axamedicalassessment.rockinsurance.com Open in urlscan Pro
2606:4700::6812:ed9 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://axamedicalassessment.rockinsurance.com/
Submission: On May 08 via manual (May 8th 2024, 9:38:10 am UTC) from PH — Scanned from DE

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 2 countries across 4 domains to perform 21 HTTP transactions. The main IP is 2606:4700::6812:ed9, located in United States and belongs to CLOUDFLARENET, US. The main domain is axamedicalassessment.rockinsurance.com.
TLS certificate: Issued by GTS CA 1P5 on March 15th 2024. Valid for: 3 months.

This is the only time axamedicalassessment.rockinsurance.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Axa (Insurance)

Domain & IP information

	IP Address	AS Autonomous System
14	2606:4700::68... 2606:4700::6812:ed9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:827::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:4f49	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:249... 2600:9000:2490:4a00:1f:5417:2880:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:267... 2600:9000:2670:6c00:9:429c:140:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:235... 2600:9000:235a:9000:f:6a9:200:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:249... 2600:9000:2490:3000:1f:5417:2880:93a1	16509 (AMAZON-02) (AMAZON-02)
21	7

14 2606:4700::6812:ed9 (United States)

ASN13335 (CLOUDFLARENET, US)

axamedicalassessment.rockinsurance.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:4f49 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2490:4a00:1f:5417:2880:93a1 (United States)

ASN16509 (AMAZON-02, US)

webchat.mitel.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2670:6c00:9:429c:140:93a1 (United States)

ASN16509 (AMAZON-02, US)

director.api.mitel.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:235a:9000:f:6a9:200:93a1 (United States)

ASN16509 (AMAZON-02, US)

gcp-gateway.eu.api.mitel.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2490:3000:1f:5417:2880:93a1 (United States)

ASN16509 (AMAZON-02, US)

webchat.mitel.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	rockinsurance.com axamedicalassessment.rockinsurance.com	339 KB
4	mitel.io webchat.mitel.io — Cisco Umbrella Rank: 102184 director.api.mitel.io — Cisco Umbrella Rank: 110061 gcp-gateway.eu.api.mitel.io — Cisco Umbrella Rank: 318125	10 KB
2	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 380	97 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 804	7 KB
21	4

	Domain	Requested by
14	axamedicalassessment.rockinsurance.com	axamedicalassessment.rockinsurance.com static.cloudflareinsights.com
2	webchat.mitel.io	axamedicalassessment.rockinsurance.com webchat.mitel.io
2	ajax.googleapis.com	axamedicalassessment.rockinsurance.com
1	gcp-gateway.eu.api.mitel.io	webchat.mitel.io
1	director.api.mitel.io	webchat.mitel.io
1	static.cloudflareinsights.com	axamedicalassessment.rockinsurance.com
21	6

This site contains no links.

Subject Issuer	Validity	Valid
rockinsurance.com GTS CA 1P5	`2024-03-15` - `2024-06-13`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
cloudflareinsights.com GTS CA 1P5	`2024-05-08` - `2024-08-06`	3 months	crt.sh
webchat.mitel.io Amazon RSA 2048 M02	`2024-03-05` - `2025-04-03`	a year	crt.sh
*.api.mitel.io Amazon RSA 2048 M03	`2024-04-07` - `2025-05-06`	a year	crt.sh
*.eu.api.mitel.io Amazon RSA 2048 M03	`2024-02-08` - `2025-03-09`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://axamedicalassessment.rockinsurance.com/
Frame ID: 9F8DB8E1B6C23FC15A0C11ABB8E51E0C
Requests: 20 HTTP requests in this frame

Frame: https://webchat.mitel.io/?accountid=NGM5OGIyNTYtNWNkNC00NjExLTk2NjYtNzMzZjQwOTMyMTc3&chatname=QVhBIENvLW9wIENoYXQ=&chaturl=aHR0cHM6Ly9nY3AtZ2F0ZXdheS5ldS5hcGkubWl0ZWwuaW8vMjAxOC0wNS0yNy9tZXNzZW5nZXIvYWNjb3VudHMvNGM5OGIyNTYtNWNkNC00NjExLTk2NjYtNzMzZjQwOTMyMTc3L2NoYXRzP2NoYXRuYW1lPUFYQSBDby1vcCBDaGF0
Frame ID: 06200CCA8991140BED66E7629D6B56C1
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Home Page - The co-operative bank

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)/jquery-ui(?:\.min)?\.js
jquery-ui.*\.js

Page Statistics

21
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

6
Subdomains

7
IPs

2
Countries

452 kB
Transfer

1016 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
axamedicalassessment.rockinsurance.com/ 5 KB
3 KB 213ms
118ms Document
text/html 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

37791f6e0494b3a84ed57de1bcbc061a80e68afc81d20fe5a5b8d30be539467b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: private
cf-cache-status: DYNAMIC
cf-ray: 880879894f3d03ac-FRA
content-encoding: gzip
content-security-policy-report-only: script-src 'none'; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=.fQZTKUhNDrHX8dPWLEMfzClC334CH_0ulg4nHBP5C8-1715161084-1.0.1.1-IdZW6w0Btmo_nCdZla._daj3mlzrJP8GBY6SBhkFYbNgvsVElaiEt9zsLCFTaV5IHFNIcsva37Ft9rQd7CG5XImGSXmOrKPDwlXWIA0HHBInklBYSzTfGDtfjmSiID259IdcJ6L5Rd0wOArwEZyDuXAeR8hf9jwpvevlovTJYZG3v1v3igMSSVOGeVJ_0QXg; report-to cf-csp-endpoint
content-type: text/html; charset=utf-8
date: Wed, 08 May 2024 09:38:04 GMT
report-to: {"endpoints":[{"url":"https:\/\/csp-reporting.cloudflare.com\/cdn-cgi\/script_monitor\/report?m=.fQZTKUhNDrHX8dPWLEMfzClC334CH_0ulg4nHBP5C8-1715161084-1.0.1.1-IdZW6w0Btmo_nCdZla._daj3mlzrJP8GBY6SBhkFYbNgvsVElaiEt9zsLCFTaV5IHFNIcsva37Ft9rQd7CG5XImGSXmOrKPDwlXWIA0HHBInklBYSzTfGDtfjmSiID259IdcJ6L5Rd0wOArwEZyDuXAeR8hf9jwpvevlovTJYZG3v1v3igMSSVOGeVJ_0QXg"}],"group":"cf-csp-endpoint","max_age":86400}
server: cloudflare
x-frame-options: SAMEORIGIN

GET
H2 200 css
axamedicalassessment.rockinsurance.com/Content/ 157 KB
26 KB 58ms
56ms Stylesheet
text/css 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/Content/css?v=tdU4UpMWgKw_ZxuSfQuiRW4nBFUCKV5zajLNt7a7Hus1

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d90f47e07b81f5d9b988797901b7595ce0de70b83e649783b5ff64b9064d313c

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 09:38:04 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
last-modified: Wed, 08 May 2024 09:38:04 GMT
server: cloudflare
vary: User-Agent
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
cache-control: public
cf-ray: 8808798a184703ac-FRA
expires: Thu, 08 May 2025 09:38:04 GMT

GET
H2 200 modernizr Show response
axamedicalassessment.rockinsurance.com/bundles/ 11 KB
4 KB 115ms
113ms Script
text/javascript 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/bundles/modernizr?v=wBEWDufH_8Md-Pbioxomt90vm6tJN2Pyy9u9zHtWsPo1

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ec4e0295f86b2142b8996e03d4195888843b50d1954d7e248341da032b7ebba

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 09:38:04 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
last-modified: Wed, 08 May 2024 09:38:04 GMT
server: cloudflare
vary: User-Agent
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: public
cf-ray: 8808798a184e03ac-FRA
expires: Thu, 08 May 2025 09:38:04 GMT

GET
H2 200 jquery-ui.css
axamedicalassessment.rockinsurance.com/Content/ 22 KB
4 KB 124ms
123ms Stylesheet
text/css 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/Content/jquery-ui.css

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d4df104b6aa10034fd8278508b32bdec8291a659c1bc5b881b44d6fb8834652

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 09:38:04 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Thu, 29 Feb 2024 06:39:36 GMT
server: cloudflare
etag: W/"044b8fda6ada1:0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 8808798a184a03ac-FRA
expires: Wed, 08 May 2024 13:38:04 GMT

GET
H2 200 Site.css
axamedicalassessment.rockinsurance.com/Content/ 37 KB
6 KB 127ms
125ms Stylesheet
text/css 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/Content/Site.css

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1363c0ccd09bba9a97f6291c53b34c3bcdcae9ab9c0d1d1d7373aa7a0e2a7372

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 09:38:04 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Thu, 29 Feb 2024 06:39:36 GMT
server: cloudflare
etag: W/"044b8fda6ada1:0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 8808798a184c03ac-FRA
expires: Wed, 08 May 2024 13:38:04 GMT

GET
H2 200 SiteScript.js Show response
axamedicalassessment.rockinsurance.com/Scripts/ 39 KB
6 KB 122ms
121ms Script
application/javascript 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/Scripts/SiteScript.js

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

89014a32395d68835aac9669de641b949d0abce46011e1ba950b15c4540eb654

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 09:38:04 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Thu, 29 Feb 2024 06:39:36 GMT
server: cloudflare
etag: W/"044b8fda6ada1:0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 8808798a185103ac-FRA
expires: Wed, 08 May 2024 13:38:04 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ 85 KB
30 KB 102ms
45ms Script
text/javascript 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 07 May 2024 20:42:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46537
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30306
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 07 May 2025 20:42:27 GMT

GET
H2 200 jquery-ui.min.js Show response
ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/ 248 KB
67 KB 79ms
23ms Script
text/javascript 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 06 May 2024 01:06:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 203465
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67948
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 May 2025 01:06:59 GMT

GET
H2 200 homepage Show response
axamedicalassessment.rockinsurance.com/bundles/ 30 KB
8 KB 116ms
115ms Script
text/javascript 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/bundles/homepage?v=ocBX-8n5ylPwInVESoUqRzcYSqFiX1QW3x2oBIqbmtw1

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d4b468a0575f7586e7aea75628a9c6d26d3c6ce3532a212c37138954e10354f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 09:38:04 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
last-modified: Wed, 08 May 2024 09:38:04 GMT
server: cloudflare
vary: User-Agent
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: public
cf-ray: 8808798a185203ac-FRA
expires: Thu, 08 May 2025 09:38:04 GMT

GET
H2 200 axa_logo.svg
axamedicalassessment.rockinsurance.com/Images/ 2 KB
1 KB 120ms
119ms Image
image/svg+xml 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://axamedicalassessment.rockinsurance.com/Images/axa_logo.svg

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f15551e8df16365a4eba91f078b16e4dc40959a98f6f8e1de8b2ad895ccc705

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 09:38:04 GMT
content-encoding: gzip
cf-cache-status: MISS
last-modified: Thu, 29 Feb 2024 06:39:36 GMT
server: cloudflare
etag: W/"044b8fda6ada1:0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 8808798a185503ac-FRA
expires: Wed, 08 May 2024 13:38:04 GMT

GET
H2 200 coopbanner.jpg
axamedicalassessment.rockinsurance.com/Images/ 184 KB
185 KB 175ms
174ms Image
image/jpeg 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://axamedicalassessment.rockinsurance.com/Images/coopbanner.jpg

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

55021755ce7658de23ff637fe37d08f16f8f754df4d1df4e3a9749f5bd28658f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 09:38:04 GMT
cf-cache-status: MISS
last-modified: Thu, 29 Feb 2024 06:39:36 GMT
server: cloudflare
etag: "044b8fda6ada1:0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8808798a185603ac-FRA
content-length: 188671
expires: Wed, 08 May 2024 13:38:04 GMT

GET
H2 404 jquery
axamedicalassessment.rockinsurance.com/bundles/ 0
0 58ms
57ms Script
text/html 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/bundles/jquery

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 09:38:04 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
x-frame-options: SAMEORIGIN
content-type: text/html; charset=utf-8
cache-control: private
cf-ray: 8808798ad96e03ac-FRA

GET
H2 200 bootstrap Show response
axamedicalassessment.rockinsurance.com/bundles/ 51 KB
14 KB 55ms
54ms Script
text/javascript 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/bundles/bootstrap?v=HzdVbFvB6FVyYDAwjqp1DBKR6cDgYi41o36gxAFgrXs1

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1c1b45131597b28c252c0b0c89fe4a00a76c67127cf6c6cfeec244600a697fc0

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 09:38:04 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
last-modified: Wed, 08 May 2024 09:38:04 GMT
server: cloudflare
vary: User-Agent
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: public
cf-ray: 8808798b09aa03ac-FRA
expires: Thu, 08 May 2025 09:38:04 GMT

GET
H2 200 vedd3670a3b1c4e178fdfb0cc912d969e1713874337387 Show response
static.cloudflareinsights.com/beacon.min.js/ 19 KB
7 KB 112ms
62ms Script
text/javascript 2606:4700::6810:4f49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vedd3670a3b1c4e178fdfb0cc912d969e1713874337387
Requested by: Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:4f49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d2e817d2c44b9cf45f0e45cfa351abba3203af38f5aa1c8576a2db69ebd15192

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://axamedicalassessment.rockinsurance.com/
Origin: https://axamedicalassessment.rockinsurance.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 09:38:04 GMT
content-encoding: gzip
last-modified: Mon, 06 May 2024 19:01:13 GMT
server: cloudflare
etag: W/"2024.4.1"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 8808798b5f064db4-FRA

GET
H2 200 bootstrapper.js Show response
webchat.mitel.io/ 22 KB
7 KB 490ms
428ms Script
application/javascript 2600:9000:2490:4a00:1f:5417:2880:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://webchat.mitel.io/bootstrapper.js?accountid%3DNGM5OGIyNTYtNWNkNC00NjExLTk2NjYtNzMzZjQwOTMyMTc3%26chatname%3DQVhBIENvLW9wIENoYXQ%3D

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:4a00:1f:5417:2880:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

4206a02818302e5a182f30a29fdcefb222b3ddcc2cecac2bde6f1536d28f20c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 09:38:06 GMT
content-encoding: br
via: 1.1 e016ea20838aeed1d878a5244c9e2552.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-amz-cf-pop: FRA56-P6
x-amz-server-side-encryption: AES256
content-security-policy-report-only: trusted-types angular angular#bundler; require-trusted-types-for 'script'; upgrade-insecure-requests; default-src 'none'; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://fonts.googleapis.com data: 'unsafe-inline'; font-src 'self' https://fonts.gstatic.com data:; connect-src 'self' https://*.api.mitel.io; object-src 'none'; form-action 'self'; frame-ancestors https://*.dev.mitel.io https://*.mitel.io; base-uri 'self'; report-uri https://cloudlink.report-uri.com/r/d/csp/wizard; report-to csp-wizard
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: origin-when-cross-origin
last-modified: Tue, 05 Mar 2024 19:50:55 GMT
server: AmazonS3
etag: W/"6fd06a14549d9737547822b24a4c4e0d"
vary: Accept-Encoding, Origin
report-to: {'group':'csp-wizard','max_age':10886400,'endpoints':[{'url':'https://cloudlink.report-uri.com/r/d/csp/wizard'}]},{'group':'default','max_age':31536000,'endpoints':[{'url':'https://cloudlink.report-uri.com/a/t/g'}],'include_subdomains':true}
content-type: application/javascript
cache-control: no-cache, no-store, must-revalidate, max-age=0
x-amz-cf-id: G_ii7DktqbEdr4PxZSDDXTrO2cNLkdule-Mz-VuXkpwmsFKlcvan5Q==

GET
H2 200 CoopBank.ttf
axamedicalassessment.rockinsurance.com/fonts/ 70 KB
70 KB 132ms
132ms Font
application/octet-stream 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/fonts/CoopBank.ttf

Requested by

Host: axamedicalassessment.rockinsurance.com
URL: https://axamedicalassessment.rockinsurance.com/Content/css?v=tdU4UpMWgKw_ZxuSfQuiRW4nBFUCKV5zajLNt7a7Hus1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1ad4ad4e439013fe514c6e4a7a787b24c2b076a0471e20f834833da973790f9

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://axamedicalassessment.rockinsurance.com/Content/css?v=tdU4UpMWgKw_ZxuSfQuiRW4nBFUCKV5zajLNt7a7Hus1
Origin: https://axamedicalassessment.rockinsurance.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 09:38:04 GMT
cf-cache-status: REVALIDATED
last-modified: Thu, 29 Feb 2024 06:39:38 GMT
server: cloudflare
etag: "071e910da6ada1:0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/octet-stream
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8808798b19d503ac-FRA
content-length: 71572
expires: Wed, 08 May 2024 13:38:04 GMT

GET
H2 200 4c98b256-5cd4-4611-9666-733f40932177 Show response
director.api.mitel.io/2018-07-01/whereami/ 150 B
594 B 174ms
108ms XHR
application/json 2600:9000:2670:6c00:9:429c:140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://director.api.mitel.io/2018-07-01/whereami/4c98b256-5cd4-4611-9666-733f40932177
Requested by: Host: webchat.mitel.io
URL: https://webchat.mitel.io/bootstrapper.js?accountid%3DNGM5OGIyNTYtNWNkNC00NjExLTk2NjYtNzMzZjQwOTMyMTc3%26chatname%3DQVhBIENvLW9wIENoYXQ%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2670:6c00:9:429c:140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 684535330ed2cce0ccbafc7eef3ab721fd429388c059b49cb8fdc759497afd82

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 09:38:05 GMT
via: 1.1 3a52599b74209adc8297b59f7eaa4bce.cloudfront.net (CloudFront)
x-mitel-correlation-id: 7ec130b2-b969-4ba0-8ee8-8abf7ba5eea3
x-amz-cf-pop: FRA56-P9
x-amzn-trace-id: Root=1-663b47fd-1130c7d56e5a6b8116631eed;Parent=1ff4fc0d934efded;Sampled=0;lineage=119842c8:0
x-amzn-requestid: b45a719b-bec4-4bc3-bef9-9cc6b5c1cce8
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: *
x-amz-apigw-id: XcgvoEpHliAEXRA=
content-length: 150
x-amz-cf-id: xyo2Nupq4cM_wRhhvhVjFIq9ld0tvWvJkiskIPJLx8gft2KmaDBVbw==

POST
H2 204 rum Show response
axamedicalassessment.rockinsurance.com/cdn-cgi/ 0
209 B 26ms
26ms XHR
text/plain 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vedd3670a3b1c4e178fdfb0cc912d969e1713874337387

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
content-type: application/json

Response headers

date: Wed, 08 May 2024 09:38:05 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://axamedicalassessment.rockinsurance.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 8808798eaf0603ac-FRA

GET
H2 200 favicon.ico
axamedicalassessment.rockinsurance.com/ 31 KB
10 KB 119ms
118ms Other
image/x-icon 2606:4700::6812:ed9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://axamedicalassessment.rockinsurance.com/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ed9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a94f8a8553caea8430dd4ca3cc01d4e318d19828f74cb65453ffb7f5d9e2f44d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 09:38:05 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Thu, 29 Feb 2024 06:39:38 GMT
server: cloudflare
etag: W/"071e910da6ada1:0"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/csp-reporting.cloudflare.com\/cdn-cgi\/script_monitor\/report?m=S9iNlpfnl_H2ScqLGgLqBkdyEDAtOFimSIaC9.ARTW8-1715161085-1.0.1.1-MDTRgMajX5UvtWSXP17HGZMGbQ5OMY_EowhQS8FiD_82ulA4p7jZJvCuorSXA4.rUiSDGrCu1ngVKO6wBbhq8Q2h0RNkHbLLQrQlyQYLzZUB6SkvTg2ZDSTCaEIwpSBsrTK4E9rrrtx1Sz9r4jtflSPaM27QqBOETIsKbTCaGBGCaVgO7ZunHrMr3uj3UOUz"}],"group":"cf-csp-endpoint","max_age":86400}
content-type: image/x-icon
content-security-policy-report-only: script-src 'none'; connect-src 'none'; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=S9iNlpfnl_H2ScqLGgLqBkdyEDAtOFimSIaC9.ARTW8-1715161085-1.0.1.1-MDTRgMajX5UvtWSXP17HGZMGbQ5OMY_EowhQS8FiD_82ulA4p7jZJvCuorSXA4.rUiSDGrCu1ngVKO6wBbhq8Q2h0RNkHbLLQrQlyQYLzZUB6SkvTg2ZDSTCaEIwpSBsrTK4E9rrrtx1Sz9r4jtflSPaM27QqBOETIsKbTCaGBGCaVgO7ZunHrMr3uj3UOUz; report-to cf-csp-endpoint
cache-control: public, max-age=14400
vary: Accept-Encoding
cf-ray: 8808798eaf0903ac-FRA
expires: Wed, 08 May 2024 13:38:05 GMT

GET
H2 200 chats Show response
gcp-gateway.eu.api.mitel.io/2018-05-27/messenger/accounts/4c98b256-5cd4-4611-9666-733f40932177/ 4 KB
2 KB 306ms
251ms XHR
application/json 2600:9000:235a:9000:f:6a9:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://gcp-gateway.eu.api.mitel.io/2018-05-27/messenger/accounts/4c98b256-5cd4-4611-9666-733f40932177/chats?chatname=AXA%20Co-op%20Chat
Requested by: Host: webchat.mitel.io
URL: https://webchat.mitel.io/bootstrapper.js?accountid%3DNGM5OGIyNTYtNWNkNC00NjExLTk2NjYtNzMzZjQwOTMyMTc3%26chatname%3DQVhBIENvLW9wIENoYXQ%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:9000:f:6a9:200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 13d32b63fa4346e3acfdf4548221b13d01c2d8a238b1879bd45c3b26a5f4eb4c

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://axamedicalassessment.rockinsurance.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 09:38:05 GMT
content-encoding: gzip
via: 1.1 a6ec089aa02839578670b49d128782c2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P9
x-amzn-requestid: d1c17adc-3e58-4636-91c3-a9e2e592c7f9
x-amzn-trace-id: Root=1-663b47fd-59ce1dc8552090a25b3dc557;Parent=516c94c8a0566c4f;Sampled=0;lineage=57e441ef:0
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: *
x-amz-apigw-id: XcgvpE6tliAEGcg=
x-amz-cf-id: vl2Yu_8V1UJGEn8cIQaNtIvOBDLrGklwH-T3a2yWMKYSkfHatbmW1w==

GET
H2 200 /
webchat.mitel.io/ Frame 0620 0
0 476ms
430ms Document
text/html 2600:9000:2490:3000:1f:5417:2880:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://webchat.mitel.io/?accountid=NGM5OGIyNTYtNWNkNC00NjExLTk2NjYtNzMzZjQwOTMyMTc3&chatname=QVhBIENvLW9wIENoYXQ=&chaturl=aHR0cHM6Ly9nY3AtZ2F0ZXdheS5ldS5hcGkubWl0ZWwuaW8vMjAxOC0wNS0yNy9tZXNzZW5nZXIvYWNjb3VudHMvNGM5OGIyNTYtNWNkNC00NjExLTk2NjYtNzMzZjQwOTMyMTc3L2NoYXRzP2NoYXRuYW1lPUFYQSBDby1vcCBDaGF0

Requested by

Host: webchat.mitel.io
URL: https://webchat.mitel.io/bootstrapper.js?accountid%3DNGM5OGIyNTYtNWNkNC00NjExLTk2NjYtNzMzZjQwOTMyMTc3%26chatname%3DQVhBIENvLW9wIENoYXQ%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3000:1f:5417:2880:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://axamedicalassessment.rockinsurance.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ranges: bytes
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-length: 684
content-security-policy-report-only: trusted-types angular angular#bundler; require-trusted-types-for 'script'; upgrade-insecure-requests; default-src 'none'; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://fonts.googleapis.com data: 'unsafe-inline'; font-src 'self' https://fonts.gstatic.com data:; connect-src 'self' https://*.api.mitel.io; object-src 'none'; form-action 'self'; frame-ancestors https://*.dev.mitel.io https://*.mitel.io; base-uri 'self'; report-uri https://cloudlink.report-uri.com/r/d/csp/wizard; report-to csp-wizard
content-type: text/html
date: Wed, 08 May 2024 09:38:08 GMT
etag: "53d718c2fb88e3d2ac2ff510cc3005d8"
last-modified: Tue, 05 Mar 2024 19:50:55 GMT
referrer-policy: origin-when-cross-origin
report-to: {'group':'csp-wizard','max_age':10886400,'endpoints':[{'url':'https://cloudlink.report-uri.com/r/d/csp/wizard'}]},{'group':'default','max_age':31536000,'endpoints':[{'url':'https://cloudlink.report-uri.com/a/t/g'}],'include_subdomains':true}
server: AmazonS3
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin
via: 1.1 b26b931354407da013ac53d2c1c55034.cloudfront.net (CloudFront)
x-amz-cf-id: uJFqm2qIRBMJ6WTrGTKbaGBwrcYOPB-t8CGhpgJVIzlUtxPZK2UsMg==
x-amz-cf-pop: FRA56-P6
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Axa (Insurance)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.rockinsurance.com/	1970-01-20 20:26:02	Name: __cf_bm Value: GlEQcSm8eD8Ni8fAwgFop.Un0FMxYoaRrgfMyRqBfok-1715161084-1.0.1.1-suRFpjAQTHlQovYBSufnGPJBoBNAX.rz4ICzMYDu9l4jhoD4L318oSKLY.EoXloJyAkR2mUG8JmFQ20myJnaVw

13 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://axamedicalassessment.rockinsurance.com/ Message: [Report Only] Refused to load the script 'https://axamedicalassessment.rockinsurance.com/bundles/modernizr?v=wBEWDufH_8Md-Pbioxomt90vm6tJN2Pyy9u9zHtWsPo1' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://axamedicalassessment.rockinsurance.com/ Message: [Report Only] Refused to load the script 'https://axamedicalassessment.rockinsurance.com/Scripts/SiteScript.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://axamedicalassessment.rockinsurance.com/ Message: [Report Only] Refused to load the script 'https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://axamedicalassessment.rockinsurance.com/ Message: [Report Only] Refused to load the script 'https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://axamedicalassessment.rockinsurance.com/ Message: [Report Only] Refused to load the script 'https://axamedicalassessment.rockinsurance.com/bundles/homepage?v=ocBX-8n5ylPwInVESoUqRzcYSqFiX1QW3x2oBIqbmtw1' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://axamedicalassessment.rockinsurance.com/(Line 24) Message: [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-NIV17/oENjZbWAGhToZCZ5f1qfw1MQNARq2UQHVNnXs='), or a nonce ('nonce-...') is required to enable inline execution.
security	error	URL: https://axamedicalassessment.rockinsurance.com/(Line 35) Message: [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-mCGwvhNG6TNVBGhGpxWJn3BBVLpdbbl1dRW166MEUtY='), or a nonce ('nonce-...') is required to enable inline execution.
security	error	URL: https://axamedicalassessment.rockinsurance.com/(Line 40) Message: [Report Only] Refused to load the script 'https://webchat.mitel.io/bootstrapper.js?accountid%3DNGM5OGIyNTYtNWNkNC00NjExLTk2NjYtNzMzZjQwOTMyMTc3%26chatname%3DQVhBIENvLW9wIENoYXQ%3D' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://axamedicalassessment.rockinsurance.com/ Message: [Report Only] Refused to load the script 'https://axamedicalassessment.rockinsurance.com/bundles/jquery' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
network	error	URL: https://axamedicalassessment.rockinsurance.com/bundles/jquery Message: Failed to load resource: the server responded with a status of 404 ()
security	error	URL: https://axamedicalassessment.rockinsurance.com/ Message: [Report Only] Refused to load the script 'https://axamedicalassessment.rockinsurance.com/bundles/bootstrap?v=HzdVbFvB6FVyYDAwjqp1DBKR6cDgYi41o36gxAFgrXs1' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://axamedicalassessment.rockinsurance.com/ Message: [Report Only] Refused to load the script 'https://static.cloudflareinsights.com/beacon.min.js/vedd3670a3b1c4e178fdfb0cc912d969e1713874337387' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	Message: [Report Only] Refused to frame 'https://webchat.mitel.io/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors https://.dev.mitel.io https://.mitel.io".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
axamedicalassessment.rockinsurance.com
director.api.mitel.io
gcp-gateway.eu.api.mitel.io
static.cloudflareinsights.com
webchat.mitel.io
2600:9000:235a:9000:f:6a9:200:93a1
2600:9000:2490:3000:1f:5417:2880:93a1
2600:9000:2490:4a00:1f:5417:2880:93a1
2600:9000:2670:6c00:9:429c:140:93a1
2606:4700::6810:4f49
2606:4700::6812:ed9
2a00:1450:4001:827::200a
0ec4e0295f86b2142b8996e03d4195888843b50d1954d7e248341da032b7ebba
1363c0ccd09bba9a97f6291c53b34c3bcdcae9ab9c0d1d1d7373aa7a0e2a7372
13d32b63fa4346e3acfdf4548221b13d01c2d8a238b1879bd45c3b26a5f4eb4c
1c1b45131597b28c252c0b0c89fe4a00a76c67127cf6c6cfeec244600a697fc0
37791f6e0494b3a84ed57de1bcbc061a80e68afc81d20fe5a5b8d30be539467b
3d4b468a0575f7586e7aea75628a9c6d26d3c6ce3532a212c37138954e10354f
3d4df104b6aa10034fd8278508b32bdec8291a659c1bc5b881b44d6fb8834652
4206a02818302e5a182f30a29fdcefb222b3ddcc2cecac2bde6f1536d28f20c7
4f15551e8df16365a4eba91f078b16e4dc40959a98f6f8e1de8b2ad895ccc705
55021755ce7658de23ff637fe37d08f16f8f754df4d1df4e3a9749f5bd28658f
55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5
684535330ed2cce0ccbafc7eef3ab721fd429388c059b49cb8fdc759497afd82
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
89014a32395d68835aac9669de641b949d0abce46011e1ba950b15c4540eb654
a94f8a8553caea8430dd4ca3cc01d4e318d19828f74cb65453ffb7f5d9e2f44d
d2e817d2c44b9cf45f0e45cfa351abba3203af38f5aa1c8576a2db69ebd15192
d90f47e07b81f5d9b988797901b7595ce0de70b83e649783b5ff64b9064d313c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f1ad4ad4e439013fe514c6e4a7a787b24c2b076a0471e20f834833da973790f9

axamedicalassessment.rockinsurance.com Open in urlscan Pro 2606:4700::6812:ed9 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

21 Requests

100 %HTTPS

100 %IPv6

4 Domains

6 Subdomains

7 IPs

2 Countries

452 kBTransfer

1016 kBSize

1 Cookies

0 Outgoing links

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

22 JavaScript Global Variables

1 Cookies

13 Console Messages

Security Headers

Indicators

axamedicalassessment.rockinsurance.com Open in urlscan Pro
2606:4700::6812:ed9 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

6
Subdomains

7
IPs

2
Countries

452 kB
Transfer

1016 kB
Size

1
Cookies

21 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!