webdatamltrainingdiag842.blob.core.windows.net Open in urlscan Pro
52.239.193.68  Malicious Activity! Public Scan

URL: https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
Submission: On April 21 via manual from US

Summary

This website contacted 8 IPs in 4 countries across 7 domains to perform 26 HTTP transactions. The main IP is 52.239.193.68, located in Redmond, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US. The main domain is webdatamltrainingdiag842.blob.core.windows.net.
TLS certificate: Issued by Microsoft IT TLS CA 4 on November 28th 2018. Valid for: 2 years.
This is the only time webdatamltrainingdiag842.blob.core.windows.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Ameriprise Financial (Financial)

Domain & IP information

IP Address AS Autonomous System
3 52.239.193.68 8075 (MICROSOFT...)
1 205.185.208.52 20446 (HIGHWINDS3)
16 23.37.49.118 16625 (AKAMAI-AS)
1 3 129.33.102.78 14558 (AFS-6)
1 2620:1ec:c11:... 8068 (MICROSOFT...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2.18.232.23 16625 (AKAMAI-AS)
1 2 216.58.207.38 15169 (GOOGLE)
26 8
Domain Requested by
16 www.ameriprise.com webdatamltrainingdiag842.blob.core.windows.net
code.jquery.com
3 my.ameriprise.com 1 redirects webdatamltrainingdiag842.blob.core.windows.net
3 webdatamltrainingdiag842.blob.core.windows.net webdatamltrainingdiag842.blob.core.windows.net
2 4266532.fls.doubleclick.net 1 redirects webdatamltrainingdiag842.blob.core.windows.net
1 assets.adobedtm.com webdatamltrainingdiag842.blob.core.windows.net
1 fonts.googleapis.com webdatamltrainingdiag842.blob.core.windows.net
1 bat.bing.com webdatamltrainingdiag842.blob.core.windows.net
1 code.jquery.com webdatamltrainingdiag842.blob.core.windows.net
26 8
Subject Issuer Validity Valid
*.blob.core.windows.net
Microsoft IT TLS CA 4
2018-11-28 -
2020-11-28
2 years crt.sh
jquery.org
COMODO RSA Domain Validation Secure Server CA
2018-10-17 -
2020-10-16
2 years crt.sh
digitalcontent.ameriprise.com
DigiCert SHA2 Extended Validation Server CA
2019-02-19 -
2021-03-10
2 years crt.sh
my.ameriprise.com
DigiCert SHA2 Extended Validation Server CA
2018-02-20 -
2019-07-23
a year crt.sh
www.bing.com
Microsoft IT TLS CA 5
2017-07-20 -
2019-07-10
2 years crt.sh
*.googleapis.com
Google Internet Authority G3
2019-03-26 -
2019-06-18
3 months crt.sh
assets.adobedtm.com
DigiCert SHA2 High Assurance Server CA
2019-03-04 -
2020-03-11
a year crt.sh
*.doubleclick.net
Google Internet Authority G3
2019-03-26 -
2019-06-18
3 months crt.sh

This page contains 5 frames:

Primary Page: https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
Frame ID: 41A9881BBAE91E845EEC7092608FC3BC
Requests: 22 HTTP requests in this frame

Frame: https://my.ameriprise.com/web/register/ampuserheader
Frame ID: 348917F3C9C5E3B93B5A633F74F5AFFA
Requests: 1 HTTP requests in this frame

Frame: https://www.ameriprise.com/client-login/?TYPE=33554433&REALMOID=06-000932b0-5f64-1bdb-b320-ef6d9fca0000&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=clientportalmyfa_cportb00_wa_agent&TARGET=$SM$http%3a%2f%2fmy%2eameriprise%2ecom%2fFinancialAccounts%2fhtml%2fLOGIN%2eHTML
Frame ID: D4832EF99583959A24E12E4DBF3BB9C8
Requests: 1 HTTP requests in this frame

Frame: https://assets.adobedtm.com/7846f6d0f60a64efbba45d8943bae8935d8d2d7d/scripts/satellite-590a3eff64746d2514000177.html
Frame ID: FE9E2084AC5273A5E86C10F58622E847
Requests: 1 HTTP requests in this frame

Frame: https://4266532.fls.doubleclick.net/activityi;dc_pre=CNWhmeHC4OECFRD3dwodUWEKYg;src=4266532;type=pagev228;cat=total0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5999108722899.109
Frame ID: 02ED00F4665D017B32E5F9BC24A6F340
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /Microsoft-HTTPAPI(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
  • script /jquery.*\.js/i
  • env /^jQuery$/i

Page Statistics

26
Requests

100 %
HTTPS

25 %
IPv6

7
Domains

8
Subdomains

8
IPs

4
Countries

482 kB
Transfer

936 kB
Size

5
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10
  • https://my.ameriprise.com/FinancialAccounts/html/LOGIN.HTML HTTP 302
  • https://www.ameriprise.com/client-login/?TYPE=33554433&REALMOID=06-000932b0-5f64-1bdb-b320-ef6d9fca0000&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=clientportalmyfa_cportb00_wa_agent&TARGET=$SM$http%3a%2f%2fmy%2eameriprise%2ecom%2fFinancialAccounts%2fhtml%2fLOGIN%2eHTML
Request Chain 12
  • https://4266532.fls.doubleclick.net/activityi;src=4266532;type=pagev228;cat=total0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5999108722899.109 HTTP 302
  • https://4266532.fls.doubleclick.net/activityi;dc_pre=CNWhmeHC4OECFRD3dwodUWEKYg;src=4266532;type=pagev228;cat=total0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5999108722899.109

26 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request 20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
webdatamltrainingdiag842.blob.core.windows.net/genericheader/
140 KB
141 KB
Document
General
Full URL
https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.193.68 Redmond, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
d8078c97e602f8967be49c0b1d2ffc2c383a6793a32cd97765593188a845fc6e

Request headers

Host
webdatamltrainingdiag842.blob.core.windows.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Length
143590
Content-Type
text/html
Content-MD5
8v8XPS7e4b136I4/NxuSDw==
Last-Modified
Fri, 05 Apr 2019 23:50:53 GMT
ETag
0x8D6BA218A3D995D
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id
2b426e87-901e-0023-0808-f8d7cd000000
x-ms-version
2009-09-19
x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Sun, 21 Apr 2019 06:07:52 GMT
jquery-1.11.3.min.js
code.jquery.com/
94 KB
33 KB
Script
General
Full URL
https://code.jquery.com/jquery-1.11.3.min.js
Requested by
Host: webdatamltrainingdiag842.blob.core.windows.net
URL: https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.185.208.52 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
vip052.ssl.hwcdn.net
Software
nginx /
Resource Hash
ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8

Request headers

Referer
https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sun, 21 Apr 2019 06:07:53 GMT
Content-Encoding
gzip
Last-Modified
Tue, 28 Apr 2015 16:20:58 GMT
Server
nginx
ETag
"553fb36a-176d5"
Vary
Accept-Encoding
X-HW
1555826873.dop001.pa1.shc,1555826873.dop001.pa1.t,1555826873.cds029.pa1.c
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000, public
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
33261
CleanBodyHighlight.js
webdatamltrainingdiag842.blob.core.windows.net/genericheader/
9 KB
9 KB
Script
General
Full URL
https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/CleanBodyHighlight.js
Requested by
Host: webdatamltrainingdiag842.blob.core.windows.net
URL: https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.193.68 Redmond, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
7144d56de02b26e69b23e7200d156dccb2965de01c6bc12166a401e210506149

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
webdatamltrainingdiag842.blob.core.windows.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
Connection
keep-alive
Cache-Control
no-cache
Referer
https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Sun, 21 Apr 2019 06:07:53 GMT
Last-Modified
Mon, 08 Apr 2019 07:26:32 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag
0x8D6BBF38689380A
Content-Type
text/javascript
x-ms-request-id
2476da43-701e-0066-0208-f8022e000000
x-ms-version
2009-09-19
Content-Length
9253
global-style-1.0.css
www.ameriprise.com/cm/public/platform/
3 KB
2 KB
Stylesheet
General
Full URL
https://www.ameriprise.com/cm/public/platform/global-style-1.0.css
Requested by
Host: webdatamltrainingdiag842.blob.core.windows.net
URL: https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.49.118 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-37-49-118.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a9069d5082b599f4456f55111847d45cfd0bac423f0548bca1482efa8880d8b6
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sun, 21 Apr 2019 06:07:53 GMT
Content-Encoding
gzip
Last-Modified
Sun, 23 Jul 2017 04:34:11 GMT
Vary
Accept-Encoding
Strict-Transport-Security
max-age=15768000
Content-Type
text/css
Cache-Control
public, max-age=900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1232
bootstrap-style-3.3-amp.css
www.ameriprise.com/cm/groups/platform/documents/webassets/
115 KB
23 KB
Stylesheet
General
Full URL
https://www.ameriprise.com/cm/groups/platform/documents/webassets/bootstrap-style-3.3-amp.css
Requested by
Host: webdatamltrainingdiag842.blob.core.windows.net
URL: https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.49.118 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-37-49-118.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c37c06c7a628fed40996a25c5631bcd583a3b8ddcd22f3519b79ee2da5e3f004
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sun, 21 Apr 2019 06:07:53 GMT
Content-Encoding
gzip
Last-Modified
Sun, 23 Jul 2017 04:34:11 GMT
Vary
Accept-Encoding
Strict-Transport-Security
max-age=15768000
Content-Type
text/css
Cache-Control
public, max-age=900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
23283
ameriprise-template.css
www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/webassets/
310 KB
49 KB
Stylesheet
General
Full URL
https://www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/webassets/ameriprise-template.css
Requested by
Host: webdatamltrainingdiag842.blob.core.windows.net
URL: https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.49.118 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-37-49-118.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b56dc0013827070771ad7b224620a9ca62c7132a97b69c08c5a03674c2709ca5
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sun, 21 Apr 2019 06:07:53 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Apr 2019 03:04:58 GMT
Vary
Accept-Encoding
Strict-Transport-Security
max-age=15768000
Content-Type
text/css
Cache-Control
public, max-age=900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
49406
ameriprise-navigation-style.css
www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/webassets/
48 KB
8 KB
Stylesheet
General
Full URL
https://www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/webassets/ameriprise-navigation-style.css
Requested by
Host: webdatamltrainingdiag842.blob.core.windows.net
URL: https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.49.118 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-37-49-118.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
8341bc5e802a595390adba7e78dd7d096ebd9d205ea1637385ea07d374824c52
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sun, 21 Apr 2019 06:07:53 GMT
Content-Encoding
gzip
Last-Modified
Wed, 17 Apr 2019 03:04:58 GMT
Vary
Accept-Encoding
Strict-Transport-Security
max-age=15768000
Content-Type
text/css
Cache-Control
public, max-age=900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
7913
amp-feeding-america-logout-pro.gif
my.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/webassets/
0
1 KB
Image
General
Full URL
https://my.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/webassets/amp-feeding-america-logout-pro.gif
Requested by
Host: webdatamltrainingdiag842.blob.core.windows.net
URL: https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
129.33.102.78 Durham, United States, ASN14558 (AFS-6 - AMERIPRISE FINANCIAL SERVICES, INC., US),
Reverse DNS
my.ameriprise.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

0
bat.bing.com/action/
0
200 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=5219528&Ver=2&mid=74953d46-c77b-caa4-ce27-86ffe3b9283b&pi=576086242&lg=en-US&sw=1024&sh=768&sc=24&tl=Log%20In%20-%20Ameriprise%20Financial&r=https%3A%2F%2Fwww.ameriprise.com%2Fclient-login%2F&p=https%3A%2F%2Fwww.ameriprise.com%2Fclient-login%2F&evt=pageLoad&msclkid=N&rn=920258
Requested by
Host: webdatamltrainingdiag842.blob.core.windows.net
URL: https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
204
pragma
no-cache
date
Sun, 21 Apr 2019 06:07:53 GMT
cache-control
no-cache, must-revalidate
x-msedge-ref
Ref A: AB62EF9C0FF44DF7B901F75A2BB3D5DA Ref B: VIEEDGE0609 Ref C: 2019-04-21T06:07:53Z
access-control-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
css
fonts.googleapis.com/
3 KB
620 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Source+Sans+Pro
Requested by
Host: webdatamltrainingdiag842.blob.core.windows.net
URL: https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
e6531839aa5993377435d8f7413ce362414fc45f4196e465f398006503036db6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Sun, 21 Apr 2019 06:07:53 GMT
server
ESF
access-control-allow-origin
*
date
Sun, 21 Apr 2019 06:07:53 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection
1; mode=block
expires
Sun, 21 Apr 2019 06:07:53 GMT
Cookie set ampuserheader
my.ameriprise.com/web/register/ Frame 3489
0
0
Document
General
Full URL
https://my.ameriprise.com/web/register/ampuserheader
Requested by
Host: webdatamltrainingdiag842.blob.core.windows.net
URL: https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
129.33.102.78 Durham, United States, ASN14558 (AFS-6 - AMERIPRISE FINANCIAL SERVICES, INC., US),
Reverse DNS
my.ameriprise.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Host
my.ameriprise.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html

Response headers

Date
Sun, 21 Apr 2019 06:07:54 GMT
Content-Length
299
Connection
close
Content-Type
text/html; charset=iso-8859-1
Strict-Transport-Security
max-age=31536000
Set-Cookie
TLTSID=15CC4D5C4584A5E09D5E4D6CD72EA936;Path=/;Domain=.ameriprise.com;Expires=Sun, 21-Apr-2019 18:07:54 GMT TLTUID=4EAE8DAE55AEDA78620FE63FB7AC3C0E;Path=/;Domain=.ameriprise.com;Expires=Fri, 11-Dec-2020 06:07:54 GMT TS01e6a124=012d122f6f4cf374a55cb52e3187eb337db818cd4a1767b235c708f60a67f39c7190dbdf52a2bf8b2526debc162c5034db9d7fb119; Path=/; Secure; HTTPOnly TS0191c4a1=012d122f6fe62bbbd211b2aabf792514d5fb3df12a1767b235c708f60a67f39c7190dbdf52158ecdc0c021131e1270a5dcba9ab7dd9bbc99e33bd5a9c87a4365509ef5e31d090a6e0a121c0a17ac5d3f0ab59f04fe; path=/; domain=.ameriprise.com; HTTPonly; Secure
/
www.ameriprise.com/client-login/ Frame D483
Redirect Chain
  • https://my.ameriprise.com/FinancialAccounts/html/LOGIN.HTML
  • https://www.ameriprise.com/client-login/?TYPE=33554433&REALMOID=06-000932b0-5f64-1bdb-b320-ef6d9fca0000&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=clientportalmyfa_cportb00_wa_agent&TARGET=$SM$htt...
0
0
Document
General
Full URL
https://www.ameriprise.com/client-login/?TYPE=33554433&REALMOID=06-000932b0-5f64-1bdb-b320-ef6d9fca0000&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=clientportalmyfa_cportb00_wa_agent&TARGET=$SM$http%3a%2f%2fmy%2eameriprise%2ecom%2fFinancialAccounts%2fhtml%2fLOGIN%2eHTML
Requested by
Host: webdatamltrainingdiag842.blob.core.windows.net
URL: https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.49.118 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-37-49-118.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Host
www.ameriprise.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
Accept-Encoding
gzip, deflate, br
Cookie
TLTSID=E5BF2807CDB4A85EAB1B68A96F3AE7A1; TLTUID=5A55B1CB17ED3C6F784E0F511CB26119; TS0191c4a1=012d122f6fbf857a429843b392cce41a52d6262ec07ee186b0dbb35dc7e4dfcdaaccf48ba33818ba3c3891c67d244e532f04aeca3a969040e474bc29a513a6fdeecfdf57a78bb6d5e80062875b9818a96082f8fb7c
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html

Response headers

Pragma
no-cache
X-XSS-Protection
1; mode=block
X-ORACLE-DMS-RID
0
X-Frame-Options
SAMEORIGIN
Content-Type
text/html;charset=utf-8
Content-Encoding
gzip
Content-Length
4011
X-EdgeConnect-MidMile-RTT
0 0
X-EdgeConnect-Origin-MEX-Latency
501 501
Cache-Control
no-cache, no-store, must-revalidate
Expires
Sun, 21 Apr 2019 06:07:54 GMT
Date
Sun, 21 Apr 2019 06:07:54 GMT
Connection
keep-alive
Vary
Accept-Encoding
Strict-Transport-Security
max-age=15768000

Redirect headers

Date
Sun, 21 Apr 2019 06:07:54 GMT
Cache-Control
no-store
Location
https://www.ameriprise.com/client-login/?TYPE=33554433&REALMOID=06-000932b0-5f64-1bdb-b320-ef6d9fca0000&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=clientportalmyfa_cportb00_wa_agent&TARGET=$SM$http%3a%2f%2fmy%2eameriprise%2ecom%2fFinancialAccounts%2fhtml%2fLOGIN%2eHTML
Content-Length
478
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=iso-8859-1
Strict-Transport-Security
max-age=31536000
Set-Cookie
TLTSID=E5BF2807CDB4A85EAB1B68A96F3AE7A1;Path=/;Domain=.ameriprise.com;Expires=Sun, 21-Apr-2019 18:07:54 GMT TLTUID=5A55B1CB17ED3C6F784E0F511CB26119;Path=/;Domain=.ameriprise.com;Expires=Fri, 11-Dec-2020 06:07:54 GMT TS01e6a124=012d122f6f196736a064cdc4125f01d35f9d4d8de87ee186b0dbb35dc7e4dfcdaaccf48ba36da91f0ff580c198fcae5f8dad8aaff3; Path=/; Secure; HTTPOnly TS0191c4a1=012d122f6fbf857a429843b392cce41a52d6262ec07ee186b0dbb35dc7e4dfcdaaccf48ba33818ba3c3891c67d244e532f04aeca3a969040e474bc29a513a6fdeecfdf57a78bb6d5e80062875b9818a96082f8fb7c; path=/; domain=.ameriprise.com; HTTPonly; Secure
satellite-590a3eff64746d2514000177.html
assets.adobedtm.com/7846f6d0f60a64efbba45d8943bae8935d8d2d7d/scripts/ Frame FE9E
0
0
Document
General
Full URL
https://assets.adobedtm.com/7846f6d0f60a64efbba45d8943bae8935d8d2d7d/scripts/satellite-590a3eff64746d2514000177.html
Requested by
Host: webdatamltrainingdiag842.blob.core.windows.net
URL: https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.232.23 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash

Request headers

:method
GET
:authority
assets.adobedtm.com
:scheme
https
:path
/7846f6d0f60a64efbba45d8943bae8935d8d2d7d/scripts/satellite-590a3eff64746d2514000177.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html

Response headers

status
200
server
Apache
etag
"d373009428e95a37e4e63e36c9cda7b6:1555069557"
last-modified
Fri, 12 Apr 2019 11:45:56 GMT
accept-ranges
bytes
content-type
text/html
vary
Accept-Encoding
content-encoding
gzip
content-length
634
cache-control
max-age=3600
expires
Sun, 21 Apr 2019 07:07:53 GMT
date
Sun, 21 Apr 2019 06:07:53 GMT
timing-allow-origin
*
activityi;dc_pre=CNWhmeHC4OECFRD3dwodUWEKYg;src=4266532;type=pagev228;cat=total0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5999108722899.109
4266532.fls.doubleclick.net/ Frame 02ED
Redirect Chain
  • https://4266532.fls.doubleclick.net/activityi;src=4266532;type=pagev228;cat=total0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5999108722899.109?
  • https://4266532.fls.doubleclick.net/activityi;dc_pre=CNWhmeHC4OECFRD3dwodUWEKYg;src=4266532;type=pagev228;cat=total0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5999108722899.109?
0
0
Document
General
Full URL
https://4266532.fls.doubleclick.net/activityi;dc_pre=CNWhmeHC4OECFRD3dwodUWEKYg;src=4266532;type=pagev228;cat=total0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5999108722899.109?
Requested by
Host: webdatamltrainingdiag842.blob.core.windows.net
URL: https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.58.207.38 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra16s24-in-f6.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
4266532.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=CNWhmeHC4OECFRD3dwodUWEKYg;src=4266532;type=pagev228;cat=total0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5999108722899.109?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
date
Sun, 21 Apr 2019 06:07:53 GMT
expires
Sun, 21 Apr 2019 06:07:53 GMT
cache-control
private, max-age=0
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
319
x-xss-protection
0
set-cookie
IDE=AHWqTUls1VwVm6u96vdIAF0ZNIqTeYKW2pS0qY87wmfiF-MWfbt8C-3YFVp70jV2; expires=Fri, 15-May-2020 06:07:53 GMT; path=/; domain=.doubleclick.net; HttpOnly test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
date
Sun, 21 Apr 2019 06:07:53 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://4266532.fls.doubleclick.net/activityi;dc_pre=CNWhmeHC4OECFRD3dwodUWEKYg;src=4266532;type=pagev228;cat=total0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5999108722899.109?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Sun, 21-Apr-2019 06:22:53 GMT; path=/; domain=.doubleclick.net
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
amp-project-star-logo-retina.png
www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/images/
10 KB
10 KB
Image
General
Full URL
https://www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/images/amp-project-star-logo-retina.png
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.11.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.49.118 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-37-49-118.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
3967008ea6ef67d52ee726b04f1902a8b6e35a0ff995d7847ae0b808a1259652
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/webassets/ameriprise-navigation-style.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sun, 21 Apr 2019 06:07:53 GMT
Content-Encoding
gzip
Last-Modified
Wed, 03 Oct 2018 03:01:38 GMT
Vary
Accept-Encoding
Strict-Transport-Security
max-age=15768000
Content-Type
image/png
Cache-Control
public, max-age=900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
10338
ampf-retina-social-icons.png
www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/images/
7 KB
7 KB
Image
General
Full URL
https://www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/images/ampf-retina-social-icons.png
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.11.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.49.118 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-37-49-118.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b88f350293bdf7c3ea68e9a9fec451acd2b157d9070b4932ab771120c65ba72b
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/webassets/ameriprise-navigation-style.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sun, 21 Apr 2019 06:07:53 GMT
Content-Encoding
gzip
Last-Modified
Wed, 03 Oct 2018 03:01:38 GMT
Vary
Accept-Encoding
Strict-Transport-Security
max-age=15768000
Content-Type
image/png
Cache-Control
public, max-age=900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6552
ampf-nav-menu-sprite.png
www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/images/
4 KB
4 KB
Image
General
Full URL
https://www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/images/ampf-nav-menu-sprite.png
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.11.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.49.118 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-37-49-118.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fecda93e73ba6207a1b41c7d938950da96fdc29adc42ae2cb4a7818aa2fed274
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/webassets/ameriprise-navigation-style.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sun, 21 Apr 2019 06:07:53 GMT
Content-Encoding
gzip
Last-Modified
Sun, 23 Jul 2017 04:40:42 GMT
Vary
Accept-Encoding
Strict-Transport-Security
max-age=15768000
Content-Type
image/png
Cache-Control
public, max-age=900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3768
ampf-client-sprite.png
www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/images/
4 KB
4 KB
Image
General
Full URL
https://www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/images/ampf-client-sprite.png
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.11.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.49.118 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-37-49-118.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
49cfe016f7e4deb7e2baaa690a5234bec87ced2e7163f310d918e5dbc4f5c9ef
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/webassets/ameriprise-navigation-style.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sun, 21 Apr 2019 06:07:53 GMT
Content-Encoding
gzip
Last-Modified
Wed, 03 Oct 2018 03:01:38 GMT
Vary
Accept-Encoding
Strict-Transport-Security
max-age=15768000
Content-Type
image/png
Cache-Control
public, max-age=900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3709
d-031769.png
www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/images/
8 KB
9 KB
Image
General
Full URL
https://www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/images/d-031769.png
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.11.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.49.118 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-37-49-118.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e042411b40f152a533b1c5569cdf10a825b31cc85e40d79d1e88ae247682ed63
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/webassets/ameriprise-template.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sun, 21 Apr 2019 06:07:53 GMT
Content-Encoding
gzip
Last-Modified
Sun, 23 Jul 2017 04:39:19 GMT
Vary
Accept-Encoding
Strict-Transport-Security
max-age=15768000
Content-Type
image/png
Cache-Control
public, max-age=900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
8506
amp-feeding-america-logout-bg.gif
www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/webassets/
3 KB
3 KB
Image
General
Full URL
https://www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/webassets/amp-feeding-america-logout-bg.gif
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.11.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.49.118 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-37-49-118.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2dc837ee84a3a90b4fb31c0e7986f34ce5b8b1e97bcca84cf0965f71e716d5fd
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/webassets/ameriprise-template.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sun, 21 Apr 2019 06:07:53 GMT
Content-Encoding
gzip
Last-Modified
Sun, 23 Jul 2017 04:38:52 GMT
Vary
Accept-Encoding
Strict-Transport-Security
max-age=15768000
Content-Type
image/gif
Cache-Control
public, max-age=900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2522
norton-seal-public-site.png
www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/images/
12 KB
12 KB
Image
General
Full URL
https://www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/images/norton-seal-public-site.png
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.11.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.49.118 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-37-49-118.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
48d9360c9ba99ab3295c42e846033a08c5448518c27662814f7c324f9503bfb2
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/webassets/ameriprise-navigation-style.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sun, 21 Apr 2019 06:07:53 GMT
Content-Encoding
gzip
Last-Modified
Thu, 25 Oct 2018 02:11:00 GMT
Vary
Accept-Encoding
Strict-Transport-Security
max-age=15768000
Content-Type
image/png
Cache-Control
public, max-age=900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
11923
franklin-gothic-lt-woff.woff
www.ameriprise.com/cm/public/platform/
34 KB
34 KB
Font
General
Full URL
https://www.ameriprise.com/cm/public/platform/franklin-gothic-lt-woff.woff
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.11.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.49.118 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-37-49-118.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
7b6ff6274453a8abf9c54eaf4554d25af222ec2fa4ef029c81eb81a2fab606ae
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.ameriprise.com/cm/public/platform/global-style-1.0.css
Origin
https://webdatamltrainingdiag842.blob.core.windows.net

Response headers

Date
Sun, 21 Apr 2019 06:07:53 GMT
Last-Modified
Wed, 23 May 2018 03:23:57 GMT
Strict-Transport-Security
max-age=15768000
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=86400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
34504
franklin-gothic-bk-woff.woff
www.ameriprise.com/cm/public/platform/
32 KB
33 KB
Font
General
Full URL
https://www.ameriprise.com/cm/public/platform/franklin-gothic-bk-woff.woff
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.11.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.49.118 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-37-49-118.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
7e09521ddee3d795a7b76e2540c3f4fbf69431a9edc339315e9b7e4c6a783cca
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/webassets/ameriprise-template.css
Origin
https://webdatamltrainingdiag842.blob.core.windows.net

Response headers

Date
Sun, 21 Apr 2019 06:07:53 GMT
Last-Modified
Tue, 08 May 2018 22:12:38 GMT
Strict-Transport-Security
max-age=15768000
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=86400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
33236
franklin-gothic-md-woff.woff
www.ameriprise.com/cm/groups/platform/documents/webassets/
32 KB
33 KB
Font
General
Full URL
https://www.ameriprise.com/cm/groups/platform/documents/webassets/franklin-gothic-md-woff.woff
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.11.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.49.118 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-37-49-118.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b388dcbba9592b98652d278162de405aa595bdb59cabe041eae649e9460cb74e
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/webassets/ameriprise-template.css
Origin
https://webdatamltrainingdiag842.blob.core.windows.net

Response headers

Date
Sun, 21 Apr 2019 06:07:53 GMT
Last-Modified
Tue, 08 May 2018 22:13:11 GMT
Strict-Transport-Security
max-age=15768000
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=86400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
33144
georgia-pro-bk-woff.woff
www.ameriprise.com/cm/groups/platform/documents/webassets/
63 KB
63 KB
Font
General
Full URL
https://www.ameriprise.com/cm/groups/platform/documents/webassets/georgia-pro-bk-woff.woff
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.11.3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.37.49.118 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-37-49-118.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e6351560c905099738ef63d315bd228a3a6460c0940df917ed705ebce1cc8d32
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://www.ameriprise.com/cm/groups/web/@amp/@ameriprise/documents/webassets/ameriprise-template.css
Origin
https://webdatamltrainingdiag842.blob.core.windows.net

Response headers

Date
Sun, 21 Apr 2019 06:07:53 GMT
Last-Modified
Sun, 23 Jul 2017 04:34:26 GMT
Strict-Transport-Security
max-age=15768000
Content-Type
application/font-woff
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=86400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
64572
instrument.css
webdatamltrainingdiag842.blob.core.windows.net/vdomlabeltask2/
5 KB
5 KB
Stylesheet
General
Full URL
https://webdatamltrainingdiag842.blob.core.windows.net/vdomlabeltask2/instrument.css?v=1555826873870
Requested by
Host: webdatamltrainingdiag842.blob.core.windows.net
URL: https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/CleanBodyHighlight.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.193.68 Redmond, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
a09f84d36357f72d0d3b6cbe441b139a23d24909ac54dbacb067ed9974b285c8

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
webdatamltrainingdiag842.blob.core.windows.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
Connection
keep-alive
Cache-Control
no-cache
Referer
https://webdatamltrainingdiag842.blob.core.windows.net/genericheader/20190405165053.GenericHeader_FineTune.3C017B21E5D62EA5AB7BA095EAB54A02.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Sun, 21 Apr 2019 06:07:53 GMT
Last-Modified
Mon, 15 Apr 2019 22:44:27 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag
0x8D6C1F3EABCBBDF
Content-Type
text/css
x-ms-request-id
2476db09-701e-0066-3b08-f8022e000000
x-ms-version
2009-09-19
Content-Length
4871

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Ameriprise Financial (Financial)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery object| keepXPathObjectHere number| numXPress object| operationStack object| targetWindow string| cssDirectory object| dcNodeIdMap function| getElementByNodeId function| linkToCss function| jsGetPositiveNodes function| jsGetInnerText function| jsGetInnerTextForArray function| jsGetHtml function| undo function| addLabel function| removeLabel function| sendPositiveNodes object| jQuery111302378235840871794

5 Cookies

Domain/Path Name / Value
.doubleclick.net/ Name: IDE
Value: AHWqTUls1VwVm6u96vdIAF0ZNIqTeYKW2pS0qY87wmfiF-MWfbt8C-3YFVp70jV2
.ameriprise.com/ Name: TLTUID
Value: 88F945DE5157FE76B181726542D99453
.ameriprise.com/ Name: TS0191c4a1
Value: 012d122f6f37b133dc7c43983912e26c1371f4696104a027bb7ad5fff67c4e5d8c59db5d5adb5f4b283d4bb1e98cce6e46409fc674057a8d09b257ce8f46b28be97624c608ad9baade1de9c2f353cc39cc4ddcdfa8
my.ameriprise.com/ Name: TS01e6a124
Value: 012d122f6f212ae7e714077ce1ea094d04f47a928304a027bb7ad5fff67c4e5d8c59db5d5afe1bbfe53021c7458bb958fd5d9fd2e9
.ameriprise.com/ Name: TLTSID
Value: 42E542796124ACDC63B7955466A1DD7A

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4266532.fls.doubleclick.net
assets.adobedtm.com
bat.bing.com
code.jquery.com
fonts.googleapis.com
my.ameriprise.com
webdatamltrainingdiag842.blob.core.windows.net
www.ameriprise.com
129.33.102.78
2.18.232.23
205.185.208.52
216.58.207.38
23.37.49.118
2620:1ec:c11::200
2a00:1450:4001:81f::200a
52.239.193.68
2dc837ee84a3a90b4fb31c0e7986f34ce5b8b1e97bcca84cf0965f71e716d5fd
3967008ea6ef67d52ee726b04f1902a8b6e35a0ff995d7847ae0b808a1259652
48d9360c9ba99ab3295c42e846033a08c5448518c27662814f7c324f9503bfb2
49cfe016f7e4deb7e2baaa690a5234bec87ced2e7163f310d918e5dbc4f5c9ef
7144d56de02b26e69b23e7200d156dccb2965de01c6bc12166a401e210506149
7b6ff6274453a8abf9c54eaf4554d25af222ec2fa4ef029c81eb81a2fab606ae
7e09521ddee3d795a7b76e2540c3f4fbf69431a9edc339315e9b7e4c6a783cca
8341bc5e802a595390adba7e78dd7d096ebd9d205ea1637385ea07d374824c52
a09f84d36357f72d0d3b6cbe441b139a23d24909ac54dbacb067ed9974b285c8
a9069d5082b599f4456f55111847d45cfd0bac423f0548bca1482efa8880d8b6
b388dcbba9592b98652d278162de405aa595bdb59cabe041eae649e9460cb74e
b56dc0013827070771ad7b224620a9ca62c7132a97b69c08c5a03674c2709ca5
b88f350293bdf7c3ea68e9a9fec451acd2b157d9070b4932ab771120c65ba72b
c37c06c7a628fed40996a25c5631bcd583a3b8ddcd22f3519b79ee2da5e3f004
d8078c97e602f8967be49c0b1d2ffc2c383a6793a32cd97765593188a845fc6e
e042411b40f152a533b1c5569cdf10a825b31cc85e40d79d1e88ae247682ed63
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6351560c905099738ef63d315bd228a3a6460c0940df917ed705ebce1cc8d32
e6531839aa5993377435d8f7413ce362414fc45f4196e465f398006503036db6
ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8
fecda93e73ba6207a1b41c7d938950da96fdc29adc42ae2cb4a7818aa2fed274