bank-demo.sandbox-eks.token.io Open in urlscan Pro
3.64.106.33  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response bank-demo.sandbox-eks.token.io/	1 KB 1 KB	35ms 12ms	Document text/html	3.64.106.33 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bank-demo.sandbox-eks.token.io/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 3.64.106.33 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-64-106-33.eu-central-1.compute.amazonaws.com Software / Resource Hash 19528cf8b8777cb9e5a2a4efdc5816c6ad8f97bf5c37dbdb4a7882ea3f511b40 Security Headers Name Value Content-Security-Policy default-src 'self';script-src 'self' https://*.token.io 'sha256-88lD4YFmGJkSZZVxhnTv+rpgZNYYr006rFEeJDhqOsQ=';connect-src 'self' https://*.token.io;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;font-src 'self' 'unsafe-inline' https://fonts.gstatic.com data:;frame-src 'self' https://*.token.io Strict-Transport-Security max-age=15724800; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes cache-control private, no-cache, no-store, must-revalidate content-encoding gzip content-security-policy default-src 'self';script-src 'self' https://*.token.io 'sha256-88lD4YFmGJkSZZVxhnTv+rpgZNYYr006rFEeJDhqOsQ=';connect-src 'self' https://*.token.io;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;font-src 'self' 'unsafe-inline' https://fonts.gstatic.com data:;frame-src 'self' https://*.token.io content-type text/html; charset=UTF-8 date Thu, 23 Feb 2023 15:19:24 GMT etag W/"49e-1867a007c9d" expect-ct max-age=0 expires -1 last-modified Wed, 22 Feb 2023 16:41:37 GMT pragma no-cache referrer-policy no-referrer strict-transport-security max-age=15724800; includeSubDomains vary Accept-Encoding x-content-type-options nosniff x-dns-prefetch-control off x-download-options noopen x-frame-options SAMEORIGIN x-permitted-cross-domain-policies none x-xss-protection 0
GET H2	200	css fonts.googleapis.com/	2 KB 981 B	110ms 44ms	Stylesheet text/css	2a00:1450:400d:80c::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto+Slab:400 Requested by Host: bank-demo.sandbox-eks.token.io URL: https://bank-demo.sandbox-eks.token.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:80c::200a , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 104a4a5f9dc5812a9fb4c4d6ba6594ce850ae344fdf658dd49cda44feed20881 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Thu, 23 Feb 2023 15:19:24 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 23 Feb 2023 14:07:32 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 23 Feb 2023 15:19:24 GMT
GET H2	200	css fonts.googleapis.com/	6 KB 771 B	111ms 45ms	Stylesheet text/css	2a00:1450:400d:80c::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600,700 Requested by Host: bank-demo.sandbox-eks.token.io URL: https://bank-demo.sandbox-eks.token.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:80c::200a , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash e3a3e39fca849dd5ca088dcb3176b67eb7258689b1e4b63f7f410e8479a7bf64 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Thu, 23 Feb 2023 15:19:24 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 23 Feb 2023 15:15:05 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 23 Feb 2023 15:19:24 GMT
GET H2	200	app.min.e6578a06b5.css bank-demo.sandbox-eks.token.io/assets/	68 KB 10 KB	17ms 16ms	Stylesheet text/css	3.64.106.33 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bank-demo.sandbox-eks.token.io/assets/app.min.e6578a06b5.css Requested by Host: bank-demo.sandbox-eks.token.io URL: https://bank-demo.sandbox-eks.token.io/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 3.64.106.33 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-64-106-33.eu-central-1.compute.amazonaws.com Software / Resource Hash aa0ae63ae2445af6695435890792274b039486afcafbff9138c1e06d74eb9255 Security Headers Name Value Content-Security-Policy default-src 'self';script-src 'self' https://*.token.io 'sha256-88lD4YFmGJkSZZVxhnTv+rpgZNYYr006rFEeJDhqOsQ=';connect-src 'self' https://*.token.io;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;font-src 'self' 'unsafe-inline' https://fonts.gstatic.com data:;frame-src 'self' https://*.token.io Strict-Transport-Security max-age=15724800; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Thu, 23 Feb 2023 15:19:24 GMT content-security-policy default-src 'self';script-src 'self' https://*.token.io 'sha256-88lD4YFmGJkSZZVxhnTv+rpgZNYYr006rFEeJDhqOsQ=';connect-src 'self' https://*.token.io;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;font-src 'self' 'unsafe-inline' https://fonts.gstatic.com data:;frame-src 'self' https://*.token.io x-content-type-options nosniff strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip x-permitted-cross-domain-policies none x-dns-prefetch-control off x-xss-protection 0 referrer-policy no-referrer last-modified Thu, 15 Sep 2022 16:34:13 GMT etag W/"10e5f-18342003388" x-download-options noopen expect-ct max-age=0 x-frame-options SAMEORIGIN content-type text/css; charset=UTF-8 vary Accept-Encoding cache-control public, max-age=31557 accept-ranges bytes
GET H2	200	environment.js Show response bank-demo.sandbox-eks.token.io/	368 B 1 KB	15ms 15ms	Script application/javascript	3.64.106.33 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bank-demo.sandbox-eks.token.io/environment.js Requested by Host: bank-demo.sandbox-eks.token.io URL: https://bank-demo.sandbox-eks.token.io/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 3.64.106.33 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-64-106-33.eu-central-1.compute.amazonaws.com Software / Resource Hash 2ea7d25fb5228fa2ef073df73eade8956401106aa32361eb6bacf9c8273dffd4 Security Headers Name Value Content-Security-Policy default-src 'self';script-src 'self' https://*.token.io 'sha256-88lD4YFmGJkSZZVxhnTv+rpgZNYYr006rFEeJDhqOsQ=';connect-src 'self' https://*.token.io;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;font-src 'self' 'unsafe-inline' https://fonts.gstatic.com data:;frame-src 'self' https://*.token.io Strict-Transport-Security max-age=15724800; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Thu, 23 Feb 2023 15:19:24 GMT content-security-policy default-src 'self';script-src 'self' https://*.token.io 'sha256-88lD4YFmGJkSZZVxhnTv+rpgZNYYr006rFEeJDhqOsQ=';connect-src 'self' https://*.token.io;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;font-src 'self' 'unsafe-inline' https://fonts.gstatic.com data:;frame-src 'self' https://*.token.io x-content-type-options nosniff strict-transport-security max-age=15724800; includeSubDomains x-permitted-cross-domain-policies none x-dns-prefetch-control off content-length 368 x-xss-protection 0 pragma no-cache referrer-policy no-referrer last-modified Wed, 22 Feb 2023 16:41:37 GMT etag W/"170-1867a007c9d" expect-ct max-age=0 x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/javascript; charset=UTF-8 x-download-options noopen cache-control private, no-cache, no-store, must-revalidate accept-ranges bytes expires -1
GET H2	200	bankconfig.js Show response bank-demo.sandbox-eks.token.io/	26 KB 3 KB	17ms 17ms	Script application/javascript	3.64.106.33 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bank-demo.sandbox-eks.token.io/bankconfig.js Requested by Host: bank-demo.sandbox-eks.token.io URL: https://bank-demo.sandbox-eks.token.io/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 3.64.106.33 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-64-106-33.eu-central-1.compute.amazonaws.com Software / Resource Hash acac81f706821cced0dc04763eb40515212ed6387a6f6b8e3d1b4905ba39e790 Security Headers Name Value Content-Security-Policy default-src 'self';script-src 'self' https://*.token.io 'sha256-88lD4YFmGJkSZZVxhnTv+rpgZNYYr006rFEeJDhqOsQ=';connect-src 'self' https://*.token.io;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;font-src 'self' 'unsafe-inline' https://fonts.gstatic.com data:;frame-src 'self' https://*.token.io Strict-Transport-Security max-age=15724800; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Thu, 23 Feb 2023 15:19:24 GMT content-security-policy default-src 'self';script-src 'self' https://*.token.io 'sha256-88lD4YFmGJkSZZVxhnTv+rpgZNYYr006rFEeJDhqOsQ=';connect-src 'self' https://*.token.io;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;font-src 'self' 'unsafe-inline' https://fonts.gstatic.com data:;frame-src 'self' https://*.token.io x-content-type-options nosniff strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip x-permitted-cross-domain-policies none x-dns-prefetch-control off x-xss-protection 0 pragma no-cache referrer-policy no-referrer last-modified Wed, 22 Feb 2023 16:41:37 GMT etag W/"68b6-1867a007c9d" x-download-options noopen expect-ct max-age=0 x-frame-options SAMEORIGIN content-type application/javascript; charset=UTF-8 vary Accept-Encoding cache-control private, no-cache, no-store, must-revalidate accept-ranges bytes expires -1
GET H2	200	vendor.min.98019f7c82.js Show response bank-demo.sandbox-eks.token.io/assets/	223 KB 74 KB	25ms 24ms	Script application/javascript	3.64.106.33 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bank-demo.sandbox-eks.token.io/assets/vendor.min.98019f7c82.js Requested by Host: bank-demo.sandbox-eks.token.io URL: https://bank-demo.sandbox-eks.token.io/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 3.64.106.33 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-64-106-33.eu-central-1.compute.amazonaws.com Software / Resource Hash 92cf1f440c933b7b965201896ad7d6a38e0b637db117c3589d488c6226fa90bc Security Headers Name Value Content-Security-Policy default-src 'self';script-src 'self' https://*.token.io 'sha256-88lD4YFmGJkSZZVxhnTv+rpgZNYYr006rFEeJDhqOsQ=';connect-src 'self' https://*.token.io;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;font-src 'self' 'unsafe-inline' https://fonts.gstatic.com data:;frame-src 'self' https://*.token.io Strict-Transport-Security max-age=15724800; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Thu, 23 Feb 2023 15:19:24 GMT content-security-policy default-src 'self';script-src 'self' https://*.token.io 'sha256-88lD4YFmGJkSZZVxhnTv+rpgZNYYr006rFEeJDhqOsQ=';connect-src 'self' https://*.token.io;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;font-src 'self' 'unsafe-inline' https://fonts.gstatic.com data:;frame-src 'self' https://*.token.io x-content-type-options nosniff strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip x-permitted-cross-domain-policies none x-dns-prefetch-control off x-xss-protection 0 referrer-policy no-referrer last-modified Thu, 15 Sep 2022 16:34:13 GMT etag W/"37bf1-18342003388" x-download-options noopen expect-ct max-age=0 x-frame-options SAMEORIGIN content-type application/javascript; charset=UTF-8 vary Accept-Encoding cache-control public, max-age=31557 accept-ranges bytes
GET H2	200	app.min.f2dbc1e0f4.js Show response bank-demo.sandbox-eks.token.io/assets/	403 KB 114 KB	26ms 25ms	Script application/javascript	3.64.106.33 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://bank-demo.sandbox-eks.token.io/assets/app.min.f2dbc1e0f4.js Requested by Host: bank-demo.sandbox-eks.token.io URL: https://bank-demo.sandbox-eks.token.io/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 3.64.106.33 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-64-106-33.eu-central-1.compute.amazonaws.com Software / Resource Hash 439cf94a1cb3cab09fa3277f08133f774fb115522c3c5b7d6be34c0e75963299 Security Headers Name Value Content-Security-Policy default-src 'self';script-src 'self' https://*.token.io 'sha256-88lD4YFmGJkSZZVxhnTv+rpgZNYYr006rFEeJDhqOsQ=';connect-src 'self' https://*.token.io;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;font-src 'self' 'unsafe-inline' https://fonts.gstatic.com data:;frame-src 'self' https://*.token.io Strict-Transport-Security max-age=15724800; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Thu, 23 Feb 2023 15:19:24 GMT content-security-policy default-src 'self';script-src 'self' https://*.token.io 'sha256-88lD4YFmGJkSZZVxhnTv+rpgZNYYr006rFEeJDhqOsQ=';connect-src 'self' https://*.token.io;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;font-src 'self' 'unsafe-inline' https://fonts.gstatic.com data:;frame-src 'self' https://*.token.io x-content-type-options nosniff strict-transport-security max-age=15724800; includeSubDomains content-encoding gzip x-permitted-cross-domain-policies none x-dns-prefetch-control off x-xss-protection 0 referrer-policy no-referrer last-modified Thu, 15 Sep 2022 16:34:13 GMT etag W/"64c40-18342003388" x-download-options noopen expect-ct max-age=0 x-frame-options SAMEORIGIN content-type application/javascript; charset=UTF-8 vary Accept-Encoding cache-control public, max-age=31557 accept-ranges bytes
GET H2	200	token.js Show response web-app.sandbox.token.io/	105 KB 37 KB	94ms 14ms	Script application/javascript	3.123.49.97 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://web-app.sandbox.token.io/token.js Requested by Host: bank-demo.sandbox-eks.token.io URL: https://bank-demo.sandbox-eks.token.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.123.49.97 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-123-49-97.eu-central-1.compute.amazonaws.com Software envoy / Resource Hash 186133dd66d4fa25082a9e6fd3c7641edec0955ec9d2df8e889f20049e7a8cea Security Headers Name Value Content-Security-Policy default-src 'self';script-src 'self' 'nonce-d901b90e-5826-4f7b-9c46-ea166f120eb8' 'nonce-f5322da6-f47f-43c4-9d07-b9cd3cf43ae6' 'nonce-54ca891e-5ca0-4a78-972e-823f1c8f6d9d' 'nonce-06c9e793-f432-4397-a2b1-7eee9588458d';img-src 'self' https://s3-us-west-2.amazonaws.com/tokenio-assets/ data:;frame-src 'self' https://*.token.io;connect-src 'self' https://*.token.io https://online.ebury.com/ http://ebo.localhost/ https://*.sentry.io/ https://ingest.lightstep.com/ https://ipinfo.io/;style-src 'self' https://fonts.googleapis.com;font-src 'self' https://fonts.gstatic.com;upgrade-insecure-requests Strict-Transport-Security max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers content-security-policy default-src 'self';script-src 'self' 'nonce-d901b90e-5826-4f7b-9c46-ea166f120eb8' 'nonce-f5322da6-f47f-43c4-9d07-b9cd3cf43ae6' 'nonce-54ca891e-5ca0-4a78-972e-823f1c8f6d9d' 'nonce-06c9e793-f432-4397-a2b1-7eee9588458d';img-src 'self' https://s3-us-west-2.amazonaws.com/tokenio-assets/ data:;frame-src 'self' https://*.token.io;connect-src 'self' https://*.token.io https://online.ebury.com/ http://ebo.localhost/ https://*.sentry.io/ https://ingest.lightstep.com/ https://ipinfo.io/;style-src 'self' https://fonts.googleapis.com;font-src 'self' https://fonts.gstatic.com;upgrade-insecure-requests strict-transport-security max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains x-content-type-options nosniff date Thu, 23 Feb 2023 15:19:23 GMT content-encoding gzip x-permitted-cross-domain-policies none surrogate-control no-store x-dns-prefetch-control off x-envoy-upstream-service-time 5 x-xss-protection 0 pragma no-cache referrer-policy no-referrer last-modified Tue, 21 Feb 2023 06:49:49 GMT server envoy etag W/"1a382-18672bc4ec8" expect-ct max-age=0 x-frame-options DENY vary Accept-Encoding x-download-options noopen access-control-allow-origin * content-type application/javascript; charset=utf-8 cache-control no-store, no-cache, must-revalidate, proxy-revalidate accept-ranges bytes expires 0
GET H2	200	iron bank-demo.sandbox-eks.token.io/bank-logo/	7 KB 8 KB	11ms 11ms	Image image/png	3.64.106.33 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://bank-demo.sandbox-eks.token.io/bank-logo/iron Requested by Host: bank-demo.sandbox-eks.token.io URL: https://bank-demo.sandbox-eks.token.io/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 3.64.106.33 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-64-106-33.eu-central-1.compute.amazonaws.com Software / Resource Hash 77771f4c7291b94039d5e7d921022f23247c4b1cc582a8ba3245ac3e5f98fdd4 Security Headers Name Value Content-Security-Policy default-src 'self';script-src 'self' https://*.token.io 'sha256-88lD4YFmGJkSZZVxhnTv+rpgZNYYr006rFEeJDhqOsQ=';connect-src 'self' https://*.token.io;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;font-src 'self' 'unsafe-inline' https://fonts.gstatic.com data:;frame-src 'self' https://*.token.io Strict-Transport-Security max-age=15724800; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Thu, 23 Feb 2023 15:19:24 GMT content-security-policy default-src 'self';script-src 'self' https://*.token.io 'sha256-88lD4YFmGJkSZZVxhnTv+rpgZNYYr006rFEeJDhqOsQ=';connect-src 'self' https://*.token.io;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;font-src 'self' 'unsafe-inline' https://fonts.gstatic.com data:;frame-src 'self' https://*.token.io x-content-type-options nosniff strict-transport-security max-age=15724800; includeSubDomains x-permitted-cross-domain-policies none x-dns-prefetch-control off content-length 7571 x-xss-protection 0 pragma no-cache referrer-policy no-referrer last-modified Thu, 15 Sep 2022 16:34:13 GMT etag W/"1d93-18342003388" expect-ct max-age=0 x-frame-options SAMEORIGIN content-type image/png x-download-options noopen cache-control private, no-cache, no-store, must-revalidate accept-ranges bytes expires -1
GET H2	200	6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2 fonts.gstatic.com/s/sourcesanspro/v21/	13 KB 13 KB	36ms 10ms	Font font/woff2	2a00:1450:4001:802::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcesanspro/v21/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600,700 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://bank-demo.sandbox-eks.token.io accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 17 Feb 2023 06:34:44 GMT x-content-type-options nosniff age 549880 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 13052 x-xss-protection 0 last-modified Wed, 27 Apr 2022 16:09:03 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 17 Feb 2024 06:34:44 GMT
GET H2	200	BngbUXZYTXPIvIBgJJSb6s3BzlRRfKOFbvjojISmb2Rj.woff2 fonts.gstatic.com/s/robotoslab/v24/	12 KB 13 KB	35ms 9ms	Font font/woff2	2a00:1450:4001:802::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/robotoslab/v24/BngbUXZYTXPIvIBgJJSb6s3BzlRRfKOFbvjojISmb2Rj.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto+Slab:400 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e3b93a1b0941a116dcb0ed0b5c3ea062cdcad365207c405b231094eb485d95fc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://bank-demo.sandbox-eks.token.io accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Fri, 17 Feb 2023 01:15:19 GMT x-content-type-options nosniff age 569045 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 12608 x-xss-protection 0 last-modified Mon, 11 Jul 2022 19:15:08 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 17 Feb 2024 01:15:19 GMT
GET H2	200	6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2 fonts.gstatic.com/s/sourcesanspro/v21/	13 KB 13 KB	43ms 18ms	Font font/woff2	2a00:1450:4001:802::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcesanspro/v21/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600,700 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://bank-demo.sandbox-eks.token.io accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36 Response headers date Thu, 23 Feb 2023 14:06:25 GMT x-content-type-options nosniff age 4379 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 13036 x-xss-protection 0 last-modified Wed, 27 Apr 2022 16:04:42 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Fri, 23 Feb 2024 14:06:25 GMT

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless string| BROWSER_ENV string| BANK_CONFIG object| script object| __core-js_shared__ object| core object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill function| Token

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self';script-src 'self' https://*.token.io 'sha256-88lD4YFmGJkSZZVxhnTv+rpgZNYYr006rFEeJDhqOsQ=';connect-src 'self' https://*.token.io;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;font-src 'self' 'unsafe-inline' https://fonts.gstatic.com data:;frame-src 'self' https://*.token.io
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bank-demo.sandbox-eks.token.io
fonts.googleapis.com
fonts.gstatic.com
web-app.sandbox.token.io
2a00:1450:4001:802::2003
2a00:1450:400d:80c::200a
3.123.49.97
3.64.106.33
104a4a5f9dc5812a9fb4c4d6ba6594ce850ae344fdf658dd49cda44feed20881
186133dd66d4fa25082a9e6fd3c7641edec0955ec9d2df8e889f20049e7a8cea
19528cf8b8777cb9e5a2a4efdc5816c6ad8f97bf5c37dbdb4a7882ea3f511b40
2ea7d25fb5228fa2ef073df73eade8956401106aa32361eb6bacf9c8273dffd4
439cf94a1cb3cab09fa3277f08133f774fb115522c3c5b7d6be34c0e75963299
77771f4c7291b94039d5e7d921022f23247c4b1cc582a8ba3245ac3e5f98fdd4
92cf1f440c933b7b965201896ad7d6a38e0b637db117c3589d488c6226fa90bc
aa0ae63ae2445af6695435890792274b039486afcafbff9138c1e06d74eb9255
acac81f706821cced0dc04763eb40515212ed6387a6f6b8e3d1b4905ba39e790
bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
e3a3e39fca849dd5ca088dcb3176b67eb7258689b1e4b63f7f410e8479a7bf64
e3b93a1b0941a116dcb0ed0b5c3ea062cdcad365207c405b231094eb485d95fc