login.microsoftonline.com Open in urlscan Pro
2603:1026:3000:150::5 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://prod.beeline.com/carefirst?8442b1a0fc4646769b893b52a936e607
Effective URL:
https://login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/saml2?sso_reload=true
Submission: On April 26 via manual (April 26th 2024, 6:31:57 pm UTC) from US — Scanned from DE

Summary HTTP 44 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 10 IPs in 4 countries across 11 domains to perform 44 HTTP transactions. The main IP is 2603:1026:3000:150::5, located in Amsterdam, Netherlands and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is login.microsoftonline.com. The Cisco Umbrella rank of the primary domain is 10.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on April 4th 2024. Valid for: a year.

This is the only time login.microsoftonline.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3 3	104.16.58.62 104.16.58.62	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.64.145.76 172.64.145.76	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	3.15.167.136 3.15.167.136	16509 (AMAZON-02) (AMAZON-02)
16	18.244.18.49 18.244.18.49	16509 (AMAZON-02) (AMAZON-02)
1	108.138.7.85 108.138.7.85	16509 (AMAZON-02) (AMAZON-02)
3	2603:1026:300... 2603:1026:3000:150::5	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2620:1ec:bdf::45 2620:1ec:bdf::45	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
12	2606:2800:233... 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef	15133 (EDGECAST) (EDGECAST)
1	40.126.32.76 40.126.32.76	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2603:1026:300... 2603:1026:3000:148::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	51.105.71.137 51.105.71.137	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
44	10

3 104.16.58.62 (None, ) 3 redirects

ASN13335 (CLOUDFLARENET, US)

prod.beeline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.64.145.76 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

azure-prd.auth.beeline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 3.15.167.136 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-15-167-136.us-east-2.compute.amazonaws.com

wflogin.carefirst.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 18.244.18.49 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-244-18-49.fra56.r.cloudfront.net

ok10static.oktacdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.7.85 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-7-85.fra56.r.cloudfront.net

login.okta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2603:1026:3000:150::5 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

login.microsoftonline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:bdf::45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
aadcdn.msftauthimages.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef (United States)

ASN15133 (EDGECAST, US)

aadcdn.msftauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 40.126.32.76 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

login.live.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2603:1026:3000:148::10 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

autologon.microsoftazuread-sso.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 51.105.71.137 (London, United Kingdom)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

browser.events.data.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	oktacdn.com ok10static.oktacdn.com — Cisco Umbrella Rank: 24933	1 MB
12	msftauth.net aadcdn.msftauth.net — Cisco Umbrella Rank: 861	335 KB
5	carefirst.com wflogin.carefirst.com	36 KB
4	beeline.com 3 redirects prod.beeline.com — Cisco Umbrella Rank: 96271 azure-prd.auth.beeline.com — Cisco Umbrella Rank: 163007	9 KB
3	microsoftonline.com login.microsoftonline.com — Cisco Umbrella Rank: 10	28 KB
2	microsoft.com browser.events.data.microsoft.com — Cisco Umbrella Rank: 111	766 B
1	microsoftazuread-sso.com autologon.microsoftazuread-sso.com — Cisco Umbrella Rank: 1297	1 KB
1	msftauthimages.net aadcdn.msftauthimages.net — Cisco Umbrella Rank: 3293	7 KB
1	live.com login.live.com — Cisco Umbrella Rank: 78
1	msauth.net aadcdn.msauth.net — Cisco Umbrella Rank: 841	49 KB
1	okta.com login.okta.com — Cisco Umbrella Rank: 4026
44	11

	Domain	Requested by
16	ok10static.oktacdn.com	wflogin.carefirst.com ok10static.oktacdn.com
12	aadcdn.msftauth.net	login.microsoftonline.com aadcdn.msftauth.net
5	wflogin.carefirst.com	wflogin.carefirst.com ok10static.oktacdn.com
3	login.microsoftonline.com	aadcdn.msftauth.net
3	prod.beeline.com	3 redirects
2	browser.events.data.microsoft.com	aadcdn.msftauth.net
1	autologon.microsoftazuread-sso.com
1	aadcdn.msftauthimages.net
1	login.live.com	login.microsoftonline.com
1	aadcdn.msauth.net	login.microsoftonline.com
1	login.okta.com	ok10static.oktacdn.com
1	azure-prd.auth.beeline.com
44	12

This site contains links to these domains. Also see Links.

Domain
www.microsoft.com
privacy.microsoft.com

Subject Issuer	Validity	Valid
auth.beeline.com E1	`2024-03-05` - `2024-06-03`	3 months	crt.sh
wflogin.carefirst.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-14` - `2024-07-16`	a year	crt.sh
*.oktacdn.com DigiCert TLS RSA SHA256 2020 CA1	`2023-12-15` - `2025-01-02`	a year	crt.sh
accounts.okta.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-19` - `2024-07-24`	a year	crt.sh
stamp2.login.microsoftonline.com DigiCert SHA2 Secure Server CA	`2024-04-04` - `2025-04-04`	a year	crt.sh
aadcdn.msauth.net DigiCert SHA2 Secure Server CA	`2024-01-29` - `2025-01-29`	a year	crt.sh
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA	`2023-12-01` - `2024-12-01`	a year	crt.sh
login.live.com DigiCert SHA2 Secure Server CA	`2024-02-13` - `2025-02-13`	a year	crt.sh
aadcdn.msftauthimages.net Microsoft Azure RSA TLS Issuing CA 07	`2024-02-18` - `2025-02-12`	a year	crt.sh
autologon.microsoftazuread-sso.com DigiCert SHA2 Secure Server CA	`2024-02-13` - `2025-02-13`	a year	crt.sh
*.events.data.microsoft.com Microsoft Azure RSA TLS Issuing CA 08	`2024-03-17` - `2025-03-12`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/saml2?sso_reload=true
Frame ID: B58E972F30A18A35526F5A3806E7EBC0
Requests: 42 HTTP requests in this frame

Frame: https://login.okta.com/discovery/iframe.html
Frame ID: 094174BB849FBDACCF03893F12517D28
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Bei Ihrem Konto anmelden

Page URL History Show full URLs

https://prod.beeline.com/carefirst?8442b1a0fc4646769b893b52a936e607 HTTP 301
https://prod.beeline.com/carefirst/?8442b1a0fc4646769b893b52a936e607 HTTP 302
https://prod.beeline.com/carefirst/n.ashx?ni=8442b1a0-fc46-4676-9b89-3b52a936e607 HTTP 302
https://azure-prd.auth.beeline.com/authorize?client_id=jEPWv6qkw9uidwb4UucVhWhAdbOQWP0R&scope=openid%20email%20... Page URL
https://wflogin.carefirst.com/app/carefirst_beeline_1/exk148qtanLOFfse94h7/sso/saml Page URL
https://wflogin.carefirst.com/sso/idps/0oajybe54Ftgwy9ua4h6?stateTokenExternalId=bEtsL2NjL1RGbkNRWGh6MndDR... Page URL
https://login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/saml2 Page URL
https://login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/saml2?sso_reload=true Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

44
Requests

100 %
HTTPS

36 %
IPv6

11
Domains

12
Subdomains

10
IPs

4
Countries

1515 kB
Transfer

4224 kB
Size

30
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.microsoft.com/de-DE/servicesagreement/
Title: Nutzungsbedingungen

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/de-DE/privacystatement
Title: Datenschutz und Cookies

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/de-de/corporate/rechtliche-hinweise/impressum.aspx
Title: Haftungsausschluss

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://prod.beeline.com/carefirst?8442b1a0fc4646769b893b52a936e607 HTTP 301
https://prod.beeline.com/carefirst/?8442b1a0fc4646769b893b52a936e607 HTTP 302
https://prod.beeline.com/carefirst/n.ashx?ni=8442b1a0-fc46-4676-9b89-3b52a936e607 HTTP 302
https://azure-prd.auth.beeline.com/authorize?client_id=jEPWv6qkw9uidwb4UucVhWhAdbOQWP0R&scope=openid%20email%20offline_access%20talent%3Aprofile%3Aread%20esignature%3Asettings%3Awrite&audience=https%3A%2F%2Fcws-apis.beeline.com&response_type=code&redirect_uri=https%3A%2F%2Fprod.beeline.com%2Fcarefirst%2Fsecurity%2Fauth0%2Fauth0callbackhandler.ashx&connection=CareFirst-SSO Page URL
https://wflogin.carefirst.com/app/carefirst_beeline_1/exk148qtanLOFfse94h7/sso/saml Page URL
https://wflogin.carefirst.com/sso/idps/0oajybe54Ftgwy9ua4h6?stateTokenExternalId=bEtsL2NjL1RGbkNRWGh6MndDRVNlWXM3STQ5bmxXdzdjcDJDZTlDSE5FMEhra1Fyeml0enBQZ201T3NPVXpBUw Page URL
https://login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/saml2 Page URL
https://login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/saml2?sso_reload=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://prod.beeline.com/carefirst?8442b1a0fc4646769b893b52a936e607 HTTP 301
https://prod.beeline.com/carefirst/?8442b1a0fc4646769b893b52a936e607 HTTP 302
https://prod.beeline.com/carefirst/n.ashx?ni=8442b1a0-fc46-4676-9b89-3b52a936e607 HTTP 302
https://azure-prd.auth.beeline.com/authorize?client_id=jEPWv6qkw9uidwb4UucVhWhAdbOQWP0R&scope=openid%20email%20offline_access%20talent%3Aprofile%3Aread%20esignature%3Asettings%3Awrite&audience=https%3A%2F%2Fcws-apis.beeline.com&response_type=code&redirect_uri=https%3A%2F%2Fprod.beeline.com%2Fcarefirst%2Fsecurity%2Fauth0%2Fauth0callbackhandler.ashx&connection=CareFirst-SSO

44 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

authorize Show response
azure-prd.auth.beeline.com/
Redirect Chain

https://prod.beeline.com/carefirst?8442b1a0fc4646769b893b52a936e607
https://prod.beeline.com/carefirst/?8442b1a0fc4646769b893b52a936e607
https://prod.beeline.com/carefirst/n.ashx?ni=8442b1a0-fc46-4676-9b89-3b52a936e607
https://azure-prd.auth.beeline.com/authorize?client_id=jEPWv6qkw9uidwb4UucVhWhAdbOQWP0R&scope=openid%20email%20offline_access%20talent%3Aprofile%3Aread%20esignature%3Asettings%3Awrite&audience=http...

4 KB
5 KB

579ms
309ms

Document
text/html

172.64.145.76
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://azure-prd.auth.beeline.com/authorize?client_id=jEPWv6qkw9uidwb4UucVhWhAdbOQWP0R&scope=openid%20email%20offline_access%20talent%3Aprofile%3Aread%20esignature%3Asettings%3Awrite&audience=https%3A%2F%2Fcws-apis.beeline.com&response_type=code&redirect_uri=https%3A%2F%2Fprod.beeline.com%2Fcarefirst%2Fsecurity%2Fauth0%2Fauth0callbackhandler.ashx&connection=CareFirst-SSO

Protocol

Security

QUIC, , AES_128_GCM

Server

172.64.145.76 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

85ae625f47bf6724036cdb0ecff096d7f684593896a067a5525a612f9b2b461c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, max-age=0, no-transform
cf-cache-status: DYNAMIC
cf-ray: 87a8a6ef186418da-FRA
content-type: text/html; charset=utf-8
date: Fri, 26 Apr 2024 18:31:51 GMT
etag: W/"102b-4agkaaAbnwS6D1upWYGsHwE07WI"
pragma: no-cache
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-auth0-requestid: 9ac4999227edd2672f4d
x-content-type-options: nosniff
x-ratelimit-limit: 500
x-ratelimit-remaining: 499
x-ratelimit-reset: 1714156312

Redirect headers

CF-Cache-Status: DYNAMIC
CF-RAY: 87a8a6ec18cf6acc-FRA
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Date: Fri, 26 Apr 2024 18:31:50 GMT
Server: cloudflare
Transfer-Encoding: chunked
cache-control: no-cache
content-security-policy: frame-ancestors *.beeline.com *.iqnavigator.com *.iqnavigator.eu *.beeline.to *.beelinetowork.io beeline.to beelinetowork.io;default-src 'none';object-src 'none';connect-src 'self' *.beeline.com *.walkme.com *.iqnavigator.com *.algolia.net *.algolianet.com;font-src 'self' data: *.beeline.com *.walkme.com *.iqnavigator.com *.algolia.net *.algolianet.com;frame-src 'self' *.beeline.com *.walkme.com *.iqnavigator.com *.algolia.net *.algolianet.com;img-src 'self' *.beeline.com *.walkme.com *.iqnavigator.com *.algolia.net *.algolianet.com;script-src 'self' 'unsafe-inline' 'unsafe-eval' *.beeline.com *.walkme.com *.iqnavigator.com *.algolia.net *.algolianet.com;style-src 'self' 'unsafe-inline' *.beeline.com *.walkme.com *.iqnavigator.com *.algolia.net *.algolianet.com;
expires: -1
location: https://azure-prd.auth.beeline.com/authorize?client_id=jEPWv6qkw9uidwb4UucVhWhAdbOQWP0R&scope=openid%20email%20offline_access%20talent%3Aprofile%3Aread%20esignature%3Asettings%3Awrite&audience=https%3A%2F%2Fcws-apis.beeline.com&response_type=code&redirect_uri=https%3A%2F%2Fprod.beeline.com%2Fcarefirst%2Fsecurity%2Fauth0%2Fauth0callbackhandler.ashx&connection=CareFirst-SSO
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000
totalserverpagetime: 65
x-content-type-options: nosniff
x-ua-compatible: IE=edge
x-xss-protection: 1

POST
H/1.1 200
OK saml Show response
wflogin.carefirst.com/app/carefirst_beeline_1/exk148qtanLOFfse94h7/sso/ 18 KB
11 KB 573ms
316ms Document
text/html 3.15.167.136
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://wflogin.carefirst.com/app/carefirst_beeline_1/exk148qtanLOFfse94h7/sso/saml

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.15.167.136 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-15-167-136.us-east-2.compute.amazonaws.com

Software

nginx /

Resource Hash

f6216505350125a44d0b325743d7af4d397369181b205814c7639aa8c7e1ca91

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' carefirst.okta.com wflogin.carefirst.com .oktacdn.com; connect-src 'self' carefirst.okta.com carefirst-admin.okta.com wflogin.carefirst.com .oktacdn.com .mixpanel.com .mapbox.com .mtls.okta.com carefirst.kerberos.okta.com .authenticatorlocalprod.com:8769 http://localhost:8769 http://127.0.0.1:8769 .authenticatorlocalprod.com:65111 http://localhost:65111 http://127.0.0.1:65111 .authenticatorlocalprod.com:65121 http://localhost:65121 http://127.0.0.1:65121 .authenticatorlocalprod.com:65131 http://localhost:65131 http://127.0.0.1:65131 .authenticatorlocalprod.com:65141 http://localhost:65141 http://127.0.0.1:65141 .authenticatorlocalprod.com:65151 http://localhost:65151 http://127.0.0.1:65151 https://oinmanager.okta.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; script-src 'unsafe-inline' 'unsafe-eval' 'self' carefirst.okta.com wflogin.carefirst.com .oktacdn.com; style-src 'unsafe-inline' 'self' carefirst.okta.com wflogin.carefirst.com .oktacdn.com; frame-src 'self' carefirst.okta.com carefirst-admin.okta.com wflogin.carefirst.com login.okta.com com-okta-authenticator:; img-src 'self' carefirst.okta.com wflogin.carefirst.com .oktacdn.com .tiles.mapbox.com .mapbox.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com blob:; font-src 'self' carefirst.okta.com wflogin.carefirst.com data: *.oktacdn.com fonts.gstatic.com
Strict-Transport-Security	max-age=315360000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Content-Type: application/x-www-form-urlencoded
Origin: https://azure-prd.auth.beeline.com
Referer: https://azure-prd.auth.beeline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=utf-8
Date: Fri, 26 Apr 2024 18:31:51 GMT
Keep-Alive: timeout=5, max=100
Server: nginx
Strict-Transport-Security: max-age=315360000; includeSubDomains
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Robots-Tag: noindex,nofollow
accept-ch: Sec-CH-UA-Platform-Version
cache-control: no-cache, no-store
content-language: de
content-security-policy: default-src 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com; connect-src 'self' carefirst.okta.com carefirst-admin.okta.com wflogin.carefirst.com *.oktacdn.com *.mixpanel.com *.mapbox.com *.mtls.okta.com carefirst.kerberos.okta.com *.authenticatorlocalprod.com:8769 http://localhost:8769 http://127.0.0.1:8769 *.authenticatorlocalprod.com:65111 http://localhost:65111 http://127.0.0.1:65111 *.authenticatorlocalprod.com:65121 http://localhost:65121 http://127.0.0.1:65121 *.authenticatorlocalprod.com:65131 http://localhost:65131 http://127.0.0.1:65131 *.authenticatorlocalprod.com:65141 http://localhost:65141 http://127.0.0.1:65141 *.authenticatorlocalprod.com:65151 http://localhost:65151 http://127.0.0.1:65151 https://oinmanager.okta.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; script-src 'unsafe-inline' 'unsafe-eval' 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com; style-src 'unsafe-inline' 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com; frame-src 'self' carefirst.okta.com carefirst-admin.okta.com wflogin.carefirst.com login.okta.com com-okta-authenticator:; img-src 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com *.tiles.mapbox.com *.mapbox.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com blob:; font-src 'self' carefirst.okta.com wflogin.carefirst.com data: *.oktacdn.com fonts.gstatic.com
content-security-policy-report-only: default-src 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com; connect-src 'self' carefirst.okta.com carefirst-admin.okta.com wflogin.carefirst.com *.oktacdn.com *.mixpanel.com *.mapbox.com *.mtls.okta.com carefirst.kerberos.okta.com *.authenticatorlocalprod.com:8769 http://localhost:8769 http://127.0.0.1:8769 *.authenticatorlocalprod.com:65111 http://localhost:65111 http://127.0.0.1:65111 *.authenticatorlocalprod.com:65121 http://localhost:65121 http://127.0.0.1:65121 *.authenticatorlocalprod.com:65131 http://localhost:65131 http://127.0.0.1:65131 *.authenticatorlocalprod.com:65141 http://localhost:65141 http://127.0.0.1:65141 *.authenticatorlocalprod.com:65151 http://localhost:65151 http://127.0.0.1:65151 https://oinmanager.okta.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; script-src 'unsafe-inline' 'unsafe-eval' 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com; style-src 'unsafe-inline' 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com; frame-src 'self' carefirst.okta.com carefirst-admin.okta.com wflogin.carefirst.com login.okta.com com-okta-authenticator:; img-src 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com *.tiles.mapbox.com *.mapbox.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com blob:; font-src 'self' carefirst.okta.com wflogin.carefirst.com data: *.oktacdn.com fonts.gstatic.com; frame-ancestors 'self'
expires: 0
p3p: CP="HONK"
pragma: no-cache
x-content-type-options: nosniff
x-okta-request-id: ZivzF56m03E3CyPi0tvhgQAAC6s
x-rate-limit-limit: 60
x-rate-limit-remaining: 59
x-rate-limit-reset: 1714156371
x-ua-compatible: IE=edge
x-xss-protection: 0

GET
H2 200 okta-sign-in.min.js Show response
ok10static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.17.1/js/ 2 MB
483 KB 56ms
13ms Script
application/javascript 18.244.18.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ok10static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.17.1/js/okta-sign-in.min.js

Requested by

Host: wflogin.carefirst.com
URL: https://wflogin.carefirst.com/app/carefirst_beeline_1/exk148qtanLOFfse94h7/sso/saml

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.244.18.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-244-18-49.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

106fda5aa319c1c673704511ebfdb4ef376d05a04a0756f5fc7436e111b6f3f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://wflogin.carefirst.com/
Origin: https://wflogin.carefirst.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 19:30:47 GMT
x-amz-meta-sha1sum: 564824d43974ca071cff4ea7db070a933279ccba
content-encoding: gzip
strict-transport-security: max-age=315360000; includeSubDomains
via: 1.1 39cfa117a3536e9c0afd90708900b558.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P11
age: 860464
x-cache: Hit from cloudfront
last-modified: Tue, 16 Apr 2024 18:56:56 GMT
server: nginx
etag: W/"05c3609bdb7673c6a09964f34933608d"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
x-amz-cf-id: cyW_-x-bMiPWdyFSCOzMqYrHNJsOJXJl-dGKEdkETTnsI-jfpV0BSg==
expires: Wed, 16 Apr 2025 19:30:47 GMT

GET
H2 200 okta-sign-in.min.css
ok10static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.17.1/css/ 217 KB
37 KB 53ms
10ms Stylesheet
text/css 18.244.18.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ok10static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.17.1/css/okta-sign-in.min.css

Requested by

Host: wflogin.carefirst.com
URL: https://wflogin.carefirst.com/app/carefirst_beeline_1/exk148qtanLOFfse94h7/sso/saml

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.244.18.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-244-18-49.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

19714eaf0cbf6de9f909794bddca2470bf498dc53b02f50947a5e89476251fde

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://wflogin.carefirst.com/
Origin: https://wflogin.carefirst.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 19:30:48 GMT
x-amz-meta-sha1sum: 4cfa8d8c88cf536e49e478565a2da853267beb22
content-encoding: gzip
strict-transport-security: max-age=315360000; includeSubDomains
via: 1.1 39cfa117a3536e9c0afd90708900b558.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P11
age: 860463
x-cache: Hit from cloudfront
last-modified: Tue, 16 Apr 2024 18:56:08 GMT
server: nginx
etag: W/"14a902da0701755f1c3dc816ee428221"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
x-amz-cf-id: cxnBAz8QmY4o7wxIVbGIVdW_17sdl0DJ8LWZ6uThG_-ZC7f6_soqkQ==
expires: Wed, 16 Apr 2025 19:30:48 GMT

GET
H2 200 loginpage-theme.e0d37a504604ef874bad26435d62011f.css
ok10static.oktacdn.com/assets/loginpage/css/ 10 KB
3 KB 51ms
8ms Stylesheet
text/css 18.244.18.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ok10static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css

Requested by

Host: wflogin.carefirst.com
URL: https://wflogin.carefirst.com/app/carefirst_beeline_1/exk148qtanLOFfse94h7/sso/saml

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.244.18.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-244-18-49.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

c39ff65e2a102e644eb0bf2e31d2bad3d18f7afb25b3b9ba7a4d46263a711179

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://wflogin.carefirst.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-meta-sha1sum: 4301f0d2b729ae22adece657d79eccaa25f429b1
strict-transport-security: max-age=315360000; includeSubDomains
content-encoding: gzip
date: Thu, 25 Apr 2024 21:47:37 GMT
via: 1.1 354c49ee216d1b8ed995ee7b94d96f10.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P11
age: 74664
x-cache: Hit from cloudfront
last-modified: Wed, 13 Mar 2024 18:16:11 GMT
server: nginx
etag: W/"e0d37a504604ef874bad26435d62011f"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
x-amz-cf-id: wI73ezpuM1LrOHkXooXuDbjNxX0YiHKGRubiGX4gNPGeri83xcWxxA==
expires: Fri, 25 Apr 2025 21:47:27 GMT

GET
H/1.1 200
OK style-sheet
wflogin.carefirst.com/api/internal/brand/theme/ 556 B
3 KB 126ms
126ms Stylesheet
text/css 3.15.167.136
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://wflogin.carefirst.com/api/internal/brand/theme/style-sheet?touch-point=SIGN_IN_PAGE&v=abc4780733b2999dc5536ea4bf18a7237d32beafe91e2f7611b8af3ecb8ae0d0dfb208992a3b1ecefd0c0f9333f4b59d

Requested by

Host: wflogin.carefirst.com
URL: https://wflogin.carefirst.com/app/carefirst_beeline_1/exk148qtanLOFfse94h7/sso/saml

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.15.167.136 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-15-167-136.us-east-2.compute.amazonaws.com

Software

nginx /

Resource Hash

9af30b5e4695010f9be253f861784e638c81274ca0390214629886029ca9b509

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform-version: "10.0.0"
Referer: https://wflogin.carefirst.com/app/carefirst_beeline_1/exk148qtanLOFfse94h7/sso/saml
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-okta-request-id: ZivzF56m03E3CyPi0tvhhwAAC6s
Date: Fri, 26 Apr 2024 18:31:51 GMT
Strict-Transport-Security: max-age=315360000; includeSubDomains
x-rate-limit-limit: 12000
x-content-type-options: nosniff
Content-Encoding: gzip
x-rate-limit-remaining: 11986
content-security-policy-report-only: default-src 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com; connect-src 'self' carefirst.okta.com carefirst-admin.okta.com wflogin.carefirst.com *.oktacdn.com *.mixpanel.com *.mapbox.com *.mtls.okta.com carefirst.kerberos.okta.com *.authenticatorlocalprod.com:8769 http://localhost:8769 http://127.0.0.1:8769 *.authenticatorlocalprod.com:65111 http://localhost:65111 http://127.0.0.1:65111 *.authenticatorlocalprod.com:65121 http://localhost:65121 http://127.0.0.1:65121 *.authenticatorlocalprod.com:65131 http://localhost:65131 http://127.0.0.1:65131 *.authenticatorlocalprod.com:65141 http://localhost:65141 http://127.0.0.1:65141 *.authenticatorlocalprod.com:65151 http://localhost:65151 http://127.0.0.1:65151 https://oinmanager.okta.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; script-src 'unsafe-inline' 'unsafe-eval' 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com; style-src 'unsafe-inline' 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com; frame-src 'self' carefirst.okta.com carefirst-admin.okta.com wflogin.carefirst.com login.okta.com com-okta-authenticator:; img-src 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com *.tiles.mapbox.com *.mapbox.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com blob:; font-src 'self' carefirst.okta.com wflogin.carefirst.com data: *.oktacdn.com fonts.gstatic.com; frame-ancestors 'self'
Transfer-Encoding: chunked
p3p: CP="HONK"
Connection: Keep-Alive
x-xss-protection: 0
Server: nginx
accept-ch: Sec-CH-UA-Platform-Version
Vary: Accept-Encoding
Content-Type: text/css
x-rate-limit-reset: 1714156314
cache-control: max-age=31536000, must-revalidate
Keep-Alive: timeout=5, max=99
expires: Sat, 26 Apr 2025 18:31:51 GMT

GET
H2 200 default.6770228fb0dab49a1695ef440a5279bb.png
ok10static.oktacdn.com/assets/img/logos/ 2 KB
2 KB 50ms
7ms Image
image/png 18.244.18.49
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ok10static.oktacdn.com/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png

Requested by

Host: wflogin.carefirst.com
URL: https://wflogin.carefirst.com/app/carefirst_beeline_1/exk148qtanLOFfse94h7/sso/saml

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.244.18.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-244-18-49.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

9ce729df778fbee5e9bb0b6cde926b2e5c19c87ebd301e10eeaabab0d3d89c66

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://wflogin.carefirst.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=315360000; includeSubDomains
date: Sun, 07 Apr 2024 04:51:19 GMT
via: 1.1 354c49ee216d1b8ed995ee7b94d96f10.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P11
age: 1690832
x-cache: Hit from cloudfront
content-length: 1632
last-modified: Tue, 20 Aug 2019 20:04:21 GMT
server: nginx
etag: "6770228fb0dab49a1695ef440a5279bb"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
accept-ranges: bytes
x-amz-cf-id: jQttmTt3DZDmC21gN5jwzApB-SeAk-uXpjh_lzPt9k64JKbivTqYnQ==
expires: Mon, 07 Apr 2025 04:51:19 GMT

GET
H2 200 fs04kpd12dDb9whit4h7
ok10static.oktacdn.com/fs/bco/1/ 4 KB
5 KB 51ms
9ms Image
image/png 18.244.18.49
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ok10static.oktacdn.com/fs/bco/1/fs04kpd12dDb9whit4h7

Requested by

Host: wflogin.carefirst.com
URL: https://wflogin.carefirst.com/app/carefirst_beeline_1/exk148qtanLOFfse94h7/sso/saml

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.244.18.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-244-18-49.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

ce55b94f10a3895ae05730df746a031ce303b03ce563274aada9f4a5e04a0b18

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://wflogin.carefirst.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 22 Apr 2024 14:25:45 GMT
strict-transport-security: max-age=315360000; includeSubDomains
via: 1.1 354c49ee216d1b8ed995ee7b94d96f10.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P11
age: 360366
x-cache: Hit from cloudfront
content-length: 4512
last-modified: Wed, 21 Jun 2023 21:01:58 GMT
server: nginx
etag: "88114d41bec5e6507ef83ade5ecee391"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
accept-ranges: bytes
x-amz-cf-id: drZsBJpM-OFNMaFSC4IyUCCaFQI-iEkMtepNeUrcymWERsyMEkybeg==
expires: Tue, 22 Apr 2025 14:25:45 GMT

GET
H2 200 initLoginPage.pack.58de3be0c9b511a0fdfd7ea4f69b56fc.js Show response
ok10static.oktacdn.com/assets/js/mvc/loginpage/ 204 KB
76 KB 8ms
8ms Script
application/javascript 18.244.18.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ok10static.oktacdn.com/assets/js/mvc/loginpage/initLoginPage.pack.58de3be0c9b511a0fdfd7ea4f69b56fc.js

Requested by

Host: wflogin.carefirst.com
URL: https://wflogin.carefirst.com/app/carefirst_beeline_1/exk148qtanLOFfse94h7/sso/saml

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.244.18.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-244-18-49.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

6a6c595fcf3a6c74bf3509f160ba34b78a8a3eb92ecaf290412c46679576d3ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://wflogin.carefirst.com/
Origin: https://wflogin.carefirst.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 07 Apr 2024 19:24:11 GMT
x-amz-meta-sha1sum: 91eca02abf11239ec4af7a30b1da6e2610f1b9a6
content-encoding: gzip
strict-transport-security: max-age=315360000; includeSubDomains
via: 1.1 39cfa117a3536e9c0afd90708900b558.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P11
age: 1638460
x-cache: Hit from cloudfront
last-modified: Tue, 07 Nov 2023 18:57:13 GMT
server: nginx
etag: W/"58de3be0c9b511a0fdfd7ea4f69b56fc"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
x-amz-cf-id: fmc3sZFK_1ljSmsSI09WW_Tc40yGwlRtJrtHfGw4cwrY2a8DjuFtpA==
expires: Mon, 07 Apr 2025 19:24:11 GMT

GET
H2 200 proximanova-light-webfont.aba797dabec6686294a9.woff2
ok10static.oktacdn.com/assets/loginpage/font/assets/ 20 KB
20 KB 8ms
7ms Font
application/font-woff2 18.244.18.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ok10static.oktacdn.com/assets/loginpage/font/assets/proximanova-light-webfont.aba797dabec6686294a9.woff2

Requested by

Host: ok10static.oktacdn.com
URL: https://ok10static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.244.18.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-244-18-49.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

018930498a4b01e598099a6e45d7316d54c7b1411ce2b741a3b1f1b0ed4e578b

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://ok10static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css
Origin: https://wflogin.carefirst.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-meta-sha1sum: 28b8b4bd234dde07b7ee63a6d32c6f275f03eca1
strict-transport-security: max-age=315360000; includeSubDomains
via: 1.1 39cfa117a3536e9c0afd90708900b558.cloudfront.net (CloudFront)
date: Fri, 19 Apr 2024 06:42:09 GMT
x-amz-cf-pop: FRA56-P11
age: 1740136
x-cache: Hit from cloudfront
content-length: 20052
last-modified: Tue, 07 Nov 2023 18:57:12 GMT
server: nginx
etag: "3bf194f33d52c87ea38f13e04fd41950"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
accept-ranges: bytes
x-amz-cf-id: 4QqjlHoN8A75rCh0dQ-vy4FscEaVihDkxKnP1F22CaPdgZe0KGfPjA==
expires: Sun, 06 Apr 2025 15:09:35 GMT

GET
H2 200 proximanova-reg-webfont.353416ed0ff540352235.woff2
ok10static.oktacdn.com/assets/loginpage/font/assets/ 20 KB
20 KB 9ms
8ms Font
application/font-woff2 18.244.18.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ok10static.oktacdn.com/assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2

Requested by

Host: ok10static.oktacdn.com
URL: https://ok10static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.244.18.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-244-18-49.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

affdba1620552b12a1a8a04467136aeb408c03fa337d20e9c38374d682d4d149

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://ok10static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css
Origin: https://wflogin.carefirst.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 07 Apr 2024 11:18:29 GMT
x-amz-meta-sha1sum: 2b5fcd8431953c44e410d0489899e74f6d2cfecc
via: 1.1 39cfa117a3536e9c0afd90708900b558.cloudfront.net (CloudFront)
strict-transport-security: max-age=315360000; includeSubDomains
x-amz-cf-pop: FRA56-P11
age: 1667602
x-cache: Hit from cloudfront
content-length: 20416
last-modified: Tue, 07 Nov 2023 18:55:45 GMT
server: nginx
etag: "d99a7377dabb55772ca9f986b0a04b57"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
accept-ranges: bytes
x-amz-cf-id: Jl3XNFXR7dJkl_8AJvTpZGLwuYSPUJWlX04Lgk9wRQMeOcel_pE67g==
expires: Mon, 07 Apr 2025 11:18:29 GMT

GET
H/1.1 200
OK iframe.html
login.okta.com/discovery/ Frame 0941 0
0 49ms
6ms Document
text/html 108.138.7.85
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://login.okta.com/discovery/iframe.html

Requested by

Host: ok10static.oktacdn.com
URL: https://ok10static.oktacdn.com/assets/js/mvc/loginpage/initLoginPage.pack.58de3be0c9b511a0fdfd7ea4f69b56fc.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

108.138.7.85 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-85.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://wflogin.carefirst.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Age: 56120
Connection: keep-alive
Content-Length: 451
Content-Type: text/html
Date: Fri, 26 Apr 2024 02:56:33 GMT
ETag: "cb4083f71191b66321c4e0310d0383ab"
Last-Modified: Mon, 25 Mar 2024 16:51:14 GMT
Server: AmazonS3
Strict-Transport-Security: max-age=31536000; includeSubDomains
Via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
X-Amz-Cf-Id: RdvAz1hZlNZhO0OjB8Z5QYOkNOLSxH2msmGKlWcwRUCe9QVAAfkDew==
X-Amz-Cf-Pop: FRA56-P6
X-Cache: Hit from cloudfront

GET
H2 200 login_de.json Show response
ok10static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.17.1/labels/json/ 114 KB
115 KB 8ms
8ms XHR
application/json 18.244.18.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ok10static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.17.1/labels/json/login_de.json

Requested by

Host: ok10static.oktacdn.com
URL: https://ok10static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.17.1/js/okta-sign-in.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.244.18.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-244-18-49.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

c72d18b9c0efac5a6844a75651a7ab5163152cf5e371e4cff8750b447dec9e98

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
content-type: text/plain
accept: application/json
Referer: https://wflogin.carefirst.com/
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 20:00:48 GMT
x-amz-meta-sha1sum: 3b77d149eee503d29a2cc275a2da551ea2e6289c
via: 1.1 39cfa117a3536e9c0afd90708900b558.cloudfront.net (CloudFront)
strict-transport-security: max-age=315360000; includeSubDomains
x-amz-cf-pop: FRA56-P11
age: 858664
x-cache: Hit from cloudfront
content-length: 117214
last-modified: Tue, 16 Apr 2024 18:57:01 GMT
server: nginx
etag: "d80a0c3392392948c28563c965b793c9"
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
accept-ranges: bytes
x-amz-cf-id: HF3I5hCYGM9h_On6YJI-cwcha21Vv6GsyK12uDoA82YKdG-uDonPfA==
expires: Wed, 16 Apr 2025 20:00:48 GMT

GET
H2 200 country_de.json Show response
ok10static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.17.1/labels/json/ 5 KB
5 KB 8ms
7ms XHR
application/json 18.244.18.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ok10static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.17.1/labels/json/country_de.json

Requested by

Host: ok10static.oktacdn.com
URL: https://ok10static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.17.1/js/okta-sign-in.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.244.18.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-244-18-49.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

e540549c5ee85d139a6590536daf86400fccd811ebc9d5b714794efe1e34b897

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
content-type: text/plain
accept: application/json
Referer: https://wflogin.carefirst.com/
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 20:00:48 GMT
x-amz-meta-sha1sum: 251dd1ccca4c80570aee52db71eed703ac579ad8
via: 1.1 39cfa117a3536e9c0afd90708900b558.cloudfront.net (CloudFront)
strict-transport-security: max-age=315360000; includeSubDomains
x-amz-cf-pop: FRA56-P11
age: 858664
x-cache: Hit from cloudfront
content-length: 4805
last-modified: Tue, 16 Apr 2024 18:57:00 GMT
server: nginx
etag: "51bec6463b4f7c5a26ede1fd8ee067f8"
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
accept-ranges: bytes
x-amz-cf-id: w77GSewA94blChXcOnu7xkVlsmqxunfDoCkyK6885-VbNORXSJVHtg==
expires: Wed, 16 Apr 2025 20:00:48 GMT

GET
H/1.1 200
OK favicon.ico
wflogin.carefirst.com/ 5 KB
6 KB 108ms
108ms Other
image/x-icon 3.15.167.136
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://wflogin.carefirst.com/favicon.ico

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.15.167.136 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-15-167-136.us-east-2.compute.amazonaws.com

Software

nginx /

Resource Hash

f9e86fb363a05f75ab3b525439d46bf4911d4cd4ae94c656c0198206374002aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform-version: "10.0.0"
Referer: https://wflogin.carefirst.com/app/carefirst_beeline_1/exk148qtanLOFfse94h7/sso/saml
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 26 Apr 2024 18:31:52 GMT
Strict-Transport-Security: max-age=315360000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 19 Apr 2024 19:43:02 GMT
Server: nginx
etag: W/"5430-1713555782000"
Content-Type: image/x-icon
Connection: Keep-Alive
accept-ranges: bytes
X-Robots-Tag: noindex,nofollow
Keep-Alive: timeout=5, max=98
Content-Length: 5430

POST
H/1.1 200
OK introspect Show response
wflogin.carefirst.com/idp/idx/ 1 KB
3 KB 282ms
186ms Fetch
application/ion+json 3.15.167.136
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://wflogin.carefirst.com/idp/idx/introspect

Requested by

Host: ok10static.oktacdn.com
URL: https://ok10static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.17.1/js/okta-sign-in.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.15.167.136 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-15-167-136.us-east-2.compute.amazonaws.com

Software

nginx /

Resource Hash

d2d93f48c153295d93aff135dd9c5153e19c8f8c6cc24f46d4d3f69c7d23110f

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
X-Okta-User-Agent-Extended: okta-auth-js/7.0.1 okta-signin-widget-7.17.1
Accept-Language: de
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/ion+json; okta-version=1.0.0
Accept: application/ion+json; okta-version=1.0.0
sec-ch-ua-platform-version: "10.0.0"
Referer: https://wflogin.carefirst.com/app/carefirst_beeline_1/exk148qtanLOFfse94h7/sso/saml
sec-ch-ua-platform: "Win32"

Response headers

x-okta-request-id: ZivzGJ6m03E3CyPi0tvhiwAAC6s
Date: Fri, 26 Apr 2024 18:31:52 GMT
Strict-Transport-Security: max-age=315360000; includeSubDomains
x-rate-limit-limit: 10000
x-content-type-options: nosniff
x-rate-limit-remaining: 9941
content-security-policy-report-only: default-src 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com; connect-src 'self' carefirst.okta.com carefirst-admin.okta.com wflogin.carefirst.com *.oktacdn.com *.mixpanel.com *.mapbox.com *.mtls.okta.com carefirst.kerberos.okta.com *.authenticatorlocalprod.com:8769 http://localhost:8769 http://127.0.0.1:8769 *.authenticatorlocalprod.com:65111 http://localhost:65111 http://127.0.0.1:65111 *.authenticatorlocalprod.com:65121 http://localhost:65121 http://127.0.0.1:65121 *.authenticatorlocalprod.com:65131 http://localhost:65131 http://127.0.0.1:65131 *.authenticatorlocalprod.com:65141 http://localhost:65141 http://127.0.0.1:65141 *.authenticatorlocalprod.com:65151 http://localhost:65151 http://127.0.0.1:65151 https://oinmanager.okta.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; script-src 'unsafe-inline' 'unsafe-eval' 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com; style-src 'unsafe-inline' 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com; frame-src 'self' carefirst.okta.com carefirst-admin.okta.com wflogin.carefirst.com login.okta.com com-okta-authenticator:; img-src 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com *.tiles.mapbox.com *.mapbox.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com blob:; font-src 'self' carefirst.okta.com wflogin.carefirst.com data: *.oktacdn.com fonts.gstatic.com; frame-ancestors 'self'
Transfer-Encoding: chunked
p3p: CP="HONK"
Connection: Keep-Alive
x-xss-protection: 0
pragma: no-cache
Server: nginx
accept-ch: Sec-CH-UA-Platform-Version
vary: Origin
Content-Type: application/ion+json;okta-version=1.0.0
access-control-allow-origin: https://wflogin.carefirst.com
x-rate-limit-reset: 1714156312
access-control-allow-credentials: true
cache-control: no-cache, no-store
X-Robots-Tag: noindex,nofollow
Keep-Alive: timeout=5, max=97
expires: 0

GET
H2 200 sign-on-widget-spinner.gif
ok10static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.17.1/img/ui/indicators/ 16 KB
17 KB 11ms
10ms Image
image/gif 18.244.18.49
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ok10static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.17.1/img/ui/indicators/sign-on-widget-spinner.gif

Requested by

Host: ok10static.oktacdn.com
URL: https://ok10static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.17.1/css/okta-sign-in.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.244.18.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-244-18-49.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://ok10static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.17.1/css/okta-sign-in.min.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 19:50:27 GMT
x-amz-meta-sha1sum: f14e151b40c54e0e4a80184e8c8ca49c91840ba8
via: 1.1 354c49ee216d1b8ed995ee7b94d96f10.cloudfront.net (CloudFront)
strict-transport-security: max-age=315360000; includeSubDomains
x-amz-cf-pop: FRA56-P11
age: 859285
x-cache: Hit from cloudfront
content-length: 16473
last-modified: Tue, 16 Apr 2024 18:56:54 GMT
server: nginx
etag: "eea28db2b98f4df40b5608a54d0b9131"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
accept-ranges: bytes
x-amz-cf-id: D3YKaHZiBtsaZeruPvhweyMm6n9mlTiWjmc72nkC_pG9WGqmhLArzg==
expires: Wed, 16 Apr 2025 19:50:27 GMT

GET
H2 200 proximanova-sbold-webfont.41acb8650115f83780fc.woff2
ok10static.oktacdn.com/assets/loginpage/font/assets/ 20 KB
20 KB 11ms
11ms Font
application/font-woff2 18.244.18.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ok10static.oktacdn.com/assets/loginpage/font/assets/proximanova-sbold-webfont.41acb8650115f83780fc.woff2

Requested by

Host: ok10static.oktacdn.com
URL: https://ok10static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.244.18.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-244-18-49.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://ok10static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css
Origin: https://wflogin.carefirst.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 08 Apr 2024 23:05:19 GMT
x-amz-meta-sha1sum: dd4beda27e8057403b27d1276ca9d68902692615
via: 1.1 39cfa117a3536e9c0afd90708900b558.cloudfront.net (CloudFront)
strict-transport-security: max-age=315360000; includeSubDomains
x-amz-cf-pop: FRA56-P11
age: 1538793
x-cache: Hit from cloudfront
content-length: 20328
last-modified: Tue, 07 Nov 2023 18:54:13 GMT
server: nginx
etag: "27429b092c0595aa8803b611bd7508f3"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
accept-ranges: bytes
x-amz-cf-id: 3uzsNpPpIIc8TYiULQgxQMVJs9Topd6NbeKNdW_Vzp7FhWx_pQbSiQ==
expires: Tue, 08 Apr 2025 23:05:19 GMT

GET
H/1.1 200
OK 0oajybe54Ftgwy9ua4h6 Show response
wflogin.carefirst.com/sso/idps/ 30 KB
13 KB 206ms
206ms Document
text/html 3.15.167.136
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://wflogin.carefirst.com/sso/idps/0oajybe54Ftgwy9ua4h6?stateTokenExternalId=bEtsL2NjL1RGbkNRWGh6MndDRVNlWXM3STQ5bmxXdzdjcDJDZTlDSE5FMEhra1Fyeml0enBQZ201T3NPVXpBUw

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.15.167.136 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-15-167-136.us-east-2.compute.amazonaws.com

Software

nginx /

Resource Hash

4d05f9b05e24f0d7bf8a83765953ad520221acf5318023b82f0449836997f4ab

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' carefirst.okta.com wflogin.carefirst.com .oktacdn.com; connect-src 'self' carefirst.okta.com carefirst-admin.okta.com wflogin.carefirst.com .oktacdn.com .mixpanel.com .mapbox.com .mtls.okta.com carefirst.kerberos.okta.com .authenticatorlocalprod.com:8769 http://localhost:8769 http://127.0.0.1:8769 .authenticatorlocalprod.com:65111 http://localhost:65111 http://127.0.0.1:65111 .authenticatorlocalprod.com:65121 http://localhost:65121 http://127.0.0.1:65121 .authenticatorlocalprod.com:65131 http://localhost:65131 http://127.0.0.1:65131 .authenticatorlocalprod.com:65141 http://localhost:65141 http://127.0.0.1:65141 .authenticatorlocalprod.com:65151 http://localhost:65151 http://127.0.0.1:65151 https://oinmanager.okta.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; script-src 'unsafe-inline' 'unsafe-eval' 'self' carefirst.okta.com wflogin.carefirst.com .oktacdn.com; style-src 'unsafe-inline' 'self' carefirst.okta.com wflogin.carefirst.com .oktacdn.com; frame-src 'self' carefirst.okta.com carefirst-admin.okta.com wflogin.carefirst.com login.okta.com com-okta-authenticator:; img-src 'self' carefirst.okta.com wflogin.carefirst.com .oktacdn.com .tiles.mapbox.com .mapbox.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com blob:; font-src 'self' carefirst.okta.com wflogin.carefirst.com data: *.oktacdn.com fonts.gstatic.com
Strict-Transport-Security	max-age=315360000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://wflogin.carefirst.com/app/carefirst_beeline_1/exk148qtanLOFfse94h7/sso/saml
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"
sec-ch-ua-platform-version: "10.0.0"

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=utf-8
Date: Fri, 26 Apr 2024 18:31:52 GMT
Keep-Alive: timeout=5, max=96
Server: nginx
Strict-Transport-Security: max-age=315360000; includeSubDomains
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Robots-Tag: noindex,nofollow
accept-ch: Sec-CH-UA-Platform-Version
cache-control: no-cache, no-store
content-language: de
content-security-policy: default-src 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com; connect-src 'self' carefirst.okta.com carefirst-admin.okta.com wflogin.carefirst.com *.oktacdn.com *.mixpanel.com *.mapbox.com *.mtls.okta.com carefirst.kerberos.okta.com *.authenticatorlocalprod.com:8769 http://localhost:8769 http://127.0.0.1:8769 *.authenticatorlocalprod.com:65111 http://localhost:65111 http://127.0.0.1:65111 *.authenticatorlocalprod.com:65121 http://localhost:65121 http://127.0.0.1:65121 *.authenticatorlocalprod.com:65131 http://localhost:65131 http://127.0.0.1:65131 *.authenticatorlocalprod.com:65141 http://localhost:65141 http://127.0.0.1:65141 *.authenticatorlocalprod.com:65151 http://localhost:65151 http://127.0.0.1:65151 https://oinmanager.okta.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; script-src 'unsafe-inline' 'unsafe-eval' 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com; style-src 'unsafe-inline' 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com; frame-src 'self' carefirst.okta.com carefirst-admin.okta.com wflogin.carefirst.com login.okta.com com-okta-authenticator:; img-src 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com *.tiles.mapbox.com *.mapbox.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com blob:; font-src 'self' carefirst.okta.com wflogin.carefirst.com data: *.oktacdn.com fonts.gstatic.com
content-security-policy-report-only: default-src 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com; connect-src 'self' carefirst.okta.com carefirst-admin.okta.com wflogin.carefirst.com *.oktacdn.com *.mixpanel.com *.mapbox.com *.mtls.okta.com carefirst.kerberos.okta.com *.authenticatorlocalprod.com:8769 http://localhost:8769 http://127.0.0.1:8769 *.authenticatorlocalprod.com:65111 http://localhost:65111 http://127.0.0.1:65111 *.authenticatorlocalprod.com:65121 http://localhost:65121 http://127.0.0.1:65121 *.authenticatorlocalprod.com:65131 http://localhost:65131 http://127.0.0.1:65131 *.authenticatorlocalprod.com:65141 http://localhost:65141 http://127.0.0.1:65141 *.authenticatorlocalprod.com:65151 http://localhost:65151 http://127.0.0.1:65151 https://oinmanager.okta.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; script-src 'unsafe-inline' 'unsafe-eval' 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com; style-src 'unsafe-inline' 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com; frame-src 'self' carefirst.okta.com carefirst-admin.okta.com wflogin.carefirst.com login.okta.com com-okta-authenticator:; img-src 'self' carefirst.okta.com wflogin.carefirst.com *.oktacdn.com *.tiles.mapbox.com *.mapbox.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com blob:; font-src 'self' carefirst.okta.com wflogin.carefirst.com data: *.oktacdn.com fonts.gstatic.com; frame-ancestors 'self'
expires: 0
p3p: CP="HONK"
pragma: no-cache
x-content-type-options: nosniff
x-okta-request-id: ZivzGJ6m03E3CyPi0tvhjQAAC6s
x-rate-limit-limit: 5000
x-rate-limit-remaining: 4971
x-rate-limit-reset: 1714156312
x-xss-protection: 0

GET
H2 200 jquery-1.12.4.2ef93d9aedc4198ec425a799a371292d.js Show response
ok10static.oktacdn.com/assets/js/ 289 KB
101 KB 13ms
9ms Script
application/javascript 18.244.18.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ok10static.oktacdn.com/assets/js/jquery-1.12.4.2ef93d9aedc4198ec425a799a371292d.js

Requested by

Host: wflogin.carefirst.com
URL: https://wflogin.carefirst.com/sso/idps/0oajybe54Ftgwy9ua4h6?stateTokenExternalId=bEtsL2NjL1RGbkNRWGh6MndDRVNlWXM3STQ5bmxXdzdjcDJDZTlDSE5FMEhra1Fyeml0enBQZ201T3NPVXpBUw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.244.18.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-244-18-49.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

43e51f129fb6eb0f52aee5fb4857f14796f9a5b38e66f445658db1ac1fb7298e

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://wflogin.carefirst.com/
Origin: https://wflogin.carefirst.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 18 Apr 2024 14:59:44 GMT
x-amz-meta-sha1sum: 26667ee897b9e91a9b54c3d4aa445649aa92543d
content-encoding: gzip
strict-transport-security: max-age=315360000; includeSubDomains
via: 1.1 39cfa117a3536e9c0afd90708900b558.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P11
age: 703927
x-cache: Hit from cloudfront
last-modified: Tue, 06 Dec 2022 21:44:14 GMT
server: nginx
etag: W/"2ef93d9aedc4198ec425a799a371292d"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
x-amz-cf-id: 795RxO2GhQ5XUaJDwmFKhVOEqADXufarhLGYU8-fP4fc8lz2nb-hfg==
expires: Fri, 18 Apr 2025 14:59:44 GMT

GET
H2 200 interstitial.c280c95e9e8c971dad6d6dd597ab23f8.css
ok10static.oktacdn.com/assets/css/sections/ 8 KB
3 KB 9ms
7ms Stylesheet
text/css 18.244.18.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ok10static.oktacdn.com/assets/css/sections/interstitial.c280c95e9e8c971dad6d6dd597ab23f8.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.244.18.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-244-18-49.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

d952fafe2ace405711d16dd5b78225162c199fffc0132fb1d85b612b629c5e22

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://wflogin.carefirst.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-meta-sha1sum: 254ba22d6a26decbf68aac1f9710e47a39cc4bfa
strict-transport-security: max-age=315360000; includeSubDomains
content-encoding: gzip
date: Wed, 17 Apr 2024 21:38:57 GMT
via: 1.1 354c49ee216d1b8ed995ee7b94d96f10.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P11
age: 766426
x-cache: Hit from cloudfront
last-modified: Tue, 05 Dec 2023 18:27:23 GMT
server: nginx
etag: W/"c280c95e9e8c971dad6d6dd597ab23f8"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
x-amz-cf-id: PlVb4BMruH_STmSUaWQJVdmzICln5NY9wuV5CSrQ3O5caDdwAvsLKg==
expires: Thu, 17 Apr 2025 21:38:06 GMT

GET
H2 200 interstitial-dark-blue-brand.d4ca51b5579d1772af159f12276beb72.gif
ok10static.oktacdn.com/assets/img/ui/indicators/ 143 KB
144 KB 12ms
10ms Image
image/gif 18.244.18.49
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ok10static.oktacdn.com/assets/img/ui/indicators/interstitial-dark-blue-brand.d4ca51b5579d1772af159f12276beb72.gif

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.244.18.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-244-18-49.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://wflogin.carefirst.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 14 Apr 2024 03:42:28 GMT
strict-transport-security: max-age=315360000; includeSubDomains
via: 1.1 354c49ee216d1b8ed995ee7b94d96f10.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P11
age: 1090164
x-cache: Hit from cloudfront
content-length: 146495
last-modified: Tue, 14 Dec 2021 22:50:12 GMT
server: nginx
etag: "d4ca51b5579d1772af159f12276beb72"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
accept-ranges: bytes
x-amz-cf-id: kLQCrX8qWRe25nmelJVywKRhEdWp091VeNHzQBXxS9gig09bU-XeMA==
expires: Mon, 14 Apr 2025 03:42:28 GMT

GET
H2 200 interstitial.3bb1b1dab07d5557b70fe16c1da0276e.js Show response
ok10static.oktacdn.com/assets/js/app/sso/ 576 B
829 B 9ms
8ms Script
application/javascript 18.244.18.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ok10static.oktacdn.com/assets/js/app/sso/interstitial.3bb1b1dab07d5557b70fe16c1da0276e.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.244.18.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-244-18-49.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

d67f33137e87a6a11f9b298e5a4aefe0c3094930d5ad4fcce9e828e0d6a5d3b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://wflogin.carefirst.com/
Origin: https://wflogin.carefirst.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 22:51:17 GMT
x-amz-meta-sha1sum: ae20c501108c474c6d4f9657041db2260164e0a0
content-encoding: gzip
strict-transport-security: max-age=315360000; includeSubDomains
via: 1.1 39cfa117a3536e9c0afd90708900b558.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P11
age: 1280435
x-cache: Hit from cloudfront
last-modified: Wed, 17 Jan 2024 18:48:55 GMT
server: nginx
etag: W/"3bb1b1dab07d5557b70fe16c1da0276e"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
x-amz-cf-id: cWc6KkE97OdxjosU8ixutaGfRcmC1ebN3domvboKOMu335tGClA_cA==
expires: Fri, 11 Apr 2025 22:51:17 GMT

POST
H2 200 saml2 Show response
login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/ 24 KB
12 KB 486ms
432ms Document
text/html 2603:1026:3000:150::5
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/saml2

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2603:1026:3000:150::5 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

c248bc521482679a68ac06ffd44e717192e678df2374eef68aba9d30f7bd6bdb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Content-Type: application/x-www-form-urlencoded
Origin: https://wflogin.carefirst.com
Referer: https://wflogin.carefirst.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: no-store, no-cache
content-encoding: gzip
content-length: 10869
content-type: text/html; charset=utf-8
date: Fri, 26 Apr 2024 18:31:52 GMT
expires: -1
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]}
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-ms-ests-server: 2.1.17910.10 - WUS3 ProdSlices
x-ms-request-id: 96669daa-0f49-4556-9bec-f0fb0c3fb000
x-ms-srs: 1.P
x-xss-protection: 0

GET
H2 200 BssoInterrupt_Core_Ggyc2EJnCaHFrI6xkBPLcg2.js Show response
aadcdn.msauth.net/shared/1.0/content/js/ 138 KB
49 KB 57ms
14ms Script
application/x-javascript 2620:1ec:bdf::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msauth.net/shared/1.0/content/js/BssoInterrupt_Core_Ggyc2EJnCaHFrI6xkBPLcg2.js
Requested by: Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/saml2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: d12f35509e7ebcd8af368faf23c490fda08fa0cb21171ab6b60ae2468242e500

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://login.microsoftonline.com/
Origin: https://login.microsoftonline.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 26 Apr 2024 18:31:53 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 4554691
content-length: 49609
x-ms-lease-status: unlocked
last-modified: Mon, 01 Apr 2024 18:07:19 GMT
etag: 0x8DC527692402A16
x-azure-ref: 20240426T183153Z-15ff45446444hxv2qw1eqqzsxw0000000aw000000000mufy
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: d6357ff4-001e-001e-417b-92f7a1000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

POST
H2 200 Primary Request saml2 Show response
login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/ 39 KB
16 KB 500ms
497ms Document
text/html 2603:1026:3000:150::5
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/saml2?sso_reload=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2603:1026:3000:150::5 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

52742af7a94366e1d7b3e43c997943372ff434263c1d0726bd4a4c617ed242ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Content-Type: application/x-www-form-urlencoded
Origin: https://login.microsoftonline.com
Referer: https://login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/saml2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: no-store, no-cache
content-encoding: gzip
content-length: 14848
content-type: text/html; charset=utf-8
date: Fri, 26 Apr 2024 18:31:52 GMT
expires: -1
link: <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msftauth.net>; rel=dns-prefetch,<https://aadcdn.msauth.net>; rel=dns-prefetch
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]}
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: on
x-frame-options: DENY
x-ms-ests-server: 2.1.17910.10 - WUS3 ProdSlices
x-ms-request-id: 2068392b-1409-4bfd-91f3-6e7979f2c100
x-ms-srs: 1.P
x-xss-protection: 0

GET
H2 200 converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ 110 KB
20 KB 34ms
7ms Stylesheet
text/css 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css
Requested by: Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/saml2?sso_reload=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CBB) /
Resource Hash: 4b01a0a34ce8ed4bc8a8713be0442d49da6a756236b7b4424622ca3dee820f41

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://login.microsoftonline.com/
Origin: https://login.microsoftonline.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 26 Apr 2024 18:31:53 GMT
content-encoding: gzip
content-md5: kqhA3D0Xczna4D/t8ioitQ==
age: 2904643
x-cache: HIT
content-length: 20314
x-ms-lease-status: unlocked
last-modified: Wed, 27 Dec 2023 18:19:21 GMT
server: ECAcc (frc/4CBB)
etag: 0x8DC070858CA028D
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: e56748d7-801e-0017-2a9d-7d3b0a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 ConvergedLogin_PCore_4aBF4cdky--I3Cpch7JoPw2.js Show response
aadcdn.msftauth.net/shared/1.0/content/js/ 434 KB
119 KB 41ms
15ms Script
application/x-javascript 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_4aBF4cdky--I3Cpch7JoPw2.js
Requested by: Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/saml2?sso_reload=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4C9A) /
Resource Hash: fa449b79237b05bc9cdbedbb7879082ee80f1af5fb423c5e18408b0167a67505

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://login.microsoftonline.com/
Origin: https://login.microsoftonline.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 26 Apr 2024 18:31:53 GMT
content-encoding: gzip
content-md5: Wy47KxpwbAEBtQO3Lwqbbw==
age: 1808001
x-cache: HIT
content-length: 121259
x-ms-lease-status: unlocked
last-modified: Fri, 05 Apr 2024 02:25:10 GMT
server: ECAcc (frc/4C9A)
etag: 0x8DC55179E1E3E92
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 22f66e8c-601e-0009-3f96-872935000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 ux.converged.login.strings-de.min_424c1i9crqdf0lqqgcslza2.js Show response
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ 60 KB
17 KB 34ms
8ms Script
application/x-javascript 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-de.min_424c1i9crqdf0lqqgcslza2.js
Requested by: Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/saml2?sso_reload=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4D02) /
Resource Hash: 9ad82de52f3930cb21d7faa7c317ef69dd4e3ba398aec6bfdc9f9de360163278

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://login.microsoftonline.com/
Origin: https://login.microsoftonline.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 26 Apr 2024 18:31:53 GMT
content-encoding: gzip
content-md5: jOiousyUYhNqKTm5ZmwfKQ==
age: 2001604
x-cache: HIT
content-length: 17396
x-ms-lease-status: unlocked
last-modified: Tue, 02 Apr 2024 21:28:34 GMT
server: ECAcc (frc/4D02)
etag: 0x8DC535BDA0182DE
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 6bcd2892-a01e-0051-6dd3-851217000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H/1.1 200
OK Me.htm
login.live.com/ 0
0 203ms
150ms Other
text/html 40.126.32.76
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.live.com/Me.htm?v=3
Requested by: Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/saml2?sso_reload=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 40.126.32.76 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://login.microsoftonline.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

GET
H2 200 oneDs_f2e0f4a029670f10d892.js Show response
aadcdn.msftauth.net/shared/1.0/content/js/ 186 KB
60 KB 28ms
8ms Script
application/x-javascript 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Requested by: Host: aadcdn.msftauth.net
URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_4aBF4cdky--I3Cpch7JoPw2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CFD) /
Resource Hash: 8405362eb8f09df13ae244de155b51b1577274673d9728b6c81cd0278a63c8b0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://login.microsoftonline.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 26 Apr 2024 18:31:53 GMT
content-encoding: gzip
content-md5: wegr9xrdYirQ87+FcvY0/A==
age: 2904707
x-cache: HIT
content-length: 61052
x-ms-lease-status: unlocked
last-modified: Thu, 25 May 2023 17:22:37 GMT
server: ECAcc (frc/4CFD)
etag: 0x8DB5D44A2CEB430
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: c08bb2a0-501e-0012-2f9c-7dbc00000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js Show response
aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/ 219 KB
53 KB 8ms
8ms Script
application/x-javascript 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js
Requested by: Host: aadcdn.msftauth.net
URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_4aBF4cdky--I3Cpch7JoPw2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4C84) /
Resource Hash: 474ce0790ceb18a100cebaf1ac0915a51389fcae0830c3b44bfa1e365d40b2b4

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://login.microsoftonline.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 26 Apr 2024 18:31:53 GMT
content-encoding: gzip
content-md5: P5ihddUjL2Zb7/wjNS1xdg==
age: 2037464
x-cache: HIT
content-length: 54318
x-ms-lease-status: unlocked
last-modified: Thu, 28 Mar 2024 21:23:30 GMT
server: ECAcc (frc/4C84)
etag: 0x8DC4F6D50F3D2E7
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 0d451fae-201e-00dd-7d80-85b15b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 favicon_a_eupayfgghqiai7k9sol6lg2.ico
aadcdn.msftauth.net/shared/1.0/content/images/ 17 KB
17 KB 7ms
7ms Other
image/x-icon 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CBA) /
Resource Hash: 90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://login.microsoftonline.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 26 Apr 2024 18:31:53 GMT
content-md5: EuPayFgGHQiAI7K9SOL6lg==
age: 2904672
x-cache: HIT
content-length: 17174
x-ms-lease-status: unlocked
last-modified: Sun, 18 Oct 2020 03:02:30 GMT
server: ECAcc (frc/4CBA)
etag: 0x8D8731240E548EB
content-type: image/x-icon
access-control-allow-origin: *
x-ms-request-id: debb0496-801e-00bf-299d-7da57d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 convergedlogin_pfetchsessionsprogress_7c1aa7609345f99e4914.js Show response
aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/ 15 KB
6 KB 8ms
7ms Script
application/x-javascript 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_7c1aa7609345f99e4914.js
Requested by: Host: aadcdn.msftauth.net
URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_4aBF4cdky--I3Cpch7JoPw2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CF5) /
Resource Hash: 35afb11dab6edcbc989a25fe5cf19f5d8289499232b7ec775f318d8b8a5bbf78

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://login.microsoftonline.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 26 Apr 2024 18:31:53 GMT
content-encoding: gzip
content-md5: NuzanQiiHb2/rc4qm18OGQ==
age: 2023007
x-cache: HIT
content-length: 5515
x-ms-lease-status: unlocked
last-modified: Thu, 28 Mar 2024 21:23:32 GMT
server: ECAcc (frc/4CF5)
etag: 0x8DC4F6D51B11E63
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 5c855eba-301e-0050-19a1-853915000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
aadcdn.msftauth.net/shared/1.0/content/images/ 3 KB
3 KB 8ms
8ms Image
image/gif 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CDE) /
Resource Hash: a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://login.microsoftonline.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 26 Apr 2024 18:31:53 GMT
content-md5: Fm3lNHEmUlOrOkVt7+baIw==
age: 2904673
x-cache: HIT
content-length: 2672
x-ms-lease-status: unlocked
last-modified: Wed, 24 May 2023 10:11:48 GMT
server: ECAcc (frc/4CDE)
etag: 0x8DB5C3F4982FD30
content-type: image/gif
access-control-allow-origin: *
x-ms-request-id: 08f58f55-a01e-00e9-639d-7d3c42000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
aadcdn.msftauth.net/shared/1.0/content/images/ 4 KB
4 KB 9ms
9ms Image
image/gif 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4D04) /
Resource Hash: 8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://login.microsoftonline.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 26 Apr 2024 18:31:53 GMT
content-md5: tUCo5RgDcZLjLE/li/Lbqw==
age: 2904572
x-cache: HIT
content-length: 3620
x-ms-lease-status: unlocked
last-modified: Wed, 24 May 2023 10:11:48 GMT
server: ECAcc (frc/4D04)
etag: 0x8DB5C3F492F3EE5
content-type: image/gif
access-control-allow-origin: *
x-ms-request-id: b6e17d00-601e-00a1-2e9d-7db742000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/ 2 KB
837 B 8ms
8ms Image
image/svg+xml 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CBF) /
Resource Hash: 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://login.microsoftonline.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 26 Apr 2024 18:31:53 GMT
content-encoding: gzip
content-md5: DhdidjYrlCeaRJJRG/y9mA==
age: 2904715
x-cache: HIT
content-length: 673
x-ms-lease-status: unlocked
last-modified: Wed, 24 May 2023 10:11:43 GMT
server: ECAcc (frc/4CBF)
etag: 0x8DB5C3F466DE917
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 920c4446-a01e-00e9-709c-7d3c42000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 bannerlogo
aadcdn.msftauthimages.net/dbd5a2dd-y5vhpt4-l1nnrqj4shqrdi1qk8gfb9a1acfprnerbvy/logintenantbranding/0/ 7 KB
7 KB 416ms
356ms Image
image/* 2620:1ec:bdf::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauthimages.net/dbd5a2dd-y5vhpt4-l1nnrqj4shqrdi1qk8gfb9a1acfprnerbvy/logintenantbranding/0/bannerlogo?ts=636519837704478952
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: a009d41f49bfb879b666a1a84c1943ba7a7e0bb58a602a6629aafee7bf74afa1

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://login.microsoftonline.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 26 Apr 2024 18:31:54 GMT
x-cache: TCP_MISS
x-fd-int-roxy-purgeid: 50755578
content-length: 6935
x-ms-lease-status: unlocked
last-modified: Fri, 19 Jan 2018 18:36:10 GMT
etag: 0x8D55F6B831E4AD6
x-azure-ref: 20240426T183153Z-15ff4544644w7wgw8auk3sm1k8000000033g00000001011h
content-type: image/*
access-control-allow-origin: *
x-ms-request-id: dc55e751-101e-004b-3508-98fb00000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H/1.1 401
Unauthorized ssoprobe
autologon.microsoftazuread-sso.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/winauth/ 12 B
1 KB 416ms
353ms Image
image/png 2603:1026:3000:148::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://autologon.microsoftazuread-sso.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/winauth/ssoprobe?client-request-id=92fa569b-287d-47af-bf4f-81c7febf12be&_=1714156313872

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2603:1026:3000:148::10 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

d089c8a9fc28e4e50223eb38c9409e362521be9380a37341304fbac7a4cd9e5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://login.microsoftonline.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 26 Apr 2024 18:31:53 GMT
X-Content-Type-Options: nosniff
WWW-Authenticate: Negotiate
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
Content-Length: 12
X-XSS-Protection: 0
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Vary: Origin
Access-Control-Allow-Methods: GET, OPTIONS
Content-Type: image/png; charset=utf-8
Access-Control-Allow-Origin: https://login.microsoftonline.com
x-ms-request-id: d30169b6-176f-4865-98d4-ee0c21099c00
Cache-Control: no-store, no-cache
Access-Control-Allow-Credentials: true
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]}
x-ms-ests-server: 2.1.17846.6 - NCUS ProdSlices
Expires: -1

POST
H2 200 dssostatus Show response
login.microsoftonline.com/common/instrumentation/ 265 B
650 B 117ms
117ms XHR
application/json 2603:1026:3000:150::5
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.microsoftonline.com/common/instrumentation/dssostatus

Requested by

Host: aadcdn.msftauth.net
URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_4aBF4cdky--I3Cpch7JoPw2.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2603:1026:3000:150::5 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

339ebb3714f1babceb17d5238f6c38b37bd9684e3503f25161bfe055a3d0efc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
hpgrequestid: 2068392b-1409-4bfd-91f3-6e7979f2c100
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
client-request-id: 92fa569b-287d-47af-bf4f-81c7febf12be
canary: PAQABDgEAAADnfolhJpSnRYB1SVj-Hgd8Icl84lzAwvaOEnZyeQNR0VbVk8dRPYSHxlndlqrxa3jVxmj27c7f_ReCw3DD5H8YKlbc3Z7qtLQGzDko1zaUbsBKyXvhRUcBEqPyoJvLwJwLjL0UkGOU7Ih_PamDCDdKYEvtDEAZi5QZ1RxTPwVnbbfJNPoVvmMRdkhAqgSBE9_9wBDp8V5YePkbvhRgAdbp_sU-9-JxP5fMoz058FEX1SAA
Content-type: application/json; charset=UTF-8
hpgid: 1104
Accept: application/json
Referer: https://login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/saml2?sso_reload=true
hpgact: 1900
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Fri, 26 Apr 2024 18:31:53 GMT
x-content-type-options: nosniff
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
client-request-id: 92fa569b-287d-47af-bf4f-81c7febf12be
p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
content-length: 265
x-xss-protection: 0
pragma: no-cache
x-ms-srs: 1.P
referrer-policy: strict-origin-when-cross-origin
access-control-allow-methods: POST, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://autologon.microsoftazuread-sso.com/
x-ms-request-id: b2e9aa4f-9c77-4ad4-a1b2-f8cfcd8dc101
cache-control: no-store, no-cache
access-control-allow-credentials: true
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]}
x-ms-ests-server: 2.1.17846.6 - NCUS ProdSlices
expires: -1

GET
H2 200 convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js Show response
aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/ 111 KB
35 KB 7ms
7ms Script
application/x-javascript 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js
Requested by: Host: aadcdn.msftauth.net
URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_4aBF4cdky--I3Cpch7JoPw2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4C9C) /
Resource Hash: 4be11c075187615adaf493d54cb7b05556e76806aed2b3b082d72952d0025be5

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://login.microsoftonline.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 26 Apr 2024 18:31:54 GMT
content-encoding: gzip
content-md5: /PcUcu/J5hSxDf1JmAX3KQ==
age: 2037464
x-cache: HIT
content-length: 35807
x-ms-lease-status: unlocked
last-modified: Thu, 28 Mar 2024 21:23:33 GMT
server: ECAcc (frc/4C9C)
etag: 0x8DC4F6D5254E400
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: af16a545-201e-00b5-6680-85ab68000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
aadcdn.msftauth.net/shared/1.0/content/images/ 2 KB
772 B 14ms
14ms Image
image/svg+xml 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CA2) /
Resource Hash: 8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://login.microsoftonline.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 26 Apr 2024 18:31:54 GMT
content-encoding: gzip
content-md5: R2FAVxfpONfnQAuxVxXbHg==
age: 2904715
x-cache: HIT
content-length: 621
x-ms-lease-status: unlocked
last-modified: Wed, 24 May 2023 10:11:52 GMT
server: ECAcc (frc/4CA2)
etag: 0x8DB5C3F4BB4F03C
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: cc0763e7-101e-0082-0a9c-7d5b77000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

POST
H2 200 / Show response
browser.events.data.microsoft.com/OneCollector/1.0/ 153 B
766 B 351ms
91ms XHR
application/json 51.105.71.137
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://browser.events.data.microsoft.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0

Requested by

Host: aadcdn.msftauth.net
URL: https://aadcdn.msftauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

51.105.71.137 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-HTTPAPI/2.0 /

Resource Hash

7a743fe091ef5340f7794327932fc0b1e3643f3a8ece9598287252028e8d429a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
upload-time: 1714156316296
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
client-version: 1DS-Web-JS-3.2.6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
time-delta-to-apply-millis: use-collector-delta
content-type: application/x-json-stream
cache-control: no-cache, no-store
Referer: https://login.microsoftonline.com/
apikey: 69adc3c768bd4dc08c19416121249fcc-66f1668a-797b-4249-95e3-6c6651768c28-7293
Client-Id: NO_AUTH
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Fri, 26 Apr 2024 18:31:56 GMT
server: Microsoft-HTTPAPI/2.0
time-delta-millis: 418
access-control-allow-methods: POST
p3p: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
content-type: application/json
access-control-allow-origin: https://login.microsoftonline.com
access-control-expose-headers: time-delta-millis
access-control-allow-credentials: true
access-control-allow-headers: P3P,Set-Cookie,time-delta-millis
content-length: 153

OPTIONS
H2 200 /
browser.events.data.microsoft.com/OneCollector/1.0/ Frame 0
0 112ms
34ms Preflight 51.105.71.137
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://browser.events.data.microsoft.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

51.105.71.137 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-HTTPAPI/2.0 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Headers: apikey,cache-control,client-id,client-version,content-type,time-delta-to-apply-millis,upload-time
Access-Control-Request-Method: POST
Origin: https://login.microsoftonline.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: AuthMsaDeviceTicket,AuthXToken,Content-Encoding,Content-Type,Cache-Control,Client-Id,SDK-Name,sdk-version,apikey,x-apikey,client-version,upload-time,time-delta-to-apply-millis,client-time-epoch-millis,persistence-mode,reliability-mode,NoResponseBody
access-control-allow-origin: https://login.microsoftonline.com
access-control-max-age: 3600
cache-control: public, 3600
content-length: 0
date: Fri, 26 Apr 2024 18:31:56 GMT
server: Microsoft-HTTPAPI/2.0
strict-transport-security: max-age=31536000

Verdicts & Comments Add Verdict or Comment

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

30 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
prod.beeline.com/carefirst	1970-01-20 20:12:09	Name: AntiXsrfToken Value: 58a6fea9a97141f2a1391377ebedba2b
prod.beeline.com/carefirst	1970-01-20 20:12:09	Name: .BEEAUTHUrl Value: %2fcarefirst%2fn.ashx%3fn%3d3ead05e7f89f424590e2a72ac7f131a6
prod.beeline.com/	1969-12-31 23:59:59	Name: a73sm3 Value: prodweb107.jax
azure-prd.auth.beeline.com/	1970-01-21 04:55:13	Name: did Value: s%3Av0%3A3f9fb300-03fb-11ef-a4b2-572798e49788.5kGyfxeHlBEsKiDFB5ZBtdPAHuNT%2F3KojEIkdRklbjM
azure-prd.auth.beeline.com/	1970-01-20 20:13:35	Name: auth0 Value: s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQEPTfb35IdT6mp3YVaLuO5PeL0s5lZdt0f_LLzRxDwTeHMv6f33FQfLYn3wD2ZjQMVEuu5bmvHDRoIBpJvhqNBimY29va2llg6dleHBpcmVz1_8ehIAAZi_nl65vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.nI2s%2FpkxvgVQWfajH6vEulAv5H8OxqqV7mrMTLtyqJo
azure-prd.auth.beeline.com/	1970-01-21 04:55:13	Name: did_compat Value: s%3Av0%3A3f9fb300-03fb-11ef-a4b2-572798e49788.5kGyfxeHlBEsKiDFB5ZBtdPAHuNT%2F3KojEIkdRklbjM
azure-prd.auth.beeline.com/	1970-01-20 20:13:35	Name: auth0_compat Value: s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQEPTfb35IdT6mp3YVaLuO5PeL0s5lZdt0f_LLzRxDwTeHMv6f33FQfLYn3wD2ZjQMVEuu5bmvHDRoIBpJvhqNBimY29va2llg6dleHBpcmVz1_8ehIAAZi_nl65vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.nI2s%2FpkxvgVQWfajH6vEulAv5H8OxqqV7mrMTLtyqJo
wflogin.carefirst.com/	1969-12-31 23:59:59	Name: t Value: default
wflogin.carefirst.com/	1970-01-21 05:45:16	Name: DT Value: DI18imCazinSeqUA1ZC6CX12Q
wflogin.carefirst.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: 6CA9816A7F357C7DA9876D6D91560550
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: esctx-jDOFFPng5Aw Value: AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8D1YMgNK2NOreGIbCxcHFeAZrzmMCjG9pji-e04f3YQpLvMPO1k6XxEiDYbL2cM9AwGBk6G4ETSS_82kllvz7TxWPfQgvfKHDzsK2PrDay7kVTRi_AtS5_ARli_0zcakvB-9MbyDBtR30FGunKoNrzCAA
login.microsoftonline.com/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
login.microsoftonline.com/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: AADSSO Value: NA\|NoExtension
login.microsoftonline.com/	1970-01-20 20:09:16	Name: SSOCOOKIEPULLED Value: 1
login.microsoftonline.com/	1970-01-20 20:52:28	Name: buid Value: 0.AUUAobbYbUln402ifj_TSExtp2Y7l_drR7NIjDV06ATbj_ZFAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8tTetE1NHaQIPkAC3AidpLxr_zALhQm0y6eCEpkr00WvAC9bgFkLzStUkFKRXh_bmB6c2ziGIQ3PDousTi_jtuZ69jh7VTvhbjSPDxrCsuKAgAA
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: esctx Value: PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8-HCjWBEdYq8c66gty9hqbbAR4xUd11Fo99ZWriX_R9dwDqEmo9fIhvyHA4mLEVTLSRZHNbP-Mq1ngIVAQvldu_WqxDIrfi4WJ2Wt88XtYyXMDGXGk8QLXVM4-f-OWs57UXqxo_Bbxhc6Iu5Q8AyNbP4wBvZzwotPS-8WNApEgGogAA
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: esctx-oiXeMcIAyR0 Value: AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8hx0vYuAmeJDJPy0wahaN8aOksRr2038oqnf3GkfTeATopv1N0_LQXqx8Ww0gt02q58WRrBmL83MdnC3wTMaR7PtHq9AU8TDgxR8i5bLDs1pYwQ3tH_CaXY5BHmoq6M1bYTLLLV87zUsjBlK1RAtVmiAA
login.microsoftonline.com/	1970-01-20 20:52:28	Name: fpc Value: AjKBHYKVf3hGiLYhqeEJgC9PXE2HAQAAABjqvd0OAAAA
login.microsoftonline.com/	1970-01-21 04:54:52	Name: MicrosoftApplicationsTelemetryDeviceId Value: 5ef1c6e1-5338-43fb-959c-e17b8449dff8
.login.microsoftonline.com/	1970-01-21 05:30:52	Name: brcap Value: 0
.login.live.com/	1969-12-31 23:59:59	Name: uaid Value: 108e44b5a9964eb187058317ac228e5c
.login.live.com/	1969-12-31 23:59:59	Name: MSPRequ Value: id=N&lt=1714156313&co=1
autologon.microsoftazuread-sso.com/	1970-01-20 20:52:28	Name: fpc Value: AlbHoTPEx01CoAN-Vzn2GKg
autologon.microsoftazuread-sso.com/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
autologon.microsoftazuread-sso.com/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd
login.microsoftonline.com/	1970-01-20 20:09:18	Name: ai_session Value: T1vkYJbwbmun93zxj17RJ6\|1714156314293\|1714156314293
.microsoft.com/	1970-01-21 04:54:52	Name: MC1 Value: GUID=c3135d82fe7e451d81f1e73e0d6f44cd&HASH=c313&LV=202404&V=4&LU=1714156316714
.microsoft.com/	1970-01-20 20:09:18	Name: MS0 Value: ea1a34e237d44d64b3c518714208f15c
login.microsoftonline.com/	1970-01-21 04:54:52	Name: MSFPC Value: GUID=c3135d82fe7e451d81f1e73e0d6f44cd&HASH=c313&LV=202404&V=4&LU=1714156316714

9 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/saml2?sso_reload=true Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/saml2?sso_reload=true Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/saml2?sso_reload=true Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/saml2?sso_reload=true Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/saml2?sso_reload=true Message: Third-party cookie will be blocked. Learn more in the Issues tab.
network	error	URL: https://autologon.microsoftazuread-sso.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/winauth/ssoprobe?client-request-id=92fa569b-287d-47af-bf4f-81c7febf12be&_=1714156313872 Message: Failed to load resource: the server responded with a status of 401 (Unauthorized)
recommendation	verbose	URL: https://login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/saml2?sso_reload=true Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
other	warning	URL: https://login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/saml2?sso_reload=true Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://login.microsoftonline.com/6dd8b6a1-6749-4de3-a27e-3fd3484c6da7/saml2?sso_reload=true Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
aadcdn.msftauth.net
aadcdn.msftauthimages.net
autologon.microsoftazuread-sso.com
azure-prd.auth.beeline.com
browser.events.data.microsoft.com
login.live.com
login.microsoftonline.com
login.okta.com
ok10static.oktacdn.com
prod.beeline.com
wflogin.carefirst.com
104.16.58.62
108.138.7.85
172.64.145.76
18.244.18.49
2603:1026:3000:148::10
2603:1026:3000:150::5
2606:2800:233:78b9:f44e:2c1f:31aa:d9ef
2620:1ec:bdf::45
3.15.167.136
40.126.32.76
51.105.71.137
018930498a4b01e598099a6e45d7316d54c7b1411ce2b741a3b1f1b0ed4e578b
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
106fda5aa319c1c673704511ebfdb4ef376d05a04a0756f5fc7436e111b6f3f9
19714eaf0cbf6de9f909794bddca2470bf498dc53b02f50947a5e89476251fde
339ebb3714f1babceb17d5238f6c38b37bd9684e3503f25161bfe055a3d0efc8
35afb11dab6edcbc989a25fe5cf19f5d8289499232b7ec775f318d8b8a5bbf78
43e51f129fb6eb0f52aee5fb4857f14796f9a5b38e66f445658db1ac1fb7298e
474ce0790ceb18a100cebaf1ac0915a51389fcae0830c3b44bfa1e365d40b2b4
4b01a0a34ce8ed4bc8a8713be0442d49da6a756236b7b4424622ca3dee820f41
4be11c075187615adaf493d54cb7b05556e76806aed2b3b082d72952d0025be5
4d05f9b05e24f0d7bf8a83765953ad520221acf5318023b82f0449836997f4ab
52742af7a94366e1d7b3e43c997943372ff434263c1d0726bd4a4c617ed242ad
6a6c595fcf3a6c74bf3509f160ba34b78a8a3eb92ecaf290412c46679576d3ed
7a743fe091ef5340f7794327932fc0b1e3643f3a8ece9598287252028e8d429a
8405362eb8f09df13ae244de155b51b1577274673d9728b6c81cd0278a63c8b0
85ae625f47bf6724036cdb0ecff096d7f684593896a067a5525a612f9b2b461c
8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
9ad82de52f3930cb21d7faa7c317ef69dd4e3ba398aec6bfdc9f9de360163278
9af30b5e4695010f9be253f861784e638c81274ca0390214629886029ca9b509
9ce729df778fbee5e9bb0b6cde926b2e5c19c87ebd301e10eeaabab0d3d89c66
a009d41f49bfb879b666a1a84c1943ba7a7e0bb58a602a6629aafee7bf74afa1
a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13
affdba1620552b12a1a8a04467136aeb408c03fa337d20e9c38374d682d4d149
c248bc521482679a68ac06ffd44e717192e678df2374eef68aba9d30f7bd6bdb
c39ff65e2a102e644eb0bf2e31d2bad3d18f7afb25b3b9ba7a4d46263a711179
c72d18b9c0efac5a6844a75651a7ab5163152cf5e371e4cff8750b447dec9e98
ce55b94f10a3895ae05730df746a031ce303b03ce563274aada9f4a5e04a0b18
d089c8a9fc28e4e50223eb38c9409e362521be9380a37341304fbac7a4cd9e5f
d12f35509e7ebcd8af368faf23c490fda08fa0cb21171ab6b60ae2468242e500
d2d93f48c153295d93aff135dd9c5153e19c8f8c6cc24f46d4d3f69c7d23110f
d67f33137e87a6a11f9b298e5a4aefe0c3094930d5ad4fcce9e828e0d6a5d3b8
d952fafe2ace405711d16dd5b78225162c199fffc0132fb1d85b612b629c5e22
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e540549c5ee85d139a6590536daf86400fccd811ebc9d5b714794efe1e34b897
f6216505350125a44d0b325743d7af4d397369181b205814c7639aa8c7e1ca91
f9e86fb363a05f75ab3b525439d46bf4911d4cd4ae94c656c0198206374002aa
fa449b79237b05bc9cdbedbb7879082ee80f1af5fb423c5e18408b0167a67505

login.microsoftonline.com Open in urlscan Pro 2603:1026:3000:150::5 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

44 Requests

100 %HTTPS

36 %IPv6

11 Domains

12 Subdomains

10 IPs

4 Countries

1515 kBTransfer

4224 kBSize

30 Cookies

3 Outgoing links

Page URL History

Redirected requests

44 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

login.microsoftonline.com Open in urlscan Pro
2603:1026:3000:150::5 Public Scan

Screenshot
Live screenshot

Full Image

44
Requests

100 %
HTTPS

36 %
IPv6

11
Domains

12
Subdomains

10
IPs

4
Countries

1515 kB
Transfer

4224 kB
Size

30
Cookies

44 HTTP transactions
0 data transactions