.quickenloans.com
access-control-allow-credentials: true
date: Tue, 17 Dec 2024 20:07:42 GMT
server: Google Frontend
expires: Tue, 17 Dec 2024 20:07:42 GMT
X-Firefox-Spdy: h2
GET sgtm.quickenloans.com/g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4cc1v9169491831za200zb9137104487&_p=1734466061734&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=1732213836.1734466062&ecid=512155603&ul=en-us&sr=1280x1024&_fplc=0&ur=NO-03&frm=0&pscdl=noapi&_eu=AEA&sst.etld=google.no&sst.gcsub=region1&sst.tft=1734466061734&sst.sp=1&sst.em_event=1&sst.ude=0&_s=3&sid=1734466062&sct=1&seg=1&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D0805f9d09c054bf0bbe2fb66a8491c63%26pkey%3Db3a0950ec9aa4557a2eb160625966089%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D0805f9d09c054bf0bbe2fb66a8491c63%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&en=scroll&epn.percent_scrolled=90&tfd=5904&richsstsse
200 OK 401 B URL GET HTTP/2 sgtm.quickenloans.com/g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4cc1v9169491831za200zb9137104487&_p=1734466061734&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=1732213836.1734466062&ecid=512155603&ul=en-us&sr=1280x1024&_fplc=0&ur=NO-03&frm=0&pscdl=noapi&_eu=AEA&sst.etld=google.no&sst.gcsub=region1&sst.tft=1734466061734&sst.sp=1&sst.em_event=1&sst.ude=0&_s=3&sid=1734466062&sct=1&seg=1&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D0805f9d09c054bf0bbe2fb66a8491c63%26pkey%3Db3a0950ec9aa4557a2eb160625966089%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D0805f9d09c054bf0bbe2fb66a8491c63%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&en=scroll&epn.percent_scrolled=90&tfd=5904&richsstsse
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectsgtm.quickenloans.com
Fingerprint4E:86:D8:38:35:2F:10:58:51:04:6D:AF:7F:BE:F9:A5:A6:A8:AA:4E
ValidityThu, 21 Nov 2024 05:40:09 GMT - Wed, 19 Feb 2025 06:30:20 GMT
File type ASCII text, with very long lines (421), with no line terminators
Hash 8a2471b0da62d820c7f2075acdf45f36
44edfe735f2e1038d6cb53e77f90eca1a1c099e0
4e0e05910eb570fe946ce414e7b7a70b51c7498567a990600f79ab869d5ad120
GET /g/collect?v=2&tid=G-RXLL9Z7XBK>m=45je4cc1v9169491831za200zb9137104487&_p=1734466061734&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=1732213836.1734466062&ecid=512155603&ul=en-us&sr=1280x1024&_fplc=0&ur=NO-03&frm=0&pscdl=noapi&_eu=AEA&sst.etld=google.no&sst.gcsub=region1&sst.tft=1734466061734&sst.sp=1&sst.em_event=1&sst.ude=0&_s=3&sid=1734466062&sct=1&seg=1&dl=https%3A%2F%2Floans.quickenloans.com%2F%3Fmoid%3D321646%26sourceid%3Daffl_everflow_ql-mon_173_809%26pkey1%3D809%26pkey2%3D2%26pkey3%3D0805f9d09c054bf0bbe2fb66a8491c63%26pkey%3Db3a0950ec9aa4557a2eb160625966089%26sid%3D173%26cmpid%3D173%26crtid%3D%26oid%3D173%26affid%3D809%26_ef_transaction_id%3D0805f9d09c054bf0bbe2fb66a8491c63%26utm_medium%3Daffiliate%26utm_source%3Dnocapads.com%26utm_content%3D&dt=Refinance%2C%20Cash%20Out%20Refinance%2C%20Home%20Equity%20Loans%20and%20Lines%20of%20Credit%2C%20Personal%20Loans%20-%20Get%20Funds%20for%20Any%20Purpose&en=scroll&epn.percent_scrolled=90&tfd=5904&richsstsse HTTP/1.1
Host: sgtm.quickenloans.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Cookie: _gcl_au=1.1.292079720.1734466062; _ga_RXLL9Z7XBK=GS1.1.1734466062.1.1.1734466064.0.0.512155603; _ga=GA1.1.1732213836.1734466062; FPID=FPID2.2.7BN82GxkN50PGwJtJgKtT%2B797zZ0rvW9GB%2ByS%2Bwgwcs%3D.1734466062; FPLC=BRNam%2BuCHLkbkcz%2Bh31zTo%2BI8IwbLYAyeQJpGVmrPTJEEoOQc%2BcO05yNNMd6N%2BZjdvpG1g0z4Tie7y3JV66OrI40NHUCytfORqMu6cYdJ15N2n7JYpnjCGtG%2BSCu4g%3D%3D; FPAU=1.1.292079720.1734466062; FPGSID=1.1734466062.1734466062.G-RXLL9Z7XBK.rzmbptlxh7Qsi2qhaGXhuQ
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
set-cookie: FPID=FPID2.2.7BN82GxkN50PGwJtJgKtT%2B797zZ0rvW9GB%2ByS%2Bwgwcs%3D.1734466062; Max-Age=63072000; Domain=quickenloans.com; Path=/; Secure; HttpOnly
FPLC=zYPu5lbctSHGRYYSRW%2FG3lPVEsub81UXdLKSYxZvytebedZQX8obPSvQo2%2FvPsCLlbDuiENfn4lED7baCfRrIA38ZlTkd%2Bh7HfKQ5cfWTC74Rjn%2BgNmeI82TWnBE5Q%3D%3D; Max-Age=72000; Domain=quickenloans.com; Path=/; Secure
cache-control: no-cache
content-type: text/plain
x-content-type-options: nosniff
x-accel-buffering: no
access-control-allow-origin: https://loans.quickenloans.com
access-control-allow-credentials: true
date: Tue, 17 Dec 2024 20:07:44 GMT
server: Google Frontend
expires: Tue, 17 Dec 2024 20:07:44 GMT
X-Firefox-Spdy: h2
POST script.anura.io/response.json?24041450584
200 OK 151 B URL POST HTTP/2 script.anura.io/response.json?24041450584
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerAmazon
Subjectscript.anura.io
FingerprintCC:B4:48:82:BF:CC:04:FB:C7:35:8F:3F:D3:69:3F:10:96:9A:EF:C8
ValiditySun, 15 Sep 2024 00:00:00 GMT - Wed, 15 Oct 2025 23:59:59 GMT
File type troff or preprocessor input, ASCII text, with no line terminators
Hash 604cc0a8327b74aab0b62c09f9872603
26523f61a0a3f3d31869e5e23101668024d45044
5b09912b38bb76ad90301a1e2beca0e16773e33d501a7d8c6b76d4197545448f
POST /response.json?24041450584 HTTP/1.1
Host: script.anura.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 6041
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:47 GMT
content-type: application/json; charset=utf-8
server: nginx
vary: Accept-Encoding
access-control-allow-origin: *
access-control-allow-methods: POST
expires: Sun, 28 Dec 1980 18:57:00 EST
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
X-Firefox-Spdy: h2
GET fonts.googleapis.com/css?family=Work+Sans:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
200 OK 12 kB URL GET HTTP/2 fonts.googleapis.com/css?family=Work+Sans:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectupload.video.google.com
FingerprintD4:A3:E0:67:E1:FB:D8:0C:7B:58:AE:DA:81:4F:CA:47:9A:07:6E:5B
ValidityMon, 04 Nov 2024 08:38:51 GMT - Mon, 27 Jan 2025 08:38:50 GMT
Hash 5ba4a3ed009300adfee10ffbcf0ec98d
00858650903c8deace5e0cb3266dc1f5c437e22a
a7d9d066818d14071483fb738ada07980e96f9f418b0314fbfe4d3102d589316
GET /css?family=Work+Sans:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Tue, 17 Dec 2024 20:07:44 GMT
date: Tue, 17 Dec 2024 20:07:44 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET content.quickencompare.com/nmn/logo/dollar-money-icon-small.svg
200 OK 7.6 kB URL GET HTTP/2 content.quickencompare.com/nmn/logo/dollar-money-icon-small.svg
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectquickencompare.com
Fingerprint91:CF:56:CF:08:92:B6:4B:4D:58:82:62:70:2A:51:8C:F0:F4:49:03
ValidityMon, 11 Nov 2024 06:14:11 GMT - Sun, 09 Feb 2025 06:14:10 GMT
File type SVG Scalable Vector Graphics image
Hash 9c7fa5ca9ac7adf457a83b5aed9fe269
d527d4db3df8b0adb6af6408d9ab45c3ec67dc02
f647b5bacc626969604abca8928075eb34accf47048b1ffa58e2cc56c08b0d3a
GET /nmn/logo/dollar-money-icon-small.svg HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=oQX8LkRX5zKtdEOfmWAbS_WakXkyuS77uTIz7TN0x6w-1734466065-1.0.1.1-dsZpESvHxKPraq6nDddh7awC_7NiKNf2ZWpVDXixiEb5KTSAaW7ByMqiXTxD96UYEnaujPWwK2kBJI7MBDUNzg
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:46 GMT
content-type: image/svg+xml
last-modified: Mon, 09 Dec 2024 18:19:25 GMT
etag: W/"3b280fb1b5f603b076383e1ca6ea531f"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
via: 1.1 f66e3db0f0449307dba3fbf72bbf3bac.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: DJcfpYRwhRFkc_iP64brt6EK8Pd9f9pheMsGImaM-TPqW8tgzHw_xg==
cf-cache-status: REVALIDATED
expires: Wed, 18 Dec 2024 00:07:46 GMT
cache-control: public, max-age=14400
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8f398a923ad8b51e-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
POST create.leadid.com/2.15.1/SaveDom?msn=2&pid=2ae0bbcc-9e72-460b-b11a-6363f4a43003&token=6521732E-19FC-40DA-9CBC-81E3237BF697&_=680755846
200 OK 0 B URL POST HTTP/2 create.leadid.com/2.15.1/SaveDom?msn=2&pid=2ae0bbcc-9e72-460b-b11a-6363f4a43003&token=6521732E-19FC-40DA-9CBC-81E3237BF697&_=680755846
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerAmazon
Subjectcreate.leadid.com
FingerprintF1:00:1E:2C:3D:E1:0C:3C:9F:6C:A4:8C:6B:2F:4A:AA:A5:65:E0:13
ValiditySat, 20 Jul 2024 00:00:00 GMT - Mon, 18 Aug 2025 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /2.15.1/SaveDom?msn=2&pid=2ae0bbcc-9e72-460b-b11a-6363f4a43003&token=6521732E-19FC-40DA-9CBC-81E3237BF697&_=680755846 HTTP/1.1
Host: create.leadid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 494
Origin: https://loans.quickenloans.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:46 GMT
content-type: text/plain;charset=UTF-8
server: nginx
set-cookie: rgisanonymous=false; expires=Thu, 16 Jan 2025 20:07:46 GMT; Max-Age=2592000; path=/
rguserid=9f287ff0-cf4c-43be-aab4-9f89437a0753; expires=Thu, 16 Jan 2025 20:07:46 GMT; Max-Age=2592000; path=/
rguuid=true; expires=Thu, 16 Jan 2025 20:07:46 GMT; Max-Age=2592000; path=/
rgisanonymous=true; expires=Thu, 16 Jan 2025 20:07:46 GMT; Max-Age=2592000; path=/
cache-control: no-cache, must-revalidate
expires: Sat, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Content-Type
access-control-max-age: 1728000
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
X-Firefox-Spdy: h2
GET region1.analytics.google.com/g/s/collect?dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1>m=45j91e4c50v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485~102198178&_gsid=RXLL9Z7XBKrzmbptlxh7Qsi2qhaGXhuQ
204 No Content 0 B URL GET HTTP/2 region1.analytics.google.com/g/s/collect?dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1>m=45j91e4c50v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485~102198178&_gsid=RXLL9Z7XBKrzmbptlxh7Qsi2qhaGXhuQ
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subject*.google-analytics.com
Fingerprint4B:B1:5A:60:07:55:DD:0C:FA:98:D3:8E:E8:58:9E:E7:6A:0D:60:12
ValidityMon, 04 Nov 2024 08:37:47 GMT - Mon, 27 Jan 2025 08:37:46 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /g/s/collect?dma=1&dma_cps=syphamo&npa=1&gcd=13l3l3l2l1l1>m=45j91e4c50v9169491831z89137104487z99200500233za200zb9137104487&tag_exp=101925629~102067555~102067808~102081485~102198178&_gsid=RXLL9Z7XBKrzmbptlxh7Qsi2qhaGXhuQ HTTP/1.1
Host: region1.analytics.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
access-control-allow-origin: *
date: Tue, 17 Dec 2024 20:07:45 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: text/plain
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:194:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:194:0"}],}
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET content.quickencompare.com/qc/refi-images/down-arrow.svg
200 OK 342 B URL GET HTTP/2 content.quickencompare.com/qc/refi-images/down-arrow.svg
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectquickencompare.com
Fingerprint91:CF:56:CF:08:92:B6:4B:4D:58:82:62:70:2A:51:8C:F0:F4:49:03
ValidityMon, 11 Nov 2024 06:14:11 GMT - Sun, 09 Feb 2025 06:14:10 GMT
File type SVG Scalable Vector Graphics image
Hash 7d74f0c25043ec662f07f5da333eb80e
a0d0df3e66638c73937ef246bc959c170d403b0e
dc63d2e7cabb505304526f4ff2bdd28d5a5f2eb4621ec2450fd6f4e48a54f33f
GET /qc/refi-images/down-arrow.svg HTTP/1.1
Host: content.quickencompare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=oQX8LkRX5zKtdEOfmWAbS_WakXkyuS77uTIz7TN0x6w-1734466065-1.0.1.1-dsZpESvHxKPraq6nDddh7awC_7NiKNf2ZWpVDXixiEb5KTSAaW7ByMqiXTxD96UYEnaujPWwK2kBJI7MBDUNzg
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:46 GMT
content-type: image/svg+xml
last-modified: Wed, 16 Oct 2024 00:06:01 GMT
etag: W/"333552d29a8cd60fdd2459b641a774a1"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
via: 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P6
x-amz-cf-id: zNuZDNq-vTE-c17Tkd1hSpvTkUnT7EpxHtwVPF75WpYkuBSj4HhUtA==
cf-cache-status: REVALIDATED
expires: Wed, 18 Dec 2024 00:07:46 GMT
cache-control: public, max-age=14400
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8f398a924aebb51e-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
GET content.online.rocketmortgage.com/wham/ql_logo.svg
200 OK 4.5 kB URL GET HTTP/2 content.online.rocketmortgage.com/wham/ql_logo.svg
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerGoogle Trust Services
Subjectonline.rocketmortgage.com
Fingerprint40:8D:63:7A:73:CD:FC:C3:25:FE:8D:60:15:35:CD:D8:8F:67:33:6F
ValidityThu, 07 Nov 2024 23:12:13 GMT - Wed, 05 Feb 2025 23:12:12 GMT
File type SVG Scalable Vector Graphics image
Hash dde4d24e842798eb7f97f1640245c4ac
f1d11a797ca9c3897f39b88d349275e114d30e91
9b3bcd0e960aafc93fe8bbf97ac07625794130d392b42030723fd8388a562fb8
GET /wham/ql_logo.svg HTTP/1.1
Host: content.online.rocketmortgage.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:46 GMT
content-type: image/svg+xml
last-modified: Mon, 09 Dec 2024 18:19:31 GMT
x-amz-server-side-encryption: AES256
etag: W/"eea100e4a26adee86914e2dd622d33ae"
x-cache: Hit from cloudfront
via: 1.1 b16802a1e349d80b7688070778305ae2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: Y9v_hZGA0s4yrJo_MzUeFsX87H1ufBhyjmTU7Oz0L8mh9MpSfXJpbg==
cf-cache-status: HIT
expires: Wed, 18 Dec 2024 00:07:46 GMT
cache-control: public, max-age=14400
set-cookie: __cf_bm=iauaVUMDpUxuUb9k3cA2PYUshEcjzszRF5VWQeGc_0k-1734466066-1.0.1.1-cFB4l6IRm0BolRKHw9MmuWj7.88FJkciCHDyuS6CW8Z9xxLNDix0M_iNKgiL4rxVAtb_6BanmwjM.V43mqA0Xg; path=/; expires=Tue, 17-Dec-24 20:37:46 GMT; domain=.online.rocketmortgage.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
strict-transport-security: max-age=2592000
content-security-policy: frame-ancestors 'self' *.lowermybills.com *.quickenloans.com app.optimizely.com analytics.google.com
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 8f398a925a18b511-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
GET script.anura.io/request.js?instance=3439535758&exid=413327a0-bfc8-5d5f-9e07-ff640edf985d&source=affl_everflow_ql-mon_173_809&campaign=2&521241189371
200 OK 76 kB URL GET HTTP/2 script.anura.io/request.js?instance=3439535758&exid=413327a0-bfc8-5d5f-9e07-ff640edf985d&source=affl_everflow_ql-mon_173_809&campaign=2&521241189371
IP
Requested by https://loans.quickenloans.com/?moid=321646&sourceid=affl_everflow_ql-mon_173_809&pkey1=809&pkey2=2&pkey3=0805f9d09c054bf0bbe2fb66a8491c63&pkey=b3a0950ec9aa4557a2eb160625966089&sid=173&cmpid=173&crtid=&oid=173&affid=809&_ef_transaction_id=0805f9d09c054bf0bbe2fb66a8491c63&utm_medium=affiliate&utm_source=nocapads.com&utm_content=
Certificate IssuerAmazon
Subjectscript.anura.io
FingerprintCC:B4:48:82:BF:CC:04:FB:C7:35:8F:3F:D3:69:3F:10:96:9A:EF:C8
ValiditySun, 15 Sep 2024 00:00:00 GMT - Wed, 15 Oct 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (2089)
Hash 1b67ed7bb65a68cb56aa9e163d9b4cff
2e1dfbd3d7dce86906ab1cc8c3e78aa1fdbaf0a8
22db14f08c4d053e2f2ce430927b9ac1ad3a45b05ec8432bf77026ceaf29651a
GET /request.js?instance=3439535758&exid=413327a0-bfc8-5d5f-9e07-ff640edf985d&source=affl_everflow_ql-mon_173_809&campaign=2&521241189371 HTTP/1.1
Host: script.anura.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:46 GMT
content-type: application/javascript; charset=utf-8
server: nginx
vary: Accept-Encoding
expires: Sun, 28 Dec 1980 18:57:00 EST
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, post-check=0, pre-check=0
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
X-Firefox-Spdy: h2
GET deviceid.trueleadid.com/iframe.html?token=6521732E-19FC-40DA-9CBC-81E3237BF697&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D
200 OK 4.8 kB URL GET HTTP/2 deviceid.trueleadid.com/iframe.html?token=6521732E-19FC-40DA-9CBC-81E3237BF697&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D
IP
Requested by https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=6521732E-19FC-40DA-9CBC-81E3237BF697&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D
Certificate IssuerGlobalSign nv-sa
Subjectimperva.com
Fingerprint01:B4:BB:C2:E4:D2:08:99:B9:DC:7E:2A:46:00:7C:75:07:D0:E9:D0
ValidityWed, 10 Jul 2024 14:31:23 GMT - Mon, 06 Jan 2025 14:31:23 GMT
File type HTML document, ASCII text, with very long lines (4880), with no line terminators
Hash ea68fa77becfe971eb23a154faf6041b
6456498e9bb888e96894f29c40ea16ca071227cd
c58bed181114d1e1e3a98c6290fe75e7d37eb33ac8956634fa7c7b2043b4c305
GET /iframe.html?token=6521732E-19FC-40DA-9CBC-81E3237BF697&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.15.1&lck=B87EED3A-5F1D-1EA4-B60B-FCC3F180B22D&lac=20CCD961-FA4F-5BB7-1E71-E4197110D50D HTTP/1.1
Host: deviceid.trueleadid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://d2m2wsoho8qq12.cloudfront.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 17 Dec 2024 20:07:47 GMT
content-type: text/html
server: nginx
last-modified: Thu, 31 Oct 2024 14:48:02 GMT
etag: W/"672398a2-1209"
expires: Wed, 18 Dec 2024 20:07:47 GMT
p3p: CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
cache-control: max-age=86400, public
content-encoding: gzip
set-cookie: nlbi_3051494=he8gDLCvORL3hSLeC30iGwAAAADY5ySbgo8Tlyke7a5lfogp; HttpOnly; path=/; Domain=.trueleadid.com; Secure; SameSite=None
visid_incap_3051494=8AEi105vTDiqQeAp5OGaDhLaYWcAAAAAQUIPAAAAAACuAe+41JxmQjKf25H4oj8E; expires=Tue, 16 Dec 2025 22:24:47 GMT; HttpOnly; path=/; Domain=.trueleadid.com; Secure; SameSite=None
incap_ses_7233_3051494=2DdCW5qPNlh6XYshXMdgZBLaYWcAAAAA9xMjjaBpWwe5y1C5c8q0Ig==; path=/; Domain=.trueleadid.com; Secure; SameSite=None
strict-transport-security: max-age=31536000
x-cdn: Imperva
x-iinfo: 12-25452040-25450237 pNNy RT(1734466066352 36) q(0 0 0 0) r(1 1) U24
X-Firefox-Spdy: h2
66.29.146.44
23.36.77.91
104.18.1.71
35.176.216.82
18.159.105.57
0.0.0.0