auth.willistowerswatson.com Open in urlscan Pro
2620:1ec:46::45 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://email2.wtwco.com/NzQyLUxaWS0yMzEAAAGSI7Ecly17-sTFt9WmmUWgUL46HG0UxVfo9vDjeWKkAbMkjsz-vbtaMIxFVfiQutKjkLRK-u8=
Effective URL:
https://auth.willistowerswatson.com/auth.willistowerswatson.com/oauth2/v2.0/authorize?p=b2c_1a_hcb_oneplace_signuporsignin&client_id...
Submission: On March 28 via manual (March 28th 2024, 1:47:42 pm UTC) from QA — Scanned from DE

Summary HTTP 31 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 10 IPs in 4 countries across 8 domains to perform 31 HTTP transactions. The main IP is 2620:1ec:46::45, located in United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is auth.willistowerswatson.com. The Cisco Umbrella rank of the primary domain is 251967.
TLS certificate: Issued by GlobalSign RSA OV SSL CA 2018 on June 20th 2023. Valid for: a year.

This is the only time auth.willistowerswatson.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.17.70.206 104.17.70.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 9	23.102.120.139 23.102.120.139	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4 7	45.60.14.1 45.60.14.1	19551 (INCAPSULA) (INCAPSULA)
2	2620:1ec:46::45 2620:1ec:46::45	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
10	40.114.106.25 40.114.106.25	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2606:2800:133... 2606:2800:133:206e:1315:22a5:2006:24fd	15133 (EDGECAST) (EDGECAST)
2	20.50.88.238 20.50.88.238	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a00:1450:400... 2a00:1450:4001:82f::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
31	10

1 104.17.70.206 (None, )

ASN13335 (CLOUDFLARENET, US)

email2.wtwco.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 23.102.120.139 (Boydton, United States) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

dashboards.willistowerswatson.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
oneplacelogin.willistowerswatson.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 45.60.14.1 (United States) 4 redirects

ASN19551 (INCAPSULA, US)

oneplace.ehr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:46::45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

auth.willistowerswatson.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 40.114.106.25 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

wtw-ca-p-brandengine01.willistowerswatson.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:133:206e:1315:22a5:2006:24fd (United States)

ASN15133 (EDGECAST, US)

az416426.vo.msecnd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 20.50.88.238 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

dc.services.visualstudio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
21	willistowerswatson.com 1 redirects dashboards.willistowerswatson.com oneplacelogin.willistowerswatson.com — Cisco Umbrella Rank: 890082 auth.willistowerswatson.com — Cisco Umbrella Rank: 251967 wtw-ca-p-brandengine01.willistowerswatson.com — Cisco Umbrella Rank: 878475	360 KB
7	ehr.com 4 redirects oneplace.ehr.com — Cisco Umbrella Rank: 209666	13 KB
2	gstatic.com fonts.gstatic.com	92 KB
2	visualstudio.com dc.services.visualstudio.com — Cisco Umbrella Rank: 706	200 B
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35	1 KB
1	msecnd.net az416426.vo.msecnd.net — Cisco Umbrella Rank: 2752	22 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 234	22 KB
1	wtwco.com email2.wtwco.com	1 KB
31	8

	Domain	Requested by
10	wtw-ca-p-brandengine01.willistowerswatson.com	auth.willistowerswatson.com wtw-ca-p-brandengine01.willistowerswatson.com
8	dashboards.willistowerswatson.com	email2.wtwco.com dashboards.willistowerswatson.com
7	oneplace.ehr.com	4 redirects dashboards.willistowerswatson.com oneplace.ehr.com
2	fonts.gstatic.com	fonts.googleapis.com
2	dc.services.visualstudio.com	az416426.vo.msecnd.net
2	auth.willistowerswatson.com	oneplace.ehr.com auth.willistowerswatson.com
1	fonts.googleapis.com	wtw-ca-p-brandengine01.willistowerswatson.com
1	az416426.vo.msecnd.net	auth.willistowerswatson.com
1	oneplacelogin.willistowerswatson.com	1 redirects
1	cdnjs.cloudflare.com	dashboards.willistowerswatson.com
1	email2.wtwco.com
31	11

This site contains links to these domains. Also see Links.

Domain
www.willistowerswatson.com

Subject Issuer	Validity	Valid
email2.wtwco.com E1	`2024-03-18` - `2024-06-16`	3 months	crt.sh
*.willistowerswatson.com GlobalSign RSA OV SSL CA 2018	`2023-11-07` - `2024-12-08`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
imperva.com GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-03-06` - `2024-09-02`	6 months	crt.sh
*.vo.msecnd.net DigiCert SHA2 Secure Server CA	`2024-01-30` - `2025-01-30`	a year	crt.sh
prod.ai.ingestion.msftcloudes.com Microsoft Azure RSA TLS Issuing CA 03	`2024-01-17` - `2025-01-11`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://auth.willistowerswatson.com/auth.willistowerswatson.com/oauth2/v2.0/authorize?p=b2c_1a_hcb_oneplace_signuporsignin&client_id=8703959d-87ab-4d81-ac81-d3eadbead636&redirect_uri=https%3a%2f%2foneplacelogin.willistowerswatson.com%2f&response_mode=form_post&response_type=id_token&scope=openid+offline_access&state=OpenIdConnect.AuthenticationProperties%3dBOIU9jzJs46cQy9zAc9YjKn2T3VNNu_fpH7v67f8F0VzKySf2qlXrqds6CgkJ8DrAUezLCm7NJhPxbbdUtvkIY49YrZP1jK2g4-6DWkoseMku3VAlHRar7cp_9yMW0lIJCXpQAIVNWn7bdWUV-8R8HLLF9m6nQk52ofTXeYsbTgcYl9VSHTvMSzHUAvR_ghvV7cfDQFrO47H9xMp7tL2B4ItCRCUI1KAFlmpt4tXLlwcNvEQJsn0GbEKPj3o9cS5E80bZ-JC0zfyj0wuiuqSTYUG5EGhQh1Q9somx3GGkFZJD83BRbJLZc9mythrq5H1IFzBcx5nOMaV-PoiyiXojniTc7jqv1NBoQOZjhPSsJt-sPIgKmFVXB8ZNSrRyL4a9O1LHH9p2b7RYbwJiEf9p9wcvJW49dogg81SWtfEO5sbM5s9HKzlh2Z3mO676aRRpCPgvpBoVWcnJGGE8eRrGe0MJKVUrHlX3EdiCRZO1l9RnxaL1TUorsiVFIKiNrqovIq0GHhiAvwTJbeLHJygAylGskGIGLUNU7wcZHPa7QAeTE3YkZ4iNYkFz0z-65HUwR1XgFUB09c0DmRze1m6DeENjSz7xcKNR_N7d5WX_EA&nonce=638472304591441172.ZWNjMTBhMzItMmY4OC00ZTc4LTg4NzYtM2U3MTM2MGI4OTI0YzkyMzg3N2UtOTA3YS00ZTg1LThkOWYtMWE1OWYyZjE5N2E2&isFederated=False&gn=OPL&suite=opl&app=opl&client=opl
Frame ID: 2BE91F8137A116E466C1D7E1FC57163B
Requests: 30 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

OnePlace

Page URL History Show full URLs

https://email2.wtwco.com/NzQyLUxaWS0yMzEAAAGSI7Ecly17-sTFt9WmmUWgUL46HG0UxVfo9vDjeWKkAbMkjsz-vbtaMIxF... Page URL
https://dashboards.willistowerswatson.com/?mkt_tok=NzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT8... Page URL
https://oneplace.ehr.com/_layouts/watsonwyatt/login.aspx?tokenUrl=https%3A%2F%2Fdashboards.willistowe... HTTP 302
https://oneplace.ehr.com/_layouts/15/watsonwyatt/login.aspx?tokenUrl=https%3A%2F%2Fdashboards.willist... Page URL
https://oneplacelogin.willistowerswatson.com//?username=&isFederated=False&samlTarget=OnePlace_Prod&isLW=False&returnUrl=... HTTP 302
https://auth.willistowerswatson.com/auth.willistowerswatson.com/oauth2/v2.0/authorize?p=b2c_1a_hcb_oneplace_sign... Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

31
Requests

97 %
HTTPS

40 %
IPv6

8
Domains

11
Subdomains

10
IPs

4
Countries

508 kB
Transfer

909 kB
Size

19
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.willistowerswatson.com/

Search URL Search Domain Scan URL

URL: https://www.willistowerswatson.com/en-US/Notices/global-website-privacy-notice
Title: Global Privacy Notice

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://email2.wtwco.com/NzQyLUxaWS0yMzEAAAGSI7Ecly17-sTFt9WmmUWgUL46HG0UxVfo9vDjeWKkAbMkjsz-vbtaMIxFVfiQutKjkLRK-u8= Page URL
https://dashboards.willistowerswatson.com/?mkt_tok=NzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp Page URL
https://oneplace.ehr.com/_layouts/watsonwyatt/login.aspx?tokenUrl=https%3A%2F%2Fdashboards.willistowerswatson.com%2F%3Fopspa_code%3DaHR0cHM6Ly9kYXNoYm9hcmRzLndpbGxpc3Rvd2Vyc3dhdHNvbi5jb20vP21rdF90b2s9TnpReUxVeGFXUzB5TXpFQUFBR1NJN0VjbHhMY2NpNE9MRDIwZDNvQU9Yb2c2dlNXa3ozMDdrQ3ZGeEJkUFlta1pUODFMVk1KazhFeGRXSlhEVVMzcHI2c0Z0d2Q5bkR5NkJGTGdhcUh6Y1RnMEFmN29aVGhoNGNneTRUY2I2UjBxeFBw%26state%3Dadf5a421891a3161a539b24e93af5e6500526ab4e50a3ced9899df59%26code_challenge%3Dm0faCcBmKBNV7gpf14z_ysPHcVtsoY-JM4IdRV03TzI%26ReturnUrl%3Dhttps%3A%2F%2Fdashboards.willistowerswatson.com%2F%3Fmkt_tok%3DNzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp HTTP 302
https://oneplace.ehr.com/_layouts/15/watsonwyatt/login.aspx?tokenUrl=https%3A%2F%2Fdashboards.willistowerswatson.com%2F%3Fopspa_code%3DaHR0cHM6Ly9kYXNoYm9hcmRzLndpbGxpc3Rvd2Vyc3dhdHNvbi5jb20vP21rdF90b2s9TnpReUxVeGFXUzB5TXpFQUFBR1NJN0VjbHhMY2NpNE9MRDIwZDNvQU9Yb2c2dlNXa3ozMDdrQ3ZGeEJkUFlta1pUODFMVk1KazhFeGRXSlhEVVMzcHI2c0Z0d2Q5bkR5NkJGTGdhcUh6Y1RnMEFmN29aVGhoNGNneTRUY2I2UjBxeFBw%26state%3Dadf5a421891a3161a539b24e93af5e6500526ab4e50a3ced9899df59%26code_challenge%3Dm0faCcBmKBNV7gpf14z_ysPHcVtsoY-JM4IdRV03TzI%26ReturnUrl%3Dhttps%3A%2F%2Fdashboards.willistowerswatson.com%2F%3Fmkt_tok%3DNzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp Page URL
https://oneplacelogin.willistowerswatson.com//?username=&isFederated=False&samlTarget=OnePlace_Prod&isLW=False&returnUrl=ooneplace_redirect_WH70m3-Q31LgefYsx2yszxjO3uA HTTP 302
https://auth.willistowerswatson.com/auth.willistowerswatson.com/oauth2/v2.0/authorize?p=b2c_1a_hcb_oneplace_signuporsignin&client_id=8703959d-87ab-4d81-ac81-d3eadbead636&redirect_uri=https%3a%2f%2foneplacelogin.willistowerswatson.com%2f&response_mode=form_post&response_type=id_token&scope=openid+offline_access&state=OpenIdConnect.AuthenticationProperties%3dBOIU9jzJs46cQy9zAc9YjKn2T3VNNu_fpH7v67f8F0VzKySf2qlXrqds6CgkJ8DrAUezLCm7NJhPxbbdUtvkIY49YrZP1jK2g4-6DWkoseMku3VAlHRar7cp_9yMW0lIJCXpQAIVNWn7bdWUV-8R8HLLF9m6nQk52ofTXeYsbTgcYl9VSHTvMSzHUAvR_ghvV7cfDQFrO47H9xMp7tL2B4ItCRCUI1KAFlmpt4tXLlwcNvEQJsn0GbEKPj3o9cS5E80bZ-JC0zfyj0wuiuqSTYUG5EGhQh1Q9somx3GGkFZJD83BRbJLZc9mythrq5H1IFzBcx5nOMaV-PoiyiXojniTc7jqv1NBoQOZjhPSsJt-sPIgKmFVXB8ZNSrRyL4a9O1LHH9p2b7RYbwJiEf9p9wcvJW49dogg81SWtfEO5sbM5s9HKzlh2Z3mO676aRRpCPgvpBoVWcnJGGE8eRrGe0MJKVUrHlX3EdiCRZO1l9RnxaL1TUorsiVFIKiNrqovIq0GHhiAvwTJbeLHJygAylGskGIGLUNU7wcZHPa7QAeTE3YkZ4iNYkFz0z-65HUwR1XgFUB09c0DmRze1m6DeENjSz7xcKNR_N7d5WX_EA&nonce=638472304591441172.ZWNjMTBhMzItMmY4OC00ZTc4LTg4NzYtM2U3MTM2MGI4OTI0YzkyMzg3N2UtOTA3YS00ZTg1LThkOWYtMWE1OWYyZjE5N2E2&isFederated=False&gn=OPL&suite=opl&app=opl&client=opl Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11

https://oneplace.ehr.com/_layouts/watsonwyatt/login.aspx?tokenUrl=https%3A%2F%2Fdashboards.willistowerswatson.com%2F%3Fopspa_code%3DaHR0cHM6Ly9kYXNoYm9hcmRzLndpbGxpc3Rvd2Vyc3dhdHNvbi5jb20vP21rdF90b2s9TnpReUxVeGFXUzB5TXpFQUFBR1NJN0VjbHhMY2NpNE9MRDIwZDNvQU9Yb2c2dlNXa3ozMDdrQ3ZGeEJkUFlta1pUODFMVk1KazhFeGRXSlhEVVMzcHI2c0Z0d2Q5bkR5NkJGTGdhcUh6Y1RnMEFmN29aVGhoNGNneTRUY2I2UjBxeFBw%26state%3Dadf5a421891a3161a539b24e93af5e6500526ab4e50a3ced9899df59%26code_challenge%3Dm0faCcBmKBNV7gpf14z_ysPHcVtsoY-JM4IdRV03TzI%26ReturnUrl%3Dhttps%3A%2F%2Fdashboards.willistowerswatson.com%2F%3Fmkt_tok%3DNzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp HTTP 302
https://oneplace.ehr.com/_layouts/15/watsonwyatt/login.aspx?tokenUrl=https%3A%2F%2Fdashboards.willistowerswatson.com%2F%3Fopspa_code%3DaHR0cHM6Ly9kYXNoYm9hcmRzLndpbGxpc3Rvd2Vyc3dhdHNvbi5jb20vP21rdF90b2s9TnpReUxVeGFXUzB5TXpFQUFBR1NJN0VjbHhMY2NpNE9MRDIwZDNvQU9Yb2c2dlNXa3ozMDdrQ3ZGeEJkUFlta1pUODFMVk1KazhFeGRXSlhEVVMzcHI2c0Z0d2Q5bkR5NkJGTGdhcUh6Y1RnMEFmN29aVGhoNGNneTRUY2I2UjBxeFBw%26state%3Dadf5a421891a3161a539b24e93af5e6500526ab4e50a3ced9899df59%26code_challenge%3Dm0faCcBmKBNV7gpf14z_ysPHcVtsoY-JM4IdRV03TzI%26ReturnUrl%3Dhttps%3A%2F%2Fdashboards.willistowerswatson.com%2F%3Fmkt_tok%3DNzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp

Request Chain 12

https://oneplace.ehr.com/favicon.ico HTTP 302
https://oneplace.ehr.com/ HTTP 302
https://oneplace.ehr.com/_layouts/15/Authenticate.aspx?Source=%2F HTTP 302
https://oneplace.ehr.com/_layouts/15/oneplace/login.aspx?ReturnUrl=%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F

31 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 302 NzQyLUxaWS0yMzEAAAGSI7Ecly17-sTFt9WmmUWgUL46HG0UxVfo9vDjeWKkAbMkjsz-vbtaMIxFVfiQutKjkLRK-u8=
email2.wtwco.com/ 536 B
1 KB 525ms
206ms Document
text/html 104.17.70.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://email2.wtwco.com/NzQyLUxaWS0yMzEAAAGSI7Ecly17-sTFt9WmmUWgUL46HG0UxVfo9vDjeWKkAbMkjsz-vbtaMIxFVfiQutKjkLRK-u8=

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; img-src 'self';script-src 'self' 'sha256-FYsvoY6cUoZHUBmZddW3bLIpgPb1ohCYkdwa1hwkMkk=';object-src 'none';form-action 'none';frame-src 'none';style-src 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: private, no-cache, no-store, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 86b812b58e888c43-FRA
content-security-policy: default-src 'self'; img-src 'self';script-src 'self' 'sha256-FYsvoY6cUoZHUBmZddW3bLIpgPb1ohCYkdwa1hwkMkk=';object-src 'none';form-action 'none';frame-src 'none';style-src 'self'
content-type: text/html;charset=UTF-8
date: Thu, 28 Mar 2024 13:47:37 GMT
referrer-policy: strict-origin
server: cloudflare
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-request-id: 94254a073dfc8a96

GET
H/1.1 200
OK / Show response
dashboards.willistowerswatson.com/ 7 KB
3 KB 341ms
99ms Document
text/html 23.102.120.139
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dashboards.willistowerswatson.com/?mkt_tok=NzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp

Requested by

Host: email2.wtwco.com
URL: https://email2.wtwco.com/NzQyLUxaWS0yMzEAAAGSI7Ecly17-sTFt9WmmUWgUL46HG0UxVfo9vDjeWKkAbMkjsz-vbtaMIxFVfiQutKjkLRK-u8=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.102.120.139 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

6714808311bbbd251392ecb011189e9d25531fdf8689e6da4e4a0201dc022468

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' data: https:;style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' .willistowerswatson.com .ehr.com ajax.googleapis.com cdnjs.cloudflare.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://email2.wtwco.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 1513
Content-Security-Policy: default-src 'self' 'unsafe-inline' data: https:;style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.willistowerswatson.com *.ehr.com ajax.googleapis.com cdnjs.cloudflare.com;
Content-Type: text/html
Date: Thu, 28 Mar 2024 13:47:37 GMT
ETag: "80cc1137a372da1:0"
Last-Modified: Sun, 10 Mar 2024 04:27:09 GMT
PERMISSIONS-POLICY: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
Referrer-Policy: no-referrer-when-downgrade
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Referrer-Policy: no-override

GET
H/1.1 200
OK config.js Show response
dashboards.willistowerswatson.com/ 242 B
1 KB 117ms
115ms Script
application/javascript 23.102.120.139
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dashboards.willistowerswatson.com/config.js

Requested by

Host: dashboards.willistowerswatson.com
URL: https://dashboards.willistowerswatson.com/?mkt_tok=NzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.102.120.139 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

d2887a8b7d3b6439f0c0e5e2f8504eb1718972ce29be9be8ae762e11a66cc0f5

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' data: https:;style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' .willistowerswatson.com .ehr.com ajax.googleapis.com cdnjs.cloudflare.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://dashboards.willistowerswatson.com/?mkt_tok=NzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 28 Mar 2024 13:47:37 GMT
Content-Security-Policy: default-src 'self' 'unsafe-inline' data: https:;style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.willistowerswatson.com *.ehr.com ajax.googleapis.com cdnjs.cloudflare.com;
Referrer-Policy: no-referrer-when-downgrade
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Last-Modified: Sun, 25 Apr 2021 17:54:22 GMT
X-Content-Type-Options: nosniff
ETag: "fbd7e85fc39d71:0"
X-Frame-Options: DENY
Content-Type: application/javascript
Cache-Control: no-cache
X-Referrer-Policy: no-override
PERMISSIONS-POLICY: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 242

GET
H/1.1 200
OK dashboard.css
dashboards.willistowerswatson.com/Content/css/ 15 KB
4 KB 217ms
99ms Stylesheet
text/css 23.102.120.139
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dashboards.willistowerswatson.com/Content/css/dashboard.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.102.120.139 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

7438429ecbb9b8f27d5838e4e7d5bd547867fb4b14cca212ca0f73c59d63520f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' data: https:;style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' .willistowerswatson.com .ehr.com ajax.googleapis.com cdnjs.cloudflare.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://dashboards.willistowerswatson.com/?mkt_tok=NzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 28 Mar 2024 13:47:37 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'self' 'unsafe-inline' data: https:;style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.willistowerswatson.com *.ehr.com ajax.googleapis.com cdnjs.cloudflare.com;
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Connection: keep-alive
Content-Length: 3351
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Sun, 10 Mar 2024 04:27:09 GMT
ETag: "80cc1137a372da1:0"
Vary: Accept-Encoding
X-Frame-Options: DENY
Content-Type: text/css
Cache-Control: no-cache
X-Referrer-Policy: no-override
PERMISSIONS-POLICY: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
Accept-Ranges: bytes

GET
H/1.1 200
OK UserListing.css
dashboards.willistowerswatson.com/Content/css/ 16 KB
4 KB 292ms
103ms Stylesheet
text/css 23.102.120.139
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dashboards.willistowerswatson.com/Content/css/UserListing.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.102.120.139 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

d4dc19795fe3914f4c02323981e9d59672d1d96eb3f2b2b662b7070a2be01e07

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' data: https:;style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' .willistowerswatson.com .ehr.com ajax.googleapis.com cdnjs.cloudflare.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://dashboards.willistowerswatson.com/?mkt_tok=NzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 28 Mar 2024 13:47:38 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'self' 'unsafe-inline' data: https:;style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.willistowerswatson.com *.ehr.com ajax.googleapis.com cdnjs.cloudflare.com;
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Connection: keep-alive
Content-Length: 3607
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Sun, 10 Mar 2024 04:27:09 GMT
ETag: "80cc1137a372da1:0"
Vary: Accept-Encoding
X-Frame-Options: DENY
Content-Type: text/css
Cache-Control: no-cache
X-Referrer-Policy: no-override
PERMISSIONS-POLICY: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
Accept-Ranges: bytes

GET
H/1.1 200
OK bulkuserupload.css
dashboards.willistowerswatson.com/Content/css/ 807 B
1 KB 292ms
104ms Stylesheet
text/css 23.102.120.139
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dashboards.willistowerswatson.com/Content/css/bulkuserupload.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.102.120.139 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

8f4ad48d6b6b9e97a104f741e669eb58da1bb71e671c7d4d29ad5bf20e4e5814

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' data: https:;style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' .willistowerswatson.com .ehr.com ajax.googleapis.com cdnjs.cloudflare.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://dashboards.willistowerswatson.com/?mkt_tok=NzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 28 Mar 2024 13:47:38 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'self' 'unsafe-inline' data: https:;style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.willistowerswatson.com *.ehr.com ajax.googleapis.com cdnjs.cloudflare.com;
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Connection: keep-alive
Content-Length: 508
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Sun, 10 Mar 2024 04:27:09 GMT
ETag: "fecca937a372da1:0"
Vary: Accept-Encoding
X-Frame-Options: DENY
Content-Type: text/css
Cache-Control: no-cache
X-Referrer-Policy: no-override
PERMISSIONS-POLICY: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
Accept-Ranges: bytes

GET
H/1.1 200
OK dm-close-icon.png
dashboards.willistowerswatson.com/content/Images/ 409 B
1 KB 303ms
114ms Image
image/png 23.102.120.139
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dashboards.willistowerswatson.com/content/Images/dm-close-icon.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.102.120.139 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

306dceede7d4fa088840c113691bd4adf79275ea945ad072d0c1f7af820ba5e2

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' data: https:;style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' .willistowerswatson.com .ehr.com ajax.googleapis.com cdnjs.cloudflare.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://dashboards.willistowerswatson.com/?mkt_tok=NzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 28 Mar 2024 13:47:38 GMT
Content-Security-Policy: default-src 'self' 'unsafe-inline' data: https:;style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.willistowerswatson.com *.ehr.com ajax.googleapis.com cdnjs.cloudflare.com;
Referrer-Policy: no-referrer-when-downgrade
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Last-Modified: Sun, 10 Mar 2024 04:27:09 GMT
X-Content-Type-Options: nosniff
ETag: "fecca937a372da1:0"
X-Frame-Options: DENY
Content-Type: image/png
Cache-Control: no-cache
X-Referrer-Policy: no-override
PERMISSIONS-POLICY: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 409

GET
H3 200 knockout-latest.min.js Show response
cdnjs.cloudflare.com/ajax/libs/knockout/3.5.1/ 66 KB
22 KB 28ms
17ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/knockout/3.5.1/knockout-latest.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c9cadf2d340b9a5ff3a7f4601116ddc451747986b3b3d02cb1d6c5f2165d553

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://dashboards.willistowerswatson.com/?mkt_tok=NzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 13:47:37 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1283047
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 21755
last-modified: Mon, 04 May 2020 16:11:59 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ecf-10698"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NvPfLZTqs5vrPi4v0ocmnjVNEZuvs9Gn3Vcw5tsH0Rq%2FcBNC%2B2J498ok9IGLDMXteztIF%2BCkG4mkkisVyQPrHUPFm6G%2FEqPRdmieWmVvpQiD7nc3aGe0dHhKJLmNQH0G6K4p34aF"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 86b812b939e965b2-FRA
expires: Tue, 18 Mar 2025 13:47:37 GMT

GET
H/1.1 200
OK bulkuserupload.js Show response
dashboards.willistowerswatson.com/Content/js/ 40 KB
7 KB 267ms
114ms Script
application/javascript 23.102.120.139
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dashboards.willistowerswatson.com/Content/js/bulkuserupload.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.102.120.139 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

4aa32d31ee385baf30739e940325c41b5aa84b2c922cc283799944e417618fd3

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' data: https:;style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' .willistowerswatson.com .ehr.com ajax.googleapis.com cdnjs.cloudflare.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://dashboards.willistowerswatson.com/?mkt_tok=NzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 28 Mar 2024 13:47:38 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'self' 'unsafe-inline' data: https:;style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.willistowerswatson.com *.ehr.com ajax.googleapis.com cdnjs.cloudflare.com;
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Connection: keep-alive
Content-Length: 6352
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Sun, 10 Mar 2024 04:27:09 GMT
ETag: "80cc1137a372da1:0"
Vary: Accept-Encoding
X-Frame-Options: DENY
Content-Type: application/javascript
Cache-Control: no-cache
X-Referrer-Policy: no-override
PERMISSIONS-POLICY: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
Accept-Ranges: bytes

GET
H/1.1 200
OK app.min.js Show response
dashboards.willistowerswatson.com/ 26 KB
8 KB 197ms
97ms Script
application/javascript 23.102.120.139
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dashboards.willistowerswatson.com/app.min.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.102.120.139 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

ca99a39cbac53a01999c8c9d3cd4382981c600c9d70e380df357272b268998e3

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' data: https:;style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' .willistowerswatson.com .ehr.com ajax.googleapis.com cdnjs.cloudflare.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://dashboards.willistowerswatson.com/?mkt_tok=NzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 28 Mar 2024 13:47:38 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'self' 'unsafe-inline' data: https:;style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.willistowerswatson.com *.ehr.com ajax.googleapis.com cdnjs.cloudflare.com;
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Connection: keep-alive
Content-Length: 7458
Referrer-Policy: no-referrer-when-downgrade
Last-Modified: Sun, 10 Mar 2024 04:27:09 GMT
ETag: "80cc1137a372da1:0"
Vary: Accept-Encoding
X-Frame-Options: DENY
Content-Type: application/javascript
Cache-Control: no-cache
X-Referrer-Policy: no-override
PERMISSIONS-POLICY: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
Accept-Ranges: bytes

GET
H2 200 ophelper.js
oneplace.ehr.com/_layouts/sec/ 22 KB
10 KB 378ms
316ms Script
application/x-javascript 45.60.14.1
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://oneplace.ehr.com/_layouts/sec/ophelper.js

Requested by

Host: dashboards.willistowerswatson.com
URL: https://dashboards.willistowerswatson.com/app.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.14.1 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' data: https:;frame-src 'self' 'unsafe-inline' 'unsafe-eval' https: ms-word: ms-excel: ms-powerpoint: data:; frame-ancestors 'self' https://*.willistowerswatson.com ;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://dashboards.willistowerswatson.com/?mkt_tok=NzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 13:47:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: https:;frame-src 'self' 'unsafe-inline' 'unsafe-eval' https: ms-word: ms-excel: ms-powerpoint: data:; frame-ancestors 'self' https://*.willistowerswatson.com ;
access-control-request-method: POST, GET, OPTIONS
x-permitted-cross-domain-policies: none
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cdn: Imperva
x-iinfo: 12-83051383-83037353 2NNN RT(1711633657368 10) q(0 0 0 0) r(3 3) U2
content-length: 8534
pragma: no-cache
x-ms-invokeapp: 1; RequireReadOnly
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: no-cache
x-referrer-policy: no-override
access-control-allow-credentials: true
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
x-incap-sess-cookie-hdr: 3zS1Fq2EYUDfR4tZ0tMWCvl0BWYAAAAAy+CIikYt5L/u68yyP53PJw==
access-control-allow-headers: CONTENT-TYPE
expires: -1

GET
H2

200

https://oneplace.ehr.com/_layouts/watsonwyatt/login.aspx?tokenUrl=https%3A%2F%2Fdashboards.willistowerswatson.com%2F%3Fopspa_code%3DaHR0cHM6Ly9kYXNoYm9hcmRzLndpbGxpc3Rvd2Vyc3dhdHNvbi5jb20vP21rdF90b...
https://oneplace.ehr.com/_layouts/15/watsonwyatt/login.aspx?tokenUrl=https%3A%2F%2Fdashboards.willistowerswatson.com%2F%3Fopspa_code%3DaHR0cHM6Ly9kYXNoYm9hcmRzLndpbGxpc3Rvd2Vyc3dhdHNvbi5jb20vP21rdF...

511 B
894 B

129ms
129ms

Document
text/html

45.60.14.1
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://oneplace.ehr.com/_layouts/15/watsonwyatt/login.aspx?tokenUrl=https%3A%2F%2Fdashboards.willistowerswatson.com%2F%3Fopspa_code%3DaHR0cHM6Ly9kYXNoYm9hcmRzLndpbGxpc3Rvd2Vyc3dhdHNvbi5jb20vP21rdF90b2s9TnpReUxVeGFXUzB5TXpFQUFBR1NJN0VjbHhMY2NpNE9MRDIwZDNvQU9Yb2c2dlNXa3ozMDdrQ3ZGeEJkUFlta1pUODFMVk1KazhFeGRXSlhEVVMzcHI2c0Z0d2Q5bkR5NkJGTGdhcUh6Y1RnMEFmN29aVGhoNGNneTRUY2I2UjBxeFBw%26state%3Dadf5a421891a3161a539b24e93af5e6500526ab4e50a3ced9899df59%26code_challenge%3Dm0faCcBmKBNV7gpf14z_ysPHcVtsoY-JM4IdRV03TzI%26ReturnUrl%3Dhttps%3A%2F%2Fdashboards.willistowerswatson.com%2F%3Fmkt_tok%3DNzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp

Requested by

Host: oneplace.ehr.com
URL: https://oneplace.ehr.com/_layouts/sec/ophelper.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.14.1 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

e462574027f6fbe5b14929b941043d200c85151043893fcfae5ac80f4ac6c703

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .powerapps.com .yammer.com .officeapps.live.com .office.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: https:;frame-src 'self' 'unsafe-inline' 'unsafe-eval' https: ms-word: ms-excel: ms-powerpoint: data:; frame-ancestors 'self' https://*.willistowerswatson.com ;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://dashboards.willistowerswatson.com/?mkt_tok=NzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: private
content-encoding: gzip
content-length: 511
content-security-policy: frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.powerapps.com *.yammer.com *.officeapps.live.com *.office.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: https:;frame-src 'self' 'unsafe-inline' 'unsafe-eval' https: ms-word: ms-excel: ms-powerpoint: data:; frame-ancestors 'self' https://*.willistowerswatson.com ;
content-type: text/html; charset=utf-8
date: Thu, 28 Mar 2024 13:47:38 GMT
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
request-id: dc7719a1-2eb2-d0e5-8b5b-0b9d1003a3b2
spiislatency: 1
sprequestduration: 26
sprequestguid: dc7719a1-2eb2-d0e5-8b5b-0b9d1003a3b2
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-cdn: Imperva
x-content-type-options: nosniff
x-frame-options: DENY
x-iinfo: 6-43812455-43812459 PNNy RT(1711633657707 116) q(0 0 0 -1) r(1 1) U12
x-incap-sess-cookie-hdr: s5MrAKPx3yLfR4tZ0tMWCvl0BWYAAAAAsdoOR46i9JwOv6Mh70M7pg==
x-ms-invokeapp: 1; RequireReadOnly
x-permitted-cross-domain-policies: none
x-referrer-policy: no-override

Redirect headers

content-length: 812
content-security-policy: frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.powerapps.com *.yammer.com *.officeapps.live.com *.office.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: https:;frame-src 'self' 'unsafe-inline' 'unsafe-eval' https: ms-word: ms-excel: ms-powerpoint: data:; frame-ancestors 'self' https://*.willistowerswatson.com ;
content-type: text/html; charset=utf-8
date: Thu, 28 Mar 2024 13:47:38 GMT
location: /_layouts/15/watsonwyatt/login.aspx?tokenUrl=https%3A%2F%2Fdashboards.willistowerswatson.com%2F%3Fopspa_code%3DaHR0cHM6Ly9kYXNoYm9hcmRzLndpbGxpc3Rvd2Vyc3dhdHNvbi5jb20vP21rdF90b2s9TnpReUxVeGFXUzB5TXpFQUFBR1NJN0VjbHhMY2NpNE9MRDIwZDNvQU9Yb2c2dlNXa3ozMDdrQ3ZGeEJkUFlta1pUODFMVk1KazhFeGRXSlhEVVMzcHI2c0Z0d2Q5bkR5NkJGTGdhcUh6Y1RnMEFmN29aVGhoNGNneTRUY2I2UjBxeFBw%26state%3Dadf5a421891a3161a539b24e93af5e6500526ab4e50a3ced9899df59%26code_challenge%3Dm0faCcBmKBNV7gpf14z_ysPHcVtsoY-JM4IdRV03TzI%26ReturnUrl%3Dhttps%3A%2F%2Fdashboards.willistowerswatson.com%2F%3Fmkt_tok%3DNzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
request-id: dc7719a1-9eab-d0e5-8b5b-08cacc0b9047
sprequestguid: dc7719a1-9eab-d0e5-8b5b-08cacc0b9047
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cdn: Imperva
x-content-type-options: nosniff
x-frame-options: DENY
x-iinfo: 6-43812455-43812459 NNNY CT(88 89 0) RT(1711633657707 8) q(0 0 0 -1) r(1 1) U11
x-incap-sess-cookie-hdr: kIk8S+NVcTbfR4tZ0tMWCvl0BWYAAAAAZzGh3QULsErM3XdjeLG9pA==
x-ms-invokeapp: 1; RequireReadOnly
x-permitted-cross-domain-policies: none
x-referrer-policy: no-override

GET
H2

200

https://oneplace.ehr.com/favicon.ico
https://oneplace.ehr.com/
https://oneplace.ehr.com/_layouts/15/Authenticate.aspx?Source=%2F
https://oneplace.ehr.com/_layouts/15/oneplace/login.aspx?ReturnUrl=%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F

511 B
871 B

133ms
133ms

Other
text/html

45.60.14.1
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://oneplace.ehr.com/_layouts/15/oneplace/login.aspx?ReturnUrl=%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F

Protocol

Server

45.60.14.1 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .powerapps.com .yammer.com .officeapps.live.com .office.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com;, default-src 'self' 'unsafe-inline' 'unsafe-eval' data: https:;frame-src 'self' 'unsafe-inline' 'unsafe-eval' https: ms-word: ms-excel: ms-powerpoint: data:; frame-ancestors 'self' https://*.willistowerswatson.com ;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://oneplace.ehr.com/_layouts/15/watsonwyatt/login.aspx?tokenUrl=https%3A%2F%2Fdashboards.willistowerswatson.com%2F%3Fopspa_code%3DaHR0cHM6Ly9kYXNoYm9hcmRzLndpbGxpc3Rvd2Vyc3dhdHNvbi5jb20vP21rdF90b2s9TnpReUxVeGFXUzB5TXpFQUFBR1NJN0VjbHhMY2NpNE9MRDIwZDNvQU9Yb2c2dlNXa3ozMDdrQ3ZGeEJkUFlta1pUODFMVk1KazhFeGRXSlhEVVMzcHI2c0Z0d2Q5bkR5NkJGTGdhcUh6Y1RnMEFmN29aVGhoNGNneTRUY2I2UjBxeFBw%26state%3Dadf5a421891a3161a539b24e93af5e6500526ab4e50a3ced9899df59%26code_challenge%3Dm0faCcBmKBNV7gpf14z_ysPHcVtsoY-JM4IdRV03TzI%26ReturnUrl%3Dhttps%3A%2F%2Fdashboards.willistowerswatson.com%2F%3Fmkt_tok%3DNzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

date: Thu, 28 Mar 2024 13:47:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.powerapps.com *.yammer.com *.officeapps.live.com *.office.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com;, default-src 'self' 'unsafe-inline' 'unsafe-eval' data: https:;frame-src 'self' 'unsafe-inline' 'unsafe-eval' https: ms-word: ms-excel: ms-powerpoint: data:; frame-ancestors 'self' https://*.willistowerswatson.com ;
x-permitted-cross-domain-policies: none
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cdn: Imperva
x-iinfo: 6-43812455-43812459 PNNy RT(1711633657707 652) q(0 0 0 -1) r(1 1) U12
request-id: dc7719a1-9ed3-d0e5-8b5b-097805e79d7d
content-length: 510
x-ms-invokeapp: 1; RequireReadOnly
sprequestduration: 27
sprequestguid: dc7719a1-9ed3-d0e5-8b5b-097805e79d7d
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/html; charset=utf-8
cache-control: private
x-referrer-policy: no-override
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
spiislatency: 0

Redirect headers

date: Thu, 28 Mar 2024 13:47:39 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: https:;frame-src 'self' 'unsafe-inline' 'unsafe-eval' https: ms-word: ms-excel: ms-powerpoint: data:; frame-ancestors 'self' https://*.willistowerswatson.com ;
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-permitted-cross-domain-policies: none
x-cdn: Imperva
x-sharepointhealthscore: 0
x-iinfo: 6-43812455-43812459 PNNy RT(1711633657707 530) q(0 0 0 -1) r(1 1) U11
content-length: 228
x-ms-invokeapp: 1; RequireReadOnly
sprequestduration: 20
x-frame-options: DENY
content-type: text/html; charset=utf-8
location: /_layouts/15/oneplace/login.aspx?ReturnUrl=%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F
cache-control: private
x-referrer-policy: no-override
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
spiislatency: 0

GET
H2

200

Primary Request authorize Show response
auth.willistowerswatson.com/auth.willistowerswatson.com/oauth2/v2.0/
Redirect Chain

https://oneplacelogin.willistowerswatson.com//?username=&isFederated=False&samlTarget=OnePlace_Prod&isLW=False&returnUrl=ooneplace_redirect_WH70m3-Q31LgefYsx2yszxjO3uA
https://auth.willistowerswatson.com/auth.willistowerswatson.com/oauth2/v2.0/authorize?p=b2c_1a_hcb_oneplace_signuporsignin&client_id=8703959d-87ab-4d81-ac81-d3eadbead636&redirect_uri=https%3a%2f%2f...

80 KB
83 KB

645ms
573ms

Document
text/html

2620:1ec:46::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.willistowerswatson.com/auth.willistowerswatson.com/oauth2/v2.0/authorize?p=b2c_1a_hcb_oneplace_signuporsignin&client_id=8703959d-87ab-4d81-ac81-d3eadbead636&redirect_uri=https%3a%2f%2foneplacelogin.willistowerswatson.com%2f&response_mode=form_post&response_type=id_token&scope=openid+offline_access&state=OpenIdConnect.AuthenticationProperties%3dBOIU9jzJs46cQy9zAc9YjKn2T3VNNu_fpH7v67f8F0VzKySf2qlXrqds6CgkJ8DrAUezLCm7NJhPxbbdUtvkIY49YrZP1jK2g4-6DWkoseMku3VAlHRar7cp_9yMW0lIJCXpQAIVNWn7bdWUV-8R8HLLF9m6nQk52ofTXeYsbTgcYl9VSHTvMSzHUAvR_ghvV7cfDQFrO47H9xMp7tL2B4ItCRCUI1KAFlmpt4tXLlwcNvEQJsn0GbEKPj3o9cS5E80bZ-JC0zfyj0wuiuqSTYUG5EGhQh1Q9somx3GGkFZJD83BRbJLZc9mythrq5H1IFzBcx5nOMaV-PoiyiXojniTc7jqv1NBoQOZjhPSsJt-sPIgKmFVXB8ZNSrRyL4a9O1LHH9p2b7RYbwJiEf9p9wcvJW49dogg81SWtfEO5sbM5s9HKzlh2Z3mO676aRRpCPgvpBoVWcnJGGE8eRrGe0MJKVUrHlX3EdiCRZO1l9RnxaL1TUorsiVFIKiNrqovIq0GHhiAvwTJbeLHJygAylGskGIGLUNU7wcZHPa7QAeTE3YkZ4iNYkFz0z-65HUwR1XgFUB09c0DmRze1m6DeENjSz7xcKNR_N7d5WX_EA&nonce=638472304591441172.ZWNjMTBhMzItMmY4OC00ZTc4LTg4NzYtM2U3MTM2MGI4OTI0YzkyMzg3N2UtOTA3YS00ZTg1LThkOWYtMWE1OWYyZjE5N2E2&isFederated=False&gn=OPL&suite=opl&app=opl&client=opl

Requested by

Host: oneplace.ehr.com
URL: https://oneplace.ehr.com/_layouts/15/watsonwyatt/login.aspx?tokenUrl=https%3A%2F%2Fdashboards.willistowerswatson.com%2F%3Fopspa_code%3DaHR0cHM6Ly9kYXNoYm9hcmRzLndpbGxpc3Rvd2Vyc3dhdHNvbi5jb20vP21rdF90b2s9TnpReUxVeGFXUzB5TXpFQUFBR1NJN0VjbHhMY2NpNE9MRDIwZDNvQU9Yb2c2dlNXa3ozMDdrQ3ZGeEJkUFlta1pUODFMVk1KazhFeGRXSlhEVVMzcHI2c0Z0d2Q5bkR5NkJGTGdhcUh6Y1RnMEFmN29aVGhoNGNneTRUY2I2UjBxeFBw%26state%3Dadf5a421891a3161a539b24e93af5e6500526ab4e50a3ced9899df59%26code_challenge%3Dm0faCcBmKBNV7gpf14z_ysPHcVtsoY-JM4IdRV03TzI%26ReturnUrl%3Dhttps%3A%2F%2Fdashboards.willistowerswatson.com%2F%3Fmkt_tok%3DNzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

6b24725c45fe3493599bf4f9dfb8af11496362d22d867d8ee58bd12e2ff6f8cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://oneplace.ehr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ranges: bytes
allow: OPTIONS TRACE GET HEAD POST
cache-control: no-store, must-revalidate, no-cache
content-length: 81792
content-type: text/html; charset=utf-8
date: Thu, 28 Mar 2024 13:47:39 GMT
expires: -1
public: OPTIONS,TRACE,GET,HEAD,POST
strict-transport-security: max-age=31536000; includeSubDomains
x-azure-ref: 20240328T134739Z-xkz0hzc2690pv1tu4ye217by0g0000000a70000000006z8w
x-build: 1.1.98.0
x-cache: CONFIG_NOCACHE
x-content-type-options: nosniff
x-frame-options: DENY
x-ms-gateway-requestid: 161c7cc6-28ef-436a-9c2a-77fdd6efb9f7
x-request-id: 90d72064-1b43-48c2-904f-f0985be40291
x-ua-compatible: IE=edge
x-xss-protection: 1; mode=block

Redirect headers

Cache-Control: private
Connection: keep-alive
Content-Length: 0
Content-Security-Policy: frame-ancestors 'self' https://*.willistowerswatson.com;
Date: Thu, 28 Mar 2024 13:47:39 GMT
Location: https://auth.willistowerswatson.com/auth.willistowerswatson.com/oauth2/v2.0/authorize?p=b2c_1a_hcb_oneplace_signuporsignin&client_id=8703959d-87ab-4d81-ac81-d3eadbead636&redirect_uri=https%3a%2f%2foneplacelogin.willistowerswatson.com%2f&response_mode=form_post&response_type=id_token&scope=openid+offline_access&state=OpenIdConnect.AuthenticationProperties%3dBOIU9jzJs46cQy9zAc9YjKn2T3VNNu_fpH7v67f8F0VzKySf2qlXrqds6CgkJ8DrAUezLCm7NJhPxbbdUtvkIY49YrZP1jK2g4-6DWkoseMku3VAlHRar7cp_9yMW0lIJCXpQAIVNWn7bdWUV-8R8HLLF9m6nQk52ofTXeYsbTgcYl9VSHTvMSzHUAvR_ghvV7cfDQFrO47H9xMp7tL2B4ItCRCUI1KAFlmpt4tXLlwcNvEQJsn0GbEKPj3o9cS5E80bZ-JC0zfyj0wuiuqSTYUG5EGhQh1Q9somx3GGkFZJD83BRbJLZc9mythrq5H1IFzBcx5nOMaV-PoiyiXojniTc7jqv1NBoQOZjhPSsJt-sPIgKmFVXB8ZNSrRyL4a9O1LHH9p2b7RYbwJiEf9p9wcvJW49dogg81SWtfEO5sbM5s9HKzlh2Z3mO676aRRpCPgvpBoVWcnJGGE8eRrGe0MJKVUrHlX3EdiCRZO1l9RnxaL1TUorsiVFIKiNrqovIq0GHhiAvwTJbeLHJygAylGskGIGLUNU7wcZHPa7QAeTE3YkZ4iNYkFz0z-65HUwR1XgFUB09c0DmRze1m6DeENjSz7xcKNR_N7d5WX_EA&nonce=638472304591441172.ZWNjMTBhMzItMmY4OC00ZTc4LTg4NzYtM2U3MTM2MGI4OTI0YzkyMzg3N2UtOTA3YS00ZTg1LThkOWYtMWE1OWYyZjE5N2E2&isFederated=False&gn=OPL&suite=opl&app=opl&client=opl
PERMISSIONS-POLICY: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 5.2
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Referrer-Policy: no-override

GET
H2 200 jquery-bundle-1.10.2.min.js Show response
auth.willistowerswatson.com/static/bundles/ 100 KB
100 KB 524ms
524ms Script
application/javascript 2620:1ec:46::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.willistowerswatson.com/static/bundles/jquery-bundle-1.10.2.min.js?slice=001-000&dc=BL2

Requested by

Host: auth.willistowerswatson.com
URL: https://auth.willistowerswatson.com/auth.willistowerswatson.com/oauth2/v2.0/authorize?p=b2c_1a_hcb_oneplace_signuporsignin&client_id=8703959d-87ab-4d81-ac81-d3eadbead636&redirect_uri=https%3a%2f%2foneplacelogin.willistowerswatson.com%2f&response_mode=form_post&response_type=id_token&scope=openid+offline_access&state=OpenIdConnect.AuthenticationProperties%3dBOIU9jzJs46cQy9zAc9YjKn2T3VNNu_fpH7v67f8F0VzKySf2qlXrqds6CgkJ8DrAUezLCm7NJhPxbbdUtvkIY49YrZP1jK2g4-6DWkoseMku3VAlHRar7cp_9yMW0lIJCXpQAIVNWn7bdWUV-8R8HLLF9m6nQk52ofTXeYsbTgcYl9VSHTvMSzHUAvR_ghvV7cfDQFrO47H9xMp7tL2B4ItCRCUI1KAFlmpt4tXLlwcNvEQJsn0GbEKPj3o9cS5E80bZ-JC0zfyj0wuiuqSTYUG5EGhQh1Q9somx3GGkFZJD83BRbJLZc9mythrq5H1IFzBcx5nOMaV-PoiyiXojniTc7jqv1NBoQOZjhPSsJt-sPIgKmFVXB8ZNSrRyL4a9O1LHH9p2b7RYbwJiEf9p9wcvJW49dogg81SWtfEO5sbM5s9HKzlh2Z3mO676aRRpCPgvpBoVWcnJGGE8eRrGe0MJKVUrHlX3EdiCRZO1l9RnxaL1TUorsiVFIKiNrqovIq0GHhiAvwTJbeLHJygAylGskGIGLUNU7wcZHPa7QAeTE3YkZ4iNYkFz0z-65HUwR1XgFUB09c0DmRze1m6DeENjSz7xcKNR_N7d5WX_EA&nonce=638472304591441172.ZWNjMTBhMzItMmY4OC00ZTc4LTg4NzYtM2U3MTM2MGI4OTI0YzkyMzg3N2UtOTA3YS00ZTg1LThkOWYtMWE1OWYyZjE5N2E2&isFederated=False&gn=OPL&suite=opl&app=opl&client=opl

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

a035f5bc873960a65bcb6493b4d18782247a5a5d8cad443d297c853b09ea7bb4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.willistowerswatson.com/auth.willistowerswatson.com/oauth2/v2.0/authorize?p=b2c_1a_hcb_oneplace_signuporsignin&client_id=8703959d-87ab-4d81-ac81-d3eadbead636&redirect_uri=https%3a%2f%2foneplacelogin.willistowerswatson.com%2f&response_mode=form_post&response_type=id_token&scope=openid+offline_access&state=OpenIdConnect.AuthenticationProperties%3dBOIU9jzJs46cQy9zAc9YjKn2T3VNNu_fpH7v67f8F0VzKySf2qlXrqds6CgkJ8DrAUezLCm7NJhPxbbdUtvkIY49YrZP1jK2g4-6DWkoseMku3VAlHRar7cp_9yMW0lIJCXpQAIVNWn7bdWUV-8R8HLLF9m6nQk52ofTXeYsbTgcYl9VSHTvMSzHUAvR_ghvV7cfDQFrO47H9xMp7tL2B4ItCRCUI1KAFlmpt4tXLlwcNvEQJsn0GbEKPj3o9cS5E80bZ-JC0zfyj0wuiuqSTYUG5EGhQh1Q9somx3GGkFZJD83BRbJLZc9mythrq5H1IFzBcx5nOMaV-PoiyiXojniTc7jqv1NBoQOZjhPSsJt-sPIgKmFVXB8ZNSrRyL4a9O1LHH9p2b7RYbwJiEf9p9wcvJW49dogg81SWtfEO5sbM5s9HKzlh2Z3mO676aRRpCPgvpBoVWcnJGGE8eRrGe0MJKVUrHlX3EdiCRZO1l9RnxaL1TUorsiVFIKiNrqovIq0GHhiAvwTJbeLHJygAylGskGIGLUNU7wcZHPa7QAeTE3YkZ4iNYkFz0z-65HUwR1XgFUB09c0DmRze1m6DeENjSz7xcKNR_N7d5WX_EA&nonce=638472304591441172.ZWNjMTBhMzItMmY4OC00ZTc4LTg4NzYtM2U3MTM2MGI4OTI0YzkyMzg3N2UtOTA3YS00ZTg1LThkOWYtMWE1OWYyZjE5N2E2&isFederated=False&gn=OPL&suite=opl&app=opl&client=opl
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 13:47:40 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Mon, 11 Mar 2024 10:03:34 GMT
etag: "01fae609b73da1:0"
access-control-max-age: 3600
access-control-allow-methods: GET, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
x-frame-options: DENY
x-azure-ref: 20240328T134739Z-xkz0hzc2690pv1tu4ye217by0g0000000a70000000006zaq
accept-ranges: bytes
content-length: 101973
x-xss-protection: 1; mode=block

GET
H2 200 localsignup Show response
wtw-ca-p-brandengine01.willistowerswatson.com/template/ 9 KB
3 KB 841ms
200ms XHR
text/html 40.114.106.25
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://wtw-ca-p-brandengine01.willistowerswatson.com/template/localsignup?suite=opl&app=opl&client=opl
Requested by: Host: auth.willistowerswatson.com
URL: https://auth.willistowerswatson.com/auth.willistowerswatson.com/oauth2/v2.0/authorize?p=b2c_1a_hcb_oneplace_signuporsignin&client_id=8703959d-87ab-4d81-ac81-d3eadbead636&redirect_uri=https%3a%2f%2foneplacelogin.willistowerswatson.com%2f&response_mode=form_post&response_type=id_token&scope=openid+offline_access&state=OpenIdConnect.AuthenticationProperties%3dBOIU9jzJs46cQy9zAc9YjKn2T3VNNu_fpH7v67f8F0VzKySf2qlXrqds6CgkJ8DrAUezLCm7NJhPxbbdUtvkIY49YrZP1jK2g4-6DWkoseMku3VAlHRar7cp_9yMW0lIJCXpQAIVNWn7bdWUV-8R8HLLF9m6nQk52ofTXeYsbTgcYl9VSHTvMSzHUAvR_ghvV7cfDQFrO47H9xMp7tL2B4ItCRCUI1KAFlmpt4tXLlwcNvEQJsn0GbEKPj3o9cS5E80bZ-JC0zfyj0wuiuqSTYUG5EGhQh1Q9somx3GGkFZJD83BRbJLZc9mythrq5H1IFzBcx5nOMaV-PoiyiXojniTc7jqv1NBoQOZjhPSsJt-sPIgKmFVXB8ZNSrRyL4a9O1LHH9p2b7RYbwJiEf9p9wcvJW49dogg81SWtfEO5sbM5s9HKzlh2Z3mO676aRRpCPgvpBoVWcnJGGE8eRrGe0MJKVUrHlX3EdiCRZO1l9RnxaL1TUorsiVFIKiNrqovIq0GHhiAvwTJbeLHJygAylGskGIGLUNU7wcZHPa7QAeTE3YkZ4iNYkFz0z-65HUwR1XgFUB09c0DmRze1m6DeENjSz7xcKNR_N7d5WX_EA&nonce=638472304591441172.ZWNjMTBhMzItMmY4OC00ZTc4LTg4NzYtM2U3MTM2MGI4OTI0YzkyMzg3N2UtOTA3YS00ZTg1LThkOWYtMWE1OWYyZjE5N2E2&isFederated=False&gn=OPL&suite=opl&app=opl&client=opl
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 40.114.106.25 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Kestrel / ASP.NET
Resource Hash: ae18323345c4fe10663b9e9e7bd4cdf19e007e246894709d71caf46da1f863de

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.willistowerswatson.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: *
date: Thu, 28 Mar 2024 13:47:40 GMT
content-encoding: gzip
server: Kestrel
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/html; charset=utf-8

GET
H2 200 ai.0.js Show response
az416426.vo.msecnd.net/scripts/a/ 94 KB
22 KB 40ms
12ms Script
application/x-javascript 2606:2800:133:206e:1315:22a5:2006:24fd
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by: Host: auth.willistowerswatson.com
URL: https://auth.willistowerswatson.com/auth.willistowerswatson.com/oauth2/v2.0/authorize?p=b2c_1a_hcb_oneplace_signuporsignin&client_id=8703959d-87ab-4d81-ac81-d3eadbead636&redirect_uri=https%3a%2f%2foneplacelogin.willistowerswatson.com%2f&response_mode=form_post&response_type=id_token&scope=openid+offline_access&state=OpenIdConnect.AuthenticationProperties%3dBOIU9jzJs46cQy9zAc9YjKn2T3VNNu_fpH7v67f8F0VzKySf2qlXrqds6CgkJ8DrAUezLCm7NJhPxbbdUtvkIY49YrZP1jK2g4-6DWkoseMku3VAlHRar7cp_9yMW0lIJCXpQAIVNWn7bdWUV-8R8HLLF9m6nQk52ofTXeYsbTgcYl9VSHTvMSzHUAvR_ghvV7cfDQFrO47H9xMp7tL2B4ItCRCUI1KAFlmpt4tXLlwcNvEQJsn0GbEKPj3o9cS5E80bZ-JC0zfyj0wuiuqSTYUG5EGhQh1Q9somx3GGkFZJD83BRbJLZc9mythrq5H1IFzBcx5nOMaV-PoiyiXojniTc7jqv1NBoQOZjhPSsJt-sPIgKmFVXB8ZNSrRyL4a9O1LHH9p2b7RYbwJiEf9p9wcvJW49dogg81SWtfEO5sbM5s9HKzlh2Z3mO676aRRpCPgvpBoVWcnJGGE8eRrGe0MJKVUrHlX3EdiCRZO1l9RnxaL1TUorsiVFIKiNrqovIq0GHhiAvwTJbeLHJygAylGskGIGLUNU7wcZHPa7QAeTE3YkZ4iNYkFz0z-65HUwR1XgFUB09c0DmRze1m6DeENjSz7xcKNR_N7d5WX_EA&nonce=638472304591441172.ZWNjMTBhMzItMmY4OC00ZTc4LTg4NzYtM2U3MTM2MGI4OTI0YzkyMzg3N2UtOTA3YS00ZTg1LThkOWYtMWE1OWYyZjE5N2E2&isFederated=False&gn=OPL&suite=opl&app=opl&client=opl
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:133:206e:1315:22a5:2006:24fd , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CD6) /
Resource Hash: 5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.willistowerswatson.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 28 Mar 2024 13:47:40 GMT
content-encoding: gzip
x-ms-meta-lastmodified: 2020-10-01 19:31:04
content-md5: HdY95yzx9wIyQkVEGES+Ew==
age: 404
x-cache: HIT
content-length: 22495
x-ms-lease-status: unlocked
last-modified: Thu, 11 Mar 2021 07:46:59 GMT
server: ECAcc (frc/4CD6)
etag: 0x8D8E461DA1A5889
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 96f459b3-901e-00a7-5a15-818fe3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=1800
x-ms-version: 2009-09-19
expires: Thu, 28 Mar 2024 14:17:40 GMT

OPTIONS
H2 204 track
dc.services.visualstudio.com/v2/ 0
0 268ms
29ms Preflight 20.50.88.238
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dc.services.visualstudio.com/v2/track

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

20.50.88.238 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-HTTPAPI/2.0 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,sdk-context
Access-Control-Request-Method: POST
Origin: https://auth.willistowerswatson.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin,X-Requested-With,Content-Name,Content-Type,Accept,Cache-Control,Sdk-Context
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 3600
date: Thu, 28 Mar 2024 13:47:40 GMT
server: Microsoft-HTTPAPI/2.0
strict-transport-security: max-age=31536000

POST
H2 200 track Show response
dc.services.visualstudio.com/v2/ 96 B
200 B 97ms
94ms XHR
application/json 20.50.88.238
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dc.services.visualstudio.com/v2/track

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

20.50.88.238 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-HTTPAPI/2.0 /

Resource Hash

d0e9b19250eaf1e6a2e62d9965942889f0387e0e35dd8bf18f716c713c15c205

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
Sdk-Context: appId
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://auth.willistowerswatson.com/
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: *
strict-transport-security: max-age=31536000
date: Thu, 28 Mar 2024 13:47:40 GMT
x-content-type-options: nosniff
server: Microsoft-HTTPAPI/2.0
content-type: application/json; charset=utf-8

GET
H2 200 master.css
wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/css/ 26 KB
8 KB 395ms
115ms Stylesheet
text/css 40.114.106.25
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/css/master.css?rev=20240328
Requested by: Host: auth.willistowerswatson.com
URL: https://auth.willistowerswatson.com/static/bundles/jquery-bundle-1.10.2.min.js?slice=001-000&dc=BL2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 40.114.106.25 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Kestrel / ASP.NET
Resource Hash: a3431ea94be4332cf3fc3c9db61a41b3b5e8359a512065f13ecbe3a2f12f422f

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.willistowerswatson.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 13:47:41 GMT
content-encoding: gzip
last-modified: Fri, 27 Jan 2023 09:39:00 GMT
server: Kestrel
etag: "1d932332f27b5f3"
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes

GET
H2 200 account-issues.jpg
wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/img/ 37 KB
37 KB 491ms
213ms Image
image/jpeg 40.114.106.25
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/img/account-issues.jpg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 40.114.106.25 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Kestrel / ASP.NET
Resource Hash: 2702e3cedfcce9f1544f0ac0574115bc87e3412aee8bd6aa6e87421b4a0ed038

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.willistowerswatson.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 13:47:41 GMT
last-modified: Fri, 27 Jan 2023 09:39:00 GMT
server: Kestrel
etag: "1d932332f274065"
x-powered-by: ASP.NET
content-type: image/jpeg
accept-ranges: bytes
content-length: 37477

GET
H2 200 bg-promo.jpg
wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/img/ 86 KB
86 KB 447ms
169ms Image
image/jpeg 40.114.106.25
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/img/bg-promo.jpg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 40.114.106.25 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Kestrel / ASP.NET
Resource Hash: 8a075fbfdf4e97fb93937990e862c737df1011b97228e213d229daeaa2434521

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.willistowerswatson.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 13:47:41 GMT
last-modified: Fri, 27 Jan 2023 09:39:00 GMT
server: Kestrel
etag: "1d932332f2684cc"
x-powered-by: ASP.NET
content-type: image/jpeg
accept-ranges: bytes
content-length: 87756

GET
H2 200 oneplace-logo.svg
wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/img/ 3 KB
4 KB 400ms
122ms Image
image/svg+xml 40.114.106.25
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/img/oneplace-logo.svg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 40.114.106.25 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Kestrel / ASP.NET
Resource Hash: 9362f78e71d0c6500ded653961f3cb4a80ba409baf4453f70d38d3ed4aff43f6

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.willistowerswatson.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 13:47:41 GMT
last-modified: Fri, 27 Jan 2023 09:39:00 GMT
server: Kestrel
etag: "1d932332f27de68"
x-powered-by: ASP.NET
content-type: image/svg+xml
accept-ranges: bytes
content-length: 3176

GET
H2 200 wtw-white.svg
wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/img/ 666 B
1 KB 444ms
166ms Image
image/svg+xml 40.114.106.25
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/img/wtw-white.svg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 40.114.106.25 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Kestrel / ASP.NET
Resource Hash: f1c88d366b35b6a1149636d9128cf2d6e6821cabaed3a0914aca7d4e0fa1f89a

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.willistowerswatson.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 13:47:41 GMT
last-modified: Fri, 27 Jan 2023 09:39:00 GMT
server: Kestrel
etag: "1d932332f27d09a"
x-powered-by: ASP.NET
content-type: image/svg+xml
accept-ranges: bytes
content-length: 666

GET
H2 200 index.js Show response
wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/js/ 16 KB
6 KB 486ms
213ms Script
application/javascript 40.114.106.25
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/js/index.js?_=1711633660467
Requested by: Host: auth.willistowerswatson.com
URL: https://auth.willistowerswatson.com/static/bundles/jquery-bundle-1.10.2.min.js?slice=001-000&dc=BL2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 40.114.106.25 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Kestrel / ASP.NET
Resource Hash: a875416cb33af7397e0f4719173341a152f8b6f4c251b58c8c23ee43f63a2671

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://auth.willistowerswatson.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 13:47:41 GMT
content-encoding: gzip
last-modified: Fri, 27 Jan 2023 09:39:00 GMT
server: Kestrel
etag: "1d932332f27ed51"
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes

GET
H2 200 css2
fonts.googleapis.com/ 9 KB
1 KB 81ms
59ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap

Requested by

Host: wtw-ca-p-brandengine01.willistowerswatson.com
URL: https://wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/css/master.css?rev=20240328

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

77190354256d2bb6e2f740715bbc72c1af70ec722773ab27bd7ddd63dac90529

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://wtw-ca-p-brandengine01.willistowerswatson.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Thu, 28 Mar 2024 13:47:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 28 Mar 2024 13:20:29 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 28 Mar 2024 13:47:41 GMT

GET
H2 200 oneplace-bg-5.jpg
wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/img/ 163 KB
0 190ms
189ms Image
image/jpeg 40.114.106.25
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/img/oneplace-bg-5.jpg
Requested by: Host: wtw-ca-p-brandengine01.willistowerswatson.com
URL: https://wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/css/master.css?rev=20240328
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 40.114.106.25 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Kestrel / ASP.NET
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/css/master.css?rev=20240328
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 13:47:41 GMT
last-modified: Fri, 27 Jan 2023 09:39:00 GMT
server: Kestrel
etag: "1d932332f2430ec"
x-powered-by: ASP.NET
content-type: image/jpeg
accept-ranges: bytes
content-length: 254700

GET
H2 200 UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
fonts.gstatic.com/s/inter/v13/ 46 KB
46 KB 29ms
7ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

88df0b5a7bc397dbc13a26bb8b3742cc62cd1c9b0dded57da7832416d6f52f42

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fonts.googleapis.com/
Origin: https://auth.willistowerswatson.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 07:46:29 GMT
x-content-type-options: nosniff
age: 194472
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46704
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 23:49:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 Mar 2025 07:46:29 GMT

GET
H2 200 UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
fonts.gstatic.com/s/inter/v13/ 46 KB
46 KB 35ms
14ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

88df0b5a7bc397dbc13a26bb8b3742cc62cd1c9b0dded57da7832416d6f52f42

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fonts.googleapis.com/
Origin: https://auth.willistowerswatson.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 07:46:29 GMT
x-content-type-options: nosniff
age: 194472
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46704
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 23:49:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 Mar 2025 07:46:29 GMT

GET
H2 200 lock-icon.svg
wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/img/ 730 B
789 B 197ms
197ms Image
image/svg+xml 40.114.106.25
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/img/lock-icon.svg
Requested by: Host: wtw-ca-p-brandengine01.willistowerswatson.com
URL: https://wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/css/master.css?rev=20240328
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 40.114.106.25 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Kestrel / ASP.NET
Resource Hash: 8c826e1fbf409e622b7c348594b6ee15cb72c78d4c7e3cbcc060a11b128f692a

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/css/master.css?rev=20240328
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 13:47:41 GMT
last-modified: Fri, 27 Jan 2023 09:39:00 GMT
server: Kestrel
etag: "1d932332f27d0da"
x-powered-by: ASP.NET
content-type: image/svg+xml
accept-ranges: bytes
content-length: 730

GET
H2 200 wtw-white.svg
wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/img/ 666 B
707 B 198ms
198ms Image
image/svg+xml 40.114.106.25
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/img/wtw-white.svg
Requested by: Host: wtw-ca-p-brandengine01.willistowerswatson.com
URL: https://wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/css/master.css?rev=20240328
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 40.114.106.25 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Kestrel / ASP.NET
Resource Hash: f1c88d366b35b6a1149636d9128cf2d6e6821cabaed3a0914aca7d4e0fa1f89a

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://wtw-ca-p-brandengine01.willistowerswatson.com/templates/suites/opl/clients/opl/css/master.css?rev=20240328
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 13:47:41 GMT
last-modified: Fri, 27 Jan 2023 09:39:00 GMT
server: Kestrel
etag: "1d932332f27d09a"
x-powered-by: ASP.NET
content-type: image/svg+xml
accept-ranges: bytes
content-length: 666

Verdicts & Comments Add Verdict or Comment

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

19 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.email2.wtwco.com/	1970-01-20 19:27:15	Name: __cf_bm Value: 6NF9aw.YQ2A6A754JSBxNXS.Xdb8QO491dud44DbO80-1711633657-1.0.1.1-9MlAMF7KQZHaP3RNPPB0la6MTrzmUFYeKwW16fok946z5mUSsYlt1hLEo6qoRoA31wDO49jw02brKjy8hGEG3A
dashboards.willistowerswatson.com/	1969-12-31 23:59:59	Name: ApplicationGatewayAffinityCORS Value: a4f27bfaaeb3853359be01884f340c60
dashboards.willistowerswatson.com/	1969-12-31 23:59:59	Name: ApplicationGatewayAffinity Value: a4f27bfaaeb3853359be01884f340c60
oneplace.ehr.com/	1969-12-31 23:59:59	Name: ApplicationGatewayAffinityCORS Value: e64970438baa72d5db075a61153d7551
.ehr.com/	1969-12-31 23:59:59	Name: nlbi_2144506 Value: N9NXSAutHwwl9yuWsuq2EwAAAADkCjXs4yTaEGx71GTHa166
.ehr.com/	1970-01-21 04:11:55	Name: visid_incap_2144506 Value: SakeswZ+Sma3TxioxH8znvl0BWYAAAAAQUIPAAAAAABkhdzaIn1x4R0+Cij5FiyA
.ehr.com/	1969-12-31 23:59:59	Name: incap_ses_727_2144506 Value: yMZda5k1DH3fR4tZ0tMWCvl0BWYAAAAAHyJ12Se/KU4GCsgFtu/1cg==
oneplace.ehr.com/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: lyjog3td3yorknteyvvbjg2j
oneplacelogin.willistowerswatson.com/	1969-12-31 23:59:59	Name: ApplicationGatewayAffinityCORS Value: a4f27bfaaeb3853359be01884f340c60
oneplacelogin.willistowerswatson.com/	1969-12-31 23:59:59	Name: ApplicationGatewayAffinity Value: a4f27bfaaeb3853359be01884f340c60
oneplacelogin.willistowerswatson.com/	1969-12-31 23:59:59	Name: OpenIdConnect.nonce.MBeP1b6e57leTvP4EfKQ7kuabtx%2F3Jl3pFkcLcyGk9A%3D Value: ak9fd1Izb05GNy1zVk9yWmFQUDloeWJObS11LUdoT2lFblYxekhBNkQwMGF0MTQ3djF3RnJaZ0w1NHRvbTAyZ0hjZ3J1NVNYY2NXNWZCM2JYRTBxTFB4b1ptTThJaU9OQlZCWWw4bE9tOE1wVWNVRzlyZG9vMGl6RzFRWWZ1SWcwWkFCUTBmU3AyZHdGcURoMUFNZWZ3ZE92UDBIZnVEVDcwdnJrbkFhN2g4M2lMeVVFWDNsTU00YXVoQUlJTnh3NENjaWd1SGpUcVJOVy1IX3ZTdlIzSjE1QmRnM1NPZV9pMXBUYXpLbllndw%3D%3D
.auth.willistowerswatson.com/	1969-12-31 23:59:59	Name: x-ms-cpim-csrf Value: bjQ0aXNyTHN0eVVRaDNOUC9PR1cwa0F3UDMrT2ZaMlU1TmkzcnBRK3ZhZm5ubDBRSzdMeVJpeVpIME1CYzYzR2VyYURLRGRncHY1dUVUZDZZeGpLRXc9PTsyMDI0LTAzLTI4VDEzOjQ3OjM5LjYyMTY0ODhaO0pnL3l4ZXpNa1BleXNUQStZTnhZbFE9PTt7IlRhcmdldEVudGl0eSI6Ik11bHRpU3RlcFNpZ25pblVzZXJuYW1lRXhjaGFuZ2UiLCJPcmNoZXN0cmF0aW9uU3RlcCI6MX0=
.auth.willistowerswatson.com/	1969-12-31 23:59:59	Name: x-ms-cpim-cache\|zcdxkembwkiqt_cyw-qckq_0 Value: m1.jLirRwhTrnDy0rFc.Un4uZ+HmDJcbIn4UY/QeBg==.0.YrjnMuOjzkpRA3Ro0bXgsj6Cja4QFNw0YUrTs5HvHRdM1kyxQ6zvgCmfUKz5RHUFxQHOhJVKqkQBboxsYqTaN5f3aQ6qkirTZNf6TLCdrraANjaISMoth211IsG02pYfQY9jOI0+Ttfv951o6Quq8kGVUujvydzcypL13mDx9tvFtuKZSQmelkZ90i2HL80bNT+tvBB1ZejEMaVhia3Q2cWqhjc5HUK9fJXqhoYQPOPBTFLEX7tq64VgrnXtCxVlYJ6IEEyQFcas8ogg0sqwm+8uwa6+LthLyh9i7Yr43XBTx51DfW+WCpy6lDviZqdjwVr3q1JbKMRCUZNxlskVoKhTtAG6+8X9IbuSp7k0R0tg6xhahPsI/eSxwot3LgjozrsGMgZrKzNrRqawq+V9plQICoCAGJzbo9jQBu/QUv0cL7xwz6U5BPO/gI6yaedDJBjoc3muj1sTegu7ah3jy6BSAI9Gk35QF7S2IJuKbAZwqb1u9XMipIKlxHO3n802uzQw1NMmQQEtLpWNlhf+19yCoRwjKThG2LUf9dydPNQ+eAdeMw54slt/iYusyvksynn+p6TtF4RvLNEr5J4BaFg5pZ/2+S5oVEA4EHUTCAxQlGL7qbUhX53p5sQ0cWcrr9bOJPYz7r8DHxooYhkxAVclL1I+/EdCWic8WNzbIpuMshX8Lg12zQJ10naBmWfjRUr4D9s2M3XKlwlmA7yHAa/NLVF52c20XHoRO3WJdPcKLAkBzgD9M/xsyYjUP9HnEyS1djycsrHrNkPA1eykU5+glzLo3tEP43v26j5kEsTj7ppIV4mRO6WXiGG9NWLQ15b3s0RBknKGX20hd/anJ9i/N53xOrd7Eib3hn2GcMrTyR46Am82wgfsplAt52u8PGbKTuJ4/yGiifCCW9MCyRsFNhocXgXX57oPTPwM2GYxmtkEK6g5dgUyPHFU9SI5m5FJNvsmcZC9Eo1cfwwKJixQ+5aOG2vvhJKzDqQEsvVUDjG//VidZvH1klcsleDDtF6IlKtK9aZDJCU+ghrfKtLbtyjaIhWHltc8hQ32WI+SGikN98wY9PBj+5ukdgtg0z4mltbkqS8d/A6NeDrRzYmbihU/51vJvGgFU6V1D+wHVqiVzjwgAfZTsPnQRIxYDd1pDGnUBc+jdwDtQ424/6xs6wg9XsJSIiah62MlHlXUIS/WlinDsSJxjym/milx1yJX+tVQUE3iwMeP00RbYFURyBuZlm8qmGO8Fu1fUrVQBvhGdS6f1gC9eUtDfs7E2+5fXwdFCMVw1FXQLStl2xQ6/areC4L+4031E+L08TmvCgPhWmdvtmbmAZNjbvtCLxZctTOIbZoXACG22UHcte3D+O7fpBcUVvqEs5tjdcYBnL9S/0VknrrKBIWI7lzEUw1FnrkGIb9jr8D600jnfS2nyHjdkvGUbpmjLVAeitj8CMRBhP/G5OfgQTIyRtjIzIvchvrEJ7D7mBe4NGkYfuCCrhY7RoUkRZfSv0QwaxQoCDevYkohiHILraJNZPySisp7ZrC2Fy3vis+/9AYh4NPzNezmIlJEMBMqvKnQcYc/VXMmNoE3SGOTzXqiPIKz
.auth.willistowerswatson.com/	1969-12-31 23:59:59	Name: x-ms-cpim-trans Value: eyJUX0RJQyI6W3siSSI6IjkwZDcyMDY0LTFiNDMtNDhjMi05MDRmLWYwOTg1YmU0MDI5MSIsIlQiOiJ3dHdiMmNQcm9kLm9ubWljcm9zb2Z0LmNvbSIsIlAiOiJiMmNfMWFfaGNiX29uZXBsYWNlX3NpZ251cG9yc2lnbmluIiwiQyI6Ijg3MDM5NTlkLTg3YWItNGQ4MS1hYzgxLWQzZWFkYmVhZDYzNiIsIlMiOjEsIk0iOnt9LCJEIjowLCJFIjoiIn1dLCJDX0lEIjoiOTBkNzIwNjQtMWI0My00OGMyLTkwNGYtZjA5ODViZTQwMjkxIn0=
auth.willistowerswatson.com/	1970-01-20 19:27:17	Name: x-ms-cpim-geo Value: NA
auth.willistowerswatson.com/	1970-01-21 04:12:49	Name: ai_user Value: pH1G3\|2024-03-28T13:47:40.524Z
auth.willistowerswatson.com/	1970-01-20 19:27:15	Name: ai_session Value: 6oRvF\|1711633660629.3\|1711633660629.3
.wtw-ca-p-brandengine01.willistowerswatson.com/	1969-12-31 23:59:59	Name: ARRAffinity Value: d84116f92d815be6afd62176e7f545356cc3cdff735707fce918af0754767e30
.wtw-ca-p-brandengine01.willistowerswatson.com/	1969-12-31 23:59:59	Name: ARRAffinitySameSite Value: d84116f92d815be6afd62176e7f545356cc3cdff735707fce918af0754767e30

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://dashboards.willistowerswatson.com/?mkt_tok=NzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://dashboards.willistowerswatson.com/?mkt_tok=NzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://dashboards.willistowerswatson.com/?mkt_tok=NzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://dashboards.willistowerswatson.com/?mkt_tok=NzQyLUxaWS0yMzEAAAGSI7EclxLcci4OLD20d3oAOXog6vSWkz307kCvFxBdPYmkZT81LVMJk8ExdWJXDUS3pr6sFtwd9nDy6BFLgaqHzcTg0Af7oZThh4cgy4Tcb6R0qxPp Message: Third-party cookie will be blocked. Learn more in the Issues tab.
deprecation	warning	URL: https://auth.willistowerswatson.com/static/bundles/jquery-bundle-1.10.2.min.js?slice=001-000&dc=BL2(Line 2) Message: Listener added for a synchronous 'DOMSubtreeModified' DOM Mutation Event. This event type is deprecated (https://w3c.github.io/uievents/#legacy-event-types) and work is underway to remove it from this browser. Usage of this event listener will cause performance issues today, and represents a risk of future incompatibility. Consider using MutationObserver instead.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self'; img-src 'self';script-src 'self' 'sha256-FYsvoY6cUoZHUBmZddW3bLIpgPb1ohCYkdwa1hwkMkk=';object-src 'none';form-action 'none';frame-src 'none';style-src 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

auth.willistowerswatson.com
az416426.vo.msecnd.net
cdnjs.cloudflare.com
dashboards.willistowerswatson.com
dc.services.visualstudio.com
email2.wtwco.com
fonts.googleapis.com
fonts.gstatic.com
oneplace.ehr.com
oneplacelogin.willistowerswatson.com
wtw-ca-p-brandengine01.willistowerswatson.com
104.17.25.14
104.17.70.206
20.50.88.238
23.102.120.139
2606:2800:133:206e:1315:22a5:2006:24fd
2620:1ec:46::45
2a00:1450:4001:80f::2003
2a00:1450:4001:82f::200a
40.114.106.25
45.60.14.1
2702e3cedfcce9f1544f0ac0574115bc87e3412aee8bd6aa6e87421b4a0ed038
306dceede7d4fa088840c113691bd4adf79275ea945ad072d0c1f7af820ba5e2
4aa32d31ee385baf30739e940325c41b5aa84b2c922cc283799944e417618fd3
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e
6714808311bbbd251392ecb011189e9d25531fdf8689e6da4e4a0201dc022468
6b24725c45fe3493599bf4f9dfb8af11496362d22d867d8ee58bd12e2ff6f8cf
7438429ecbb9b8f27d5838e4e7d5bd547867fb4b14cca212ca0f73c59d63520f
77190354256d2bb6e2f740715bbc72c1af70ec722773ab27bd7ddd63dac90529
88df0b5a7bc397dbc13a26bb8b3742cc62cd1c9b0dded57da7832416d6f52f42
8a075fbfdf4e97fb93937990e862c737df1011b97228e213d229daeaa2434521
8c826e1fbf409e622b7c348594b6ee15cb72c78d4c7e3cbcc060a11b128f692a
8c9cadf2d340b9a5ff3a7f4601116ddc451747986b3b3d02cb1d6c5f2165d553
8f4ad48d6b6b9e97a104f741e669eb58da1bb71e671c7d4d29ad5bf20e4e5814
9362f78e71d0c6500ded653961f3cb4a80ba409baf4453f70d38d3ed4aff43f6
a035f5bc873960a65bcb6493b4d18782247a5a5d8cad443d297c853b09ea7bb4
a3431ea94be4332cf3fc3c9db61a41b3b5e8359a512065f13ecbe3a2f12f422f
a875416cb33af7397e0f4719173341a152f8b6f4c251b58c8c23ee43f63a2671
ae18323345c4fe10663b9e9e7bd4cdf19e007e246894709d71caf46da1f863de
ca99a39cbac53a01999c8c9d3cd4382981c600c9d70e380df357272b268998e3
d0e9b19250eaf1e6a2e62d9965942889f0387e0e35dd8bf18f716c713c15c205
d2887a8b7d3b6439f0c0e5e2f8504eb1718972ce29be9be8ae762e11a66cc0f5
d4dc19795fe3914f4c02323981e9d59672d1d96eb3f2b2b662b7070a2be01e07
e462574027f6fbe5b14929b941043d200c85151043893fcfae5ac80f4ac6c703
f1c88d366b35b6a1149636d9128cf2d6e6821cabaed3a0914aca7d4e0fa1f89a

auth.willistowerswatson.com Open in urlscan Pro 2620:1ec:46::45 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

31 Requests

97 %HTTPS

40 %IPv6

8 Domains

11 Subdomains

10 IPs

4 Countries

508 kBTransfer

909 kBSize

19 Cookies

2 Outgoing links

Page URL History

Redirected requests

31 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

auth.willistowerswatson.com Open in urlscan Pro
2620:1ec:46::45 Public Scan

Screenshot
Live screenshot

Full Image

31
Requests

97 %
HTTPS

40 %
IPv6

8
Domains

11
Subdomains

10
IPs

4
Countries

508 kB
Transfer

909 kB
Size

19
Cookies

31 HTTP transactions
0 data transactions