urlscan.io logo urlscan.io
SecurityTrails logo

site55.moneymap.bain.io Open in urlscan Pro
2606:4700:4400::ac40:994b  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://site55.moneymap.bain.io/
Effective URL: https://site55.moneymap.bain.io/login
Submission: On November 29 via automatic, source certstream-suspicious — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 1 countries across 2 domains to perform 18 HTTP transactions. The main IP is 2606:4700:4400::ac40:994b, located in United States and belongs to CLOUDFLARENET, US. The main domain is site55.moneymap.bain.io.
TLS certificate: Issued by GTS CA 1P5 on November 29th 2023. Valid for: 3 months.
This is the only time site55.moneymap.bain.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
10 2606:4700:440... 13335 (CLOUDFLAR...)
2 34.36.213.229 396982 (GOOGLE-CL...)
4 3.33.152.248 16509 (AMAZON-02)
18 4
Apex Domain
Subdomains		 Transfer
14 bain.io
site55.moneymap.bain.io
login.moneymap.bain.io Failed
7 MB
2 pendo.io
cdn.pendo.io — Cisco Umbrella Rank: 844
283 KB
18 2
Domain Requested by
10 site55.moneymap.bain.io site55.moneymap.bain.io
4 login.moneymap.bain.io site55.moneymap.bain.io
2 cdn.pendo.io site55.moneymap.bain.io
18 3

This site contains no links.

Subject Issuer Validity Valid
site55.moneymap.bain.io
GTS CA 1P5		 2023-11-29 -
2024-02-27		 3 months crt.sh
cdn.pendo.io
GTS CA 1D4		 2023-10-09 -
2024-01-07		 3 months crt.sh
login.moneymap.bain.io
R3		 2023-11-03 -
2024-02-01		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://site55.moneymap.bain.io/login
Frame ID: D0CE7F462FC2443EAAF9388BCA36F519
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

MoneyMap - Bain

Page URL History Show full URLs

  1. https://site55.moneymap.bain.io/ Page URL
  2. https://site55.moneymap.bain.io/login Page URL

Page Statistics

18
Requests

89 %
HTTPS

33 %
IPv6

2
Domains

3
Subdomains

4
IPs

1
Countries

7403 kB
Transfer

22615 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://site55.moneymap.bain.io/ Page URL
  2. https://site55.moneymap.bain.io/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
site55.moneymap.bain.io/ 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://site55.moneymap.bain.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:994b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
af5519930479fb725e29cad54236e20728d6ad720d771997abe6965f5f22dd36
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cf-cache-status
DYNAMIC
cf-ray
82d9cbafca449010-FRA
content-encoding
br
content-type
text/html
date
Wed, 29 Nov 2023 09:24:06 GMT
last-modified
Wed, 22 Nov 2023 23:42:34 GMT
request-context
appId=cid-v1:fb91caab-ab17-4e25-b5f5-7dd09da79b9e
server
cloudflare
strict-transport-security
max-age=86400; includeSubDomains
vary
Accept-Encoding
x-azure-ref
20231129T092405Z-c1yw0tv5x53696kfsrn4qhv5r400000002kg00000001mzr8
x-cache
CONFIG_NOCACHE
x-powered-by
ASP.NET
styles.862b05e9df67470c.css
site55.moneymap.bain.io/ 		163 KB
25 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://site55.moneymap.bain.io/styles.862b05e9df67470c.css
Requested by
Host: site55.moneymap.bain.io
URL: https://site55.moneymap.bain.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:994b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
f9ddbb2b2e91066aa4eb44299feeec5dd91668aff69944cc3f3b01fda1d7ac2c
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://site55.moneymap.bain.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 09:24:07 GMT
strict-transport-security
max-age=86400; includeSubDomains
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 22 Nov 2023 23:42:34 GMT
server
cloudflare
etag
W/"1da1d9d90f41b81"
x-powered-by
ASP.NET
vary
Accept-Encoding
x-azure-ref
20231129T092406Z-xevz7chfsd0nt2fs54u5y2xgrc0000000ek000000000fcqf
content-type
text/css
x-cache
CONFIG_NOCACHE
cache-control
no-store, must-revalidate, no-cache, max-age=0
cf-ray
82d9cbb37df59010-FRA
request-context
appId=cid-v1:fb91caab-ab17-4e25-b5f5-7dd09da79b9e
runtime.382fb532c0dce09a.esm.js
site55.moneymap.bain.io/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://site55.moneymap.bain.io/runtime.382fb532c0dce09a.esm.js
Requested by
Host: site55.moneymap.bain.io
URL: https://site55.moneymap.bain.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:994b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
7148388d9493c0673ea07673f18a2376eeabb91e24313b842ee974fcaccc167b
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains

Request headers

Referer
https://site55.moneymap.bain.io/
Origin
https://site55.moneymap.bain.io
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 09:24:06 GMT
strict-transport-security
max-age=86400; includeSubDomains
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 22 Nov 2023 23:42:34 GMT
server
cloudflare
etag
W/"1da1d9d90f69f3a"
x-powered-by
ASP.NET
vary
Accept-Encoding
x-azure-ref
20231129T092406Z-xbw71y738t64128u3m4vnx2n5w00000001q0000000002653
content-type
application/javascript
x-cache
CONFIG_NOCACHE
cache-control
no-store, must-revalidate, no-cache, max-age=0
cf-ray
82d9cbb37df69010-FRA
request-context
appId=cid-v1:fb91caab-ab17-4e25-b5f5-7dd09da79b9e
main.d6f214e0d1c051d2.esm.js
site55.moneymap.bain.io/ 		10 MB
3 MB 		Script
General
Check archive.org
Download Go to
Full URL
https://site55.moneymap.bain.io/main.d6f214e0d1c051d2.esm.js
Requested by
Host: site55.moneymap.bain.io
URL: https://site55.moneymap.bain.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:994b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
f080ba3438fd8c64909e1fcc5908b2bcb09105baf9dde828f1fdd0fe7d529d89
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains

Request headers

Referer
https://site55.moneymap.bain.io/
Origin
https://site55.moneymap.bain.io
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 09:24:07 GMT
strict-transport-security
max-age=86400; includeSubDomains
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 22 Nov 2023 23:42:34 GMT
server
cloudflare
etag
W/"1da1d9d905199c4"
x-powered-by
ASP.NET
vary
Accept-Encoding
x-azure-ref
20231129T092406Z-n65vxb924d2d5az1k3mwb991g000000004wg00000000gafy
content-type
application/javascript
x-cache
CONFIG_NOCACHE
cache-control
no-store, must-revalidate, no-cache, max-age=0
cf-ray
82d9cbb37df79010-FRA
request-context
appId=cid-v1:fb91caab-ab17-4e25-b5f5-7dd09da79b9e
pendo.js
cdn.pendo.io/agent/static/285838ac-3608-4aec-7028-85543ea092f2/ 		427 KB
142 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.pendo.io/agent/static/285838ac-3608-4aec-7028-85543ea092f2/pendo.js
Requested by
Host: site55.moneymap.bain.io
URL: https://site55.moneymap.bain.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.36.213.229 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
229.213.36.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
9c7f5bdaee423839891bf4c85549a25d51a9209772bd3d19a03524e7e449816b
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://site55.moneymap.bain.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 09:24:07 GMT
content-encoding
gzip
strict-transport-security
max-age=63072000; includeSubDomains
x-guploader-uploadid
ABPtcPqIsdPiA36XyF_1z-LVKFHAzyFQ9qWLzlMk__xzBQnUvXuFub3nJ3nga9sbTj576iCLrfj_i0vbmwPju6DIzq6PnA
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
144463
last-modified
Thu, 16 Nov 2023 19:12:52 GMT
server
UploadServer
etag
"710dc04c24a71200a8b7cc61c56a90fe"
vary
Accept-Encoding
x-goog-generation
1700161972383425
content-type
application/javascript
access-control-allow-origin
*
x-goog-hash
crc32c=gEbrRw==, md5=cQ3ATCSnEgCot8xhxWqQ/g==
access-control-expose-headers
*
cache-control
public,max-age=450
x-goog-stored-content-length
144463
accept-ranges
bytes
me
login.moneymap.bain.io/api/v1/sessions/ 		0
0
me
login.moneymap.bain.io/api/v1/sessions/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://login.moneymap.bain.io/api/v1/sessions/me
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.33.152.248 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a9d4dea8e2661b2ed.awsglobalaccelerator.com
Software
nginx /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com; connect-src 'self' bainco.okta.com bainco-admin.okta.com login.moneymap.bain.io *.oktacdn.com *.mixpanel.com *.mapbox.com app.pendo.io data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com *.mtls.okta.com bainco.kerberos.okta.com *.authenticatorlocalprod.com:8769 http://localhost:8769 http://127.0.0.1:8769 *.authenticatorlocalprod.com:65111 http://localhost:65111 http://127.0.0.1:65111 *.authenticatorlocalprod.com:65121 http://localhost:65121 http://127.0.0.1:65121 *.authenticatorlocalprod.com:65131 http://localhost:65131 http://127.0.0.1:65131 *.authenticatorlocalprod.com:65141 http://localhost:65141 http://127.0.0.1:65141 *.authenticatorlocalprod.com:65151 http://localhost:65151 http://127.0.0.1:65151 https://oinmanager.okta.com data:; script-src 'unsafe-inline' 'unsafe-eval' 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com; style-src 'unsafe-inline' 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com app.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; frame-src 'self' bainco.okta.com bainco-admin.okta.com login.moneymap.bain.io login.okta.com com-okta-authenticator:; img-src 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com *.tiles.mapbox.com *.mapbox.com app.pendo.io data.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com data: blob:; font-src 'self' bainco.okta.com login.moneymap.bain.io data: *.oktacdn.com fonts.gstatic.com; frame-ancestors 'self'
Strict-Transport-Security max-age=315360000; includeSubDomains
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,x-okta-user-agent-extended
Access-Control-Request-Method
GET
Origin
https://site55.moneymap.bain.io
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Connection
Keep-Alive
Content-Length
0
Date
Wed, 29 Nov 2023 09:24:10 GMT
Keep-Alive
timeout=5, max=100
Server
nginx
Strict-Transport-Security
max-age=315360000; includeSubDomains
allow
GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
cache-control
no-cache, no-store
content-security-policy
default-src 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com; connect-src 'self' bainco.okta.com bainco-admin.okta.com login.moneymap.bain.io *.oktacdn.com *.mixpanel.com *.mapbox.com app.pendo.io data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com *.mtls.okta.com bainco.kerberos.okta.com *.authenticatorlocalprod.com:8769 http://localhost:8769 http://127.0.0.1:8769 *.authenticatorlocalprod.com:65111 http://localhost:65111 http://127.0.0.1:65111 *.authenticatorlocalprod.com:65121 http://localhost:65121 http://127.0.0.1:65121 *.authenticatorlocalprod.com:65131 http://localhost:65131 http://127.0.0.1:65131 *.authenticatorlocalprod.com:65141 http://localhost:65141 http://127.0.0.1:65141 *.authenticatorlocalprod.com:65151 http://localhost:65151 http://127.0.0.1:65151 https://oinmanager.okta.com data:; script-src 'unsafe-inline' 'unsafe-eval' 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com; style-src 'unsafe-inline' 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com app.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; frame-src 'self' bainco.okta.com bainco-admin.okta.com login.moneymap.bain.io login.okta.com com-okta-authenticator:; img-src 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com *.tiles.mapbox.com *.mapbox.com app.pendo.io data.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com data: blob:; font-src 'self' bainco.okta.com login.moneymap.bain.io data: *.oktacdn.com fonts.gstatic.com; frame-ancestors 'self'
expires
0
p3p
CP="HONK"
pragma
no-cache
vary
Origin
x-frame-options
SAMEORIGIN
x-okta-request-id
ZWcDOXx-rnQKhzH8-_1xAQAAB1E
x-rate-limit-limit
10000
x-rate-limit-remaining
9998
x-rate-limit-reset
1701249876
x-xss-protection
0
Primary Request login
site55.moneymap.bain.io/ 		1 KB
774 B 		Document
General
Check archive.org
Download Go to
Full URL
https://site55.moneymap.bain.io/login
Requested by
Host: site55.moneymap.bain.io
URL: https://site55.moneymap.bain.io/main.d6f214e0d1c051d2.esm.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:994b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
af5519930479fb725e29cad54236e20728d6ad720d771997abe6965f5f22dd36
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains

Request headers

Referer
https://site55.moneymap.bain.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cf-cache-status
DYNAMIC
cf-ray
82d9cbcbece59010-FRA
content-encoding
br
content-type
text/html
date
Wed, 29 Nov 2023 09:24:10 GMT
last-modified
Wed, 22 Nov 2023 23:42:34 GMT
request-context
appId=cid-v1:fb91caab-ab17-4e25-b5f5-7dd09da79b9e
server
cloudflare
strict-transport-security
max-age=86400; includeSubDomains
vary
Accept-Encoding
x-azure-ref
20231129T092410Z-c1yw0tv5x53696kfsrn4qhv5r400000002kg00000001n0rw
x-cache
CONFIG_NOCACHE
x-powered-by
ASP.NET
styles.862b05e9df67470c.css
site55.moneymap.bain.io/ 		163 KB
25 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://site55.moneymap.bain.io/styles.862b05e9df67470c.css
Requested by
Host: site55.moneymap.bain.io
URL: https://site55.moneymap.bain.io/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:994b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
f9ddbb2b2e91066aa4eb44299feeec5dd91668aff69944cc3f3b01fda1d7ac2c
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://site55.moneymap.bain.io/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 09:24:10 GMT
strict-transport-security
max-age=86400; includeSubDomains
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 22 Nov 2023 23:42:34 GMT
server
cloudflare
etag
W/"1da1d9d90f41b81"
x-powered-by
ASP.NET
vary
Accept-Encoding
x-azure-ref
20231129T092410Z-xevz7chfsd0nt2fs54u5y2xgrc0000000ek000000000fdsb
content-type
text/css
x-cache
CONFIG_NOCACHE
cache-control
no-store, must-revalidate, no-cache, max-age=0
cf-ray
82d9cbccedc19010-FRA
request-context
appId=cid-v1:fb91caab-ab17-4e25-b5f5-7dd09da79b9e
runtime.382fb532c0dce09a.esm.js
site55.moneymap.bain.io/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://site55.moneymap.bain.io/runtime.382fb532c0dce09a.esm.js
Requested by
Host: site55.moneymap.bain.io
URL: https://site55.moneymap.bain.io/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:994b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
7148388d9493c0673ea07673f18a2376eeabb91e24313b842ee974fcaccc167b
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains

Request headers

Referer
https://site55.moneymap.bain.io/login
Origin
https://site55.moneymap.bain.io
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 09:24:10 GMT
strict-transport-security
max-age=86400; includeSubDomains
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 22 Nov 2023 23:42:34 GMT
server
cloudflare
etag
W/"1da1d9d90f69f3a"
x-powered-by
ASP.NET
vary
Accept-Encoding
x-azure-ref
20231129T092410Z-xbw71y738t64128u3m4vnx2n5w00000001q00000000026b9
content-type
application/javascript
x-cache
CONFIG_NOCACHE
cache-control
no-store, must-revalidate, no-cache, max-age=0
cf-ray
82d9cbccedc39010-FRA
request-context
appId=cid-v1:fb91caab-ab17-4e25-b5f5-7dd09da79b9e
main.d6f214e0d1c051d2.esm.js
site55.moneymap.bain.io/ 		10 MB
3 MB 		Script
General
Check archive.org
Download Go to
Full URL
https://site55.moneymap.bain.io/main.d6f214e0d1c051d2.esm.js
Requested by
Host: site55.moneymap.bain.io
URL: https://site55.moneymap.bain.io/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:994b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
f080ba3438fd8c64909e1fcc5908b2bcb09105baf9dde828f1fdd0fe7d529d89
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains

Request headers

Referer
https://site55.moneymap.bain.io/login
Origin
https://site55.moneymap.bain.io
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 09:24:10 GMT
strict-transport-security
max-age=86400; includeSubDomains
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 22 Nov 2023 23:42:34 GMT
server
cloudflare
etag
W/"1da1d9d905199c4"
x-powered-by
ASP.NET
vary
Accept-Encoding
x-azure-ref
20231129T092410Z-n65vxb924d2d5az1k3mwb991g000000004wg00000000gara
content-type
application/javascript
x-cache
CONFIG_NOCACHE
cache-control
no-store, must-revalidate, no-cache, max-age=0
cf-ray
82d9cbccedc49010-FRA
request-context
appId=cid-v1:fb91caab-ab17-4e25-b5f5-7dd09da79b9e
pendo.js
cdn.pendo.io/agent/static/285838ac-3608-4aec-7028-85543ea092f2/ 		427 KB
141 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.pendo.io/agent/static/285838ac-3608-4aec-7028-85543ea092f2/pendo.js
Requested by
Host: site55.moneymap.bain.io
URL: https://site55.moneymap.bain.io/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.36.213.229 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
229.213.36.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
9c7f5bdaee423839891bf4c85549a25d51a9209772bd3d19a03524e7e449816b
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://site55.moneymap.bain.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 09:24:07 GMT
content-encoding
gzip
strict-transport-security
max-age=63072000; includeSubDomains
age
3
x-guploader-uploadid
ABPtcPqIsdPiA36XyF_1z-LVKFHAzyFQ9qWLzlMk__xzBQnUvXuFub3nJ3nga9sbTj576iCLrfj_i0vbmwPju6DIzq6PnA
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
144463
last-modified
Thu, 16 Nov 2023 19:12:52 GMT
server
UploadServer
etag
"710dc04c24a71200a8b7cc61c56a90fe"
vary
Accept-Encoding
x-goog-generation
1700161972383425
x-goog-hash
crc32c=gEbrRw==, md5=cQ3ATCSnEgCot8xhxWqQ/g==
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public,max-age=450
x-goog-stored-content-length
144463
accept-ranges
bytes
content-type
application/javascript
openid-configuration
login.moneymap.bain.io/oauth2/ausg77i929vkwfCFG357/.well-known/ 		3 KB
5 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://login.moneymap.bain.io/oauth2/ausg77i929vkwfCFG357/.well-known/openid-configuration
Requested by
Host: site55.moneymap.bain.io
URL: https://site55.moneymap.bain.io/main.d6f214e0d1c051d2.esm.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.33.152.248 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a9d4dea8e2661b2ed.awsglobalaccelerator.com
Software
nginx /
Resource Hash
77f571dadf74a85e2ced31862a77bd85418794e312428642416fa00005038d99
Security Headers
Name Value
Content-Security-Policy default-src 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com; connect-src 'self' bainco.okta.com bainco-admin.okta.com login.moneymap.bain.io *.oktacdn.com *.mixpanel.com *.mapbox.com app.pendo.io data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com *.mtls.okta.com bainco.kerberos.okta.com *.authenticatorlocalprod.com:8769 http://localhost:8769 http://127.0.0.1:8769 *.authenticatorlocalprod.com:65111 http://localhost:65111 http://127.0.0.1:65111 *.authenticatorlocalprod.com:65121 http://localhost:65121 http://127.0.0.1:65121 *.authenticatorlocalprod.com:65131 http://localhost:65131 http://127.0.0.1:65131 *.authenticatorlocalprod.com:65141 http://localhost:65141 http://127.0.0.1:65141 *.authenticatorlocalprod.com:65151 http://localhost:65151 http://127.0.0.1:65151 https://oinmanager.okta.com data:; script-src 'unsafe-inline' 'unsafe-eval' 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com; style-src 'unsafe-inline' 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com app.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; frame-src 'self' bainco.okta.com bainco-admin.okta.com login.moneymap.bain.io login.okta.com com-okta-authenticator:; img-src 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com *.tiles.mapbox.com *.mapbox.com app.pendo.io data.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com data: blob:; font-src 'self' bainco.okta.com login.moneymap.bain.io data: *.oktacdn.com fonts.gstatic.com; frame-ancestors 'self'
Strict-Transport-Security max-age=315360000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept
application/json
Referer
https://site55.moneymap.bain.io/
X-Okta-User-Agent-Extended
okta-auth-js/7.0.2 okta-signin-widget-7.10.1
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/json

Response headers

X-Okta-Request-Id
ZWcDO3x-rnQKhzH8-_1xCQAAB1E
Date
Wed, 29 Nov 2023 09:24:11 GMT
content-security-policy
default-src 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com; connect-src 'self' bainco.okta.com bainco-admin.okta.com login.moneymap.bain.io *.oktacdn.com *.mixpanel.com *.mapbox.com app.pendo.io data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com *.mtls.okta.com bainco.kerberos.okta.com *.authenticatorlocalprod.com:8769 http://localhost:8769 http://127.0.0.1:8769 *.authenticatorlocalprod.com:65111 http://localhost:65111 http://127.0.0.1:65111 *.authenticatorlocalprod.com:65121 http://localhost:65121 http://127.0.0.1:65121 *.authenticatorlocalprod.com:65131 http://localhost:65131 http://127.0.0.1:65131 *.authenticatorlocalprod.com:65141 http://localhost:65141 http://127.0.0.1:65141 *.authenticatorlocalprod.com:65151 http://localhost:65151 http://127.0.0.1:65151 https://oinmanager.okta.com data:; script-src 'unsafe-inline' 'unsafe-eval' 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com; style-src 'unsafe-inline' 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com app.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; frame-src 'self' bainco.okta.com bainco-admin.okta.com login.moneymap.bain.io login.okta.com com-okta-authenticator:; img-src 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com *.tiles.mapbox.com *.mapbox.com app.pendo.io data.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com data: blob:; font-src 'self' bainco.okta.com login.moneymap.bain.io data: *.oktacdn.com fonts.gstatic.com; frame-ancestors 'self'
x-content-type-options
nosniff
Strict-Transport-Security
max-age=315360000; includeSubDomains
Transfer-Encoding
chunked
p3p
CP="HONK"
Connection
Keep-Alive
x-xss-protection
0
Server
nginx
vary
Origin
Content-Type
application/json
Access-Control-Allow-Origin
https://site55.moneymap.bain.io
cache-control
max-age=86400, must-revalidate
Access-Control-Allow-Credentials
true
Keep-Alive
timeout=5, max=98
expires
Thu, 30 Nov 2023 09:24:11 GMT
openid-configuration
login.moneymap.bain.io/oauth2/ausg77i929vkwfCFG357/.well-known/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://login.moneymap.bain.io/oauth2/ausg77i929vkwfCFG357/.well-known/openid-configuration
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.33.152.248 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a9d4dea8e2661b2ed.awsglobalaccelerator.com
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=315360000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,x-okta-user-agent-extended
Access-Control-Request-Method
GET
Origin
https://site55.moneymap.bain.io
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
content-type,x-okta-user-agent-extended
Access-Control-Allow-Methods
GET, OPTIONS
Access-Control-Allow-Origin
https://site55.moneymap.bain.io
Access-Control-Max-Age
3600
Connection
Keep-Alive
Content-Length
0
Content-Type
application/octet-stream
Date
Wed, 29 Nov 2023 09:24:11 GMT
Keep-Alive
timeout=5, max=99
Server
nginx
Strict-Transport-Security
max-age=315360000; includeSubDomains
Vary
Origin
X-Okta-Request-Id
ZWcDO3x-rnQKhzH8-_1xBwAAB1E
interact
login.moneymap.bain.io/oauth2/ausg77i929vkwfCFG357/v1/ 		0
0
interact
login.moneymap.bain.io/oauth2/ausg77i929vkwfCFG357/v1/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://login.moneymap.bain.io/oauth2/ausg77i929vkwfCFG357/v1/interact
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.33.152.248 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a9d4dea8e2661b2ed.awsglobalaccelerator.com
Software
nginx /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com; connect-src 'self' bainco.okta.com bainco-admin.okta.com login.moneymap.bain.io *.oktacdn.com *.mixpanel.com *.mapbox.com app.pendo.io data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com *.mtls.okta.com bainco.kerberos.okta.com *.authenticatorlocalprod.com:8769 http://localhost:8769 http://127.0.0.1:8769 *.authenticatorlocalprod.com:65111 http://localhost:65111 http://127.0.0.1:65111 *.authenticatorlocalprod.com:65121 http://localhost:65121 http://127.0.0.1:65121 *.authenticatorlocalprod.com:65131 http://localhost:65131 http://127.0.0.1:65131 *.authenticatorlocalprod.com:65141 http://localhost:65141 http://127.0.0.1:65141 *.authenticatorlocalprod.com:65151 http://localhost:65151 http://127.0.0.1:65151 https://oinmanager.okta.com data:; script-src 'unsafe-inline' 'unsafe-eval' 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com; style-src 'unsafe-inline' 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com app.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; frame-src 'self' bainco.okta.com bainco-admin.okta.com login.moneymap.bain.io login.okta.com com-okta-authenticator:; img-src 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com *.tiles.mapbox.com *.mapbox.com app.pendo.io data.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com data: blob:; font-src 'self' bainco.okta.com login.moneymap.bain.io data: *.oktacdn.com fonts.gstatic.com; frame-ancestors 'self'
Strict-Transport-Security max-age=315360000; includeSubDomains
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept
*/*
Access-Control-Request-Headers
x-okta-user-agent-extended
Access-Control-Request-Method
POST
Origin
https://site55.moneymap.bain.io
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Connection
Keep-Alive
Content-Length
0
Date
Wed, 29 Nov 2023 09:24:11 GMT
Keep-Alive
timeout=5, max=97
Server
nginx
Strict-Transport-Security
max-age=315360000; includeSubDomains
X-Robots-Tag
noindex,nofollow
allow
GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
cache-control
no-cache, no-store
content-security-policy
default-src 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com; connect-src 'self' bainco.okta.com bainco-admin.okta.com login.moneymap.bain.io *.oktacdn.com *.mixpanel.com *.mapbox.com app.pendo.io data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com *.mtls.okta.com bainco.kerberos.okta.com *.authenticatorlocalprod.com:8769 http://localhost:8769 http://127.0.0.1:8769 *.authenticatorlocalprod.com:65111 http://localhost:65111 http://127.0.0.1:65111 *.authenticatorlocalprod.com:65121 http://localhost:65121 http://127.0.0.1:65121 *.authenticatorlocalprod.com:65131 http://localhost:65131 http://127.0.0.1:65131 *.authenticatorlocalprod.com:65141 http://localhost:65141 http://127.0.0.1:65141 *.authenticatorlocalprod.com:65151 http://localhost:65151 http://127.0.0.1:65151 https://oinmanager.okta.com data:; script-src 'unsafe-inline' 'unsafe-eval' 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com; style-src 'unsafe-inline' 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com app.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; frame-src 'self' bainco.okta.com bainco-admin.okta.com login.moneymap.bain.io login.okta.com com-okta-authenticator:; img-src 'self' bainco.okta.com login.moneymap.bain.io *.oktacdn.com *.tiles.mapbox.com *.mapbox.com app.pendo.io data.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com data: blob:; font-src 'self' bainco.okta.com login.moneymap.bain.io data: *.oktacdn.com fonts.gstatic.com; frame-ancestors 'self'
expires
0
p3p
CP="HONK"
pragma
no-cache
vary
Origin
x-frame-options
SAMEORIGIN
x-okta-request-id
ZWcDO3x-rnQKhzH8-_1xCgAAB1E
x-rate-limit-limit
10000
x-rate-limit-remaining
9997
x-rate-limit-reset
1701249876
x-xss-protection
0
okticon.db28723126138387cdf4.woff
site55.moneymap.bain.io/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://site55.moneymap.bain.io/okticon.db28723126138387cdf4.woff
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:994b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
7eccbb3b4b68f9f24a3b826f2eea4a1bbb48196cb734afc1b62c3d045cb680e1
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains

Request headers

Referer
https://site55.moneymap.bain.io/login
Origin
https://site55.moneymap.bain.io
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 09:24:12 GMT
strict-transport-security
max-age=86400; includeSubDomains
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 22 Nov 2023 23:42:34 GMT
server
cloudflare
etag
W/"1da1d9d90f6c178"
x-powered-by
ASP.NET
x-azure-ref
20231129T092412Z-v7trtr7gfp7d7cb1vz33md7ha400000001v000000001p32b
x-cache
CONFIG_NOCACHE
content-type
application/font-woff
vary
Accept-Encoding
cache-control
no-store, must-revalidate, no-cache, max-age=0
cf-ray
82d9cbd7befa9010-FRA
request-context
appId=cid-v1:fb91caab-ab17-4e25-b5f5-7dd09da79b9e
montserrat-okta-light-webfont.6225f3ca44b830908330.woff
site55.moneymap.bain.io/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://site55.moneymap.bain.io/montserrat-okta-light-webfont.6225f3ca44b830908330.woff
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:994b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
feb177fb563f478cb8ecade71caea5df5ad318ca161c71875114e504ce304ace
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains

Request headers

Referer
https://site55.moneymap.bain.io/login
Origin
https://site55.moneymap.bain.io
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 29 Nov 2023 09:24:12 GMT
strict-transport-security
max-age=86400; includeSubDomains
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 22 Nov 2023 23:42:34 GMT
server
cloudflare
etag
W/"1da1d9d90f6c760"
x-powered-by
ASP.NET
x-azure-ref
20231129T092412Z-9uf38r679577b503t8ave2p3v80000000kb000000001aatd
x-cache
CONFIG_NOCACHE
content-type
application/font-woff
vary
Accept-Encoding
cache-control
no-store, must-revalidate, no-cache, max-age=0
cf-ray
82d9cbd7cefd9010-FRA
request-context
appId=cid-v1:fb91caab-ab17-4e25-b5f5-7dd09da79b9e

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
login.moneymap.bain.io
URL
https://login.moneymap.bain.io/api/v1/sessions/me
Domain
login.moneymap.bain.io
URL
https://login.moneymap.bain.io/oauth2/ausg77i929vkwfCFG357/v1/interact

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| pendo object| webpackChunk object| regeneratorRuntime function| jQueryCourage object| u2f function| _ object| __tableauApiServiceRegistry

1 Cookies

Domain/Path Name / Value
.bain.io/ Name: __cf_bm
Value: mfrGU3nUDzErcbhjulPskQp6F4zpGCdW4Vm55.4u.k0-1701249846-0-AVJy29jPrnISJjcYbCqgq30AHsyQsXUMPYN1xAJvGMbbwZMbGIwt47rC1gqwGPDZui6+VHVp7t9qeMtL405SMXQ=

4 Console Messages

Source Level URL
Text
javascript error URL: https://site55.moneymap.bain.io/
Message:
Access to fetch at 'https://login.moneymap.bain.io/api/v1/sessions/me' from origin 'https://site55.moneymap.bain.io' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
network error URL: https://login.moneymap.bain.io/api/v1/sessions/me
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://site55.moneymap.bain.io/login
Message:
Access to fetch at 'https://login.moneymap.bain.io/oauth2/ausg77i929vkwfCFG357/v1/interact' from origin 'https://site55.moneymap.bain.io' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
network error URL: https://login.moneymap.bain.io/oauth2/ausg77i929vkwfCFG357/v1/interact
Message:
Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=86400; includeSubDomains