axamedicalassessment.rockinsurance.com Open in urlscan Pro
2606:4700::6812:ed9 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://axamedicalassessment.rockinsurance.com/
Submission: On April 13 via manual (April 13th 2024, 1:43:55 pm UTC) from PH — Scanned from DE

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 4 domains to perform 21 HTTP transactions. The main IP is 2606:4700::6812:ed9, located in United States and belongs to CLOUDFLARENET, US. The main domain is axamedicalassessment.rockinsurance.com.
TLS certificate: Issued by GTS CA 1P5 on March 15th 2024. Valid for: 3 months.

This is the only time axamedicalassessment.rockinsurance.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Axa (Insurance)

Domain & IP information

	IP Address	AS Autonomous System
14	2606:4700::68... 2606:4700::6812:ed9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:803::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:4f49	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2600:9000:249... 2600:9000:2490:0:1f:5417:2880:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:267... 2600:9000:2670:7800:9:429c:140:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:235... 2600:9000:235a:8c00:f:6a9:200:93a1	16509 (AMAZON-02) (AMAZON-02)
21	6

14 2606:4700::6812:ed9 (United States)

ASN13335 (CLOUDFLARENET, US)

axamedicalassessment.rockinsurance.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:4f49 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2490:0:1f:5417:2880:93a1 (United States)

ASN16509 (AMAZON-02, US)

webchat.mitel.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2670:7800:9:429c:140:93a1 (United States)

ASN16509 (AMAZON-02, US)

director.api.mitel.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:235a:8c00:f:6a9:200:93a1 (United States)

ASN16509 (AMAZON-02, US)

gcp-gateway.eu.api.mitel.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	rockinsurance.com axamedicalassessment.rockinsurance.com	337 KB
4	mitel.io webchat.mitel.io — Cisco Umbrella Rank: 98887 director.api.mitel.io — Cisco Umbrella Rank: 112306 gcp-gateway.eu.api.mitel.io — Cisco Umbrella Rank: 309192	10 KB
2	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 376	97 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 831	7 KB
21	4

	Domain	Requested by
14	axamedicalassessment.rockinsurance.com	axamedicalassessment.rockinsurance.com static.cloudflareinsights.com
2	webchat.mitel.io	axamedicalassessment.rockinsurance.com webchat.mitel.io
2	ajax.googleapis.com	axamedicalassessment.rockinsurance.com
1	gcp-gateway.eu.api.mitel.io	webchat.mitel.io
1	director.api.mitel.io	webchat.mitel.io
1	static.cloudflareinsights.com	axamedicalassessment.rockinsurance.com
21	6

This site contains no links.

Subject Issuer	Validity	Valid
rockinsurance.com GTS CA 1P5	`2024-03-15` - `2024-06-13`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
cloudflareinsights.com GTS CA 1P5	`2024-03-10` - `2024-06-08`	3 months	crt.sh
webchat.mitel.io Amazon RSA 2048 M02	`2024-03-05` - `2025-04-03`	a year	crt.sh
*.api.mitel.io Amazon RSA 2048 M03	`2024-04-07` - `2025-05-06`	a year	crt.sh
*.eu.api.mitel.io Amazon RSA 2048 M03	`2024-02-08` - `2025-03-09`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://axamedicalassessment.rockinsurance.com/
Frame ID: F028136372F15BEA2C492E6A1F413A6C
Requests: 20 HTTP requests in this frame

Frame: https://webchat.mitel.io/?accountid=NGM5OGIyNTYtNWNkNC00NjExLTk2NjYtNzMzZjQwOTMyMTc3&chatname=QVhBIENvLW9wIENoYXQ=&chaturl=aHR0cHM6Ly9nY3AtZ2F0ZXdheS5ldS5hcGkubWl0ZWwuaW8vMjAxOC0wNS0yNy9tZXNzZW5nZXIvYWNjb3VudHMvNGM5OGIyNTYtNWNkNC00NjExLTk2NjYtNzMzZjQwOTMyMTc3L2NoYXRzP2NoYXRuYW1lPUFYQSBDby1vcCBDaGF0
Frame ID: C67261FF95512E61623931934DC3B5D8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Home Page - The co-operative bank

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)/jquery-ui(?:\.min)?\.js
jquery-ui.*\.js

Page Statistics

21
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

6
Subdomains

6
IPs

2
Countries

450 kB
Transfer

1017 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
axamedicalassessment.rockinsurance.com/ 5 KB
3 KB 3261ms
126ms Document
text/html 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

df7c70861e1f4d58c9d9b0b73b6cc965a9809e7709b36f490c9c9dd103783b4c

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: private
cf-cache-status: DYNAMIC
cf-ray: 873be3269bb5bbe9-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sat, 13 Apr 2024 13:43:49 GMT
server: cloudflare
x-frame-options: SAMEORIGIN

GET
H2 200 css
axamedicalassessment.rockinsurance.com/Content/ 157 KB
26 KB 117ms
115ms Stylesheet
text/css 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/Content/css?v=tdU4UpMWgKw_ZxuSfQuiRW4nBFUCKV5zajLNt7a7Hus1

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d90f47e07b81f5d9b988797901b7595ce0de70b83e649783b5ff64b9064d313c

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 13 Apr 2024 13:43:49 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
last-modified: Sat, 13 Apr 2024 13:43:49 GMT
server: cloudflare
vary: User-Agent
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
cache-control: public
cf-ray: 873be3275cb9bbe9-FRA
expires: Sun, 13 Apr 2025 13:43:49 GMT

GET
H2 200 modernizr Show response
axamedicalassessment.rockinsurance.com/bundles/ 11 KB
4 KB 55ms
53ms Script
text/javascript 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/bundles/modernizr?v=wBEWDufH_8Md-Pbioxomt90vm6tJN2Pyy9u9zHtWsPo1

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ec4e0295f86b2142b8996e03d4195888843b50d1954d7e248341da032b7ebba

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 13 Apr 2024 13:43:49 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
last-modified: Sat, 13 Apr 2024 13:43:49 GMT
server: cloudflare
vary: User-Agent
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: public
cf-ray: 873be3275cc2bbe9-FRA
expires: Sun, 13 Apr 2025 13:43:49 GMT

GET
H2 200 jquery-ui.css
axamedicalassessment.rockinsurance.com/Content/ 22 KB
4 KB 38ms
36ms Stylesheet
text/css 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/Content/jquery-ui.css

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d4df104b6aa10034fd8278508b32bdec8291a659c1bc5b881b44d6fb8834652

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 13 Apr 2024 13:43:49 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 29 Feb 2024 06:39:36 GMT
server: cloudflare
age: 2157
etag: W/"044b8fda6ada1:0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 873be3275cbcbbe9-FRA
expires: Sat, 13 Apr 2024 17:43:49 GMT

GET
H2 200 Site.css
axamedicalassessment.rockinsurance.com/Content/ 37 KB
6 KB 40ms
39ms Stylesheet
text/css 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/Content/Site.css

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1363c0ccd09bba9a97f6291c53b34c3bcdcae9ab9c0d1d1d7373aa7a0e2a7372

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 13 Apr 2024 13:43:49 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 29 Feb 2024 06:39:36 GMT
server: cloudflare
age: 2157
etag: W/"044b8fda6ada1:0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 873be3275cbebbe9-FRA
expires: Sat, 13 Apr 2024 17:43:49 GMT

GET
H2 200 SiteScript.js Show response
axamedicalassessment.rockinsurance.com/Scripts/ 39 KB
6 KB 64ms
63ms Script
application/javascript 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/Scripts/SiteScript.js

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

89014a32395d68835aac9669de641b949d0abce46011e1ba950b15c4540eb654

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 13 Apr 2024 13:43:49 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 29 Feb 2024 06:39:36 GMT
server: cloudflare
age: 2157
etag: W/"044b8fda6ada1:0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 873be3276ce0bbe9-FRA
expires: Sat, 13 Apr 2024 17:43:49 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ 85 KB
30 KB 79ms
21ms Script
text/javascript 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 12 Apr 2024 00:15:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 134883
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30306
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 12 Apr 2025 00:15:46 GMT

GET
H2 200 jquery-ui.min.js Show response
ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/ 248 KB
66 KB 100ms
42ms Script
text/javascript 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 09 Apr 2024 18:12:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 329498
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67948
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 09 Apr 2025 18:12:11 GMT

GET
H2 200 homepage Show response
axamedicalassessment.rockinsurance.com/bundles/ 30 KB
8 KB 124ms
123ms Script
text/javascript 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/bundles/homepage?v=ocBX-8n5ylPwInVESoUqRzcYSqFiX1QW3x2oBIqbmtw1

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d4b468a0575f7586e7aea75628a9c6d26d3c6ce3532a212c37138954e10354f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 13 Apr 2024 13:43:49 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
last-modified: Sat, 13 Apr 2024 13:43:49 GMT
server: cloudflare
vary: User-Agent
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: public
cf-ray: 873be3276ce1bbe9-FRA
expires: Sun, 13 Apr 2025 13:43:49 GMT

GET
H2 200 axa_logo.svg
axamedicalassessment.rockinsurance.com/Images/ 2 KB
1 KB 131ms
130ms Image
image/svg+xml 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://axamedicalassessment.rockinsurance.com/Images/axa_logo.svg

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f15551e8df16365a4eba91f078b16e4dc40959a98f6f8e1de8b2ad895ccc705

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 13 Apr 2024 13:43:49 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Thu, 29 Feb 2024 06:39:36 GMT
server: cloudflare
etag: W/"044b8fda6ada1:0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 873be3276ce3bbe9-FRA
expires: Sat, 13 Apr 2024 17:43:49 GMT

GET
H2 200 coopbanner.jpg
axamedicalassessment.rockinsurance.com/Images/ 184 KB
185 KB 133ms
133ms Image
image/jpeg 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://axamedicalassessment.rockinsurance.com/Images/coopbanner.jpg

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

55021755ce7658de23ff637fe37d08f16f8f754df4d1df4e3a9749f5bd28658f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 13 Apr 2024 13:43:49 GMT
cf-cache-status: REVALIDATED
cf-bgj: h2pri
last-modified: Thu, 29 Feb 2024 06:39:36 GMT
server: cloudflare
etag: "044b8fda6ada1:0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 873be3276ce4bbe9-FRA
content-length: 188671
expires: Sat, 13 Apr 2024 17:43:49 GMT

GET
H2 404 jquery
axamedicalassessment.rockinsurance.com/bundles/ 0
0 52ms
52ms Script
text/html 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/bundles/jquery

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 13 Apr 2024 13:43:49 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
x-frame-options: SAMEORIGIN
content-type: text/html; charset=utf-8
cache-control: private
cf-ray: 873be3282db3bbe9-FRA

GET
H2 200 bootstrap Show response
axamedicalassessment.rockinsurance.com/bundles/ 51 KB
14 KB 51ms
51ms Script
text/javascript 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/bundles/bootstrap?v=HzdVbFvB6FVyYDAwjqp1DBKR6cDgYi41o36gxAFgrXs1

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1c1b45131597b28c252c0b0c89fe4a00a76c67127cf6c6cfeec244600a697fc0

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 13 Apr 2024 13:43:49 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
last-modified: Sat, 13 Apr 2024 13:43:49 GMT
server: cloudflare
vary: User-Agent
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: public
cf-ray: 873be3286e02bbe9-FRA
expires: Sun, 13 Apr 2025 13:43:49 GMT

GET
H2 200 v84a3a4012de94ce1a686ba8c167c359c1696973893317 Show response
static.cloudflareinsights.com/beacon.min.js/ 20 KB
7 KB 113ms
65ms Script
text/javascript 2606:4700::6810:4f49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317
Requested by: Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:4f49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://axamedicalassessment.rockinsurance.com/
Origin: https://axamedicalassessment.rockinsurance.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 13 Apr 2024 13:43:49 GMT
content-encoding: gzip
last-modified: Tue, 10 Oct 2023 21:38:13 GMT
server: cloudflare
etag: W/"2023.10.0"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 873be328da178f30-FRA

GET
H2 200 bootstrapper.js Show response
webchat.mitel.io/ 22 KB
7 KB 494ms
432ms Script
application/javascript 2600:9000:2490:0:1f:5417:2880:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://webchat.mitel.io/bootstrapper.js?accountid%3DNGM5OGIyNTYtNWNkNC00NjExLTk2NjYtNzMzZjQwOTMyMTc3%26chatname%3DQVhBIENvLW9wIENoYXQ%3D

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:0:1f:5417:2880:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

4206a02818302e5a182f30a29fdcefb222b3ddcc2cecac2bde6f1536d28f20c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 13 Apr 2024 13:43:51 GMT
content-encoding: br
via: 1.1 409b27093eb36cec367cdee5f3ecf8b2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-amz-cf-pop: FRA56-P6
x-amz-server-side-encryption: AES256
content-security-policy-report-only: trusted-types angular angular#bundler; require-trusted-types-for 'script'; upgrade-insecure-requests; default-src 'none'; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://fonts.googleapis.com data: 'unsafe-inline'; font-src 'self' https://fonts.gstatic.com data:; connect-src 'self' https://*.api.mitel.io; object-src 'none'; form-action 'self'; frame-ancestors https://*.dev.mitel.io https://*.mitel.io; base-uri 'self'; report-uri https://cloudlink.report-uri.com/r/d/csp/wizard; report-to csp-wizard
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: origin-when-cross-origin
last-modified: Tue, 05 Mar 2024 19:50:55 GMT
server: AmazonS3
etag: W/"6fd06a14549d9737547822b24a4c4e0d"
vary: Accept-Encoding, Origin
report-to: {'group':'csp-wizard','max_age':10886400,'endpoints':[{'url':'https://cloudlink.report-uri.com/r/d/csp/wizard'}]},{'group':'default','max_age':31536000,'endpoints':[{'url':'https://cloudlink.report-uri.com/a/t/g'}],'include_subdomains':true}
content-type: application/javascript
cache-control: no-cache, no-store, must-revalidate, max-age=0
x-amz-cf-id: WQEWTtokw7zleG6739MYRdZ6efWovPn5kA-UyrQzhiWGO-3XuPFG5A==

GET
H2 200 CoopBank.ttf
axamedicalassessment.rockinsurance.com/fonts/ 70 KB
70 KB 41ms
41ms Font
application/octet-stream 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/fonts/CoopBank.ttf

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/Content/css?v=tdU4UpMWgKw_ZxuSfQuiRW4nBFUCKV5zajLNt7a7Hus1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1ad4ad4e439013fe514c6e4a7a787b24c2b076a0471e20f834833da973790f9

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://axamedicalassessment.rockinsurance.com/Content/css?v=tdU4UpMWgKw_ZxuSfQuiRW4nBFUCKV5zajLNt7a7Hus1
Origin: https://axamedicalassessment.rockinsurance.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 13 Apr 2024 13:43:49 GMT
cf-cache-status: HIT
last-modified: Thu, 29 Feb 2024 06:39:38 GMT
server: cloudflare
age: 2157
etag: "071e910da6ada1:0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/octet-stream
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 873be328be44bbe9-FRA
content-length: 71572
expires: Sat, 13 Apr 2024 17:43:49 GMT

GET
H2 200 4c98b256-5cd4-4611-9666-733f40932177 Show response
director.api.mitel.io/2018-07-01/whereami/ 150 B
594 B 161ms
96ms XHR
application/json 2600:9000:2670:7800:9:429c:140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://director.api.mitel.io/2018-07-01/whereami/4c98b256-5cd4-4611-9666-733f40932177
Requested by: Host: webchat.mitel.io
URL: https://webchat.mitel.io/bootstrapper.js?accountid%3DNGM5OGIyNTYtNWNkNC00NjExLTk2NjYtNzMzZjQwOTMyMTc3%26chatname%3DQVhBIENvLW9wIENoYXQ%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2670:7800:9:429c:140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 684535330ed2cce0ccbafc7eef3ab721fd429388c059b49cb8fdc759497afd82

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 13 Apr 2024 13:43:50 GMT
via: 1.1 f5af2731a86629973e69564f824d95be.cloudfront.net (CloudFront)
x-mitel-correlation-id: e240be2e-f7c9-49e9-b609-1b6bb5f211df
x-amz-cf-pop: FRA56-P9
x-amzn-trace-id: Root=1-661a8c16-495a3f0a30ccba5417364aa4;Parent=0e9be17e9c3cdddf;Sampled=0;lineage=119842c8:0
x-amzn-requestid: b041e3b0-a440-4e53-a31d-bc6d2e2cbd72
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: *
x-amz-apigw-id: WKrTkG0jFiAERnA=
content-length: 150
x-amz-cf-id: SU--Wb_EY1bRMM4KaKtsIt9InKCxO8N6x_x9z5wRw5m3BI3WqkA-Rw==

POST
H2 204 rum Show response
axamedicalassessment.rockinsurance.com/cdn-cgi/ 0
209 B 25ms
24ms XHR
text/plain 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
content-type: application/json

Response headers

date: Sat, 13 Apr 2024 13:43:50 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://axamedicalassessment.rockinsurance.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 873be32c59fbbbe9-FRA

GET
H2 200 favicon.ico
axamedicalassessment.rockinsurance.com/ 31 KB
9 KB 123ms
122ms Other
image/x-icon 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a94f8a8553caea8430dd4ca3cc01d4e318d19828f74cb65453ffb7f5d9e2f44d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 13 Apr 2024 13:43:50 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Thu, 29 Feb 2024 06:39:38 GMT
server: cloudflare
etag: W/"071e910da6ada1:0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/x-icon
cache-control: public, max-age=14400
cf-ray: 873be32c5a01bbe9-FRA
expires: Sat, 13 Apr 2024 17:43:50 GMT

GET
H2 200 chats Show response
gcp-gateway.eu.api.mitel.io/2018-05-27/messenger/accounts/4c98b256-5cd4-4611-9666-733f40932177/ 4 KB
2 KB 285ms
220ms XHR
application/json 2600:9000:235a:8c00:f:6a9:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://gcp-gateway.eu.api.mitel.io/2018-05-27/messenger/accounts/4c98b256-5cd4-4611-9666-733f40932177/chats?chatname=AXA%20Co-op%20Chat
Requested by: Host: webchat.mitel.io
URL: https://webchat.mitel.io/bootstrapper.js?accountid%3DNGM5OGIyNTYtNWNkNC00NjExLTk2NjYtNzMzZjQwOTMyMTc3%26chatname%3DQVhBIENvLW9wIENoYXQ%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:8c00:f:6a9:200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 13d32b63fa4346e3acfdf4548221b13d01c2d8a238b1879bd45c3b26a5f4eb4c

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 13 Apr 2024 13:43:50 GMT
content-encoding: gzip
via: 1.1 c8faaa7d637dd73af72e1355a476ffc2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P9
x-amzn-requestid: be398449-2ec7-42f9-91ef-d925faf774a8
x-amzn-trace-id: Root=1-661a8c16-7a0b15987ffe28225c7f5fd2;Parent=753aa31ecaedc2a8;Sampled=0;lineage=57e441ef:0
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: *
x-amz-apigw-id: WKrTmHNFFiAEHwg=
x-amz-cf-id: LtZ4_LpH6BUULuqd4GTaEAHKARbCt1exTd0nfOACoZecf7RAC2RkRg==

GET
H2 200 /
webchat.mitel.io/ Frame C672 0
0 480ms
436ms Document
text/html 2600:9000:2490:0:1f:5417:2880:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://webchat.mitel.io/?accountid=NGM5OGIyNTYtNWNkNC00NjExLTk2NjYtNzMzZjQwOTMyMTc3&chatname=QVhBIENvLW9wIENoYXQ=&chaturl=aHR0cHM6Ly9nY3AtZ2F0ZXdheS5ldS5hcGkubWl0ZWwuaW8vMjAxOC0wNS0yNy9tZXNzZW5nZXIvYWNjb3VudHMvNGM5OGIyNTYtNWNkNC00NjExLTk2NjYtNzMzZjQwOTMyMTc3L2NoYXRzP2NoYXRuYW1lPUFYQSBDby1vcCBDaGF0

Requested by

Host: webchat.mitel.io
URL: https://webchat.mitel.io/bootstrapper.js?accountid%3DNGM5OGIyNTYtNWNkNC00NjExLTk2NjYtNzMzZjQwOTMyMTc3%26chatname%3DQVhBIENvLW9wIENoYXQ%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:0:1f:5417:2880:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://axamedicalassessment.rockinsurance.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ranges: bytes
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-length: 684
content-security-policy-report-only: trusted-types angular angular#bundler; require-trusted-types-for 'script'; upgrade-insecure-requests; default-src 'none'; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://fonts.googleapis.com data: 'unsafe-inline'; font-src 'self' https://fonts.gstatic.com data:; connect-src 'self' https://*.api.mitel.io; object-src 'none'; form-action 'self'; frame-ancestors https://*.dev.mitel.io https://*.mitel.io; base-uri 'self'; report-uri https://cloudlink.report-uri.com/r/d/csp/wizard; report-to csp-wizard
content-type: text/html
date: Sat, 13 Apr 2024 13:43:53 GMT
etag: "53d718c2fb88e3d2ac2ff510cc3005d8"
last-modified: Tue, 05 Mar 2024 19:50:55 GMT
referrer-policy: origin-when-cross-origin
report-to: {'group':'csp-wizard','max_age':10886400,'endpoints':[{'url':'https://cloudlink.report-uri.com/r/d/csp/wizard'}]},{'group':'default','max_age':31536000,'endpoints':[{'url':'https://cloudlink.report-uri.com/a/t/g'}],'include_subdomains':true}
server: AmazonS3
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin
via: 1.1 ecb3ea567a6c6095a23354fbdc938128.cloudfront.net (CloudFront)
x-amz-cf-id: OQscNejwpZMtswadwB2wnbyHZ-M0nEL43bm34XcVOVLoBoNV4CBprg==
x-amz-cf-pop: FRA56-P6
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Axa (Insurance)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.rockinsurance.com/	1970-01-20 19:50:17	Name: __cf_bm Value: I8XXee7OzaWmGmg.sNFW5QQjYKnSkaKAyNZZmPbPx1E-1713015829-1.0.1.1-7FnXFzzT.s9xBhSmnUVsStng85q35lHNjoju70A.YNWHhAY_MrVQDex9hOcWz6f3QyRYLLZAW3fR8Avk6gvZlQ

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://axamedicalassessment.rockinsurance.com/bundles/jquery Message: Failed to load resource: the server responded with a status of 404 ()
security	error	Message: [Report Only] Refused to frame 'https://webchat.mitel.io/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors https://.dev.mitel.io https://.mitel.io".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
axamedicalassessment.rockinsurance.com
director.api.mitel.io
gcp-gateway.eu.api.mitel.io
static.cloudflareinsights.com
webchat.mitel.io
2600:9000:235a:8c00:f:6a9:200:93a1
2600:9000:2490:0:1f:5417:2880:93a1
2600:9000:2670:7800:9:429c:140:93a1
2606:4700::6810:4f49
2606:4700::6812:ed9
2a00:1450:4001:803::200a
0ec4e0295f86b2142b8996e03d4195888843b50d1954d7e248341da032b7ebba
1363c0ccd09bba9a97f6291c53b34c3bcdcae9ab9c0d1d1d7373aa7a0e2a7372
13d32b63fa4346e3acfdf4548221b13d01c2d8a238b1879bd45c3b26a5f4eb4c
1c1b45131597b28c252c0b0c89fe4a00a76c67127cf6c6cfeec244600a697fc0
3d4b468a0575f7586e7aea75628a9c6d26d3c6ce3532a212c37138954e10354f
3d4df104b6aa10034fd8278508b32bdec8291a659c1bc5b881b44d6fb8834652
4206a02818302e5a182f30a29fdcefb222b3ddcc2cecac2bde6f1536d28f20c7
4f15551e8df16365a4eba91f078b16e4dc40959a98f6f8e1de8b2ad895ccc705
55021755ce7658de23ff637fe37d08f16f8f754df4d1df4e3a9749f5bd28658f
55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
684535330ed2cce0ccbafc7eef3ab721fd429388c059b49cb8fdc759497afd82
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
89014a32395d68835aac9669de641b949d0abce46011e1ba950b15c4540eb654
a94f8a8553caea8430dd4ca3cc01d4e318d19828f74cb65453ffb7f5d9e2f44d
d90f47e07b81f5d9b988797901b7595ce0de70b83e649783b5ff64b9064d313c
df7c70861e1f4d58c9d9b0b73b6cc965a9809e7709b36f490c9c9dd103783b4c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f1ad4ad4e439013fe514c6e4a7a787b24c2b076a0471e20f834833da973790f9

axamedicalassessment.rockinsurance.com Open in urlscan Pro 2606:4700::6812:ed9 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

21 Requests

100 %HTTPS

100 %IPv6

4 Domains

6 Subdomains

6 IPs

2 Countries

450 kBTransfer

1017 kBSize

1 Cookies

0 Outgoing links

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

22 JavaScript Global Variables

1 Cookies

2 Console Messages

Security Headers

Indicators

axamedicalassessment.rockinsurance.com Open in urlscan Pro
2606:4700::6812:ed9 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

6
Subdomains

6
IPs

2
Countries

450 kB
Transfer

1017 kB
Size

1
Cookies

21 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!