Submitted URL: https://galaxy.epic.com/
Effective URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%...
Submission: On January 26 via manual from US — Scanned from DE

Summary

This website contacted 4 IPs in 1 countries across 1 domains to perform 15 HTTP transactions. The main IP is 199.204.56.180, located in Madison, United States and belongs to EPICSYS, US. The main domain is signin.epic.com. The Cisco Umbrella rank of the primary domain is 72070.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on March 3rd 2023. Valid for: a year.
This is the only time signin.epic.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 199.204.56.89 10359 (EPICSYS)
7 199.204.56.180 10359 (EPICSYS)
7 199.204.56.121 10359 (EPICSYS)
15 4
Apex Domain
Subdomains
Transfer
15 epic.com
galaxy.epic.com — Cisco Umbrella Rank: 103103
signin.epic.com — Cisco Umbrella Rank: 72070
userweb.epic.com — Cisco Umbrella Rank: 42855
3 MB
15 1
Domain Requested by
7 userweb.epic.com signin.epic.com
userweb.epic.com
7 signin.epic.com galaxy.epic.com
signin.epic.com
1 galaxy.epic.com
15 3

This site contains links to these domains. Also see Links.

Domain
userweb.epic.com
www.epic.com
Subject Issuer Validity Valid
*.epic.com
DigiCert TLS RSA SHA256 2020 CA1
2023-03-03 -
2024-04-02
a year crt.sh

This page contains 1 frames:

Primary Page: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-01-26T14%3a01%3a55Z
Frame ID: CB1F260EA62EDE67A2CC3F64920F1546
Requests: 17 HTTP requests in this frame

Screenshot

Page Title

Epic UserWeb Sign In

Page URL History Show full URLs

  1. https://galaxy.epic.com/ Page URL
  2. https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

3
Subdomains

4
IPs

1
Countries

3359 kB
Transfer

3400 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://galaxy.epic.com/ Page URL
  2. https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-01-26T14%3a01%3a55Z Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
galaxy.epic.com/
909 B
1 KB
Document
General
Full URL
https://galaxy.epic.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.89 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
documentation.epic.com
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.epic.com 'unsafe-inline' 'unsafe-eval'; connect-src 'self' data: *.epic.com; img-src 'self' data: *.epic.com; frame-src 'self' *.epic.com https://login.microsoftonline.com/; frame-ancestors 'self' *.epic.com *.microsoftonline.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options sameorigin

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-length
909
content-security-policy
default-src 'self' *.epic.com 'unsafe-inline' 'unsafe-eval'; connect-src 'self' data: *.epic.com; img-src 'self' data: *.epic.com; frame-src 'self' *.epic.com https://login.microsoftonline.com/; frame-ancestors 'self' *.epic.com *.microsoftonline.com
content-type
text/html; charset=utf-8
date
Fri, 26 Jan 2024 14:01:54 GMT
elapsedonserver
0
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
x-frame-options
sameorigin
x-ua-compatible
IE=edge
Primary Request /
signin.epic.com/adfs/ls/
386 KB
387 KB
Document
General
Full URL
https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-01-26T14%3a01%3a55Z
Requested by
Host: galaxy.epic.com
URL: https://galaxy.epic.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.180 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
signin.epic.com
Software
/
Resource Hash
d11f6d1431c37f1ee6aa0f308ad9d159838c547fb963a04d052fb98cbdbddd82
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Strict-Transport-Security max-age=20736000; includeSubDomains
X-Frame-Options DENY

Request headers

Referer
https://galaxy.epic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-cache,no-store
Content-Security-Policy
default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Content-Type
text/html; charset=utf-8
Date
Fri, 26 Jan 2024 14:01:55 GMT
Expires
-1
Pragma
no-cache
Strict-Transport-Security
max-age=20736000; includeSubDomains
Transfer-Encoding
chunked
X-Frame-Options
DENY
style.css
signin.epic.com/adfs/portal/css/
15 KB
16 KB
Stylesheet
General
Full URL
https://signin.epic.com/adfs/portal/css/style.css?id=AE9854C44D967C719CB7199E740ABF6BD0A67646DB017359EC1B93D192F0E5E6
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-01-26T14%3a01%3a55Z
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.180 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
signin.epic.com
Software
/
Resource Hash
cd137fab8d79401e166964c034311045aa20a0913844b91ce42381c02caf7f21
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Strict-Transport-Security max-age=20736000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-01-26T14%3a01%3a55Z
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Expires
Sun, 25 Feb 2024 14:01:56 GMT
Content-Security-Policy
default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Date
Fri, 26 Jan 2024 14:01:56 GMT
Strict-Transport-Security
max-age=20736000; includeSubDomains
ETag
AE9854C44D967C719CB7199E740ABF6BD0A67646DB017359EC1B93D192F0E5E6
Transfer-Encoding
chunked
Content-Type
text/css
logo.png
signin.epic.com/adfs/portal/logo/
21 KB
22 KB
Image
General
Full URL
https://signin.epic.com/adfs/portal/logo/logo.png?id=FDD6AF86718ACAAD2DA8DA80CFA51624404EF5B6FF0E7216E135122E79EB55A2
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-01-26T14%3a01%3a55Z
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.180 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
signin.epic.com
Software
/
Resource Hash
fdd6af86718acaad2da8da80cfa51624404ef5b6ff0e7216e135122e79eb55a2
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Strict-Transport-Security max-age=20736000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-01-26T14%3a01%3a55Z
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Expires
Sun, 25 Feb 2024 14:01:56 GMT
Content-Security-Policy
default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Date
Fri, 26 Jan 2024 14:01:56 GMT
Strict-Transport-Security
max-age=20736000; includeSubDomains
ETag
FDD6AF86718ACAAD2DA8DA80CFA51624404EF5B6FF0E7216E135122E79EB55A2
Transfer-Encoding
chunked
Content-Type
image/png
idp.png
signin.epic.com/adfs/portal/images/idp/
931 B
2 KB
Image
General
Full URL
https://signin.epic.com/adfs/portal/images/idp/idp.png?id=3EADD3E829A20DF612C7A77960FF811E66E3EE6BAE2C33C9B20E7478BAC87548
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-01-26T14%3a01%3a55Z
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.180 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
signin.epic.com
Software
/
Resource Hash
3eadd3e829a20df612c7a77960ff811e66e3ee6bae2c33c9b20e7478bac87548
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Strict-Transport-Security max-age=20736000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-01-26T14%3a01%3a55Z
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Expires
Sun, 25 Feb 2024 14:01:56 GMT
Content-Security-Policy
default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Date
Fri, 26 Jan 2024 14:01:56 GMT
Strict-Transport-Security
max-age=20736000; includeSubDomains
ETag
3EADD3E829A20DF612C7A77960FF811E66E3EE6BAE2C33C9B20E7478BAC87548
Transfer-Encoding
chunked
Content-Type
image/png
localsts.png
signin.epic.com/adfs/portal/images/idp/
5 KB
6 KB
Image
General
Full URL
https://signin.epic.com/adfs/portal/images/idp/localsts.png?id=533AA5E31F67D9476F0DF82EAD79366E5976AD030847CC0BBC0721C666348B4C
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-01-26T14%3a01%3a55Z
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.180 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
signin.epic.com
Software
/
Resource Hash
533aa5e31f67d9476f0df82ead79366e5976ad030847cc0bbc0721c666348b4c
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Strict-Transport-Security max-age=20736000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-01-26T14%3a01%3a55Z
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Expires
Sun, 25 Feb 2024 14:01:57 GMT
Content-Security-Policy
default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Date
Fri, 26 Jan 2024 14:01:57 GMT
Strict-Transport-Security
max-age=20736000; includeSubDomains
ETag
533AA5E31F67D9476F0DF82EAD79366E5976AD030847CC0BBC0721C666348B4C
Transfer-Encoding
chunked
Content-Type
image/png
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
44c09a1300a946429d86582c5416de91810a9fe3cf55b31f852510fd0fe01a53

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type
image/png
jquery-1.10.2.min.js
signin.epic.com/adfs/portal/script/
91 KB
92 KB
Script
General
Full URL
https://signin.epic.com/adfs/portal/script/jquery-1.10.2.min.js
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-01-26T14%3a01%3a55Z
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.180 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
signin.epic.com
Software
/
Resource Hash
0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Strict-Transport-Security max-age=20736000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-01-26T14%3a01%3a55Z
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Expires
Sun, 25 Feb 2024 14:01:57 GMT
Content-Security-Policy
default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Date
Fri, 26 Jan 2024 14:01:56 GMT
Strict-Transport-Security
max-age=20736000; includeSubDomains
ETag
0BA081F546084BD5097AA8A73C75931D5AA1FC4D6E846E53C21F98E6A1509988
Transfer-Encoding
chunked
Content-Type
text/javascript
/
userweb.epic.com/Home/Background/
567 KB
568 KB
Image
General
Full URL
https://userweb.epic.com/Home/Background/?date=1.26&time=Day&offset=-1
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-01-26T14%3a01%3a55Z
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.121 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
userweb.epic.com
Software
/
Resource Hash
2591d701c10c14fa7629c4b853dd29d0ffc54ce60af15b669c1a8ebd00f90aaf
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Security-Policy
default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Date
Fri, 26 Jan 2024 14:01:58 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 26 Jan 2024 07:27:51 GMT
Vary
*
Content-Type
image/jpeg
P3P
CP="Not a privacy policy"
Cache-Control
public, max-age=62752
Content-Length
580586
Expires
Fri, 26 Jan 2024 23:00:00 GMT
GetSignInResources
userweb.epic.com/Account/
324 B
1 KB
XHR
General
Full URL
https://userweb.epic.com/Account/GetSignInResources
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-01-26T14%3a01%3a55Z
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.121 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
userweb.epic.com
Software
/
Resource Hash
a228ce242d989f08209c1821be1073da26afcd1d42edbb5407d825299fe8e88b
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Pragma
no-cache
Content-Security-Policy
default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Date
Fri, 26 Jan 2024 14:01:58 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
P3P
CP="Not a privacy policy"
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store
Content-Length
324
Expires
-1
StyleSheet
userweb.epic.com/Customer/
69 KB
20 KB
Stylesheet
General
Full URL
https://userweb.epic.com/Customer/StyleSheet
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/portal/script/jquery-1.10.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.121 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
userweb.epic.com
Software
/
Resource Hash
9223b678e75af54a3c983f72f4fabbf161b93d69bb8dd01f40b076d45f24c076
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Security-Policy
default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Date
Fri, 26 Jan 2024 14:01:58 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 26 Jan 2024 13:23:20 GMT
Vary
*, Accept-Encoding
Content-Type
text/css; charset=utf-8
P3P
CP="Not a privacy policy"
Cache-Control
public, max-age=1281
Connection
Keep-Alive
Content-Length
19721
Expires
Fri, 26 Jan 2024 14:23:20 GMT
GetClaimsProviderIDs
userweb.epic.com/Account/
172 KB
173 KB
XHR
General
Full URL
https://userweb.epic.com/Account/GetClaimsProviderIDs
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-01-26T14%3a01%3a55Z
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.121 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
userweb.epic.com
Software
/
Resource Hash
221052b837d2ef445d617ed9813ea684da2938f49f2cbd3b30bb26861ef12bf9
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Pragma
no-cache
Content-Security-Policy
default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Date
Fri, 26 Jan 2024 14:01:58 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
application/json; charset=utf-8
P3P
CP="Not a privacy policy"
Access-Control-Allow-Origin
https://signin.epic.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Content-Length
176378
Expires
-1
GetNonSSOCustomers
userweb.epic.com/Account/
14 KB
14 KB
XHR
General
Full URL
https://userweb.epic.com/Account/GetNonSSOCustomers
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-01-26T14%3a01%3a55Z
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.121 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
userweb.epic.com
Software
/
Resource Hash
6218ed7422adfec7395580a8c10cace7a069a088c13255a163d8f21136331979
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Pragma
no-cache
Content-Security-Policy
default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Date
Fri, 26 Jan 2024 14:01:58 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
application/json; charset=utf-8
P3P
CP="Not a privacy policy"
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store
Content-Length
13886
Expires
-1
LargeIconSprite
userweb.epic.com/Customer/
2 MB
2 MB
Image
General
Full URL
https://userweb.epic.com/Customer/LargeIconSprite?tg=638418456169276330
Requested by
Host: userweb.epic.com
URL: https://userweb.epic.com/Customer/StyleSheet
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.121 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
userweb.epic.com
Software
/
Resource Hash
e994eaf7362ad900d22e4e6ad9ca7f2f28dfa6c040612af42d0941a7ad760d4d
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://userweb.epic.com/Customer/StyleSheet
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Security-Policy
default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Date
Fri, 26 Jan 2024 14:01:58 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 26 Jan 2024 13:23:32 GMT
Vary
*
Content-Type
image/png
P3P
CP="Not a privacy policy"
Cache-Control
public, max-age=1293
Content-Length
2097152
Expires
Fri, 26 Jan 2024 14:23:32 GMT
localsts.png
signin.epic.com/adfs/portal/images/idp/
5 KB
6 KB
Image
General
Full URL
https://signin.epic.com/adfs/portal/images/idp/localsts.png
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-01-26T14%3a01%3a55Z
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.180 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
signin.epic.com
Software
/
Resource Hash
533aa5e31f67d9476f0df82ead79366e5976ad030847cc0bbc0721c666348b4c
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Strict-Transport-Security max-age=20736000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-01-26T14%3a01%3a55Z
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Expires
Sun, 25 Feb 2024 14:01:59 GMT
Content-Security-Policy
default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Date
Fri, 26 Jan 2024 14:01:59 GMT
Strict-Transport-Security
max-age=20736000; includeSubDomains
ETag
533AA5E31F67D9476F0DF82EAD79366E5976AD030847CC0BBC0721C666348B4C
Transfer-Encoding
chunked
Content-Type
image/png
truncated
/
421 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
837a90288849060834b9ad77f318002e6118973713569accf389a0471a576e72

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type
image/png
EpicOnFHIR-Icon.png
userweb.epic.com/Images/
1 KB
2 KB
Image
General
Full URL
https://userweb.epic.com/Images/EpicOnFHIR-Icon.png
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-01-26T14%3a01%3a55Z
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.121 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
userweb.epic.com
Software
/
Resource Hash
8bf64bb95ea27a909b10e88cd2011004ea7113422a5c6f26e039f2d0be22ab51
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Security-Policy
default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Date
Fri, 26 Jan 2024 14:01:59 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Tue, 06 Apr 2021 23:27:28 GMT
ETag
"302292683c2bd71:0"
P3P
CP="Not a privacy policy"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
1041

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| HRDErrors function| InputUtil function| HRD undefined| emails undefined| msViewportStyle undefined| viewport function| getStyle function| computeLoadIllustration object| UserWeb function| $ function| jQuery

2 Cookies

Domain/Path Name / Value
galaxy.epic.com/ Name: EpicPersistenceCookie
Value: !So4j8QjMUwXB5S7DnBaZuGaSv3+6GPWw3YVkDrlsowqixhjOu5s01BkAomSJpXZxL9XoLctEPF9+ev4=
userweb.epic.com/ Name: EpicPersistenceCookie
Value: !L/EK7zNCs0PeSzTDnBaZuGaSv3+6GK2CgCGZzSmlWsnqRP71vKECSbml6oZL5sscVBPtSuWjhCivaw==

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self' *.epic.com 'unsafe-inline' 'unsafe-eval'; connect-src 'self' data: *.epic.com; img-src 'self' data: *.epic.com; frame-src 'self' *.epic.com https://login.microsoftonline.com/; frame-ancestors 'self' *.epic.com *.microsoftonline.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options sameorigin