Submitted URL: http://merchant.tigo.com/
Effective URL: https://merchant.tigo.com/merchant/v1/login
Submission: On July 16 via manual from PY — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 34.197.105.250, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is merchant.tigo.com.
TLS certificate: Issued by Amazon RSA 2048 M01 on February 24th 2023. Valid for: a year.
This is the only time merchant.tigo.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 52.55.194.116 14618 (AMAZON-AES)
2 9 34.197.105.250 14618 (AMAZON-AES)
7 1
Apex Domain
Subdomains
Transfer
10 tigo.com
merchant.tigo.com
493 KB
7 1
Domain Requested by
10 merchant.tigo.com 3 redirects merchant.tigo.com
7 1

This site contains no links.

Subject Issuer Validity Valid
merchant.tigo.com
Amazon RSA 2048 M01
2023-02-24 -
2024-03-24
a year crt.sh

This page contains 1 frames:

Primary Page: https://merchant.tigo.com/merchant/v1/login
Frame ID: 5D18C8ED63126AC74D349AEB896565CC
Requests: 7 HTTP requests in this frame

Screenshot

Page Title

Login

Page URL History Show full URLs

  1. http://merchant.tigo.com/ HTTP 301
    https://merchant.tigo.com/ HTTP 302
    https://merchant.tigo.com/merchant/v1/self HTTP 302
    https://merchant.tigo.com/merchant/v1/login Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

491 kB
Transfer

1484 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://merchant.tigo.com/ HTTP 301
    https://merchant.tigo.com/ HTTP 302
    https://merchant.tigo.com/merchant/v1/self HTTP 302
    https://merchant.tigo.com/merchant/v1/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login
merchant.tigo.com/merchant/v1/
Redirect Chain
  • http://merchant.tigo.com/
  • https://merchant.tigo.com/
  • https://merchant.tigo.com/merchant/v1/self
  • https://merchant.tigo.com/merchant/v1/login
2 KB
2 KB
Document
General
Full URL
https://merchant.tigo.com/merchant/v1/login
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.197.105.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-197-105-250.compute-1.amazonaws.com
Software
Apache /
Resource Hash
f75ba3e402b1f10c57cc958af292c3ac23197b001c8c4b9c603b6ac46121e854
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests; object-src 'self'; default-src 'self'; style-src * 'unsafe-inline' ; img-src * data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' stats.g.doubleclick.net *.tigocloud.net *.google-analytics.com *.google.com *.google.com.py *.tigo.com *.jsdelivr.net; form-action 'self' *.api.tigo.com frame-ancestors 'none';
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=0, must-revalidate, private
content-encoding
gzip
content-length
889
content-security-policy
upgrade-insecure-requests; object-src 'self'; default-src 'self'; style-src * 'unsafe-inline' ; img-src * data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' stats.g.doubleclick.net *.tigocloud.net *.google-analytics.com *.google.com *.google.com.py *.tigo.com *.jsdelivr.net; form-action 'self' *.api.tigo.com frame-ancestors 'none';
content-type
text/html; charset=UTF-8
date
Sun, 16 Jul 2023 23:07:09 GMT
migs
was here
server
Apache
strict-transport-security
max-age=15552000
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
DENY
x-xss-protection
1; mode=block

Redirect headers

cache-control
max-age=0, must-revalidate, private
content-length
316
content-security-policy
upgrade-insecure-requests; object-src 'self'; default-src 'self'; style-src * 'unsafe-inline' ; img-src * data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' stats.g.doubleclick.net *.tigocloud.net *.google-analytics.com *.google.com *.google.com.py *.tigo.com *.jsdelivr.net; form-action 'self' *.api.tigo.com
content-type
text/html; charset=UTF-8
date
Sun, 16 Jul 2023 23:07:09 GMT
location
/merchant/v1/login
migs
was here
server
Apache
strict-transport-security
max-age=15552000
x-content-type-options
nosniff
x-xss-protection
1; mode=block
jquery-3.4.1.min.js
merchant.tigo.com/assets/shared/v1/jquery/
86 KB
31 KB
Script
General
Full URL
https://merchant.tigo.com/assets/shared/v1/jquery/jquery-3.4.1.min.js
Requested by
Host: merchant.tigo.com
URL: https://merchant.tigo.com/merchant/v1/login
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.197.105.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-197-105-250.compute-1.amazonaws.com
Software
Apache /
Resource Hash
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests; object-src 'self'; default-src 'self'; style-src * 'unsafe-inline' ; img-src * data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' stats.g.doubleclick.net *.tigocloud.net *.google-analytics.com *.google.com *.google.com.py *.tigo.com *.jsdelivr.net; form-action 'self' *.api.tigo.com
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://merchant.tigo.com/merchant/v1/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Sun, 16 Jul 2023 23:07:09 GMT
strict-transport-security
max-age=15552000
x-content-type-options
nosniff
content-security-policy
upgrade-insecure-requests; object-src 'self'; default-src 'self'; style-src * 'unsafe-inline' ; img-src * data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' stats.g.doubleclick.net *.tigocloud.net *.google-analytics.com *.google.com *.google.com.py *.tigo.com *.jsdelivr.net; form-action 'self' *.api.tigo.com
last-modified
Sat, 24 Oct 2020 19:40:56 GMT
server
Apache
content-encoding
gzip
etag
"15851-5b26fe03eda71-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
30677
x-xss-protection
1; mode=block
migs
was here
bootstrap.min.js
merchant.tigo.com/assets/shared/v1/bootstrap/4.5.3/js/
62 KB
15 KB
Script
General
Full URL
https://merchant.tigo.com/assets/shared/v1/bootstrap/4.5.3/js/bootstrap.min.js
Requested by
Host: merchant.tigo.com
URL: https://merchant.tigo.com/merchant/v1/login
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.197.105.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-197-105-250.compute-1.amazonaws.com
Software
Apache /
Resource Hash
d8968086f7509df34c3278563dab87399da4f9dcdfb419818e3a309eedc70b88
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests; object-src 'self'; default-src 'self'; style-src * 'unsafe-inline' ; img-src * data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' stats.g.doubleclick.net *.tigocloud.net *.google-analytics.com *.google.com *.google.com.py *.tigo.com *.jsdelivr.net; form-action 'self' *.api.tigo.com
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://merchant.tigo.com/merchant/v1/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Sun, 16 Jul 2023 23:07:09 GMT
strict-transport-security
max-age=15552000
x-content-type-options
nosniff
content-security-policy
upgrade-insecure-requests; object-src 'self'; default-src 'self'; style-src * 'unsafe-inline' ; img-src * data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' stats.g.doubleclick.net *.tigocloud.net *.google-analytics.com *.google.com *.google.com.py *.tigo.com *.jsdelivr.net; form-action 'self' *.api.tigo.com
last-modified
Sat, 24 Oct 2020 19:33:19 GMT
server
Apache
content-encoding
gzip
etag
"f708-5b26fc4ff7fcc-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
14924
x-xss-protection
1; mode=block
migs
was here
all.min.js
merchant.tigo.com/assets/shared/v1/fontawesome/5.9.0/js/
1 MB
404 KB
Script
General
Full URL
https://merchant.tigo.com/assets/shared/v1/fontawesome/5.9.0/js/all.min.js
Requested by
Host: merchant.tigo.com
URL: https://merchant.tigo.com/merchant/v1/login
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.197.105.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-197-105-250.compute-1.amazonaws.com
Software
Apache /
Resource Hash
c73ac704898cda39fda032ce4651d2d7fd1e927d55cb2a44915d402ef531f255
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests; object-src 'self'; default-src 'self'; style-src * 'unsafe-inline' ; img-src * data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' stats.g.doubleclick.net *.tigocloud.net *.google-analytics.com *.google.com *.google.com.py *.tigo.com *.jsdelivr.net; form-action 'self' *.api.tigo.com
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://merchant.tigo.com/merchant/v1/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Sun, 16 Jul 2023 23:07:09 GMT
strict-transport-security
max-age=15552000
x-content-type-options
nosniff
content-security-policy
upgrade-insecure-requests; object-src 'self'; default-src 'self'; style-src * 'unsafe-inline' ; img-src * data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' stats.g.doubleclick.net *.tigocloud.net *.google-analytics.com *.google.com *.google.com.py *.tigo.com *.jsdelivr.net; form-action 'self' *.api.tigo.com
last-modified
Wed, 17 Jul 2019 20:51:32 GMT
server
Apache
content-encoding
gzip
etag
"113b7a-58de6a8783d00-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
x-xss-protection
1; mode=block
migs
was here
bootstrap.min.css
merchant.tigo.com/assets/shared/v1/bootstrap/4.5.3/css/
157 KB
24 KB
Stylesheet
General
Full URL
https://merchant.tigo.com/assets/shared/v1/bootstrap/4.5.3/css/bootstrap.min.css
Requested by
Host: merchant.tigo.com
URL: https://merchant.tigo.com/merchant/v1/login
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.197.105.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-197-105-250.compute-1.amazonaws.com
Software
Apache /
Resource Hash
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests; object-src 'self'; default-src 'self'; style-src * 'unsafe-inline' ; img-src * data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' stats.g.doubleclick.net *.tigocloud.net *.google-analytics.com *.google.com *.google.com.py *.tigo.com *.jsdelivr.net; form-action 'self' *.api.tigo.com
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://merchant.tigo.com/merchant/v1/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Sun, 16 Jul 2023 23:07:09 GMT
strict-transport-security
max-age=15552000
x-content-type-options
nosniff
content-security-policy
upgrade-insecure-requests; object-src 'self'; default-src 'self'; style-src * 'unsafe-inline' ; img-src * data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' stats.g.doubleclick.net *.tigocloud.net *.google-analytics.com *.google.com *.google.com.py *.tigo.com *.jsdelivr.net; form-action 'self' *.api.tigo.com
last-modified
Sat, 24 Oct 2020 19:31:28 GMT
server
Apache
content-encoding
gzip
etag
"27288-5b26fbe5ce743-gzip"
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
23916
x-xss-protection
1; mode=block
migs
was here
material-design-iconic-font.min.css
merchant.tigo.com/assets/shared/v1/material-iconic/css/
69 KB
9 KB
Stylesheet
General
Full URL
https://merchant.tigo.com/assets/shared/v1/material-iconic/css/material-design-iconic-font.min.css
Requested by
Host: merchant.tigo.com
URL: https://merchant.tigo.com/merchant/v1/login
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.197.105.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-197-105-250.compute-1.amazonaws.com
Software
Apache /
Resource Hash
dec3e9f0190a504ed0c8f4a5e957c107206ba106cac4a1bbb6cbac6369a16d56
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests; object-src 'self'; default-src 'self'; style-src * 'unsafe-inline' ; img-src * data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' stats.g.doubleclick.net *.tigocloud.net *.google-analytics.com *.google.com *.google.com.py *.tigo.com *.jsdelivr.net; form-action 'self' *.api.tigo.com
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://merchant.tigo.com/merchant/v1/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Sun, 16 Jul 2023 23:07:09 GMT
strict-transport-security
max-age=15552000
x-content-type-options
nosniff
content-security-policy
upgrade-insecure-requests; object-src 'self'; default-src 'self'; style-src * 'unsafe-inline' ; img-src * data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' stats.g.doubleclick.net *.tigocloud.net *.google-analytics.com *.google.com *.google.com.py *.tigo.com *.jsdelivr.net; form-action 'self' *.api.tigo.com
last-modified
Fri, 08 Mar 2019 22:22:34 GMT
server
Apache
content-encoding
gzip
etag
"1149f-5839ca8d19e80-gzip"
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
8004
x-xss-protection
1; mode=block
migs
was here
boton-pago-tigo.png
merchant.tigo.com/assets/shared/v1/images/
5 KB
6 KB
Image
General
Full URL
https://merchant.tigo.com/assets/shared/v1/images/boton-pago-tigo.png
Requested by
Host: merchant.tigo.com
URL: https://merchant.tigo.com/merchant/v1/login
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.197.105.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-197-105-250.compute-1.amazonaws.com
Software
Apache /
Resource Hash
e18f0d8712f741bed0d89bb6bdea0c085154365fc00a6e19216a01bc92ec3aeb
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests; object-src 'self'; default-src 'self'; style-src * 'unsafe-inline' ; img-src * data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' stats.g.doubleclick.net *.tigocloud.net *.google-analytics.com *.google.com *.google.com.py *.tigo.com *.jsdelivr.net; form-action 'self' *.api.tigo.com
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://merchant.tigo.com/merchant/v1/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Sun, 16 Jul 2023 23:07:10 GMT
strict-transport-security
max-age=15552000
x-content-type-options
nosniff
content-security-policy
upgrade-insecure-requests; object-src 'self'; default-src 'self'; style-src * 'unsafe-inline' ; img-src * data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' stats.g.doubleclick.net *.tigocloud.net *.google-analytics.com *.google.com *.google.com.py *.tigo.com *.jsdelivr.net; form-action 'self' *.api.tigo.com
last-modified
Fri, 08 Mar 2019 22:22:34 GMT
server
Apache
etag
"1593-5839ca8d19e80"
content-type
image/png
accept-ranges
bytes
content-length
5523
x-xss-protection
1; mode=block
migs
was here

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery object| bootstrap object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome object| elt

2 Cookies

Domain/Path Name / Value
merchant.tigo.com/ Name: AWSALB
Value: fI3CXYUNGMqBzE7/GyMdwwJJaRR0HU6qw9YOoDNeGdNwXAt6b7J4PIEWQ3du96KRMF0dzPNePFWCHXIg1/t8bUp0e3lzSmWKysNyGN2r5VQ43l2EHAMgeDMsS+2s
merchant.tigo.com/ Name: AWSALBCORS
Value: fI3CXYUNGMqBzE7/GyMdwwJJaRR0HU6qw9YOoDNeGdNwXAt6b7J4PIEWQ3du96KRMF0dzPNePFWCHXIg1/t8bUp0e3lzSmWKysNyGN2r5VQ43l2EHAMgeDMsS+2s

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests; object-src 'self'; default-src 'self'; style-src * 'unsafe-inline' ; img-src * data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' stats.g.doubleclick.net *.tigocloud.net *.google-analytics.com *.google.com *.google.com.py *.tigo.com *.jsdelivr.net; form-action 'self' *.api.tigo.com frame-ancestors 'none';
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block