urlscan.io logo urlscan.io
SecurityTrails logo

nhswestessex.covid-demo.shiftpartner.com Open in urlscan Pro
13.224.102.26  Public Scan

Go To Rescan Add Verdict Report
URL: https://nhswestessex.covid-demo.shiftpartner.com/
Submission: On July 06 via automatic, source certstream-suspicious
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 4 countries across 7 domains to perform 15 HTTP transactions. The main IP is 13.224.102.26, located in Seattle, United States and belongs to AMAZON-02, US. The main domain is nhswestessex.covid-demo.shiftpartner.com.
TLS certificate: Issued by Amazon on July 6th 2020. Valid for: a year.
This is the only time nhswestessex.covid-demo.shiftpartner.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

9    13.224.102.26 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-102-26.zrh50.r.cloudfront.net
nhswestessex.covid-demo.shiftpartner.com
1    2606:4700::6810:85e5 (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    2a00:1450:4001:806::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
2    2a00:1450:4001:824::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2a00:1450:400c:c04::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    2a00:1450:4001:817::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
2    52.56.65.252 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-56-65-252.eu-west-2.compute.amazonaws.com
api.covid-demo.shiftpartner.com
Domain Requested by
9 nhswestessex.covid-demo.shiftpartner.com nhswestessex.covid-demo.shiftpartner.com
2 api.covid-demo.shiftpartner.com nhswestessex.covid-demo.shiftpartner.com
2 www.google-analytics.com 1 redirects www.googletagmanager.com
1 www.google.de nhswestessex.covid-demo.shiftpartner.com
1 www.google.com 1 redirects
1 stats.g.doubleclick.net 1 redirects
1 www.googletagmanager.com nhswestessex.covid-demo.shiftpartner.com
1 cdnjs.cloudflare.com nhswestessex.covid-demo.shiftpartner.com
15 8

This site contains no links.

Subject Issuer Validity Valid
*.covid.shiftpartner.com
Amazon		 2020-07-06 -
2021-08-06		 a year crt.sh
cloudflare.com
Cloudflare Inc ECC CA-3		 2020-07-04 -
2021-07-04		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-06-17 -
2020-09-09		 3 months crt.sh
www.google.de
GTS CA 1O1		 2020-06-17 -
2020-09-09		 3 months crt.sh
api.covid-demo.shiftpartner.com
Amazon		 2020-06-19 -
2021-07-19		 a year crt.sh

This page contains 1 frames:

Primary Page: https://nhswestessex.covid-demo.shiftpartner.com/
Frame ID: 0A7DD5A2248300D9D873DB4C84D5AF6D
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<[^>]*class="ant-(?:btn|col|row|layout|breadcrumb|menu|pagination|steps|select|cascader|checkbox|calendar|form|input-number|input|mention|rate|radio|slider|switch|tree-select|time-picker|transfer|upload|avatar|badge|card|carousel|collapse|list|popover|tooltip|table|tabs|tag|timeline|tree|alert|modal|message|notification|progress|popconfirm|spin|anchor|back-top|divider|drawer)/i
Overall confidence: 100%
Detected patterns
  • headers via /\(CloudFront\)$/i
  • headers server /^AmazonS3$/i
Overall confidence: 100%
Detected patterns
  • headers via /\(CloudFront\)$/i
Overall confidence: 100%
Detected patterns
  • headers server /^AmazonS3$/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

15
Requests

100 %
HTTPS

75 %
IPv6

7
Domains

8
Subdomains

7
IPs

4
Countries

1525 kB
Transfer

6196 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 9
  • https://www.google-analytics.com/r/collect?v=1&_v=j83&a=1924461536&t=pageview&_s=1&dl=https%3A%2F%2Fnhswestessex.covid-demo.shiftpartner.com%2F&ul=en-us&de=UTF-8&dt=COVID%20Testing&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUAB~&jid=1543096213&gjid=414239588&cid=1858459079.1594028761&tid=UA-166755016-2&_gid=1812009484.1594028761&_r=1&gtm=2ou6o0&z=1509527965 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-166755016-2&cid=1858459079.1594028761&jid=1543096213&_gid=1812009484.1594028761&gjid=414239588&_v=j83&z=1509527965 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-166755016-2&cid=1858459079.1594028761&jid=1543096213&_v=j83&z=1509527965 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-166755016-2&cid=1858459079.1594028761&jid=1543096213&_v=j83&z=1509527965&slf_rd=1&random=271259472

15 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
nhswestessex.covid-demo.shiftpartner.com/ 		3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://nhswestessex.covid-demo.shiftpartner.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.224.102.26 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-102-26.zrh50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
9810291f912ec2497a9472f7062ffe330583f9b3e76ca9e930925756e6d31897

Request headers

:method
GET
:authority
nhswestessex.covid-demo.shiftpartner.com
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
content-type
text/html
date
Mon, 06 Jul 2020 09:46:01 GMT
last-modified
Wed, 01 Jul 2020 16:52:01 GMT
server
AmazonS3
content-encoding
gzip
vary
Accept-Encoding
x-cache
Miss from cloudfront
via
1.1 792f70324a941726ce7e749514e6fc3c.cloudfront.net (CloudFront)
x-amz-cf-pop
ZRH50-C1
x-amz-cf-id
fGBNWqGfcXWcDfmeXZGfYVBR3lZ8lQzNmx4ad9K2_PymF74KToisJQ==
index.css
nhswestessex.covid-demo.shiftpartner.com/ 		2 KB
847 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://nhswestessex.covid-demo.shiftpartner.com/index.css
Requested by
Host: nhswestessex.covid-demo.shiftpartner.com
URL: https://nhswestessex.covid-demo.shiftpartner.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.224.102.26 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-102-26.zrh50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
73cdbb1ebe67d70a040e57334518d2d74b797def68c1c4fb67dcb4d0ffb546f2

Request headers

Referer
https://nhswestessex.covid-demo.shiftpartner.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 06 Jul 2020 09:46:01 GMT
content-encoding
gzip
last-modified
Wed, 01 Jul 2020 16:52:01 GMT
server
AmazonS3
x-amz-cf-pop
ZRH50-C1
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
text/css
status
200
x-amz-cf-id
5zCRnDLf_IK58-KJqB11KTrSa2NTPGDMSslGEST1Q2FXE8b-wppfCw==
via
1.1 792f70324a941726ce7e749514e6fc3c.cloudfront.net (CloudFront)
bowser.min.js
cdnjs.cloudflare.com/ajax/libs/bowser/1.9.4/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/bowser/1.9.4/bowser.min.js
Requested by
Host: nhswestessex.covid-demo.shiftpartner.com
URL: https://nhswestessex.covid-demo.shiftpartner.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:85e5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b52f6b6011741e76cefa2be41164bbc9b33bba334b9ad15b03abad37b609d983
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Referer
https://nhswestessex.covid-demo.shiftpartner.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 06 Jul 2020 09:46:00 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
21522983
status
200
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
03c51db667000097a84229c200000001
served-in-seconds
0.001
timing-allow-origin
*
last-modified
Mon, 02 Jul 2018 14:15:51 GMT
server
cloudflare
etag
W/"5b3a3397-1edd"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
5ae8656a394997a8-FRA
expires
Sat, 26 Jun 2021 09:46:00 GMT
browserCheck.js
nhswestessex.covid-demo.shiftpartner.com/static/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nhswestessex.covid-demo.shiftpartner.com/static/browserCheck.js
Requested by
Host: nhswestessex.covid-demo.shiftpartner.com
URL: https://nhswestessex.covid-demo.shiftpartner.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.224.102.26 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-102-26.zrh50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
9810291f912ec2497a9472f7062ffe330583f9b3e76ca9e930925756e6d31897

Request headers

Referer
https://nhswestessex.covid-demo.shiftpartner.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 06 Jul 2020 09:46:01 GMT
content-encoding
gzip
last-modified
Wed, 01 Jul 2020 16:52:01 GMT
server
AmazonS3
x-amz-cf-pop
ZRH50-C1
vary
Accept-Encoding
x-cache
Error from cloudfront
content-type
text/html
status
200
x-amz-cf-id
bOiD3ITs1lxBIfMRGjKPPBYb4ZDOTEKw_TACxy7iDNNhtoS_ABQF9A==
via
1.1 792f70324a941726ce7e749514e6fc3c.cloudfront.net (CloudFront)
js
www.googletagmanager.com/gtag/ 		84 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-166755016-2
Requested by
Host: nhswestessex.covid-demo.shiftpartner.com
URL: https://nhswestessex.covid-demo.shiftpartner.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
741bbc147d06c4f93bc1f7f590b2d2307f79b8363bfd364495a373bcb5aec147
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://nhswestessex.covid-demo.shiftpartner.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 06 Jul 2020 09:46:00 GMT
content-encoding
br
vary
Accept-Encoding
status
200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33698
x-xss-protection
0
last-modified
Mon, 06 Jul 2020 09:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 06 Jul 2020 09:46:00 GMT
2.37964d00.chunk.css
nhswestessex.covid-demo.shiftpartner.com/static/css/ 		454 KB
51 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://nhswestessex.covid-demo.shiftpartner.com/static/css/2.37964d00.chunk.css
Requested by
Host: nhswestessex.covid-demo.shiftpartner.com
URL: https://nhswestessex.covid-demo.shiftpartner.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.224.102.26 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-102-26.zrh50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
88494d6ca0b8fa7938f39b83a43398ecdbc04cd3f6173477a1a37ba1b878f47c

Request headers

Referer
https://nhswestessex.covid-demo.shiftpartner.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 06 Jul 2020 09:46:01 GMT
content-encoding
gzip
last-modified
Wed, 01 Jul 2020 16:52:01 GMT
server
AmazonS3
x-amz-cf-pop
ZRH50-C1
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
text/css
status
200
x-amz-cf-id
9N1HPGSLzju9SIury7J_-tyNlbGOJWiO6gZXkP5jXULcxmaoyyGhoQ==
via
1.1 792f70324a941726ce7e749514e6fc3c.cloudfront.net (CloudFront)
main.e4273a86.chunk.css
nhswestessex.covid-demo.shiftpartner.com/static/css/ 		88 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://nhswestessex.covid-demo.shiftpartner.com/static/css/main.e4273a86.chunk.css
Requested by
Host: nhswestessex.covid-demo.shiftpartner.com
URL: https://nhswestessex.covid-demo.shiftpartner.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.224.102.26 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-102-26.zrh50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
318ec49da295ff2240abc7e10341373daad19b2b860cb1e8eee8a7b40de8cd19

Request headers

Referer
https://nhswestessex.covid-demo.shiftpartner.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 06 Jul 2020 09:46:01 GMT
content-encoding
gzip
last-modified
Wed, 01 Jul 2020 16:52:01 GMT
server
AmazonS3
x-amz-cf-pop
ZRH50-C1
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
text/css
status
200
x-amz-cf-id
fVbDVg6WBDZxmNXlUK5D0UJxpjAMJ3D6RlaNgQmn7vvfbTREA4YopQ==
via
1.1 792f70324a941726ce7e749514e6fc3c.cloudfront.net (CloudFront)
2.420236e6.chunk.js
nhswestessex.covid-demo.shiftpartner.com/static/js/ 		5 MB
1 MB 		Script
General
Check archive.org
Download Go to
Full URL
https://nhswestessex.covid-demo.shiftpartner.com/static/js/2.420236e6.chunk.js
Requested by
Host: nhswestessex.covid-demo.shiftpartner.com
URL: https://nhswestessex.covid-demo.shiftpartner.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.224.102.26 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-102-26.zrh50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a29ff2f8bb9c5dee7a71d63c3c29efc07bc95ec6e1fc0f57d0cdbed012b4e7ae

Request headers

Referer
https://nhswestessex.covid-demo.shiftpartner.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 06 Jul 2020 09:46:01 GMT
content-encoding
gzip
last-modified
Wed, 01 Jul 2020 16:52:01 GMT
server
AmazonS3
x-amz-cf-pop
ZRH50-C1
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
application/javascript
status
200
x-amz-cf-id
JhOvJpsGoNsDztY25_OYB8TLFL3Nv9far-mIPJ46cR2diqtRjLaw1Q==
via
1.1 792f70324a941726ce7e749514e6fc3c.cloudfront.net (CloudFront)
main.6c1ec551.chunk.js
nhswestessex.covid-demo.shiftpartner.com/static/js/ 		456 KB
126 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nhswestessex.covid-demo.shiftpartner.com/static/js/main.6c1ec551.chunk.js
Requested by
Host: nhswestessex.covid-demo.shiftpartner.com
URL: https://nhswestessex.covid-demo.shiftpartner.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.224.102.26 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-102-26.zrh50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a4f7557b4d07c9564fa63b48e3f04e2fd862bc5fe4b659c659b6c9d672f26fda

Request headers

Referer
https://nhswestessex.covid-demo.shiftpartner.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 06 Jul 2020 09:46:01 GMT
content-encoding
gzip
last-modified
Wed, 01 Jul 2020 16:52:01 GMT
server
AmazonS3
x-amz-cf-pop
ZRH50-C1
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
application/javascript
status
200
x-amz-cf-id
E0EKhYLSYVcuxl0d8jI2snEHJdn27qwJAhTioWMV_yNjIGQFNvhfKw==
via
1.1 792f70324a941726ce7e749514e6fc3c.cloudfront.net (CloudFront)
analytics.js
www.google-analytics.com/ 		45 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-166755016-2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://nhswestessex.covid-demo.shiftpartner.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 04 Jun 2020 23:38:14 GMT
server
Golfe2
age
5422
date
Mon, 06 Jul 2020 08:15:38 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18469
expires
Mon, 06 Jul 2020 10:15:38 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j83&a=1924461536&t=pageview&_s=1&dl=https%3A%2F%2Fnhswestessex.covid-demo.shiftpartner.com%2F&ul=en-us&de=UTF-8&dt=COVID%20Testing&sd=24-bit&sr=160...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-166755016-2&cid=1858459079.1594028761&jid=1543096213&_gid=1812009484.1594028761&gjid=414239588&_v=j83&z=1509527965
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-166755016-2&cid=1858459079.1594028761&jid=1543096213&_v=j83&z=1509527965
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-166755016-2&cid=1858459079.1594028761&jid=1543096213&_v=j83&z=1509527965&slf_rd=1&random=271259472
42 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-166755016-2&cid=1858459079.1594028761&jid=1543096213&_v=j83&z=1509527965&slf_rd=1&random=271259472
Requested by
Host: nhswestessex.covid-demo.shiftpartner.com
URL: https://nhswestessex.covid-demo.shiftpartner.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://nhswestessex.covid-demo.shiftpartner.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 06 Jul 2020 09:46:00 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 06 Jul 2020 09:46:00 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
content-type
text/html; charset=UTF-8
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-166755016-2&cid=1858459079.1594028761&jid=1543096213&_v=j83&z=1509527965&slf_rd=1&random=271259472
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
truncated
/ 		38 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
05632bd17ae6013db11864ba86f363756e305cd5a56ee788fe20774ed6c750f9

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/webp
truncated
/ 		17 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
feabc49dc4a727ad8461e187fd9096627d5bd9e44637dac06da66c0d7196bb4f

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
/
api.covid-demo.shiftpartner.com/api/v1/accounts/ 		115 B
314 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.covid-demo.shiftpartner.com/api/v1/accounts/
Requested by
Host: nhswestessex.covid-demo.shiftpartner.com
URL: https://nhswestessex.covid-demo.shiftpartner.com/static/js/2.420236e6.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.56.65.252 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-56-65-252.eu-west-2.compute.amazonaws.com
Software
nginx/1.14.2 /
Resource Hash
58fe737ebe193d509382e9d664ce3eb298547efa8b2e74b0284d4d7e97577a93
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Accept
application/json, text/plain, */*
Referer
https://nhswestessex.covid-demo.shiftpartner.com/sign-up
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Mon, 06 Jul 2020 09:46:01 GMT
allow
GET, HEAD, OPTIONS
server
nginx/1.14.2
x-frame-options
DENY
vary
Accept, Origin, Cookie
content-type
application/json
access-control-allow-origin
*
content-length
115
x-content-type-options
nosniff
/
api.covid-demo.shiftpartner.com/api/v1/accounts/ 		115 B
314 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.covid-demo.shiftpartner.com/api/v1/accounts/
Requested by
Host: nhswestessex.covid-demo.shiftpartner.com
URL: https://nhswestessex.covid-demo.shiftpartner.com/static/js/2.420236e6.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.56.65.252 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-56-65-252.eu-west-2.compute.amazonaws.com
Software
nginx/1.14.2 /
Resource Hash
58fe737ebe193d509382e9d664ce3eb298547efa8b2e74b0284d4d7e97577a93
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Accept
application/json, text/plain, */*
Referer
https://nhswestessex.covid-demo.shiftpartner.com/sign-up
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Mon, 06 Jul 2020 09:46:01 GMT
allow
GET, HEAD, OPTIONS
server
nginx/1.14.2
x-frame-options
DENY
vary
Accept, Origin, Cookie
content-type
application/json
access-control-allow-origin
*
content-length
115
x-content-type-options
nosniff
SourceSansPro-Regular.982386e2.ttf
nhswestessex.covid-demo.shiftpartner.com/static/media/ 		116 KB
117 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://nhswestessex.covid-demo.shiftpartner.com/static/media/SourceSansPro-Regular.982386e2.ttf
Requested by
Host: nhswestessex.covid-demo.shiftpartner.com
URL: https://nhswestessex.covid-demo.shiftpartner.com/sign-up
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.224.102.26 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-102-26.zrh50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
869f06e42d1a755a32f253a73f81235925cf27b686ba7702ce1f03fcc7738631

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://nhswestessex.covid-demo.shiftpartner.com/static/css/main.e4273a86.chunk.css
Origin
https://nhswestessex.covid-demo.shiftpartner.com

Response headers

date
Mon, 06 Jul 2020 09:46:02 GMT
via
1.1 792f70324a941726ce7e749514e6fc3c.cloudfront.net (CloudFront)
last-modified
Wed, 01 Jul 2020 16:52:01 GMT
server
AmazonS3
x-amz-cf-pop
ZRH50-C1
etag
"982386e2d4b16d8a061d83647e35c39c"
x-cache
Miss from cloudfront
content-type
binary/octet-stream
status
200
accept-ranges
bytes
content-length
119080
x-amz-cf-id
aBhc9fPnnyuuJ3rkyq2vLAQdZ2Q1lmQYuh6OXKgUEqpdqOVQOgqv3A==
SourceSansPro-ExtraLight.871ddabf.ttf
nhswestessex.covid-demo.shiftpartner.com/static/media/ 		117 KB
117 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://nhswestessex.covid-demo.shiftpartner.com/static/media/SourceSansPro-ExtraLight.871ddabf.ttf
Requested by
Host: nhswestessex.covid-demo.shiftpartner.com
URL: https://nhswestessex.covid-demo.shiftpartner.com/sign-up
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.224.102.26 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-102-26.zrh50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
c770886a9d8152cbe2e05daf0bb3c3c83db376f8684d697aee880652c286b8f9

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://nhswestessex.covid-demo.shiftpartner.com/static/css/main.e4273a86.chunk.css
Origin
https://nhswestessex.covid-demo.shiftpartner.com

Response headers

date
Mon, 06 Jul 2020 09:46:02 GMT
via
1.1 792f70324a941726ce7e749514e6fc3c.cloudfront.net (CloudFront)
last-modified
Wed, 01 Jul 2020 16:52:01 GMT
server
AmazonS3
x-amz-cf-pop
ZRH50-C1
etag
"871ddabf1a1d296c36453b01953a61ca"
x-cache
Miss from cloudfront
content-type
binary/octet-stream
status
200
accept-ranges
bytes
content-length
119324
x-amz-cf-id
VaU7foSIPPcq9uersEUf7hZhjeszqioUSWLCLUwc0JMCYFRBVlBmhg==

Verdicts & Comments Add Verdict or Comment

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| bowser function| gtag object| dataLayer object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData object| webpackJsonpfront-end function| setImmediate function| clearImmediate object| regeneratorRuntime function| Hammer function| _ function| Color function| Chart

3 Cookies

Domain/Path Name / Value
.shiftpartner.com/ Name: _gid
Value: GA1.2.1812009484.1594028761
.shiftpartner.com/ Name: _gat_gtag_UA_166755016_2
Value: 1
.shiftpartner.com/ Name: _ga
Value: GA1.2.1858459079.1594028761

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.covid-demo.shiftpartner.com
cdnjs.cloudflare.com
nhswestessex.covid-demo.shiftpartner.com
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
13.224.102.26
2606:4700::6810:85e5
2a00:1450:4001:802::2003
2a00:1450:4001:806::2008
2a00:1450:4001:817::2004
2a00:1450:4001:824::200e
2a00:1450:400c:c04::9c
52.56.65.252
05632bd17ae6013db11864ba86f363756e305cd5a56ee788fe20774ed6c750f9
318ec49da295ff2240abc7e10341373daad19b2b860cb1e8eee8a7b40de8cd19
58fe737ebe193d509382e9d664ce3eb298547efa8b2e74b0284d4d7e97577a93
73cdbb1ebe67d70a040e57334518d2d74b797def68c1c4fb67dcb4d0ffb546f2
741bbc147d06c4f93bc1f7f590b2d2307f79b8363bfd364495a373bcb5aec147
869f06e42d1a755a32f253a73f81235925cf27b686ba7702ce1f03fcc7738631
88494d6ca0b8fa7938f39b83a43398ecdbc04cd3f6173477a1a37ba1b878f47c
9810291f912ec2497a9472f7062ffe330583f9b3e76ca9e930925756e6d31897
a29ff2f8bb9c5dee7a71d63c3c29efc07bc95ec6e1fc0f57d0cdbed012b4e7ae
a4f7557b4d07c9564fa63b48e3f04e2fd862bc5fe4b659c659b6c9d672f26fda
b52f6b6011741e76cefa2be41164bbc9b33bba334b9ad15b03abad37b609d983
c770886a9d8152cbe2e05daf0bb3c3c83db376f8684d697aee880652c286b8f9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955
feabc49dc4a727ad8461e187fd9096627d5bd9e44637dac06da66c0d7196bb4f