Submitted URL: https://galaxy.epic.com/#Browse/page=1!68!640!100000580
Effective URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%...
Submission: On March 18 via manual from US — Scanned from DE

Summary

This website contacted 4 IPs in 1 countries across 1 domains to perform 15 HTTP transactions. The main IP is 199.204.56.180, located in Madison, United States and belongs to EPICSYS, US. The main domain is signin.epic.com. The Cisco Umbrella rank of the primary domain is 67262.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on March 3rd 2023. Valid for: a year.
This is the only time signin.epic.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 199.204.56.89 10359 (EPICSYS)
7 199.204.56.180 10359 (EPICSYS)
7 199.204.56.121 10359 (EPICSYS)
15 4
Apex Domain
Subdomains
Transfer
15 epic.com
galaxy.epic.com — Cisco Umbrella Rank: 90713
signin.epic.com — Cisco Umbrella Rank: 67262
userweb.epic.com — Cisco Umbrella Rank: 39797
4 MB
15 1
Domain Requested by
7 userweb.epic.com signin.epic.com
userweb.epic.com
7 signin.epic.com galaxy.epic.com
signin.epic.com
1 galaxy.epic.com
15 3

This site contains links to these domains. Also see Links.

Domain
userweb.epic.com
www.epic.com
Subject Issuer Validity Valid
*.epic.com
DigiCert TLS RSA SHA256 2020 CA1
2023-03-03 -
2024-04-02
a year crt.sh

This page contains 1 frames:

Primary Page: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-03-18T12%3a36%3a25Z
Frame ID: A1D9E98926CC7F6028F40B285F0DCB22
Requests: 17 HTTP requests in this frame

Screenshot

Page Title

Epic UserWeb Sign In

Page URL History Show full URLs

  1. https://galaxy.epic.com/ Page URL
  2. https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

3
Subdomains

4
IPs

1
Countries

3604 kB
Transfer

3646 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://galaxy.epic.com/ Page URL
  2. https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-03-18T12%3a36%3a25Z Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
galaxy.epic.com/
909 B
1 KB
Document
General
Full URL
https://galaxy.epic.com/?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.89 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
documentation.epic.com
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.epic.com 'unsafe-inline' 'unsafe-eval'; connect-src 'self' data: *.epic.com; img-src 'self' data: *.epic.com; frame-src 'self' *.epic.com https://login.microsoftonline.com/; frame-ancestors 'self' *.epic.com *.microsoftonline.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options sameorigin

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-length
909
content-security-policy
default-src 'self' *.epic.com 'unsafe-inline' 'unsafe-eval'; connect-src 'self' data: *.epic.com; img-src 'self' data: *.epic.com; frame-src 'self' *.epic.com https://login.microsoftonline.com/; frame-ancestors 'self' *.epic.com *.microsoftonline.com
content-type
text/html; charset=utf-8
date
Mon, 18 Mar 2024 12:36:24 GMT
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
x-frame-options
sameorigin
x-ua-compatible
IE=edge
Primary Request /
signin.epic.com/adfs/ls/
389 KB
390 KB
Document
General
Full URL
https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-03-18T12%3a36%3a25Z
Requested by
Host: galaxy.epic.com
URL: https://galaxy.epic.com/?
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.180 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
signin.epic.com
Software
/
Resource Hash
5f15ad7fcc49dabaffedfa72375bec83e6aeb891f3255891d520a99a025955f0
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Strict-Transport-Security max-age=20736000; includeSubDomains
X-Frame-Options DENY

Request headers

Referer
https://galaxy.epic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-cache,no-store
Content-Security-Policy
default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Content-Type
text/html; charset=utf-8
Date
Mon, 18 Mar 2024 12:36:25 GMT
Expires
-1
Pragma
no-cache
Strict-Transport-Security
max-age=20736000; includeSubDomains
Transfer-Encoding
chunked
X-Frame-Options
DENY
style.css
signin.epic.com/adfs/portal/css/
15 KB
16 KB
Stylesheet
General
Full URL
https://signin.epic.com/adfs/portal/css/style.css?id=AE9854C44D967C719CB7199E740ABF6BD0A67646DB017359EC1B93D192F0E5E6
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-03-18T12%3a36%3a25Z
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.180 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
signin.epic.com
Software
/
Resource Hash
cd137fab8d79401e166964c034311045aa20a0913844b91ce42381c02caf7f21
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Strict-Transport-Security max-age=20736000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-03-18T12%3a36%3a25Z
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Expires
Wed, 17 Apr 2024 12:36:26 GMT
Content-Security-Policy
default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Date
Mon, 18 Mar 2024 12:36:26 GMT
Strict-Transport-Security
max-age=20736000; includeSubDomains
ETag
AE9854C44D967C719CB7199E740ABF6BD0A67646DB017359EC1B93D192F0E5E6
Transfer-Encoding
chunked
Content-Type
text/css
logo.png
signin.epic.com/adfs/portal/logo/
21 KB
22 KB
Image
General
Full URL
https://signin.epic.com/adfs/portal/logo/logo.png?id=FDD6AF86718ACAAD2DA8DA80CFA51624404EF5B6FF0E7216E135122E79EB55A2
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-03-18T12%3a36%3a25Z
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.180 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
signin.epic.com
Software
/
Resource Hash
fdd6af86718acaad2da8da80cfa51624404ef5b6ff0e7216e135122e79eb55a2
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Strict-Transport-Security max-age=20736000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-03-18T12%3a36%3a25Z
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Expires
Wed, 17 Apr 2024 12:36:26 GMT
Content-Security-Policy
default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Date
Mon, 18 Mar 2024 12:36:26 GMT
Strict-Transport-Security
max-age=20736000; includeSubDomains
ETag
FDD6AF86718ACAAD2DA8DA80CFA51624404EF5B6FF0E7216E135122E79EB55A2
Transfer-Encoding
chunked
Content-Type
image/png
idp.png
signin.epic.com/adfs/portal/images/idp/
931 B
2 KB
Image
General
Full URL
https://signin.epic.com/adfs/portal/images/idp/idp.png?id=3EADD3E829A20DF612C7A77960FF811E66E3EE6BAE2C33C9B20E7478BAC87548
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-03-18T12%3a36%3a25Z
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.180 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
signin.epic.com
Software
/
Resource Hash
3eadd3e829a20df612c7a77960ff811e66e3ee6bae2c33c9b20e7478bac87548
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Strict-Transport-Security max-age=20736000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-03-18T12%3a36%3a25Z
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Expires
Wed, 17 Apr 2024 12:36:26 GMT
Content-Security-Policy
default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Date
Mon, 18 Mar 2024 12:36:26 GMT
Strict-Transport-Security
max-age=20736000; includeSubDomains
ETag
3EADD3E829A20DF612C7A77960FF811E66E3EE6BAE2C33C9B20E7478BAC87548
Transfer-Encoding
chunked
Content-Type
image/png
localsts.png
signin.epic.com/adfs/portal/images/idp/
5 KB
6 KB
Image
General
Full URL
https://signin.epic.com/adfs/portal/images/idp/localsts.png?id=533AA5E31F67D9476F0DF82EAD79366E5976AD030847CC0BBC0721C666348B4C
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-03-18T12%3a36%3a25Z
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.180 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
signin.epic.com
Software
/
Resource Hash
533aa5e31f67d9476f0df82ead79366e5976ad030847cc0bbc0721c666348b4c
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Strict-Transport-Security max-age=20736000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-03-18T12%3a36%3a25Z
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Expires
Wed, 17 Apr 2024 12:36:26 GMT
Content-Security-Policy
default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Date
Mon, 18 Mar 2024 12:36:26 GMT
Strict-Transport-Security
max-age=20736000; includeSubDomains
ETag
533AA5E31F67D9476F0DF82EAD79366E5976AD030847CC0BBC0721C666348B4C
Transfer-Encoding
chunked
Content-Type
image/png
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
44c09a1300a946429d86582c5416de91810a9fe3cf55b31f852510fd0fe01a53

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Content-Type
image/png
jquery-1.10.2.min.js
signin.epic.com/adfs/portal/script/
91 KB
92 KB
Script
General
Full URL
https://signin.epic.com/adfs/portal/script/jquery-1.10.2.min.js
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-03-18T12%3a36%3a25Z
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.180 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
signin.epic.com
Software
/
Resource Hash
0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Strict-Transport-Security max-age=20736000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-03-18T12%3a36%3a25Z
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Expires
Wed, 17 Apr 2024 12:36:26 GMT
Content-Security-Policy
default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Date
Mon, 18 Mar 2024 12:36:26 GMT
Strict-Transport-Security
max-age=20736000; includeSubDomains
ETag
0BA081F546084BD5097AA8A73C75931D5AA1FC4D6E846E53C21F98E6A1509988
Transfer-Encoding
chunked
Content-Type
text/javascript
/
userweb.epic.com/Home/Background/
805 KB
806 KB
Image
General
Full URL
https://userweb.epic.com/Home/Background/?date=3.18&time=Day&offset=-1
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-03-18T12%3a36%3a25Z
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.121 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
userweb.epic.com
Software
/
Resource Hash
7cafeac62da5b7094cdc48ba154839424fc15b88f732902aec125bbd60b7933b
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Content-Security-Policy
default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Date
Mon, 18 Mar 2024 12:36:26 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Mon, 18 Mar 2024 05:35:49 GMT
Vary
*
Content-Type
image/jpeg
P3P
CP="Not a privacy policy"
Cache-Control
public, max-age=61161
Content-Length
823877
Expires
Mon, 18 Mar 2024 23:00:00 GMT
GetSignInResources
userweb.epic.com/Account/
324 B
1 KB
XHR
General
Full URL
https://userweb.epic.com/Account/GetSignInResources
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-03-18T12%3a36%3a25Z
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.121 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
userweb.epic.com
Software
/
Resource Hash
a228ce242d989f08209c1821be1073da26afcd1d42edbb5407d825299fe8e88b
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Pragma
no-cache
Content-Security-Policy
default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Date
Mon, 18 Mar 2024 12:36:26 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
P3P
CP="Not a privacy policy"
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store
Content-Length
324
Expires
-1
StyleSheet
userweb.epic.com/Customer/
70 KB
21 KB
Stylesheet
General
Full URL
https://userweb.epic.com/Customer/StyleSheet
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/portal/script/jquery-1.10.2.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.121 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
userweb.epic.com
Software
/
Resource Hash
8d3342e52e8da3f5722179d04e3686e0409fe1bb1820060e7342f2105abf75ab
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Content-Security-Policy
default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Date
Mon, 18 Mar 2024 12:36:26 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Mon, 18 Mar 2024 12:30:34 GMT
Vary
*, Accept-Encoding
Content-Type
text/css; charset=utf-8
P3P
CP="Not a privacy policy"
Cache-Control
public, max-age=3247
Connection
Keep-Alive
Content-Length
20074
Expires
Mon, 18 Mar 2024 13:30:34 GMT
GetClaimsProviderIDs
userweb.epic.com/Account/
177 KB
178 KB
XHR
General
Full URL
https://userweb.epic.com/Account/GetClaimsProviderIDs
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-03-18T12%3a36%3a25Z
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.121 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
userweb.epic.com
Software
/
Resource Hash
8b0dbd2337e490ce9566f8502a4ad913070ec86644c8a116f73d4a9b7e5d7f7b
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Pragma
no-cache
Content-Security-Policy
default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Date
Mon, 18 Mar 2024 12:36:26 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
application/json; charset=utf-8
P3P
CP="Not a privacy policy"
Access-Control-Allow-Origin
https://signin.epic.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Content-Length
181257
Expires
-1
GetNonSSOCustomers
userweb.epic.com/Account/
13 KB
14 KB
XHR
General
Full URL
https://userweb.epic.com/Account/GetNonSSOCustomers
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-03-18T12%3a36%3a25Z
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.121 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
userweb.epic.com
Software
/
Resource Hash
ba7b1594d6f11e4d9c6463b38ccaad331752ec1baa362db2a1dc5364d86cd1f8
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Pragma
no-cache
Content-Security-Policy
default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Date
Mon, 18 Mar 2024 12:36:28 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
application/json; charset=utf-8
P3P
CP="Not a privacy policy"
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store
Content-Length
13414
Expires
-1
LargeIconSprite
userweb.epic.com/Customer/
2 MB
2 MB
Image
General
Full URL
https://userweb.epic.com/Customer/LargeIconSprite?tg=638463384033497135
Requested by
Host: userweb.epic.com
URL: https://userweb.epic.com/Customer/StyleSheet
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.121 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
userweb.epic.com
Software
/
Resource Hash
85133da816b47346e959940df7e675e93f57384f18581cd4cfeae1cfdb13a2a6
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://userweb.epic.com/Customer/StyleSheet
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Content-Security-Policy
default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Date
Mon, 18 Mar 2024 12:36:28 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Mon, 18 Mar 2024 12:30:34 GMT
Vary
*
Content-Type
image/png
P3P
CP="Not a privacy policy"
Cache-Control
public, max-age=3246
Content-Length
2097152
Expires
Mon, 18 Mar 2024 13:30:34 GMT
localsts.png
signin.epic.com/adfs/portal/images/idp/
5 KB
6 KB
Image
General
Full URL
https://signin.epic.com/adfs/portal/images/idp/localsts.png
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-03-18T12%3a36%3a25Z
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.180 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
signin.epic.com
Software
/
Resource Hash
533aa5e31f67d9476f0df82ead79366e5976ad030847cc0bbc0721c666348b4c
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Strict-Transport-Security max-age=20736000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-03-18T12%3a36%3a25Z
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Expires
Wed, 17 Apr 2024 12:36:28 GMT
Content-Security-Policy
default-src 'self' *.epic.com *.epichosted.com; form-action 'self' *.epic.com *.epichosted.com *; script-src 'self' *.epic.com *.epichosted.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.epic.com *.epichosted.com 'unsafe-inline'; img-src 'self' *.epic.com *.epichosted.com data:; frame-ancestors 'self' *.epic.com *.epic.com:* *.epichosted.com https://login.microsoftonline.com https://login.microsoftonline.com:*
Date
Mon, 18 Mar 2024 12:36:28 GMT
Strict-Transport-Security
max-age=20736000; includeSubDomains
ETag
533AA5E31F67D9476F0DF82EAD79366E5976AD030847CC0BBC0721C666348B4C
Transfer-Encoding
chunked
Content-Type
image/png
truncated
/
421 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
837a90288849060834b9ad77f318002e6118973713569accf389a0471a576e72

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Content-Type
image/png
EpicOnFHIR-Icon.png
userweb.epic.com/Images/
1 KB
2 KB
Image
General
Full URL
https://userweb.epic.com/Images/EpicOnFHIR-Icon.png
Requested by
Host: signin.epic.com
URL: https://signin.epic.com/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2fgalaxy.epic.com%2f&wctx=rm%3d1%26id%3dpassive%26ru%3d%252F&wct=2024-03-18T12%3a36%3a25Z
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.56.121 Madison, United States, ASN10359 (EPICSYS, US),
Reverse DNS
userweb.epic.com
Software
/
Resource Hash
8bf64bb95ea27a909b10e88cd2011004ea7113422a5c6f26e039f2d0be22ab51
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://signin.epic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Content-Security-Policy
default-src 'none'; script-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.epic.com; img-src 'self' *.epic.com data: blob:; style-src 'self' *.epic.com https://www.gstatic.com/charts/ 'unsafe-inline'; frame-ancestors 'self' *.epic.com https://login.microsoftonline.com; frame-src 'self' https://login.microsoftonline.com *.epic.com; child-src 'self' https://login.microsoftonline.com *.epic.com; report-uri https://userweb.epic.com/Error/CspReport
Date
Mon, 18 Mar 2024 12:36:28 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Tue, 06 Apr 2021 23:27:28 GMT
ETag
"302292683c2bd71:0"
P3P
CP="Not a privacy policy"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
1041

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| HRDErrors function| InputUtil function| HRD undefined| emails undefined| msViewportStyle undefined| viewport function| getStyle function| computeLoadIllustration object| UserWeb function| $ function| jQuery

2 Cookies

Domain/Path Name / Value
galaxy.epic.com/ Name: EpicPersistenceCookie
Value: !EZ1Ue1ZJq6btwlg3O0o5OvuHB8JfptnPfnxRErOi3emGA97Rnl/3xsrzfVAB8Iad60uqGns+WtR5V5M=
userweb.epic.com/ Name: EpicPersistenceCookie
Value: !tvfjVr26X68uBV43O0o5OvuHB8Jfpood8My1X3QlnHqlEiPz/WmmFlvh5sLPLewjzHsQVzpVTq7Aeg==

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self' *.epic.com 'unsafe-inline' 'unsafe-eval'; connect-src 'self' data: *.epic.com; img-src 'self' data: *.epic.com; frame-src 'self' *.epic.com https://login.microsoftonline.com/; frame-ancestors 'self' *.epic.com *.microsoftonline.com
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options sameorigin