urlscan.io logo urlscan.io
SecurityTrails logo

sso.americanexpress.com Open in urlscan Pro
148.173.96.124  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://sso.americanexpress.com/SPS/auth/push?ssolang=en_US&ssobrand=CONCORD&TARGET=https%3A%2F%2Fwww209.americanexpress...
Effective URL: https://sso.americanexpress.com/SPS/logon?spsversion=v2&TYPE=33554432&REALMOID=06-0009e401-c0f3-1621-9977-00200a12208f&GUID=&SMA...
Submission: On September 07 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 12 HTTP transactions. The main IP is 148.173.96.124, located in United States and belongs to AMERICAN-EXPRESS, US. The main domain is sso.americanexpress.com. The Cisco Umbrella rank of the primary domain is 144672.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on January 16th 2023. Valid for: a year.
This is the only time sso.americanexpress.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 4 148.173.96.124 6307 (AMERICAN-...)
1 2600:9000:206... 16509 (AMAZON-02)
8 23.212.203.180 16625 (AKAMAI-AS)
12 3
Apex Domain
Subdomains		 Transfer
8 aexp-static.com
icm.aexp-static.com — Cisco Umbrella Rank: 14392
64 KB
4 americanexpress.com
sso.americanexpress.com — Cisco Umbrella Rank: 144672
62 KB
1 ensighten.com
nexus.ensighten.com — Cisco Umbrella Rank: 3766
492 B
12 3
Domain Requested by
8 icm.aexp-static.com sso.americanexpress.com
icm.aexp-static.com
4 sso.americanexpress.com 1 redirects sso.americanexpress.com
1 nexus.ensighten.com sso.americanexpress.com
12 3
Subject Issuer Validity Valid
sso.americanexpress.com
DigiCert SHA2 Extended Validation Server CA		 2023-01-16 -
2024-01-15		 a year crt.sh
nexus.ensighten.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-10-07 -
2023-10-14		 a year crt.sh
m.americanexpress.com
DigiCert EV RSA CA G2		 2023-04-05 -
2024-04-04		 a year crt.sh

This page contains 1 frames:

Primary Page: https://sso.americanexpress.com/SPS/logon?spsversion=v2&TYPE=33554432&REALMOID=06-0009e401-c0f3-1621-9977-00200a12208f&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$ElmmH8mybZ1joOKXN2C2D%2bLyoUdJDxOp9Hq0zB0mWJAf8rkl9DKcl%2bHP99XOwTMR&TARGET=$SM$HTTPS%3a%2f%2fsso%2eamericanexpress%2ecom%2fSPS%2fauth%2fpush%3fssolang%3den_US%26amp%3bssobrand%3dCONCORD%26amp%3bTARGET%3dhttps$%3A$%2F$%2Fwww209%2eamericanexpress%2ecom$%2Fmerchant$%2Fservices$%2Fen_US$%2Fsecure$%2Fhome$%3Fomnlogin$%3Dus_homepage_oms
Frame ID: 109D427C1589EC13133F4CBEA292CE22
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

American Express

Page URL History Show full URLs

  1. https://sso.americanexpress.com/SPS/auth/push?ssolang=en_US&ssobrand=CONCORD&TARGET=https%3A%2F%2Fww... HTTP 302
    https://sso.americanexpress.com/SPS/logon?spsversion=v2&TYPE=33554432&REALMOID=06-0009e401-c0f3-1621-9977-00... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • aexp-static\.com
Overall confidence: 100%
Detected patterns
  • //nexus\.ensighten\.com/

Page Statistics

12
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

124 kB
Transfer

280 kB
Size

6
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://sso.americanexpress.com/SPS/auth/push?ssolang=en_US&ssobrand=CONCORD&TARGET=https%3A%2F%2Fwww209.americanexpress.com%2Fmerchant%2Fservices%2Fen_US%2Fsecure%2Fhome%3Fomnlogin%3Dus_homepage_oms HTTP 302
    https://sso.americanexpress.com/SPS/logon?spsversion=v2&TYPE=33554432&REALMOID=06-0009e401-c0f3-1621-9977-00200a12208f&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$ElmmH8mybZ1joOKXN2C2D%2bLyoUdJDxOp9Hq0zB0mWJAf8rkl9DKcl%2bHP99XOwTMR&TARGET=$SM$HTTPS%3a%2f%2fsso%2eamericanexpress%2ecom%2fSPS%2fauth%2fpush%3fssolang%3den_US%26amp%3bssobrand%3dCONCORD%26amp%3bTARGET%3dhttps$%3A$%2F$%2Fwww209%2eamericanexpress%2ecom$%2Fmerchant$%2Fservices$%2Fen_US$%2Fsecure$%2Fhome$%3Fomnlogin$%3Dus_homepage_oms Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request logon
sso.americanexpress.com/SPS/
Redirect Chain
  • https://sso.americanexpress.com/SPS/auth/push?ssolang=en_US&ssobrand=CONCORD&TARGET=https%3A%2F%2Fwww209.americanexpress.com%2Fmerchant%2Fservices%2Fen_US%2Fsecure%2Fhome%3Fomnlogin%3Dus_ho...
  • https://sso.americanexpress.com/SPS/logon?spsversion=v2&TYPE=33554432&REALMOID=06-0009e401-c0f3-1621-9977-00200a12208f&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$ElmmH8mybZ1joOKXN2C2D%2bLyoUdJ...
53 KB
56 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sso.americanexpress.com/SPS/logon?spsversion=v2&TYPE=33554432&REALMOID=06-0009e401-c0f3-1621-9977-00200a12208f&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$ElmmH8mybZ1joOKXN2C2D%2bLyoUdJDxOp9Hq0zB0mWJAf8rkl9DKcl%2bHP99XOwTMR&TARGET=$SM$HTTPS%3a%2f%2fsso%2eamericanexpress%2ecom%2fSPS%2fauth%2fpush%3fssolang%3den_US%26amp%3bssobrand%3dCONCORD%26amp%3bTARGET%3dhttps$%3A$%2F$%2Fwww209%2eamericanexpress%2ecom$%2Fmerchant$%2Fservices$%2Fen_US$%2Fsecure$%2Fhome$%3Fomnlogin$%3Dus_homepage_oms
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
148.173.96.124 , United States, ASN6307 (AMERICAN-EXPRESS, US),
Reverse DNS
sso-ipc2.americanexpress.com
Software
/
Resource Hash
cd8dfabe6b2f3e4da69cb42f9803848a39e0f09bb086e3c3195b828c3e3710cf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Language
en-US
Content-Type
text/html; charset=ISO-8859-1
Date
Thu, 07 Sep 2023 11:52:03 GMT
Expires
Thu, 15 Apr 2011 20:00:00 GMT
Pragma
no-cache
Strict-Transport-Security
max-age=31536000;includeSubDomains; preload
Transfer-Encoding
chunked
content-security-policy-report-only
style-src https://*.aexp-static.com/ https://*.americanexpress.com/ 'unsafe-inline' 'self'; block-all-mixed-content ; script-src https://*.americanexpress.com/ 'unsafe-inline' 'self' https://accdn.lpsnmedia.net/ https://*.liveperson.net/ https://fls.doubleclick.net/ https://va.v.liveperson.net/ https://service.maxymiser.net/ https://c.evidon.com/ https://*.aexp-static.com/ https://www.google.com/ https://cdncache-a.akamaihd.net/ 'unsafe-eval'; base-uri 'self' https://gct.americanexpress.com/; form-action https://www.mycreditguide.americanexpress.com/ http://*.americanexpress.com/ http://www.mycreditguide.americanexpress.com/ https://*.americanexpress.com/ https://*.custhelp.com/ 'self'; frame-src https://fls.doubleclick.net/ https://*.doubleclick.net/ https://icm.aexp-static.com/ 'self' https://*.liveperson.net/ https://www.google.com/ https://lpchat.americanexpress.com/ https://aexp.demdex.net/; img-src 'self' blob: data: https:; connect-src https://icm.aexp-static.com/ https://*.americanexpress.com/ 'self' https://dpm.demdex.net/ https://stats.g.doubleclick.net/ https://*.liveperson.net/ wss://sso.americanexpress.com/ https://*.akamaihd.net/ https://*.custhelp.com/ https://ec.walkme.com/ https://*.evidon.com/; object-src 'none'; worker-src blob:; media-src https://lpchat.americanexpress.com/; frame-ancestors 'self'; font-src 'self' https://icm.aexp-static.com/ https://fonts.gstatic.com/;

Redirect headers

Cache-Control
no-store
Connection
Keep-Alive
Content-Length
795
Content-Type
text/html; charset=iso-8859-1
Date
Thu, 07 Sep 2023 11:52:03 GMT
Keep-Alive
timeout=15, max=100
Location
https://sso.americanexpress.com/SPS/logon?spsversion=v2&TYPE=33554432&REALMOID=06-0009e401-c0f3-1621-9977-00200a12208f&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$ElmmH8mybZ1joOKXN2C2D%2bLyoUdJDxOp9Hq0zB0mWJAf8rkl9DKcl%2bHP99XOwTMR&TARGET=$SM$HTTPS%3a%2f%2fsso%2eamericanexpress%2ecom%2fSPS%2fauth%2fpush%3fssolang%3den_US%26amp%3bssobrand%3dCONCORD%26amp%3bTARGET%3dhttps$%3A$%2F$%2Fwww209%2eamericanexpress%2ecom$%2Fmerchant$%2Fservices$%2Fen_US$%2Fsecure$%2Fhome$%3Fomnlogin$%3Dus_homepage_oms
Strict-Transport-Security
max-age=31536000;includeSubDomains; preload
content-security-policy-report-only
style-src https://*.aexp-static.com/ https://*.americanexpress.com/ 'unsafe-inline' 'self'; block-all-mixed-content ; script-src https://*.americanexpress.com/ 'unsafe-inline' 'self' https://accdn.lpsnmedia.net/ https://*.liveperson.net/ https://fls.doubleclick.net/ https://va.v.liveperson.net/ https://service.maxymiser.net/ https://c.evidon.com/ https://*.aexp-static.com/ https://www.google.com/ https://cdncache-a.akamaihd.net/ 'unsafe-eval'; base-uri 'self' https://gct.americanexpress.com/; form-action https://www.mycreditguide.americanexpress.com/ http://*.americanexpress.com/ http://www.mycreditguide.americanexpress.com/ https://*.americanexpress.com/ https://*.custhelp.com/ 'self'; frame-src https://fls.doubleclick.net/ https://*.doubleclick.net/ https://icm.aexp-static.com/ 'self' https://*.liveperson.net/ https://www.google.com/ https://lpchat.americanexpress.com/ https://aexp.demdex.net/; img-src 'self' blob: data: https:; connect-src https://icm.aexp-static.com/ https://*.americanexpress.com/ 'self' https://dpm.demdex.net/ https://stats.g.doubleclick.net/ https://*.liveperson.net/ wss://sso.americanexpress.com/ https://*.akamaihd.net/ https://*.custhelp.com/ https://ec.walkme.com/ https://*.evidon.com/; object-src 'none'; worker-src blob:; media-src https://lpchat.americanexpress.com/; frame-ancestors 'self'; font-src 'self' https://icm.aexp-static.com/ https://fonts.gstatic.com/;
ssoDefault.css
sso.americanexpress.com/SPS/css/ 		2 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://sso.americanexpress.com/SPS/css/ssoDefault.css
Requested by
Host: sso.americanexpress.com
URL: https://sso.americanexpress.com/SPS/logon?spsversion=v2&TYPE=33554432&REALMOID=06-0009e401-c0f3-1621-9977-00200a12208f&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$ElmmH8mybZ1joOKXN2C2D%2bLyoUdJDxOp9Hq0zB0mWJAf8rkl9DKcl%2bHP99XOwTMR&TARGET=$SM$HTTPS%3a%2f%2fsso%2eamericanexpress%2ecom%2fSPS%2fauth%2fpush%3fssolang%3den_US%26amp%3bssobrand%3dCONCORD%26amp%3bTARGET%3dhttps$%3A$%2F$%2Fwww209%2eamericanexpress%2ecom$%2Fmerchant$%2Fservices$%2Fen_US$%2Fsecure$%2Fhome$%3Fomnlogin$%3Dus_homepage_oms
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
148.173.96.124 , United States, ASN6307 (AMERICAN-EXPRESS, US),
Reverse DNS
sso-ipc2.americanexpress.com
Software
/ Servlet/3.1
Resource Hash
04330064541910877151abe3fec81994b9b477da7d8cfff500a5c3d54a02e300
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sso.americanexpress.com/SPS/logon?spsversion=v2&TYPE=33554432&REALMOID=06-0009e401-c0f3-1621-9977-00200a12208f&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$ElmmH8mybZ1joOKXN2C2D%2bLyoUdJDxOp9Hq0zB0mWJAf8rkl9DKcl%2bHP99XOwTMR&TARGET=$SM$HTTPS%3a%2f%2fsso%2eamericanexpress%2ecom%2fSPS%2fauth%2fpush%3fssolang%3den_US%26amp%3bssobrand%3dCONCORD%26amp%3bTARGET%3dhttps$%3A$%2F$%2Fwww209%2eamericanexpress%2ecom$%2Fmerchant$%2Fservices$%2Fen_US$%2Fsecure$%2Fhome$%3Fomnlogin$%3Dus_homepage_oms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Date
Thu, 07 Sep 2023 11:52:04 GMT
Strict-Transport-Security
max-age=31536000;includeSubDomains; preload
Last-Modified
Wed, 30 Aug 2023 14:21:12 GMT
X-Powered-By
Servlet/3.1
Content-Type
text/css
Content-Language
en-US
Connection
Keep-Alive
Keep-Alive
timeout=15, max=100
Content-Length
2237
Bootstrap.js
nexus.ensighten.com/amex/amexhead/ 		15 B
492 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/amex/amexhead/Bootstrap.js
Requested by
Host: sso.americanexpress.com
URL: https://sso.americanexpress.com/SPS/logon?spsversion=v2&TYPE=33554432&REALMOID=06-0009e401-c0f3-1621-9977-00200a12208f&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$ElmmH8mybZ1joOKXN2C2D%2bLyoUdJDxOp9Hq0zB0mWJAf8rkl9DKcl%2bHP99XOwTMR&TARGET=$SM$HTTPS%3a%2f%2fsso%2eamericanexpress%2ecom%2fSPS%2fauth%2fpush%3fssolang%3den_US%26amp%3bssobrand%3dCONCORD%26amp%3bTARGET%3dhttps$%3A$%2F$%2Fwww209%2eamericanexpress%2ecom$%2Fmerchant$%2Fservices$%2Fen_US$%2Fsecure$%2Fhome$%3Fomnlogin$%3Dus_homepage_oms
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:9200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
CloudFront /
Resource Hash
c0d8671e209f009f9c1ad8153222f942087ec193b7e87f856e60971bd5424633

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sso.americanexpress.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date
Thu, 07 Sep 2023 11:52:05 GMT
x-amz-version-id
WU3kzN6joMzxMs69Bq2cSVLVmYA5v.I9
via
1.1 98997c223299d9efd138e7fb9a08a072.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
x-amz-server-side-encryption
AES256
x-cache
Error from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400
content-length
15
last-modified
Fri, 01 Sep 2023 02:34:26 GMT
server
CloudFront
etag
"ffe905f50d9b47e6353b68513c4d48ac"
content-type
application/javascript
cache-control
no-cache, no-store
accept-ranges
bytes
x-amz-cf-id
4VPvYJJeVHHhW9QDLV2ZPTLE71jfKZigiYoSKzwtTBBk5FAtq5sLCw==
inav_responsive.css
icm.aexp-static.com/content/dam/Navigation/nav/ngn/css/ 		93 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://icm.aexp-static.com/content/dam/Navigation/nav/ngn/css/inav_responsive.css
Requested by
Host: sso.americanexpress.com
URL: https://sso.americanexpress.com/SPS/logon?spsversion=v2&TYPE=33554432&REALMOID=06-0009e401-c0f3-1621-9977-00200a12208f&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$ElmmH8mybZ1joOKXN2C2D%2bLyoUdJDxOp9Hq0zB0mWJAf8rkl9DKcl%2bHP99XOwTMR&TARGET=$SM$HTTPS%3a%2f%2fsso%2eamericanexpress%2ecom%2fSPS%2fauth%2fpush%3fssolang%3den_US%26amp%3bssobrand%3dCONCORD%26amp%3bTARGET%3dhttps$%3A$%2F$%2Fwww209%2eamericanexpress%2ecom$%2Fmerchant$%2Fservices$%2Fen_US$%2Fsecure$%2Fhome$%3Fomnlogin$%3Dus_homepage_oms
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.212.203.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-212-203-180.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
7f1b85f13e643de7a8dd568b6073849d777a677a7d699229b8eb2fdb787ff2b9
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sso.americanexpress.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date
Thu, 07 Sep 2023 11:52:03 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Thu, 31 Aug 2023 03:51:25 GMT
server
Akamai Resource Optimizer
etag
"175ef-59d27fa2a9e16-gzip"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, must-revalidate, max-age=7875
accept-ranges
bytes
content-length
9708
clear.gif
icm.aexp-static.com/content/dam/Navigation/nav/ngn/img/ 		43 B
224 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://icm.aexp-static.com/content/dam/Navigation/nav/ngn/img/clear.gif
Requested by
Host: sso.americanexpress.com
URL: https://sso.americanexpress.com/SPS/logon?spsversion=v2&TYPE=33554432&REALMOID=06-0009e401-c0f3-1621-9977-00200a12208f&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$ElmmH8mybZ1joOKXN2C2D%2bLyoUdJDxOp9Hq0zB0mWJAf8rkl9DKcl%2bHP99XOwTMR&TARGET=$SM$HTTPS%3a%2f%2fsso%2eamericanexpress%2ecom%2fSPS%2fauth%2fpush%3fssolang%3den_US%26amp%3bssobrand%3dCONCORD%26amp%3bTARGET%3dhttps$%3A$%2F$%2Fwww209%2eamericanexpress%2ecom$%2Fmerchant$%2Fservices$%2Fen_US$%2Fsecure$%2Fhome$%3Fomnlogin$%3Dus_homepage_oms
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.212.203.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-212-203-180.deploy.static.akamaitechnologies.com
Software
Akamai Image Manager /
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sso.americanexpress.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date
Thu, 07 Sep 2023 11:52:04 GMT
last-modified
Fri, 03 Apr 2020 23:12:15 GMT
server
Akamai Image Manager
etag
"2b-59d7318c944f3"
content-type
image/gif
access-control-allow-origin
*
cache-control
private, no-transform, max-age=32620
content-length
43
expires
Thu, 07 Sep 2023 20:55:44 GMT
logo_bluebox-55x54.svg
icm.aexp-static.com/content/dam/Navigation/nav/ngn/img/ 		9 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://icm.aexp-static.com/content/dam/Navigation/nav/ngn/img/logo_bluebox-55x54.svg
Requested by
Host: sso.americanexpress.com
URL: https://sso.americanexpress.com/SPS/logon?spsversion=v2&TYPE=33554432&REALMOID=06-0009e401-c0f3-1621-9977-00200a12208f&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$ElmmH8mybZ1joOKXN2C2D%2bLyoUdJDxOp9Hq0zB0mWJAf8rkl9DKcl%2bHP99XOwTMR&TARGET=$SM$HTTPS%3a%2f%2fsso%2eamericanexpress%2ecom%2fSPS%2fauth%2fpush%3fssolang%3den_US%26amp%3bssobrand%3dCONCORD%26amp%3bTARGET%3dhttps$%3A$%2F$%2Fwww209%2eamericanexpress%2ecom$%2Fmerchant$%2Fservices$%2Fen_US$%2Fsecure$%2Fhome$%3Fomnlogin$%3Dus_homepage_oms
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.212.203.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-212-203-180.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
9bedfbcc3e602d182e232daca408a303b96620908e515e31743c2b431d416d74
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sso.americanexpress.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
date
Thu, 07 Sep 2023 11:52:04 GMT
last-modified
Fri, 30 Sep 2022 12:44:06 GMT
server
Akamai Resource Optimizer
etag
"24de-59d732e7f02fa-gzip"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, must-revalidate, max-age=40142
accept-ranges
bytes
content-length
2759
btn_NeedHelp.gif
sso.americanexpress.com/SPS/images/helpFiles/ 		839 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sso.americanexpress.com/SPS/images/helpFiles/btn_NeedHelp.gif
Requested by
Host: sso.americanexpress.com
URL: https://sso.americanexpress.com/SPS/logon?spsversion=v2&TYPE=33554432&REALMOID=06-0009e401-c0f3-1621-9977-00200a12208f&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$ElmmH8mybZ1joOKXN2C2D%2bLyoUdJDxOp9Hq0zB0mWJAf8rkl9DKcl%2bHP99XOwTMR&TARGET=$SM$HTTPS%3a%2f%2fsso%2eamericanexpress%2ecom%2fSPS%2fauth%2fpush%3fssolang%3den_US%26amp%3bssobrand%3dCONCORD%26amp%3bTARGET%3dhttps$%3A$%2F$%2Fwww209%2eamericanexpress%2ecom$%2Fmerchant$%2Fservices$%2Fen_US$%2Fsecure$%2Fhome$%3Fomnlogin$%3Dus_homepage_oms
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
148.173.96.124 , United States, ASN6307 (AMERICAN-EXPRESS, US),
Reverse DNS
sso-ipc2.americanexpress.com
Software
/ Servlet/3.1
Resource Hash
0a89e20f3cc1e6ae4b3f6530ccef157fae4591da3450a74ea19c2d5860c6ff4d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sso.americanexpress.com/SPS/logon?spsversion=v2&TYPE=33554432&REALMOID=06-0009e401-c0f3-1621-9977-00200a12208f&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$ElmmH8mybZ1joOKXN2C2D%2bLyoUdJDxOp9Hq0zB0mWJAf8rkl9DKcl%2bHP99XOwTMR&TARGET=$SM$HTTPS%3a%2f%2fsso%2eamericanexpress%2ecom%2fSPS%2fauth%2fpush%3fssolang%3den_US%26amp%3bssobrand%3dCONCORD%26amp%3bTARGET%3dhttps$%3A$%2F$%2Fwww209%2eamericanexpress%2ecom$%2Fmerchant$%2Fservices$%2Fen_US$%2Fsecure$%2Fhome$%3Fomnlogin$%3Dus_homepage_oms
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Date
Thu, 07 Sep 2023 11:52:04 GMT
Strict-Transport-Security
max-age=31536000;includeSubDomains; preload
Last-Modified
Wed, 30 Aug 2023 14:21:12 GMT
X-Powered-By
Servlet/3.1
Content-Type
image/gif
Content-Language
en-US
Connection
Keep-Alive
Keep-Alive
timeout=15, max=99
Content-Length
839
commonFunctionsResponsive.js
icm.aexp-static.com/content/dam/Navigation/nav/ngn/js/ 		88 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://icm.aexp-static.com/content/dam/Navigation/nav/ngn/js/commonFunctionsResponsive.js
Requested by
Host: sso.americanexpress.com
URL: https://sso.americanexpress.com/SPS/logon?spsversion=v2&TYPE=33554432&REALMOID=06-0009e401-c0f3-1621-9977-00200a12208f&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$ElmmH8mybZ1joOKXN2C2D%2bLyoUdJDxOp9Hq0zB0mWJAf8rkl9DKcl%2bHP99XOwTMR&TARGET=$SM$HTTPS%3a%2f%2fsso%2eamericanexpress%2ecom%2fSPS%2fauth%2fpush%3fssolang%3den_US%26amp%3bssobrand%3dCONCORD%26amp%3bTARGET%3dhttps$%3A$%2F$%2Fwww209%2eamericanexpress%2ecom$%2Fmerchant$%2Fservices$%2Fen_US$%2Fsecure$%2Fhome$%3Fomnlogin$%3Dus_homepage_oms
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.212.203.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-212-203-180.deploy.static.akamaitechnologies.com
Software
Akamai Resource Optimizer /
Resource Hash
5292364d64bfe6f45a722a7052964ffec683c293e6e139e8b4bc2480db11a948
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://sso.americanexpress.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

strict-transport-security
max-age=63072000; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
date
Thu, 07 Sep 2023 11:52:04 GMT
last-modified
Thu, 31 Aug 2023 03:52:57 GMT
server
Akamai Resource Optimizer
etag
"161e9-603bb0db2dc03-gzip"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, must-revalidate, max-age=13195
accept-ranges
bytes
content-length
17738
iNav_ngi_sprite_new.gif
icm.aexp-static.com/content/dam/Navigation/nav/ngn/img/ 		23 KB
23 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://icm.aexp-static.com/content/dam/Navigation/nav/ngn/img/iNav_ngi_sprite_new.gif?ver=0916_01
Requested by
Host: icm.aexp-static.com
URL: https://icm.aexp-static.com/content/dam/Navigation/nav/ngn/css/inav_responsive.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.212.203.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-212-203-180.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
0d4e7d13d424c4569af233a3188ac42edaa093a12bced0dba6095c00047006e3
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://icm.aexp-static.com/content/dam/Navigation/nav/ngn/css/inav_responsive.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date
Thu, 07 Sep 2023 11:52:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 31 Jan 2020 17:44:58 GMT
etag
"5b47-59d7321df859c-gzip"
vary
Accept-Encoding
content-type
image/gif
access-control-allow-origin
*
cache-control
public, must-revalidate, max-age=11694
accept-ranges
bytes
content-length
23358
img_shdw_mainNav.png
icm.aexp-static.com/content/dam/Navigation/nav/ngn/img/ 		143 B
378 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://icm.aexp-static.com/content/dam/Navigation/nav/ngn/img/img_shdw_mainNav.png
Requested by
Host: icm.aexp-static.com
URL: https://icm.aexp-static.com/content/dam/Navigation/nav/ngn/css/inav_responsive.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.212.203.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-212-203-180.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
d3c6dbfeb63c1155df3a80a04d72d9c0c95ed561d54c9694019c28eac1920c1b
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://icm.aexp-static.com/content/dam/Navigation/nav/ngn/css/inav_responsive.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 07 Sep 2023 11:52:04 GMT
last-modified
Fri, 31 Jan 2020 17:43:46 GMT
etag
"8f-59d731d8b9fef-gzip"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, must-revalidate, max-age=4321
accept-ranges
bytes
content-length
156
iNav_sprite_footer.gif
icm.aexp-static.com/content/dam/Navigation/nav/ngn/img/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://icm.aexp-static.com/content/dam/Navigation/nav/ngn/img/iNav_sprite_footer.gif?ver=0916_02
Requested by
Host: icm.aexp-static.com
URL: https://icm.aexp-static.com/content/dam/Navigation/nav/ngn/css/inav_responsive.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.212.203.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-212-203-180.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fd959c1552b95596319a7cb998061162bc3fd7a45f059caf8c9ec7c38fac35bb
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://icm.aexp-static.com/content/dam/Navigation/nav/ngn/css/inav_responsive.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date
Thu, 07 Sep 2023 11:52:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 31 Jan 2020 17:44:59 GMT
etag
"12b4-59d7321ea1338-gzip"
vary
Accept-Encoding
content-type
image/gif
access-control-allow-origin
*
cache-control
public, must-revalidate, max-age=2903
accept-ranges
bytes
content-length
4809
iNav_sprite_footer1.gif
icm.aexp-static.com/content/dam/Navigation/nav/ngn/img/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://icm.aexp-static.com/content/dam/Navigation/nav/ngn/img/iNav_sprite_footer1.gif?ver=0917_11
Requested by
Host: icm.aexp-static.com
URL: https://icm.aexp-static.com/content/dam/Navigation/nav/ngn/css/inav_responsive.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.212.203.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-212-203-180.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b3be0c1dca2d9a00d8da591e1c209fced4d3ee588efb495eed4191aa2558e658
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://icm.aexp-static.com/content/dam/Navigation/nav/ngn/css/inav_responsive.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date
Thu, 07 Sep 2023 11:52:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 31 Jan 2020 17:48:29 GMT
etag
"15e3-59d732e75799c-gzip"
vary
Accept-Encoding
content-type
image/gif
access-control-allow-origin
*
cache-control
public, must-revalidate, max-age=8297
accept-ranges
bytes
content-length
5380

Verdicts & Comments Add Verdict or Comment

45 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| NAV object| iNavConfig string| s_TopNav function| maskUserId function| uncheckRememberMe function| popUp object| jsObj undefined| UrlConnect_newObject number| sugg_n object| iNavNGI function| initOmnDefault string| curDomain function| omn_rmaction function| omn_rmvar function| omn_bpoclick function| omn_bpoimpression function| ctn_rmaction function| ctn_rmvar function| omn_mer_rmaction function| omn_mer_rmleadstart function| omn_mer_rmshare function| omn_mer_rmvidstart function| omn_mer_rmvidcomplete function| omn_mer_trackdownload function| omn_mer_rmvar function| omn_mer_tracklogin function| omn_relatedprodclick function| searchWidgetAction function| searchWidgetError function| searchWidgetFAQAction function| searchWidgetHyperlinkClick function| searchWidgetSearch function| omn_rmdiscuss function| omn_rmfollowcomplete function| omn_rmfollowstart function| omn_rmlogin function| omn_rmprofile function| omn_rmregcomplete function| omn_rmregstart function| omn_rmaddpaybill function| omn_rmaddsscard function| omn_rmeStatement function| t function| tl

6 Cookies

Domain/Path Name / Value
.americanexpress.com/ Name: SaneID
Value: 138.199.38.133-1694087523635429
sso.americanexpress.com/ Name: ssointer_JSESSIONID
Value: 0000M3q4QCR2PA5yCy-4WJK_xGg:1dmpuj0t4
sso.americanexpress.com/ Name: TS0139a03f
Value: 019f1ef453459e684c7faed1c7eae23f6d6ba659b3ecbc6e8565b8884259f88b75d099ada45bce5d360c705621873ee56b9ae99a2cb96d87d112ccef8c26ce00ef4b0fcc8b
.americanexpress.com/ Name: TS0114bdae
Value: 019f1ef453d2cbe10064f8a902b9e5595a27b775f4ecbc6e8565b8884259f88b75d099ada428100c99a56f36db0c7d4e0427e2cf37f18b711ea08265b172b6d3a4b1795fcf
sso.americanexpress.com/ Name: TS0133491c
Value: 018378d52a841a325d56c28530cabc59cb47f48a6ebad4079d85ebfde5b25b6c2f4cfe47087e386b04ab7dd19367cc70f12f23aef552a96e3054cdeb9eb2bcd8590c7145f4
.americanexpress.com/ Name: TS011e548d
Value: 018378d52aac44d5767f4889a6a1cdf5056e0339fcd2786bc7a559a5fe0d89c5da8a5c690f6609502cdbd7beda9a8b2644a84f29ff49d7b8b6a7ad2d10525f899ae467433c

3 Console Messages

Source Level URL
Text
security error URL: https://sso.americanexpress.com/SPS/logon?spsversion=v2&TYPE=33554432&REALMOID=06-0009e401-c0f3-1621-9977-00200a12208f&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$ElmmH8mybZ1joOKXN2C2D%2bLyoUdJDxOp9Hq0zB0mWJAf8rkl9DKcl%2bHP99XOwTMR&TARGET=$SM$HTTPS%3a%2f%2fsso%2eamericanexpress%2ecom%2fSPS%2fauth%2fpush%3fssolang%3den_US%26amp%3bssobrand%3dCONCORD%26amp%3bTARGET%3dhttps$%3A$%2F$%2Fwww209%2eamericanexpress%2ecom$%2Fmerchant$%2Fservices$%2Fen_US$%2Fsecure$%2Fhome$%3Fomnlogin$%3Dus_homepage_oms
Message:
[Report Only] Refused to load the script 'https://nexus.ensighten.com/amex/amexhead/Bootstrap.js' because it violates the following Content Security Policy directive: "script-src https://*.americanexpress.com/ 'unsafe-inline' 'self' https://accdn.lpsnmedia.net/ https://*.liveperson.net/ https://fls.doubleclick.net/ https://va.v.liveperson.net/ https://service.maxymiser.net/ https://c.evidon.com/ https://*.aexp-static.com/ https://www.google.com/ https://cdncache-a.akamaihd.net/ 'unsafe-eval'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
javascript warning URL: https://sso.americanexpress.com/SPS/logon?spsversion=v2&TYPE=33554432&REALMOID=06-0009e401-c0f3-1621-9977-00200a12208f&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$ElmmH8mybZ1joOKXN2C2D%2bLyoUdJDxOp9Hq0zB0mWJAf8rkl9DKcl%2bHP99XOwTMR&TARGET=$SM$HTTPS%3a%2f%2fsso%2eamericanexpress%2ecom%2fSPS%2fauth%2fpush%3fssolang%3den_US%26amp%3bssobrand%3dCONCORD%26amp%3bTARGET%3dhttps$%3A$%2F$%2Fwww209%2eamericanexpress%2ecom$%2Fmerchant$%2Fservices$%2Fen_US$%2Fsecure$%2Fhome$%3Fomnlogin$%3Dus_homepage_oms(Line 237)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://icm.aexp-static.com/content/dam/Navigation/nav/ngn/js/commonFunctionsResponsive.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://sso.americanexpress.com/SPS/logon?spsversion=v2&TYPE=33554432&REALMOID=06-0009e401-c0f3-1621-9977-00200a12208f&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$ElmmH8mybZ1joOKXN2C2D%2bLyoUdJDxOp9Hq0zB0mWJAf8rkl9DKcl%2bHP99XOwTMR&TARGET=$SM$HTTPS%3a%2f%2fsso%2eamericanexpress%2ecom%2fSPS%2fauth%2fpush%3fssolang%3den_US%26amp%3bssobrand%3dCONCORD%26amp%3bTARGET%3dhttps$%3A$%2F$%2Fwww209%2eamericanexpress%2ecom$%2Fmerchant$%2Fservices$%2Fen_US$%2Fsecure$%2Fhome$%3Fomnlogin$%3Dus_homepage_oms(Line 237)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://icm.aexp-static.com/content/dam/Navigation/nav/ngn/js/commonFunctionsResponsive.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000;includeSubDomains; preload