Submitted URL:
https://lastpass.com/confirm/a3ca71c2d332ceaf794aaec3dc9c5f15?utm_source=trans_email&utm_medium=LastPassSecurityNotif... 13yr old
Effective URL:
https://lastpass.com/settings.php?fromL4=1&testemail=1&cmd=verify&email=supun.bulath%40epiqglobal.com&uuid=fb7f53e402... 13yr old
Submission: On August 27 via api (August 27th 2025, 1:01:07 am UTC) from CH — Scanned from FR

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 16 HTTP transactions. The main IP is 184.30.21.162, located in Frankfurt am Main, Germany and belongs to AKAMAI-AS, US. The main domain is lastpass.com. The Cisco Umbrella rank of the primary domain is 4576. 13yr old
TLS certificate: Issued by GlobalSign ECC EV SSL CA 2018 on September 2nd 2024. Valid for: 1yr.
This is the only time lastpass.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
16 184.30.21.162 184.30.21.162 16625 (AKAMAI-AS) (AKAMAI-AS)
16 1
Apex Domain
Subdomains
Transfer
16 lastpass.com
lastpass.com — Cisco Umbrella Rank: 4576 13yr old
291 KB
16 1
Domain Requested by
16 lastpass.com lastpass.com
16 1

This site contains no links.

Subject Issuer Validity Valid
lastpass.com
GlobalSign ECC EV SSL CA 2018
2024-09-02 -
2025-10-04
1yr crt.sh

This page contains 1 frames:

Primary Page: https://lastpass.com/settings.php?fromL4=1&testemail=1&cmd=verify&email=supun.bulath%40epiqglobal.com&uuid=fb7f53e402ced635ad8d24a751789518203752523e93ac771799b2b85e54db1&uid=199331238&ip=3.24.154.155&srToken=7361e6f7652847b32bba8b124567824d26c3fd8808bf1ad13304053bca3c80ec
Frame ID: A72A044D818D3D643720D4B40E9B6EA9
Requests: 16 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://lastpass.com/confirm/a3ca71c2d332ceaf794aaec3dc9c5f15?utm_source=trans_email&utm_medium=L... Page URL
  2. https://lastpass.com/settings.php?fromL4=1&testemail=1&cmd=verify&email=supun.bulath%40epiqglobal... Page URL

Detected technologies

(Programming languages)
Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

(Security)
Overall confidence: 100%
Detected patterns

Page Statistics

16
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

291 kB
Transfer

764 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://lastpass.com/confirm/a3ca71c2d332ceaf794aaec3dc9c5f15?utm_source=trans_email&utm_medium=LastPassSecurityNotification%3ALoginattemptbloc Page URL
  2. https://lastpass.com/settings.php?fromL4=1&testemail=1&cmd=verify&email=supun.bulath%40epiqglobal.com&uuid=fb7f53e402ced635ad8d24a751789518203752523e93ac771799b2b85e54db1&uid=199331238&ip=3.24.154.155&srToken=7361e6f7652847b32bba8b124567824d26c3fd8808bf1ad13304053bca3c80ec Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol
Status Resource
Path
Size
x-fer
Time
Latency
Type
MIME-Type
IP
Location
GET
H2
200
a3ca71c2d332ceaf794aaec3dc9c5f15 Show response
lastpass.com/confirm/
7 KB
10 KB
299ms
153ms
Document
text/html
184.30.21.162
AKAMAI-AS
General
Full URL
https://lastpass.com/confirm/a3ca71c2d332ceaf794aaec3dc9c5f15?utm_source=trans_email&utm_medium=LastPassSecurityNotification%3ALoginattemptbloc
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
LastPass /
Resource Hash
607f02cd78063870e0eb27aecaa97d2a3ab9abfd8302e886148fb0ff2bf96591
Security Headers
Name Value
Content-Security-Policy default-src 'nonce-605e75d102e7d25c571cb2c507dc52ca' 'self' https://admin.lastpass.com; img-src 'self' https://lastpass.com data: blob: https://analytics.twitter.com/i/adsct; object-src 'self' https://*.googlevideo.com; connect-src 'self' https://lastpass.com wss://*.lastpass.com https://5399020466.log.optimizely.com https://www.lastpass.com https://pollserver.lastpass.com https://loglogin.lastpass.com https://accounts.lastpass.com https://login.microsoftonline.com https://graph.microsoft.com https://login.microsoftonline.us https://graph.microsoft.us https://*.okta.com https://*.oktapreview.com https://*.okta-emea.com https://*.pingone.com https://*.pingone.ca https://*.pingone.eu https://*.pingone.asia https://accounts.google.com https://www.googleapis.com https://*.onelogin.com https://openidconnect.googleapis.com https://content.googleapis.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com https://www.youtube.com https://*.ytimg.com https://*.optimizely.com https://lp-cdn.lastpass.com; font-src data: 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; frame-src 'self' https://ssl.gstatic.com https://www.google.com https://www.youtube.com https://cdn.lputil.com
Strict-Transport-Security max-age=86400000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

content-length
7037
content-security-policy
default-src 'nonce-605e75d102e7d25c571cb2c507dc52ca' 'self' https://admin.lastpass.com; img-src 'self' https://lastpass.com data: blob: https://analytics.twitter.com/i/adsct; object-src 'self' https://*.googlevideo.com; connect-src 'self' https://lastpass.com wss://*.lastpass.com https://5399020466.log.optimizely.com https://www.lastpass.com https://pollserver.lastpass.com https://loglogin.lastpass.com https://accounts.lastpass.com https://login.microsoftonline.com https://graph.microsoft.com https://login.microsoftonline.us https://graph.microsoft.us https://*.okta.com https://*.oktapreview.com https://*.okta-emea.com https://*.pingone.com https://*.pingone.ca https://*.pingone.eu https://*.pingone.asia https://accounts.google.com https://www.googleapis.com https://*.onelogin.com https://openidconnect.googleapis.com https://content.googleapis.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com https://www.youtube.com https://*.ytimg.com https://*.optimizely.com https://lp-cdn.lastpass.com; font-src data: 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; frame-src 'self' https://ssl.gstatic.com https://www.google.com https://www.youtube.com https://cdn.lputil.com
content-type
text/html; charset=utf-8
date
Wed, 27 Aug 2025 01:01:08 GMT
server
LastPass
strict-transport-security
max-age=86400000
vary
origin Accept-Encoding
x-akamai-transformed
0 - 0 -
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
GET
H2
200
header_css_bundle
lastpass.com/m.php/
47 KB
17 KB
58ms
54ms
Stylesheet
text/css
184.30.21.162
AKAMAI-AS
General
Full URL
https://lastpass.com/m.php/header_css_bundle?1756200117
Requested by
Host: lastpass.com
URL: https://lastpass.com/confirm/a3ca71c2d332ceaf794aaec3dc9c5f15?utm_source=trans_email&utm_medium=LastPassSecurityNotification%3ALoginattemptbloc
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
LastPass /
Resource Hash
fa249aade99518f1ae2b7c80861ee78684398cf1d93d6b55f06e93b29bdf21db
Security Headers
Name Value
Content-Security-Policy default-src 'nonce-1ddad355f159733b0755223de01d291c' 'self' https://admin.lastpass.com; img-src 'self' https://lastpass.com data: blob: https://analytics.twitter.com/i/adsct; object-src 'self' https://*.googlevideo.com; connect-src 'self' https://lastpass.com wss://*.lastpass.com https://5399020466.log.optimizely.com https://www.lastpass.com https://pollserver.lastpass.com https://loglogin.lastpass.com https://accounts.lastpass.com https://login.microsoftonline.com https://graph.microsoft.com https://login.microsoftonline.us https://graph.microsoft.us https://*.okta.com https://*.oktapreview.com https://*.okta-emea.com https://*.pingone.com https://*.pingone.ca https://*.pingone.eu https://*.pingone.asia https://accounts.google.com https://www.googleapis.com https://*.onelogin.com https://openidconnect.googleapis.com https://content.googleapis.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com https://www.youtube.com https://*.ytimg.com https://*.optimizely.com https://lp-cdn.lastpass.com; font-src data: 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; frame-src 'self' https://ssl.gstatic.com https://www.google.com https://www.youtube.com https://cdn.lputil.com
Strict-Transport-Security max-age=86400000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://lastpass.com/

Response headers

strict-transport-security
max-age=86400000
content-security-policy
default-src 'nonce-1ddad355f159733b0755223de01d291c' 'self' https://admin.lastpass.com; img-src 'self' https://lastpass.com data: blob: https://analytics.twitter.com/i/adsct; object-src 'self' https://*.googlevideo.com; connect-src 'self' https://lastpass.com wss://*.lastpass.com https://5399020466.log.optimizely.com https://www.lastpass.com https://pollserver.lastpass.com https://loglogin.lastpass.com https://accounts.lastpass.com https://login.microsoftonline.com https://graph.microsoft.com https://login.microsoftonline.us https://graph.microsoft.us https://*.okta.com https://*.oktapreview.com https://*.okta-emea.com https://*.pingone.com https://*.pingone.ca https://*.pingone.eu https://*.pingone.asia https://accounts.google.com https://www.googleapis.com https://*.onelogin.com https://openidconnect.googleapis.com https://content.googleapis.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com https://www.youtube.com https://*.ytimg.com https://*.optimizely.com https://lp-cdn.lastpass.com; font-src data: 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; frame-src 'self' https://ssl.gstatic.com https://www.google.com https://www.youtube.com https://cdn.lputil.com
cache-control
max-age=2592000
content-encoding
gzip
x-content-type-options
nosniff
expires
Thu, 25 Sep 2025 10:44:11 GMT
content-length
16681
x-xss-protection
1; mode=block
date
Wed, 27 Aug 2025 01:01:08 GMT
content-type
text/css; charset=utf-8
vary
Accept-Encoding
server
LastPass
last-modified
Tue, 26 Aug 2025 09:21:57 GMT
x-frame-options
SAMEORIGIN
GET
H2
200
headercss
lastpass.com/m.php/
61 KB
14 KB
98ms
95ms
Stylesheet
text/css
184.30.21.162
AKAMAI-AS
General
Full URL
https://lastpass.com/m.php/headercss?1756200117
Requested by
Host: lastpass.com
URL: https://lastpass.com/confirm/a3ca71c2d332ceaf794aaec3dc9c5f15?utm_source=trans_email&utm_medium=LastPassSecurityNotification%3ALoginattemptbloc
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
LastPass /
Resource Hash
890cd19040a6f8396a8c26fe4c7d6eddb93ed963bbd482685cda9fa08b02125d
Security Headers
Name Value
Content-Security-Policy default-src 'nonce-aaa556f074e39060f9773726e83804d4' 'self' https://admin.lastpass.com; img-src 'self' https://lastpass.com data: blob: https://analytics.twitter.com/i/adsct; object-src 'self' https://*.googlevideo.com; connect-src 'self' https://lastpass.com wss://*.lastpass.com https://5399020466.log.optimizely.com https://www.lastpass.com https://pollserver.lastpass.com https://loglogin.lastpass.com https://accounts.lastpass.com https://login.microsoftonline.com https://graph.microsoft.com https://login.microsoftonline.us https://graph.microsoft.us https://*.okta.com https://*.oktapreview.com https://*.okta-emea.com https://*.pingone.com https://*.pingone.ca https://*.pingone.eu https://*.pingone.asia https://accounts.google.com https://www.googleapis.com https://*.onelogin.com https://openidconnect.googleapis.com https://content.googleapis.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com https://www.youtube.com https://*.ytimg.com https://*.optimizely.com https://lp-cdn.lastpass.com; font-src data: 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; frame-src 'self' https://ssl.gstatic.com https://www.google.com https://www.youtube.com https://cdn.lputil.com
Strict-Transport-Security max-age=86400000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://lastpass.com/

Response headers

strict-transport-security
max-age=86400000
content-security-policy
default-src 'nonce-aaa556f074e39060f9773726e83804d4' 'self' https://admin.lastpass.com; img-src 'self' https://lastpass.com data: blob: https://analytics.twitter.com/i/adsct; object-src 'self' https://*.googlevideo.com; connect-src 'self' https://lastpass.com wss://*.lastpass.com https://5399020466.log.optimizely.com https://www.lastpass.com https://pollserver.lastpass.com https://loglogin.lastpass.com https://accounts.lastpass.com https://login.microsoftonline.com https://graph.microsoft.com https://login.microsoftonline.us https://graph.microsoft.us https://*.okta.com https://*.oktapreview.com https://*.okta-emea.com https://*.pingone.com https://*.pingone.ca https://*.pingone.eu https://*.pingone.asia https://accounts.google.com https://www.googleapis.com https://*.onelogin.com https://openidconnect.googleapis.com https://content.googleapis.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com https://www.youtube.com https://*.ytimg.com https://*.optimizely.com https://lp-cdn.lastpass.com; font-src data: 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; frame-src 'self' https://ssl.gstatic.com https://www.google.com https://www.youtube.com https://cdn.lputil.com
cache-control
max-age=2592000
content-encoding
gzip
x-content-type-options
nosniff
expires
Thu, 25 Sep 2025 10:43:26 GMT
content-length
12700
x-xss-protection
1; mode=block
date
Wed, 27 Aug 2025 01:01:08 GMT
content-type
text/css; charset=utf-8
vary
Accept-Encoding
server
LastPass
last-modified
Tue, 26 Aug 2025 09:21:57 GMT
x-frame-options
SAMEORIGIN
GET
H2
200
modernizer
lastpass.com/m.php/
15 KB
7 KB
96ms
93ms
Script
application/x-javascript
184.30.21.162
AKAMAI-AS
General
Full URL
https://lastpass.com/m.php/modernizer?1756200118
Requested by
Host: lastpass.com
URL: https://lastpass.com/confirm/a3ca71c2d332ceaf794aaec3dc9c5f15?utm_source=trans_email&utm_medium=LastPassSecurityNotification%3ALoginattemptbloc
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
LastPass /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'nonce-c69f940fb51430827cfb674e2576d5f3' 'self' https://admin.lastpass.com; img-src 'self' https://lastpass.com data: blob: https://analytics.twitter.com/i/adsct; object-src 'self' https://*.googlevideo.com; connect-src 'self' https://lastpass.com wss://*.lastpass.com https://5399020466.log.optimizely.com https://www.lastpass.com https://pollserver.lastpass.com https://loglogin.lastpass.com https://accounts.lastpass.com https://login.microsoftonline.com https://graph.microsoft.com https://login.microsoftonline.us https://graph.microsoft.us https://*.okta.com https://*.oktapreview.com https://*.okta-emea.com https://*.pingone.com https://*.pingone.ca https://*.pingone.eu https://*.pingone.asia https://accounts.google.com https://www.googleapis.com https://*.onelogin.com https://openidconnect.googleapis.com https://content.googleapis.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com https://www.youtube.com https://*.ytimg.com https://*.optimizely.com https://lp-cdn.lastpass.com; font-src data: 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; frame-src 'self' https://ssl.gstatic.com https://www.google.com https://www.youtube.com https://cdn.lputil.com
Strict-Transport-Security max-age=86400000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://lastpass.com/

Response headers

strict-transport-security
max-age=86400000
content-security-policy
default-src 'nonce-c69f940fb51430827cfb674e2576d5f3' 'self' https://admin.lastpass.com; img-src 'self' https://lastpass.com data: blob: https://analytics.twitter.com/i/adsct; object-src 'self' https://*.googlevideo.com; connect-src 'self' https://lastpass.com wss://*.lastpass.com https://5399020466.log.optimizely.com https://www.lastpass.com https://pollserver.lastpass.com https://loglogin.lastpass.com https://accounts.lastpass.com https://login.microsoftonline.com https://graph.microsoft.com https://login.microsoftonline.us https://graph.microsoft.us https://*.okta.com https://*.oktapreview.com https://*.okta-emea.com https://*.pingone.com https://*.pingone.ca https://*.pingone.eu https://*.pingone.asia https://accounts.google.com https://www.googleapis.com https://*.onelogin.com https://openidconnect.googleapis.com https://content.googleapis.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com https://www.youtube.com https://*.ytimg.com https://*.optimizely.com https://lp-cdn.lastpass.com; font-src data: 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; frame-src 'self' https://ssl.gstatic.com https://www.google.com https://www.youtube.com https://cdn.lputil.com
cache-control
max-age=2592000
content-encoding
gzip
x-content-type-options
nosniff
expires
Thu, 25 Sep 2025 10:43:26 GMT
content-length
6091
x-xss-protection
1; mode=block
date
Wed, 27 Aug 2025 01:01:08 GMT
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
server
LastPass
last-modified
Tue, 26 Aug 2025 09:38:09 GMT
x-frame-options
SAMEORIGIN
GET
H2
200
rsa
lastpass.com/m.php/
62 KB
24 KB
78ms
77ms
Script
application/x-javascript
184.30.21.162
AKAMAI-AS
General
Full URL
https://lastpass.com/m.php/rsa?1756200921
Requested by
Host: lastpass.com
URL: https://lastpass.com/confirm/a3ca71c2d332ceaf794aaec3dc9c5f15?utm_source=trans_email&utm_medium=LastPassSecurityNotification%3ALoginattemptbloc
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
LastPass /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'nonce-9c224c062c0d7f00ed8cf0cb8becd8af' 'self' https://admin.lastpass.com; img-src 'self' https://lastpass.com data: blob: https://analytics.twitter.com/i/adsct; object-src 'self' https://*.googlevideo.com; connect-src 'self' https://lastpass.com wss://*.lastpass.com https://5399020466.log.optimizely.com https://www.lastpass.com https://pollserver.lastpass.com https://loglogin.lastpass.com https://accounts.lastpass.com https://login.microsoftonline.com https://graph.microsoft.com https://login.microsoftonline.us https://graph.microsoft.us https://*.okta.com https://*.oktapreview.com https://*.okta-emea.com https://*.pingone.com https://*.pingone.ca https://*.pingone.eu https://*.pingone.asia https://accounts.google.com https://www.googleapis.com https://*.onelogin.com https://openidconnect.googleapis.com https://content.googleapis.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com https://www.youtube.com https://*.ytimg.com https://*.optimizely.com https://lp-cdn.lastpass.com; font-src data: 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; frame-src 'self' https://ssl.gstatic.com https://www.google.com https://www.youtube.com https://cdn.lputil.com
Strict-Transport-Security max-age=86400000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://lastpass.com/

Response headers

strict-transport-security
max-age=86400000
content-security-policy
default-src 'nonce-9c224c062c0d7f00ed8cf0cb8becd8af' 'self' https://admin.lastpass.com; img-src 'self' https://lastpass.com data: blob: https://analytics.twitter.com/i/adsct; object-src 'self' https://*.googlevideo.com; connect-src 'self' https://lastpass.com wss://*.lastpass.com https://5399020466.log.optimizely.com https://www.lastpass.com https://pollserver.lastpass.com https://loglogin.lastpass.com https://accounts.lastpass.com https://login.microsoftonline.com https://graph.microsoft.com https://login.microsoftonline.us https://graph.microsoft.us https://*.okta.com https://*.oktapreview.com https://*.okta-emea.com https://*.pingone.com https://*.pingone.ca https://*.pingone.eu https://*.pingone.asia https://accounts.google.com https://www.googleapis.com https://*.onelogin.com https://openidconnect.googleapis.com https://content.googleapis.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com https://www.youtube.com https://*.ytimg.com https://*.optimizely.com https://lp-cdn.lastpass.com; font-src data: 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; frame-src 'self' https://ssl.gstatic.com https://www.google.com https://www.youtube.com https://cdn.lputil.com
cache-control
max-age=2592000
content-encoding
gzip
x-content-type-options
nosniff
expires
Thu, 25 Sep 2025 10:45:08 GMT
content-length
23528
x-xss-protection
1; mode=block
date
Wed, 27 Aug 2025 01:01:09 GMT
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
server
LastPass
last-modified
Tue, 26 Aug 2025 09:39:20 GMT
x-frame-options
SAMEORIGIN
GET
H2
200
header_js_smbundle_jquery_3_6_1
lastpass.com/m.php/
115 KB
42 KB
97ms
94ms
Script
application/x-javascript
184.30.21.162
AKAMAI-AS
General
Full URL
https://lastpass.com/m.php/header_js_smbundle_jquery_3_6_1?1756201035
Requested by
Host: lastpass.com
URL: https://lastpass.com/confirm/a3ca71c2d332ceaf794aaec3dc9c5f15?utm_source=trans_email&utm_medium=LastPassSecurityNotification%3ALoginattemptbloc
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
LastPass /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=86400000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://lastpass.com/

Response headers

strict-transport-security
max-age=86400000
cache-control
max-age=2592000
content-encoding
gzip
x-webkit-csp
default-src 'self' https://admin.lastpass.com; img-src 'self' https://lastpass.com data: blob: https://analytics.twitter.com/i/adsct; object-src 'self' https://*.googlevideo.com; connect-src 'self' https://lastpass.com wss://*.lastpass.com https://5399020466.log.optimizely.com https://www.lastpass.com https://pollserver.lastpass.com https://loglogin.lastpass.com https://accounts.lastpass.com https://login.microsoftonline.com https://graph.microsoft.com https://login.microsoftonline.us https://graph.microsoft.us https://*.okta.com https://*.oktapreview.com https://*.okta-emea.com https://*.pingone.com https://*.pingone.ca https://*.pingone.eu https://*.pingone.asia https://accounts.google.com https://www.googleapis.com https://*.onelogin.com https://openidconnect.googleapis.com https://content.googleapis.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com https://www.youtube.com https://*.ytimg.com https://*.optimizely.com https://lp-cdn.lastpass.com; font-src data: 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; frame-src 'self' https://ssl.gstatic.com https://www.google.com https://www.youtube.com https://cdn.lputil.com
x-content-type-options
nosniff
expires
Thu, 25 Sep 2025 10:46:22 GMT
content-length
41900
x-xss-protection
1; mode=block
date
Wed, 27 Aug 2025 01:01:08 GMT
last-modified
Tue, 26 Aug 2025 09:44:19 GMT
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
server
LastPass
x-frame-options
SAMEORIGIN
GET
H2
200
headerjs
lastpass.com/m.php/
1 KB
2 KB
131ms
129ms
Script
application/x-javascript
184.30.21.162
AKAMAI-AS
General
Full URL
https://lastpass.com/m.php/headerjs?1756200923
Requested by
Host: lastpass.com
URL: https://lastpass.com/confirm/a3ca71c2d332ceaf794aaec3dc9c5f15?utm_source=trans_email&utm_medium=LastPassSecurityNotification%3ALoginattemptbloc
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
LastPass /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=86400000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://lastpass.com/

Response headers

strict-transport-security
max-age=86400000
cache-control
max-age=2592000
content-encoding
gzip
x-webkit-csp
default-src 'self' https://admin.lastpass.com; img-src 'self' https://lastpass.com data: blob: https://analytics.twitter.com/i/adsct; object-src 'self' https://*.googlevideo.com; connect-src 'self' https://lastpass.com wss://*.lastpass.com https://5399020466.log.optimizely.com https://www.lastpass.com https://pollserver.lastpass.com https://loglogin.lastpass.com https://accounts.lastpass.com https://login.microsoftonline.com https://graph.microsoft.com https://login.microsoftonline.us https://graph.microsoft.us https://*.okta.com https://*.oktapreview.com https://*.okta-emea.com https://*.pingone.com https://*.pingone.ca https://*.pingone.eu https://*.pingone.asia https://accounts.google.com https://www.googleapis.com https://*.onelogin.com https://openidconnect.googleapis.com https://content.googleapis.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com https://www.youtube.com https://*.ytimg.com https://*.optimizely.com https://lp-cdn.lastpass.com; font-src data: 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; frame-src 'self' https://ssl.gstatic.com https://www.google.com https://www.youtube.com https://cdn.lputil.com
x-content-type-options
nosniff
expires
Thu, 25 Sep 2025 10:46:22 GMT
content-length
616
x-xss-protection
1; mode=block
date
Wed, 27 Aug 2025 01:01:08 GMT
last-modified
Tue, 26 Aug 2025 09:40:19 GMT
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
server
LastPass
x-frame-options
SAMEORIGIN
GET
H2
200
LP-logo-red.svg
lastpass.com/images/
13 KB
6 KB
130ms
127ms
Image
image/svg+xml
184.30.21.162
AKAMAI-AS
General
Full URL
https://lastpass.com/images/LP-logo-red.svg
Requested by
Host: lastpass.com
URL: https://lastpass.com/confirm/a3ca71c2d332ceaf794aaec3dc9c5f15?utm_source=trans_email&utm_medium=LastPassSecurityNotification%3ALoginattemptbloc
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
LastPass /
Resource Hash
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://lastpass.com/

Response headers

vary
Accept-Encoding
cache-control
max-age=2592000
content-encoding
gzip
etag
"686f5a84-34b5"
expires
Tue, 12 Aug 2025 21:20:50 GMT
accept-ranges
bytes
content-length
5604
date
Wed, 27 Aug 2025 01:01:08 GMT
content-type
image/svg+xml
last-modified
Thu, 10 Jul 2025 06:15:32 GMT
server
LastPass
x-frame-options
SAMEORIGIN
GET
H2
200
langdefjs
lastpass.com/m.php/
3 KB
2 KB
130ms
128ms
Script
application/x-javascript
184.30.21.162
AKAMAI-AS
General
Full URL
https://lastpass.com/m.php/langdefjs?1756200924
Requested by
Host: lastpass.com
URL: https://lastpass.com/confirm/a3ca71c2d332ceaf794aaec3dc9c5f15?utm_source=trans_email&utm_medium=LastPassSecurityNotification%3ALoginattemptbloc
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
LastPass /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'nonce-9e96d86226220534b9a9df07ca4b994c' 'self' https://admin.lastpass.com; img-src 'self' https://lastpass.com data: blob: https://analytics.twitter.com/i/adsct; object-src 'self' https://*.googlevideo.com; connect-src 'self' https://lastpass.com wss://*.lastpass.com https://5399020466.log.optimizely.com https://www.lastpass.com https://pollserver.lastpass.com https://loglogin.lastpass.com https://accounts.lastpass.com https://login.microsoftonline.com https://graph.microsoft.com https://login.microsoftonline.us https://graph.microsoft.us https://*.okta.com https://*.oktapreview.com https://*.okta-emea.com https://*.pingone.com https://*.pingone.ca https://*.pingone.eu https://*.pingone.asia https://accounts.google.com https://www.googleapis.com https://*.onelogin.com https://openidconnect.googleapis.com https://content.googleapis.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com https://www.youtube.com https://*.ytimg.com https://*.optimizely.com https://lp-cdn.lastpass.com; font-src data: 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; frame-src 'self' https://ssl.gstatic.com https://www.google.com https://www.youtube.com https://cdn.lputil.com
Strict-Transport-Security max-age=86400000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://lastpass.com/

Response headers

strict-transport-security
max-age=86400000
content-security-policy
default-src 'nonce-9e96d86226220534b9a9df07ca4b994c' 'self' https://admin.lastpass.com; img-src 'self' https://lastpass.com data: blob: https://analytics.twitter.com/i/adsct; object-src 'self' https://*.googlevideo.com; connect-src 'self' https://lastpass.com wss://*.lastpass.com https://5399020466.log.optimizely.com https://www.lastpass.com https://pollserver.lastpass.com https://loglogin.lastpass.com https://accounts.lastpass.com https://login.microsoftonline.com https://graph.microsoft.com https://login.microsoftonline.us https://graph.microsoft.us https://*.okta.com https://*.oktapreview.com https://*.okta-emea.com https://*.pingone.com https://*.pingone.ca https://*.pingone.eu https://*.pingone.asia https://accounts.google.com https://www.googleapis.com https://*.onelogin.com https://openidconnect.googleapis.com https://content.googleapis.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com https://www.youtube.com https://*.ytimg.com https://*.optimizely.com https://lp-cdn.lastpass.com; font-src data: 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; frame-src 'self' https://ssl.gstatic.com https://www.google.com https://www.youtube.com https://cdn.lputil.com
cache-control
max-age=2592000
content-encoding
gzip
x-content-type-options
nosniff
expires
Thu, 25 Sep 2025 10:43:26 GMT
content-length
1221
x-xss-protection
1; mode=block
date
Wed, 27 Aug 2025 01:01:08 GMT
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
server
LastPass
last-modified
Tue, 26 Aug 2025 09:40:19 GMT
x-frame-options
SAMEORIGIN
GET
H2
200
bsjs
lastpass.com/m.php/
45 KB
16 KB
40ms
39ms
Script
application/x-javascript
184.30.21.162
AKAMAI-AS
General
Full URL
https://lastpass.com/m.php/bsjs?1756200118
Requested by
Host: lastpass.com
URL: https://lastpass.com/confirm/a3ca71c2d332ceaf794aaec3dc9c5f15?utm_source=trans_email&utm_medium=LastPassSecurityNotification%3ALoginattemptbloc
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
LastPass /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'nonce-3bef51dee1491e5dccca66f5983840ac' 'self' https://admin.lastpass.com; img-src 'self' https://lastpass.com data: blob: https://analytics.twitter.com/i/adsct; object-src 'self' https://*.googlevideo.com; connect-src 'self' https://lastpass.com wss://*.lastpass.com https://5399020466.log.optimizely.com https://www.lastpass.com https://pollserver.lastpass.com https://loglogin.lastpass.com https://accounts.lastpass.com https://login.microsoftonline.com https://graph.microsoft.com https://login.microsoftonline.us https://graph.microsoft.us https://*.okta.com https://*.oktapreview.com https://*.okta-emea.com https://*.pingone.com https://*.pingone.ca https://*.pingone.eu https://*.pingone.asia https://accounts.google.com https://www.googleapis.com https://*.onelogin.com https://openidconnect.googleapis.com https://content.googleapis.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com https://www.youtube.com https://*.ytimg.com https://*.optimizely.com https://lp-cdn.lastpass.com; font-src data: 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; frame-src 'self' https://ssl.gstatic.com https://www.google.com https://www.youtube.com https://cdn.lputil.com
Strict-Transport-Security max-age=86400000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://lastpass.com/

Response headers

strict-transport-security
max-age=86400000
content-security-policy
default-src 'nonce-3bef51dee1491e5dccca66f5983840ac' 'self' https://admin.lastpass.com; img-src 'self' https://lastpass.com data: blob: https://analytics.twitter.com/i/adsct; object-src 'self' https://*.googlevideo.com; connect-src 'self' https://lastpass.com wss://*.lastpass.com https://5399020466.log.optimizely.com https://www.lastpass.com https://pollserver.lastpass.com https://loglogin.lastpass.com https://accounts.lastpass.com https://login.microsoftonline.com https://graph.microsoft.com https://login.microsoftonline.us https://graph.microsoft.us https://*.okta.com https://*.oktapreview.com https://*.okta-emea.com https://*.pingone.com https://*.pingone.ca https://*.pingone.eu https://*.pingone.asia https://accounts.google.com https://www.googleapis.com https://*.onelogin.com https://openidconnect.googleapis.com https://content.googleapis.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com https://www.youtube.com https://*.ytimg.com https://*.optimizely.com https://lp-cdn.lastpass.com; font-src data: 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; frame-src 'self' https://ssl.gstatic.com https://www.google.com https://www.youtube.com https://cdn.lputil.com
cache-control
max-age=2592000
content-encoding
gzip
x-content-type-options
nosniff
expires
Thu, 25 Sep 2025 10:43:26 GMT
content-length
14925
x-xss-protection
1; mode=block
date
Wed, 27 Aug 2025 01:01:08 GMT
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
server
LastPass
last-modified
Tue, 26 Aug 2025 09:40:04 GMT
x-frame-options
SAMEORIGIN
GET
H2
200
footerjs
lastpass.com/m.php/
275 B
1 KB
40ms
39ms
Script
application/x-javascript
184.30.21.162
AKAMAI-AS
General
Full URL
https://lastpass.com/m.php/footerjs?1756200118
Requested by
Host: lastpass.com
URL: https://lastpass.com/confirm/a3ca71c2d332ceaf794aaec3dc9c5f15?utm_source=trans_email&utm_medium=LastPassSecurityNotification%3ALoginattemptbloc
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
LastPass /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'nonce-20258263cffd9ba8b112cb50b57e5e1b' 'self' https://admin.lastpass.com; img-src 'self' https://lastpass.com data: blob: https://analytics.twitter.com/i/adsct; object-src 'self' https://*.googlevideo.com; connect-src 'self' https://lastpass.com wss://*.lastpass.com https://5399020466.log.optimizely.com https://www.lastpass.com https://pollserver.lastpass.com https://loglogin.lastpass.com https://accounts.lastpass.com https://login.microsoftonline.com https://graph.microsoft.com https://login.microsoftonline.us https://graph.microsoft.us https://*.okta.com https://*.oktapreview.com https://*.okta-emea.com https://*.pingone.com https://*.pingone.ca https://*.pingone.eu https://*.pingone.asia https://accounts.google.com https://www.googleapis.com https://*.onelogin.com https://openidconnect.googleapis.com https://content.googleapis.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com https://www.youtube.com https://*.ytimg.com https://*.optimizely.com https://lp-cdn.lastpass.com; font-src data: 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; frame-src 'self' https://ssl.gstatic.com https://www.google.com https://www.youtube.com https://cdn.lputil.com
Strict-Transport-Security max-age=86400000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://lastpass.com/

Response headers

strict-transport-security
max-age=86400000
content-security-policy
default-src 'nonce-20258263cffd9ba8b112cb50b57e5e1b' 'self' https://admin.lastpass.com; img-src 'self' https://lastpass.com data: blob: https://analytics.twitter.com/i/adsct; object-src 'self' https://*.googlevideo.com; connect-src 'self' https://lastpass.com wss://*.lastpass.com https://5399020466.log.optimizely.com https://www.lastpass.com https://pollserver.lastpass.com https://loglogin.lastpass.com https://accounts.lastpass.com https://login.microsoftonline.com https://graph.microsoft.com https://login.microsoftonline.us https://graph.microsoft.us https://*.okta.com https://*.oktapreview.com https://*.okta-emea.com https://*.pingone.com https://*.pingone.ca https://*.pingone.eu https://*.pingone.asia https://accounts.google.com https://www.googleapis.com https://*.onelogin.com https://openidconnect.googleapis.com https://content.googleapis.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com https://www.youtube.com https://*.ytimg.com https://*.optimizely.com https://lp-cdn.lastpass.com; font-src data: 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; frame-src 'self' https://ssl.gstatic.com https://www.google.com https://www.youtube.com https://cdn.lputil.com
cache-control
max-age=2592000
content-encoding
gzip
x-content-type-options
nosniff
expires
Thu, 25 Sep 2025 10:44:01 GMT
content-length
210
x-xss-protection
1; mode=block
date
Wed, 27 Aug 2025 01:01:09 GMT
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
server
LastPass
last-modified
Tue, 26 Aug 2025 09:40:21 GMT
x-frame-options
SAMEORIGIN
GET
H2
200
quickdl2
lastpass.com/m.php/
2 KB
2 KB
41ms
39ms
Script
application/x-javascript
184.30.21.162
AKAMAI-AS
General
Full URL
https://lastpass.com/m.php/quickdl2?1756200985
Requested by
Host: lastpass.com
URL: https://lastpass.com/confirm/a3ca71c2d332ceaf794aaec3dc9c5f15?utm_source=trans_email&utm_medium=LastPassSecurityNotification%3ALoginattemptbloc
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
LastPass /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'nonce-9b254c3a2884a76d9a514e309c9479b7' 'self' https://admin.lastpass.com; img-src 'self' https://lastpass.com data: blob: https://analytics.twitter.com/i/adsct; object-src 'self' https://*.googlevideo.com; connect-src 'self' https://lastpass.com wss://*.lastpass.com https://5399020466.log.optimizely.com https://www.lastpass.com https://pollserver.lastpass.com https://loglogin.lastpass.com https://accounts.lastpass.com https://login.microsoftonline.com https://graph.microsoft.com https://login.microsoftonline.us https://graph.microsoft.us https://*.okta.com https://*.oktapreview.com https://*.okta-emea.com https://*.pingone.com https://*.pingone.ca https://*.pingone.eu https://*.pingone.asia https://accounts.google.com https://www.googleapis.com https://*.onelogin.com https://openidconnect.googleapis.com https://content.googleapis.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com https://www.youtube.com https://*.ytimg.com https://*.optimizely.com https://lp-cdn.lastpass.com; font-src data: 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; frame-src 'self' https://ssl.gstatic.com https://www.google.com https://www.youtube.com https://cdn.lputil.com
Strict-Transport-Security max-age=86400000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://lastpass.com/

Response headers

strict-transport-security
max-age=86400000
content-security-policy
default-src 'nonce-9b254c3a2884a76d9a514e309c9479b7' 'self' https://admin.lastpass.com; img-src 'self' https://lastpass.com data: blob: https://analytics.twitter.com/i/adsct; object-src 'self' https://*.googlevideo.com; connect-src 'self' https://lastpass.com wss://*.lastpass.com https://5399020466.log.optimizely.com https://www.lastpass.com https://pollserver.lastpass.com https://loglogin.lastpass.com https://accounts.lastpass.com https://login.microsoftonline.com https://graph.microsoft.com https://login.microsoftonline.us https://graph.microsoft.us https://*.okta.com https://*.oktapreview.com https://*.okta-emea.com https://*.pingone.com https://*.pingone.ca https://*.pingone.eu https://*.pingone.asia https://accounts.google.com https://www.googleapis.com https://*.onelogin.com https://openidconnect.googleapis.com https://content.googleapis.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com https://www.youtube.com https://*.ytimg.com https://*.optimizely.com https://lp-cdn.lastpass.com; font-src data: 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; frame-src 'self' https://ssl.gstatic.com https://www.google.com https://www.youtube.com https://cdn.lputil.com
cache-control
max-age=2592000
content-encoding
gzip
x-content-type-options
nosniff
expires
Thu, 25 Sep 2025 10:43:27 GMT
content-length
888
x-xss-protection
1; mode=block
date
Wed, 27 Aug 2025 01:01:09 GMT
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
server
LastPass
last-modified
Tue, 26 Aug 2025 09:39:24 GMT
x-frame-options
SAMEORIGIN
GET
H2
200
8dTQJmLw8C
lastpass.com/UWVmmPy9d/UEzORa/nqw/D59Jm8ShakQSVJQu1p/PQ44bDJNCAE/RA/
365 KB
122 KB
43ms
41ms
Script
application/javascript
184.30.21.162
AKAMAI-AS
General
Full URL
https://lastpass.com/UWVmmPy9d/UEzORa/nqw/D59Jm8ShakQSVJQu1p/PQ44bDJNCAE/RA/8dTQJmLw8C
Requested by
Host: lastpass.com
URL: https://lastpass.com/confirm/a3ca71c2d332ceaf794aaec3dc9c5f15?utm_source=trans_email&utm_medium=LastPassSecurityNotification%3ALoginattemptbloc
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
/
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://lastpass.com/

Response headers

cache-control
max-age=21600
content-encoding
br
etag
"d211c5fd52e9318f99e23ee13bd6ec883afb70010b385e83a348799e646a560b"
content-length
124179
date
Wed, 27 Aug 2025 01:01:09 GMT
stored-attribute-sha-checksum
8635b30d3552ce202c125af360cd54e5d8d837708fe865be4f131d3cf579c718
last-modified
Tue, 12 Aug 2025 16:08:02 GMT
content-type
application/javascript
vary
Accept-Encoding
time-to-live-seconds
1260369
GET
H2
200
Primary Request settings.php Show response
lastpass.com/
203 B
2 KB
159ms
152ms
Document
text/html
184.30.21.162
AKAMAI-AS
General
Full URL
https://lastpass.com/settings.php?fromL4=1&testemail=1&cmd=verify&email=supun.bulath%40epiqglobal.com&uuid=fb7f53e402ced635ad8d24a751789518203752523e93ac771799b2b85e54db1&uid=199331238&ip=3.24.154.155&srToken=7361e6f7652847b32bba8b124567824d26c3fd8808bf1ad13304053bca3c80ec
Requested by
Host: lastpass.com
URL: https://lastpass.com/confirm/a3ca71c2d332ceaf794aaec3dc9c5f15?utm_source=trans_email&utm_medium=LastPassSecurityNotification%3ALoginattemptbloc
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
LastPass /
Resource Hash
2893e8d9449608ed445e46261b1768a65ce5f1e8c149640545abb92a6954de01
Security Headers
Name Value
Content-Security-Policy default-src 'nonce-a69c45b4d370bcc923aa033d3c9348b1' 'self' https://admin.lastpass.com; img-src 'self' https://lastpass.com data: blob: https://analytics.twitter.com/i/adsct; object-src 'self' https://*.googlevideo.com; connect-src 'self' https://lastpass.com wss://*.lastpass.com https://5399020466.log.optimizely.com https://www.lastpass.com https://pollserver.lastpass.com https://loglogin.lastpass.com https://accounts.lastpass.com https://login.microsoftonline.com https://graph.microsoft.com https://login.microsoftonline.us https://graph.microsoft.us https://*.okta.com https://*.oktapreview.com https://*.okta-emea.com https://*.pingone.com https://*.pingone.ca https://*.pingone.eu https://*.pingone.asia https://accounts.google.com https://www.googleapis.com https://*.onelogin.com https://openidconnect.googleapis.com https://content.googleapis.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com https://www.youtube.com https://*.ytimg.com https://*.optimizely.com https://lp-cdn.lastpass.com; font-src data: 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; frame-src 'self' https://ssl.gstatic.com https://www.google.com https://www.youtube.com https://cdn.lputil.com
Strict-Transport-Security max-age=86400000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://lastpass.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

cache-control
no-cache, private, no-store, max-age=0, s-maxage=0, must-revalidate, proxy-revalidate
content-length
203
content-security-policy
default-src 'nonce-a69c45b4d370bcc923aa033d3c9348b1' 'self' https://admin.lastpass.com; img-src 'self' https://lastpass.com data: blob: https://analytics.twitter.com/i/adsct; object-src 'self' https://*.googlevideo.com; connect-src 'self' https://lastpass.com wss://*.lastpass.com https://5399020466.log.optimizely.com https://www.lastpass.com https://pollserver.lastpass.com https://loglogin.lastpass.com https://accounts.lastpass.com https://login.microsoftonline.com https://graph.microsoft.com https://login.microsoftonline.us https://graph.microsoft.us https://*.okta.com https://*.oktapreview.com https://*.okta-emea.com https://*.pingone.com https://*.pingone.ca https://*.pingone.eu https://*.pingone.asia https://accounts.google.com https://www.googleapis.com https://*.onelogin.com https://openidconnect.googleapis.com https://content.googleapis.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com https://www.youtube.com https://*.ytimg.com https://*.optimizely.com https://lp-cdn.lastpass.com; font-src data: 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; frame-src 'self' https://ssl.gstatic.com https://www.google.com https://www.youtube.com https://cdn.lputil.com
content-type
text/html; charset=UTF-8
date
Wed, 27 Aug 2025 01:01:09 GMT
expires
0
server
LastPass
strict-transport-security
max-age=86400000
vary
origin Accept-Encoding
x-akamai-transformed
0 - 0 -
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
GET
H2
200
gibson-regular-webfont.woff2
lastpass.com/fonts/gibson/Regular/
22 KB
23 KB
75ms
74ms
Font
application/font-woff2
184.30.21.162
AKAMAI-AS
General
Full URL
https://lastpass.com/fonts/gibson/Regular/gibson-regular-webfont.woff2
Requested by
Host: lastpass.com
URL: https://lastpass.com/m.php/header_css_bundle?1756200117
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
LastPass /
Resource Hash
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Origin
https://lastpass.com
Referer
https://lastpass.com/m.php/header_css_bundle?1756200117

Response headers

cache-control
max-age=2592000
etag
"686f5a84-5950"
expires
Tue, 12 Aug 2025 16:46:31 GMT
accept-ranges
bytes
content-length
22864
date
Wed, 27 Aug 2025 01:01:09 GMT
content-type
application/font-woff2
last-modified
Thu, 10 Jul 2025 06:15:32 GMT
server
LastPass
x-frame-options
SAMEORIGIN
GET
H2
200
favicon.ico
lastpass.com/
6 KB
899 B
37ms
36ms
Other
image/x-icon
184.30.21.162
AKAMAI-AS
General
Full URL
https://lastpass.com/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
LastPass /
Resource Hash
6475f51aa2bebcd8090f6ff037d26cbe1a142f07d1411864c86452f3839c9418
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://lastpass.com/settings.php?fromL4=1&testemail=1&cmd=verify&email=supun.bulath%40epiqglobal.com&uuid=fb7f53e402ced635ad8d24a751789518203752523e93ac771799b2b85e54db1&uid=199331238&ip=3.24.154.155&srToken=7361e6f7652847b32bba8b124567824d26c3fd8808bf1ad13304053bca3c80ec

Response headers

vary
Accept-Encoding
cache-control
max-age=2592000
content-encoding
gzip
etag
"689378aa-163e"
expires
Mon, 08 Sep 2025 00:16:11 GMT
accept-ranges
bytes
content-length
696
date
Wed, 27 Aug 2025 01:01:09 GMT
content-type
image/x-icon
last-modified
Wed, 06 Aug 2025 15:45:46 GMT
server
LastPass
x-frame-options
SAMEORIGIN

Verdicts & Comments Add Verdict or Comment

0 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path Expires Name / Value
.lastpass.com/ 1970-01-21
16:36:32
Name: lang
Value: fr_FR
.lastpass.com/ 1970-01-21
07:51:03
Name: ak_bmsc
Value: 0D611B8442027614D697B38E15A21883~000000000000000000000000000000~YAAQNyR+aNpgq7KYAQAABv8K6RxhnPRwIWR0gEED9s62ED2QL1jCvoOle9GmfDZxFOrJdLatcGghFUGKvFXtHFDRPNMThyUS3OE/EKjmrTnCmABj6jDnu+PtKzTeaR+kt2kUGi05Ixo/V1AnmsPcXG3y9eqziE2ddyf5cJAgKWhE7RVOud8EPCkvCENLIZsaULK6QQvTSwVTyc3mmWl08jWDwk2oG+SYSNAEmAOQmm2NOPrWYHl1nQBs2nHHBIm/QLBAA3LRQ8MHDM8YixxCbzgH2AFhdtTm9lu7toLaWxrO2PZz+Hv0cPxG80mkjsaK0U3eB5q5YuPksJcZ8GO74ggMKmJ+Q/uBBZK+zKzDhX16M+UR070qtrNctpQEUyuU7mQMUjEr46ZMj7BZv94=
.lastpass.com/ 1970-01-21
16:36:32
Name: _abck
Value: 19BE84B8F0DE8488BC341A7A40D6AE50~-1~YAAQNyR+aNxgq7KYAQAAJQAL6Q5AzrxSKskdOSr6N/sIF3M9FZduohF5iaEwZkPJ9E19gJyg2hGeXFLNde0fCsfe9kD27bdWv/8DKfcu6u5EfuZ62/aqalcDON2Wi8s3zQLTKsbF2AcqC6HN+pDR42g1uNz5YxmSN3CbsBfPSj2Ee1W9xDhtD1G5iw9P4V1UkaQB9+VhtxDs7orpw/q2qGfHDpuTi8ciaW4Mg5fFzXj1ufIf+dLMNR+JPjsIcg8pbjoCL1qdL8MHS13Pf8lRtAaM6YVIv5CJcUUItl4IWevefJJ1foD4+vM0on7Yn7cEeyNH/rSqG3nU6S6U4ayCWFjjW1EZ7DknN7VjvfLo07A0VJzaFzcN/brattNWOxCzzXI5OKLulnrShTb4sARoGlpzS6NcT2FyfsetiOBf6sxg8JxFQ4o1N8UA1MKr2gMJvDz/SN2Y0lN12wDETBwHOLa0mrxgTTa/Vhm6R3iUYa4NdHP03P2c2ZpYaUw+XXEM0yYIaaXegYJCgb0v6OheszXaRTxT1/mMv3x7hGix04LMWQ==~-1~-1~-1~~
.lastpass.com/ 1970-01-21
07:51:03
Name: bm_sv
Value: 5CA829B8B6FD35F2EF995621FC50BE16~YAAQNyR+aN1gq7KYAQAA0QAL6RwF6KfqUAOLOUIbULCoHHYE8rXJquKKIEy0JcH3nEEAm9CbfM1oaWkfkJ0Qnx6i66VYK6nlCSC20IhfTp6iR5nSS5WVqyOL1sfP/iWq41LAC3zTaOZ5st+JeqDC4B+mK0mjAzM92lIWteAM4CSbnXTtTs/axkXm5jNT167JcJFz0aC/1fu047PVz/yDdQv32qcSYApKP/7kpVTETElIc4qD+9oqv8hLM3qP+Zk1Qcs=~1
.lastpass.com/ 1970-01-21
07:51:10
Name: bm_sz
Value: A4D15F581D79D765F05E1C2551C71D07~YAAQNyR+aN5gq7KYAQAA0QAL6RzQGmvpZEoB0KjGIeK6nRj7ZjrhLoG4zKEwLsSTN5HwvZRmD6Z6zaCX8bVME6hUnLQl1W5fKu6RpL+Ks+k4QMnPYla6myBsO8JDKhWX9cFuoNta09OKq9IfumJSdbiGop0YWXgI2yqB0jBC3fMO8QaNDRUqcgkHr4xcL3GAnfxPD2p7EYvk1m6lR5z6Fh3smG7TrKSAFvmlHkegoIfgmH53TQ0Rd3uLsaMgmad8h1vlM6IxRS9VwP6Y7dSJ1loCsH7lT4Rhk9W4HqWJwb7lXoqU5cosHdR/tLaLMypvOokM/wY+Td6hiC3SpwGvQu0JM7JFmzPeNpnUP+8+rrIPKIZWy94eUy2y6BuU2YU7StPyy0SOl/CDJ+3DGLYuylrrsbprmA==~3749172~3490116

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source Level URL
Text
security error URL: https://lastpass.com/confirm/a3ca71c2d332ceaf794aaec3dc9c5f15?utm_source=trans_email&utm_medium=LastPassSecurityNotification%3ALoginattemptbloc
Message:
The Content-Security-Policy directive 'plugin-types' has been removed from the specification. If you want to block plugins, consider specifying "object-src 'none'" instead.
security error URL: https://lastpass.com/settings.php?fromL4=1&testemail=1&cmd=verify&email=supun.bulath%40epiqglobal.com&uuid=fb7f53e402ced635ad8d24a751789518203752523e93ac771799b2b85e54db1&uid=199331238&ip=3.24.154.155&srToken=7361e6f7652847b32bba8b124567824d26c3fd8808bf1ad13304053bca3c80ec
Message:
The Content-Security-Policy directive 'plugin-types' has been removed from the specification. If you want to block plugins, consider specifying "object-src 'none'" instead.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'nonce-605e75d102e7d25c571cb2c507dc52ca' 'self' https://admin.lastpass.com; img-src 'self' https://lastpass.com data: blob: https://analytics.twitter.com/i/adsct; object-src 'self' https://*.googlevideo.com; connect-src 'self' https://lastpass.com wss://*.lastpass.com https://5399020466.log.optimizely.com https://www.lastpass.com https://pollserver.lastpass.com https://loglogin.lastpass.com https://accounts.lastpass.com https://login.microsoftonline.com https://graph.microsoft.com https://login.microsoftonline.us https://graph.microsoft.us https://*.okta.com https://*.oktapreview.com https://*.okta-emea.com https://*.pingone.com https://*.pingone.ca https://*.pingone.eu https://*.pingone.asia https://accounts.google.com https://www.googleapis.com https://*.onelogin.com https://openidconnect.googleapis.com https://content.googleapis.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com https://www.youtube.com https://*.ytimg.com https://*.optimizely.com https://lp-cdn.lastpass.com; font-src data: 'self' 'unsafe-inline' 'unsafe-eval' https://lastpass.com; frame-src 'self' https://ssl.gstatic.com https://www.google.com https://www.youtube.com https://cdn.lputil.com
Strict-Transport-Security max-age=86400000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block