login.microsoftonline.com Open in urlscan Pro
2603:1026:3000:d0:: Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://click1.workhuman.com/e/c/eyJlbWFpbF9pZCI6ImRnVHp0QVlBQU4yMHlRWGN0TWtGQVpBWGVuQlRnWERtbFJ3WEFGQzlPdz09IiwiaHJlZiI6Imh0...
Effective URL:
https://login.microsoftonline.com/759f9e8b-cf6d-4ef2-b0bc-dd4bdf1e7c56/saml2?sso_reload=true
Submission: On June 21 via manual (June 21st 2024, 4:31:04 am UTC) from IN — Scanned from DE

Summary HTTP 27 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 9 IPs in 4 countries across 9 domains to perform 27 HTTP transactions. The main IP is 2603:1026:3000:d0::, located in Dublin, Ireland and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is login.microsoftonline.com. The Cisco Umbrella rank of the primary domain is 11.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on May 27th 2024. Valid for: a year.

This is the only time login.microsoftonline.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	108.138.26.115 108.138.26.115	16509 (AMAZON-02) (AMAZON-02)
9	3.161.82.96 3.161.82.96	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:350... 2a02:26f0:3500:88e::13b8	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:4001:829::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
1	2.17.191.240 2.17.191.240	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2603:1026:300... 2603:1026:3000:d0::	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	2620:1ec:bdf::60 2620:1ec:bdf::60	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
6	2606:2800:233... 2606:2800:233:1cb7:261b:1f9c:2074:3c	15133 (EDGECAST) (EDGECAST)
1	20.190.160.22 20.190.160.22	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
27	9

1 108.138.26.115 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-108-138-26-115.fra56.r.cloudfront.net

click1.workhuman.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 3.161.82.96 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-161-82-96.fra56.r.cloudfront.net

cloud.workhuman.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
idp.workhuman.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:88e::13b8 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

cdn.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.17.191.240 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-17-191-240.deploy.static.akamaitechnologies.com

a15928870500.cdn.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2603:1026:3000:d0:: (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

login.microsoftonline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:bdf::60 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
aadcdn.msftauthimages.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:2800:233:1cb7:261b:1f9c:2074:3c (United States)

ASN15133 (EDGECAST, US)

aadcdn.msftauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 20.190.160.22 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

login.live.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	workhuman.com 1 redirects click1.workhuman.com — Cisco Umbrella Rank: 477832 cloud.workhuman.com — Cisco Umbrella Rank: 34647 idp.workhuman.com — Cisco Umbrella Rank: 92053	341 KB
6	msftauth.net aadcdn.msftauth.net — Cisco Umbrella Rank: 1065	246 KB
3	msftauthimages.net aadcdn.msftauthimages.net — Cisco Umbrella Rank: 4481	84 KB
2	microsoftonline.com login.microsoftonline.com — Cisco Umbrella Rank: 11	27 KB
2	gstatic.com fonts.gstatic.com	50 KB
2	optimizely.com cdn.optimizely.com — Cisco Umbrella Rank: 805 a15928870500.cdn.optimizely.com — Cisco Umbrella Rank: 96631	89 KB
1	live.com login.live.com — Cisco Umbrella Rank: 63
1	msauth.net aadcdn.msauth.net — Cisco Umbrella Rank: 1015	49 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 83	1 KB
27	9

	Domain	Requested by
7	cloud.workhuman.com	cloud.workhuman.com
6	aadcdn.msftauth.net	login.microsoftonline.com aadcdn.msftauth.net
3	aadcdn.msftauthimages.net
2	login.microsoftonline.com
2	idp.workhuman.com
2	fonts.gstatic.com	fonts.googleapis.com
1	login.live.com	login.microsoftonline.com
1	aadcdn.msauth.net	login.microsoftonline.com
1	a15928870500.cdn.optimizely.com	cdn.optimizely.com
1	fonts.googleapis.com	cloud.workhuman.com
1	cdn.optimizely.com	cloud.workhuman.com
1	click1.workhuman.com	1 redirects
27	12

This site contains links to these domains. Also see Links.

Domain
www.microsoft.com
privacy.microsoft.com

Subject Issuer	Validity	Valid
*.workhuman.com Amazon RSA 2048 M03	`2023-12-28` - `2025-01-25`	a year	crt.sh
cdn.optimizely.com DigiCert TLS RSA SHA256 2020 CA1	`2023-09-01` - `2024-09-04`	a year	crt.sh
upload.video.google.com WR2	`2024-06-03` - `2024-08-26`	3 months	crt.sh
*.gstatic.com WR2	`2024-06-03` - `2024-08-26`	3 months	crt.sh
*.cdn.optimizely.com GeoTrust RSA CA 2018	`2024-01-25` - `2025-01-27`	a year	crt.sh
stamp2.login.microsoftonline.com DigiCert SHA2 Secure Server CA	`2024-05-27` - `2025-05-27`	a year	crt.sh
aadcdn.msauth.net DigiCert SHA2 Secure Server CA	`2024-04-30` - `2025-04-30`	a year	crt.sh
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA	`2024-05-25` - `2025-05-25`	a year	crt.sh
login.live.com DigiCert SHA2 Secure Server CA	`2024-05-21` - `2025-05-21`	a year	crt.sh
aadcdn.msftauthimages.net Microsoft Azure RSA TLS Issuing CA 07	`2024-05-12` - `2025-05-07`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://login.microsoftonline.com/759f9e8b-cf6d-4ef2-b0bc-dd4bdf1e7c56/saml2?sso_reload=true
Frame ID: 9FB0F699D57E9BD6C7BFAC6F7C9FF670
Requests: 26 HTTP requests in this frame

Frame: https://a15928870500.cdn.optimizely.com/client_storage/a15928870500.html
Frame ID: 336E7BAA40EFDA31578B6A3EBD1AD416
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Bei Ihrem Konto anmelden

Page URL History Show full URLs

https://click1.workhuman.com/e/c/eyJlbWFpbF9pZCI6ImRnVHp0QVlBQU4yMHlRWGN0TWtGQVpBWGVuQlRnWERtbFJ3WEFGQzlP... HTTP 302
https://cloud.workhuman.com/store/?utm_source=cio&utm_medium=email&utm_campaign=Automation_Rec_Welcome_N... Page URL
https://cloud.workhuman.com/microsites/t/apps/forwardToInternalApp?client=allscripts&targetUrl=%2Fstore%... Page URL
https://idp.workhuman.com/sp/startSSO.ping?PartnerIdpId=https://sts.windows.net/759f9e8b-cf6d-4ef2-b0b... Page URL
https://login.microsoftonline.com/759f9e8b-cf6d-4ef2-b0bc-dd4bdf1e7c56/saml2 Page URL
https://login.microsoftonline.com/759f9e8b-cf6d-4ef2-b0bc-dd4bdf1e7c56/saml2?sso_reload=true Page URL

Detected technologies

Optimizely (Analytics) Expand

Overall confidence: 100%
Detected patterns

optimizely\.com.*\.js

Page Statistics

27
Requests

100 %
HTTPS

60 %
IPv6

9
Domains

12
Subdomains

9
IPs

4
Countries

886 kB
Transfer

2813 kB
Size

19
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.microsoft.com/de-DE/servicesagreement/
Title: Nutzungsbedingungen

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/de-DE/privacystatement
Title: Datenschutz und Cookies

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/de-de/corporate/rechtliche-hinweise/impressum.aspx
Title: Haftungsausschluss

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://click1.workhuman.com/e/c/eyJlbWFpbF9pZCI6ImRnVHp0QVlBQU4yMHlRWGN0TWtGQVpBWGVuQlRnWERtbFJ3WEFGQzlPdz09IiwiaHJlZiI6Imh0dHBzOi8vY2xvdWQud29ya2h1bWFuLmNvbS9zdG9yZS8_dXRtX3NvdXJjZT1jaW9cdTAwMjZ1dG1fbWVkaXVtPWVtYWlsXHUwMDI2dXRtX2NhbXBhaWduPUF1dG9tYXRpb25fUmVjX1dlbGNvbWVfTmV3X0hpcmVfdjNfUkVDMjMtMDA4XHUwMDI2dXRtX2NvbnRlbnQ9RW1haWwlMjAzJTIwLSUyMFJlZGVtcHRpb24lMjAtJTIwTWVyY2glMjAtJTIwTm8lMjBCYWxhbmNlX190eHQxIyFhbGxzY3JpcHRzIiwiaW50ZXJuYWwiOiJmM2I0MDY4NTAzZWM5MDAxZGRiNGM5MDUifQ/c10d793d6d10564b18cfc20c87f64bb64cbc7bd4cf3b3508825502e889a05da0 HTTP 302
https://cloud.workhuman.com/store/?utm_source=cio&utm_medium=email&utm_campaign=Automation_Rec_Welcome_New_Hire_v3_REC23-008&utm_content=Email%203%20-%20Redemption%20-%20Merch%20-%20No%20Balance__txt1 Page URL
https://cloud.workhuman.com/microsites/t/apps/forwardToInternalApp?client=allscripts&targetUrl=%2Fstore%2F%3Futm_source%3Dcio%26utm_medium%3Demail%26utm_campaign%3DAutomation_Rec_Welcome_New_Hire_v3_REC23-008%26utm_content%3DEmail%25203%2520-%2520Redemption%2520-%2520Merch%2520-%2520No%2520Balance__txt1%23%2Fallscripts Page URL
https://idp.workhuman.com/sp/startSSO.ping?PartnerIdpId=https://sts.windows.net/759f9e8b-cf6d-4ef2-b0bc-dd4bdf1e7c56/&TARGET=https%3A%2F%2Fcloud.workhuman.com%2Fmicrosites%2Fmotivation%2FSSOEntryPoint%3Fclient%3Dallscripts%26TARGET%3D Page URL
https://login.microsoftonline.com/759f9e8b-cf6d-4ef2-b0bc-dd4bdf1e7c56/saml2 Page URL
https://login.microsoftonline.com/759f9e8b-cf6d-4ef2-b0bc-dd4bdf1e7c56/saml2?sso_reload=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://click1.workhuman.com/e/c/eyJlbWFpbF9pZCI6ImRnVHp0QVlBQU4yMHlRWGN0TWtGQVpBWGVuQlRnWERtbFJ3WEFGQzlPdz09IiwiaHJlZiI6Imh0dHBzOi8vY2xvdWQud29ya2h1bWFuLmNvbS9zdG9yZS8_dXRtX3NvdXJjZT1jaW9cdTAwMjZ1dG1fbWVkaXVtPWVtYWlsXHUwMDI2dXRtX2NhbXBhaWduPUF1dG9tYXRpb25fUmVjX1dlbGNvbWVfTmV3X0hpcmVfdjNfUkVDMjMtMDA4XHUwMDI2dXRtX2NvbnRlbnQ9RW1haWwlMjAzJTIwLSUyMFJlZGVtcHRpb24lMjAtJTIwTWVyY2glMjAtJTIwTm8lMjBCYWxhbmNlX190eHQxIyFhbGxzY3JpcHRzIiwiaW50ZXJuYWwiOiJmM2I0MDY4NTAzZWM5MDAxZGRiNGM5MDUifQ/c10d793d6d10564b18cfc20c87f64bb64cbc7bd4cf3b3508825502e889a05da0 HTTP 302
https://cloud.workhuman.com/store/?utm_source=cio&utm_medium=email&utm_campaign=Automation_Rec_Welcome_New_Hire_v3_REC23-008&utm_content=Email%203%20-%20Redemption%20-%20Merch%20-%20No%20Balance__txt1

27 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
cloud.workhuman.com/store/
Redirect Chain

https://click1.workhuman.com/e/c/eyJlbWFpbF9pZCI6ImRnVHp0QVlBQU4yMHlRWGN0TWtGQVpBWGVuQlRnWERtbFJ3WEFGQzlPdz09IiwiaHJlZiI6Imh0dHBzOi8vY2xvdWQud29ya2h1bWFuLmNvbS9zdG9yZS8_dXRtX3NvdXJjZT1jaW9cdTAwMjZ1...
https://cloud.workhuman.com/store/?utm_source=cio&utm_medium=email&utm_campaign=Automation_Rec_Welcome_New_Hire_v3_REC23-008&utm_content=Email%203%20-%20Redemption%20-%20Merch%20-%20No%20Balance__txt1

5 KB
2 KB

565ms
474ms

Document
text/html

3.161.82.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cloud.workhuman.com/store/?utm_source=cio&utm_medium=email&utm_campaign=Automation_Rec_Welcome_New_Hire_v3_REC23-008&utm_content=Email%203%20-%20Redemption%20-%20Merch%20-%20No%20Balance__txt1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-96.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a1c310bb179f9ee07bfdabae6a2e7258c9cfcc1d1f432278ccb1857ea77ca2f1

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: max-age=0
content-encoding: br
content-type: text/html
date: Fri, 21 Jun 2024 04:30:58 GMT
etag: W/"c68894d3e3f52ab6d55e80847ff622b3"
last-modified: Mon, 17 Jun 2024 07:40:50 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 5d59ec457bae9e2b9df45a357eeeffd2.cloudfront.net (CloudFront)
x-amz-cf-id: lJhNqyofjRy5EgRN4p-YZWdQyIme-uzsAtlPQ3qFo6dDFtEfcJUKOQ==
x-amz-cf-pop: FRA56-P10
x-amz-id-2: kSbpCQPI9Rc/men85LisRzAaX4f5itA+7vRubeywmIHje2MwutUPJQGT2HhaJ7UVLwxriwjOCv8=
x-amz-request-id: 2QCX4ECB08MSN6KB
x-amz-server-side-encryption: AES256
x-amz-version-id: qIy887K3yZl5FFzYqB3sfgMMII28gJAE
x-cache: RefreshHit from cloudfront

Redirect headers

access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-length: 0
date: Fri, 21 Jun 2024 04:30:56 GMT
location: https://cloud.workhuman.com/store/?utm_source=cio&utm_medium=email&utm_campaign=Automation_Rec_Welcome_New_Hire_v3_REC23-008&utm_content=Email%203%20-%20Redemption%20-%20Merch%20-%20No%20Balance__txt1#!allscripts
via: 1.1 google, 1.1 fa87f2173bfe5d35fd73cec71ab12a32.cloudfront.net (CloudFront)
x-amz-cf-id: g1OFQW4AeLA4QWc6qz_KpRekVlqLIxH69EY3yhcprtU2nm9MnN24Tg==
x-amz-cf-pop: FRA56-P7
x-cache: Miss from cloudfront

GET
H2 200 16969570298.js Show response
cdn.optimizely.com/js/ 291 KB
89 KB 163ms
54ms Script
text/javascript 2a02:26f0:3500:88e::13b8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.optimizely.com/js/16969570298.js

Requested by

Host: cloud.workhuman.com
URL: https://cloud.workhuman.com/store/?utm_source=cio&utm_medium=email&utm_campaign=Automation_Rec_Welcome_New_Hire_v3_REC23-008&utm_content=Email%203%20-%20Redemption%20-%20Merch%20-%20No%20Balance__txt1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:88e::13b8 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AmazonS3 /

Resource Hash

d769b53f88f76cead15659b3d35f69de84e91d99aed129868d307eccbf559784

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://cloud.workhuman.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-meta-pci_enabled: False
x-amz-version-id: Ar_vx7H.TqafzdeZV2IVsHMiEjLPEZIf
content-encoding: gzip
date: Fri, 21 Jun 2024 04:30:57 GMT
strict-transport-security: max-age=15768000
x-amz-request-id: EQW4K0QWJVQCPNB8
x-amz-server-side-encryption: AES256
x-amz-meta-revision: 6949
x-amz-replication-status: PENDING
server-timing: cdn-cache; desc=HIT, edge; dur=5, origin; dur=0, cdn;desc="AkamaiION";dur=0,rtt;desc="38";dur=0,cdnip;desc="2a02:26f0:3500:88e::13b8";dur=0,cdnmap;desc="a5048.dsca.akamaiedge.net";dur=0,proto;desc="h2";dur=0, ak_p; desc="1718944257551_388276626_3827896035_553_1568_38_49_146";dur=1
content-length: 90543
x-amz-id-2: VGx+mV4+2RfO4WEBvf6qnIutuTddUVOfLS4qE96H5Q/WdhMmejJohYJsqBte43B4duNDTm4sxEc=
last-modified: Wed, 12 Jun 2024 14:46:14 GMT
server: AmazonS3
etag: "83932c9c03e3e0ef04cb71c8037141e0"
vary: Accept-Encoding
access-control-max-age: 86400
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
access-control-expose-headers: x-amz-meta-revision
cache-control: max-age=120
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: *

GET
H2 200 main.c83601be.js Show response
cloud.workhuman.com/store/static/js/ 1 MB
303 KB 70ms
70ms Script
application/javascript 3.161.82.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cloud.workhuman.com/store/static/js/main.c83601be.js
Requested by: Host: cloud.workhuman.com
URL: https://cloud.workhuman.com/store/?utm_source=cio&utm_medium=email&utm_campaign=Automation_Rec_Welcome_New_Hire_v3_REC23-008&utm_content=Email%203%20-%20Redemption%20-%20Merch%20-%20No%20Balance__txt1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-96.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 436cabd0ad9c329d0e5ddf738a3900dce25af815391c1e77040455c987aff059

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://cloud.workhuman.com/store/?utm_source=cio&utm_medium=email&utm_campaign=Automation_Rec_Welcome_New_Hire_v3_REC23-008&utm_content=Email%203%20-%20Redemption%20-%20Merch%20-%20No%20Balance__txt1
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: 85EEERomV4WnaGRwDZv9V89mF2F5m59M
content-encoding: br
via: 1.1 5d59ec457bae9e2b9df45a357eeeffd2.cloudfront.net (CloudFront)
date: Thu, 20 Jun 2024 07:40:55 GMT
x-amz-request-id: KQ5B4MQ49JRDDB8P
x-amz-cf-pop: FRA56-P10
x-amz-server-side-encryption: AES256
age: 75003
x-cache: Hit from cloudfront
x-amz-id-2: jDiomZBZduu5kO/seoaV/gRDd+oQmM0x3Dh4pZKm+6cJm8c2i6mmi2GwsRe/OHTz0wjqlw1M8EY=
last-modified: Mon, 17 Jun 2024 07:40:51 GMT
server: AmazonS3
etag: W/"18d8dc5582b573b7f093ffab92d09a9b"
vary: Accept-Encoding
content-type: application/javascript
x-amz-cf-id: P-tigELhpoTnWQLc5_wwLKBMXE2TS2wpCwhzvMNlXvVhBpWwG3zRZA==

GET
H2 200 main.61f6cc50.css
cloud.workhuman.com/store/static/css/ 146 KB
29 KB 195ms
195ms Stylesheet
text/css 3.161.82.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cloud.workhuman.com/store/static/css/main.61f6cc50.css
Requested by: Host: cloud.workhuman.com
URL: https://cloud.workhuman.com/store/?utm_source=cio&utm_medium=email&utm_campaign=Automation_Rec_Welcome_New_Hire_v3_REC23-008&utm_content=Email%203%20-%20Redemption%20-%20Merch%20-%20No%20Balance__txt1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.82.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-82-96.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a2c1e11873b5b4850a8075b28c33c3d472ccab0b0d26f49a8a053a3d402b43c3

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://cloud.workhuman.com/store/?utm_source=cio&utm_medium=email&utm_campaign=Automation_Rec_Welcome_New_Hire_v3_REC23-008&utm_content=Email%203%20-%20Redemption%20-%20Merch%20-%20No%20Balance__txt1
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: VIiEj_9ZC93nCdxCVXOnm8MFuk4jq_bU
content-encoding: br
via: 1.1 5d59ec457bae9e2b9df45a357eeeffd2.cloudfront.net (CloudFront)
date: Thu, 20 Jun 2024 07:40:55 GMT
x-amz-request-id: KQ504XMA715118D2
x-amz-cf-pop: FRA56-P10
x-amz-server-side-encryption: AES256
age: 75003
x-cache: Hit from cloudfront
x-amz-id-2: PskvhThHUFbKD82PtzkO7mPDUfdmDNThYwKNNeFJO69Y0IT+QZCknNghdcLSc5rId2jJRoHyBr8=
last-modified: Mon, 17 Jun 2024 07:40:51 GMT
server: AmazonS3
etag: W/"d1442383e123f1cdff91a3cc96f99e4c"
vary: Accept-Encoding
content-type: text/css
x-amz-cf-id: hixDqrTw5s9_dqJXwXusxx1ZWZS6X30jrem8av2FssYEMqAeE_X5rg==

GET
H2 200 css2
fonts.googleapis.com/ 9 KB
1 KB 136ms
48ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto+Slab:wght@400;700&family=Roboto:wght@400;700&display=swap

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

80b51eb98df76e4f9d7dd4e13ee821497cdb52835b67b74defb5a723b3ea13b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://cloud.workhuman.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Fri, 21 Jun 2024 04:30:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 21 Jun 2024 04:30:57 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 21 Jun 2024 04:30:57 GMT

GET
H2 200 BngMUXZYTXPIvIBgJJSb6ufN5qU.woff2
fonts.gstatic.com/s/robotoslab/v34/ 34 KB
34 KB 142ms
50ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotoslab/v34/BngMUXZYTXPIvIBgJJSb6ufN5qU.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto+Slab:wght@400;700&family=Roboto:wght@400;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a8e429611131e3fdc2018ec943a36100dbabb4aaa788c8dead6bdcf927917293

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://cloud.workhuman.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 02:18:34 GMT
x-content-type-options: nosniff
age: 267143
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34328
x-xss-protection: 0
last-modified: Tue, 24 Oct 2023 01:54:50 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Jun 2025 02:18:34 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 131ms
39ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto+Slab:wght@400;700&family=Roboto:wght@400;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://cloud.workhuman.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 14:48:09 GMT
x-content-type-options: nosniff
age: 222168
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Jun 2025 14:48:09 GMT

GET
H2 200 a15928870500.html
a15928870500.cdn.optimizely.com/client_storage/ Frame 336E 0
0 154ms
48ms Document
text/html 2.17.191.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://a15928870500.cdn.optimizely.com/client_storage/a15928870500.html

Requested by

Host: cdn.optimizely.com
URL: https://cdn.optimizely.com/js/16969570298.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2.17.191.240 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-17-191-240.deploy.static.akamaitechnologies.com

Software

AmazonS3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://cloud.workhuman.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ranges: bytes
cache-control: max-age=120
content-encoding: gzip
content-length: 878
content-type: text/html; charset=utf-8
date: Fri, 21 Jun 2024 04:30:57 GMT
etag: "e3cc8b11bc9f7f85065d1b3caba39b1b"
last-modified: Fri, 21 Jun 2024 04:07:04 GMT
server: AmazonS3
server-timing: cdn-cache; desc=HIT edge; dur=6 origin; dur=0 cdn;desc="AkamaiION";dur=0,rtt;desc="38";dur=0,cdnip;desc="2.17.191.240";dur=0,cdnmap;desc="a4343.a.akamaiedge.net";dur=0,proto;desc="h2";dur=0 ak_p; desc="1718944257858_34901878_10693678_571_1560_38_44_255";dur=1
strict-transport-security: max-age=15768000
vary: Accept-Encoding
x-akamai-transformed: 9 878 0 pmb=mRUM,2
x-amz-id-2: uG9jLjFamf8xhQuRHvj8f7kpFk2SJHlydoUUZ4IgPe6nJa/rP0g//Owfz3WFrK+k9YCHKlZJguOBJRpyd+dCsoi2pe/E9Kbu
x-amz-meta-pci_enabled: False
x-amz-replication-status: COMPLETED
x-amz-request-id: 7HTEZS4ESXDSAJ7T
x-amz-server-side-encryption: AES256
x-amz-version-id: NkwgCEHkJgbQnhKfX1HG.eViyr0u1e5v

GET
H2 500 userSessionAuthToken
cloud.workhuman.com/microsites/login/ 91 B
1 KB 173ms
173ms XHR
application/json 3.161.82.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cloud.workhuman.com/microsites/login/userSessionAuthToken

Requested by

Host: cloud.workhuman.com
URL: https://cloud.workhuman.com/store/static/js/main.c83601be.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.161.82.96 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-161-82-96.fra56.r.cloudfront.net

Software

Apache /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' *.quicksight.aws.amazon.com outlook.office365.com outlook.office.com teams.microsoft.com.mcas.ms teams.microsoft.com; report-uri https://68cebcfc7e2f58b08b59066f1.report-uri.com/r/d/csp/enforce
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept: application/json, text/plain, */*
Referer: https://cloud.workhuman.com/store/?utm_source=cio&utm_medium=email&utm_campaign=Automation_Rec_Welcome_New_Hire_v3_REC23-008&utm_content=Email%203%20-%20Redemption%20-%20Merch%20-%20No%20Balance__txt1
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 21 Jun 2024 04:30:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.quicksight.aws.amazon.com outlook.office365.com outlook.office.com teams.microsoft.com.mcas.ms teams.microsoft.com; report-uri https://68cebcfc7e2f58b08b59066f1.report-uri.com/r/d/csp/enforce
via: 1.1 5d59ec457bae9e2b9df45a357eeeffd2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P10
x-cache: Error from cloudfront
content-length: 91
x-xss-protection: 1; mode=block
pragma: no-cache
server: Apache
content-type: application/json;charset=utf-8
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-robots-tag: noindex
x-amz-cf-id: ZhOg49nwfQ4IJC1d7ROQ-6t0R0_SWZbPS77E3GsKJO-Yq1OJVIL3Mg==
expires: Sat, 6 May 1995 12:00:00 GMT

GET
H2 200 favicon.ico
cloud.workhuman.com/ 300 B
925 B 52ms
52ms Other
image/x-ico 3.161.82.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cloud.workhuman.com/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.161.82.96 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-161-82-96.fra56.r.cloudfront.net

Software

Apache /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' *.quicksight.aws.amazon.com outlook.office365.com outlook.office.com teams.microsoft.com.mcas.ms teams.microsoft.com; report-uri https://68cebcfc7e2f58b08b59066f1.report-uri.com/r/d/csp/enforce
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://cloud.workhuman.com/store/?utm_source=cio&utm_medium=email&utm_campaign=Automation_Rec_Welcome_New_Hire_v3_REC23-008&utm_content=Email%203%20-%20Redemption%20-%20Merch%20-%20No%20Balance__txt1
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 20 Jun 2024 05:01:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.quicksight.aws.amazon.com outlook.office365.com outlook.office.com teams.microsoft.com.mcas.ms teams.microsoft.com; report-uri https://68cebcfc7e2f58b08b59066f1.report-uri.com/r/d/csp/enforce
via: 1.1 5d59ec457bae9e2b9df45a357eeeffd2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P10
age: 84555
x-cache: Hit from cloudfront
content-length: 300
x-xss-protection: 1; mode=block
last-modified: Mon, 17 Jun 2024 20:39:18 GMT
server: Apache
etag: "12c-61b1bf58d2980"
content-type: image/x-ico
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: noindex
x-amz-cf-id: JKViR7ZCWBWjmQIsh0uiic4soSZnbmnK3l1hIMWG2hBvDuWHFAW04A==

GET
H2 200 forwardToInternalApp Show response
cloud.workhuman.com/microsites/t/apps/ 646 B
2 KB 232ms
231ms Document
text/html 3.161.82.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cloud.workhuman.com/microsites/t/apps/forwardToInternalApp?client=allscripts&targetUrl=%2Fstore%2F%3Futm_source%3Dcio%26utm_medium%3Demail%26utm_campaign%3DAutomation_Rec_Welcome_New_Hire_v3_REC23-008%26utm_content%3DEmail%25203%2520-%2520Redemption%2520-%2520Merch%2520-%2520No%2520Balance__txt1%23%2Fallscripts

Requested by

Host: cloud.workhuman.com
URL: https://cloud.workhuman.com/store/static/js/main.c83601be.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.161.82.96 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-161-82-96.fra56.r.cloudfront.net

Software

Apache /

Resource Hash

827ab7fc325db6ee87f3f6de2751537f5c4fd0af99b4529d67c6d14550b60cb7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' *.quicksight.aws.amazon.com outlook.office365.com outlook.office.com teams.microsoft.com.mcas.ms teams.microsoft.com; report-uri https://68cebcfc7e2f58b08b59066f1.report-uri.com/r/d/csp/enforce
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://cloud.workhuman.com/store/?utm_source=cio&utm_medium=email&utm_campaign=Automation_Rec_Welcome_New_Hire_v3_REC23-008&utm_content=Email%203%20-%20Redemption%20-%20Merch%20-%20No%20Balance__txt1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 646
content-security-policy: frame-ancestors 'self' *.quicksight.aws.amazon.com outlook.office365.com outlook.office.com teams.microsoft.com.mcas.ms teams.microsoft.com; report-uri https://68cebcfc7e2f58b08b59066f1.report-uri.com/r/d/csp/enforce
content-type: text/html;charset=ISO-8859-1
date: Fri, 21 Jun 2024 04:30:58 GMT
expires: 01 Apr 1995 01:10:10 GMT
pragma: no-cache
server: Apache
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 5d59ec457bae9e2b9df45a357eeeffd2.cloudfront.net (CloudFront)
x-amz-cf-id: Un7ZulECNSj34gGwQT6j6HkSR_VMUrH91WU2Kg_VFZ9AFzwAcMAf_A==
x-amz-cf-pop: FRA56-P10
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-robots-tag: noindex
x-xss-protection: 1; mode=block

POST
H2 200 startSSO.ping Show response
idp.workhuman.com/sp/ 1 KB
2 KB 381ms
363ms Document
text/html 3.161.82.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://idp.workhuman.com/sp/startSSO.ping?PartnerIdpId=https://sts.windows.net/759f9e8b-cf6d-4ef2-b0bc-dd4bdf1e7c56/&TARGET=https%3A%2F%2Fcloud.workhuman.com%2Fmicrosites%2Fmotivation%2FSSOEntryPoint%3Fclient%3Dallscripts%26TARGET%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.161.82.96 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-161-82-96.fra56.r.cloudfront.net

Software

Resource Hash

ba4683c3c73b625f118fae001687c193015267eb3ac2ae52308faed2888bfef2

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Content-Type: application/x-www-form-urlencoded
Origin: https://cloud.workhuman.com
Referer: https://cloud.workhuman.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: no-cache, no-store
content-length: 1364
content-type: text/html;charset=utf-8
date: Fri, 21 Jun 2024 04:30:58 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
referrer-policy: origin
via: 1.1 5d59ec457bae9e2b9df45a357eeeffd2.cloudfront.net (CloudFront)
x-amz-cf-id: LzMNhPPnFMvTtpqgapUGgWghbSNYABm3TTHoe0J69rVu1Hg-Y8j1cQ==
x-amz-cf-pop: FRA56-P10
x-cache: Miss from cloudfront
x-frame-options: SAMEORIGIN

GET
H2 200 favicon.ico
cloud.workhuman.com/ 300 B
0 0ms
0ms Other
image/x-ico 3.161.82.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cloud.workhuman.com/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.161.82.96 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-161-82-96.fra56.r.cloudfront.net

Software

Apache /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' *.quicksight.aws.amazon.com outlook.office365.com outlook.office.com teams.microsoft.com.mcas.ms teams.microsoft.com; report-uri https://68cebcfc7e2f58b08b59066f1.report-uri.com/r/d/csp/enforce
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://cloud.workhuman.com/microsites/t/apps/forwardToInternalApp?client=allscripts&targetUrl=%2Fstore%2F%3Futm_source%3Dcio%26utm_medium%3Demail%26utm_campaign%3DAutomation_Rec_Welcome_New_Hire_v3_REC23-008%26utm_content%3DEmail%25203%2520-%2520Redemption%2520-%2520Merch%2520-%2520No%2520Balance__txt1%23%2Fallscripts
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 20 Jun 2024 05:01:42 GMT
content-security-policy: frame-ancestors 'self' *.quicksight.aws.amazon.com outlook.office365.com outlook.office.com teams.microsoft.com.mcas.ms teams.microsoft.com; report-uri https://68cebcfc7e2f58b08b59066f1.report-uri.com/r/d/csp/enforce
x-content-type-options: nosniff
via: 1.1 5d59ec457bae9e2b9df45a357eeeffd2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P10
age: 84555
x-cache: Hit from cloudfront
content-length: 300
x-xss-protection: 1; mode=block
last-modified: Mon, 17 Jun 2024 20:39:18 GMT
server: Apache
etag: "12c-61b1bf58d2980"
content-type: image/x-ico
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: noindex
x-amz-cf-id: JKViR7ZCWBWjmQIsh0uiic4soSZnbmnK3l1hIMWG2hBvDuWHFAW04A==

POST
H/1.1 200
OK saml2 Show response
login.microsoftonline.com/759f9e8b-cf6d-4ef2-b0bc-dd4bdf1e7c56/ 20 KB
11 KB 558ms
365ms Document
text/html 2603:1026:3000:d0::
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.microsoftonline.com/759f9e8b-cf6d-4ef2-b0bc-dd4bdf1e7c56/saml2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2603:1026:3000:d0:: Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

bab01fd3f530deb371256cf74b6f5d41d8dbf01954fd5ac397955f831de9cf05

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Content-Type: application/x-www-form-urlencoded
Origin: https://idp.workhuman.com
Referer: https://idp.workhuman.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Cache-Control: no-store, no-cache
Content-Encoding: gzip
Content-Length: 9102
Content-Type: text/html; charset=utf-8
Date: Fri, 21 Jun 2024 04:30:59 GMT
Expires: -1
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]}
x-ms-ests-server: 2.1.18348.7 - SCUS ProdSlices
x-ms-request-id: c22363ff-76b0-42d4-8a65-5b79469e1f00
x-ms-srs: 1.P

GET
H2 200 favicon.ico
idp.workhuman.com/ 300 B
926 B 52ms
52ms Other
image/x-ico 3.161.82.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://idp.workhuman.com/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.161.82.96 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-161-82-96.fra56.r.cloudfront.net

Software

Apache /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' *.quicksight.aws.amazon.com outlook.office365.com outlook.office.com teams.microsoft.com.mcas.ms teams.microsoft.com; report-uri https://68cebcfc7e2f58b08b59066f1.report-uri.com/r/d/csp/enforce
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://idp.workhuman.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 20 Jun 2024 05:01:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self' *.quicksight.aws.amazon.com outlook.office365.com outlook.office.com teams.microsoft.com.mcas.ms teams.microsoft.com; report-uri https://68cebcfc7e2f58b08b59066f1.report-uri.com/r/d/csp/enforce
via: 1.1 5d59ec457bae9e2b9df45a357eeeffd2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P10
age: 84556
x-cache: Hit from cloudfront
content-length: 300
x-xss-protection: 1; mode=block
last-modified: Mon, 17 Jun 2024 20:39:18 GMT
server: Apache
etag: "12c-61b1bf58d2980"
content-type: image/x-ico
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: noindex
x-amz-cf-id: oexBTHbEnJeZMnSv7Gz-95KkCVYq-DB3mFPAMZHczOlfjNLH3fuRKw==

GET
H2 200 BssoInterrupt_Core_sw-M8KkV3_nBot-G1ImRcw2.js Show response
aadcdn.msauth.net/shared/1.0/content/js/ 138 KB
49 KB 226ms
77ms Script
application/x-javascript 2620:1ec:bdf::60
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msauth.net/shared/1.0/content/js/BssoInterrupt_Core_sw-M8KkV3_nBot-G1ImRcw2.js
Requested by: Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/759f9e8b-cf6d-4ef2-b0bc-dd4bdf1e7c56/saml2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::60 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 23804c857c0f312172654571928d8945eb9585b94f6d4be9c59a37eae054c0fd

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://login.microsoftonline.com/
Origin: https://login.microsoftonline.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 21 Jun 2024 04:30:59 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 4554691
content-length: 49696
x-ms-lease-status: unlocked
last-modified: Fri, 24 May 2024 22:13:21 GMT
etag: 0x8DC7C3EB8EDBF94
x-azure-ref: 20240621T043059Z-17d856f5577x4z6ncehp5ku95s000000039000000000nn9c
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 48af03e4-f01e-005d-645f-c259b6000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

POST
H/1.1 200
OK Primary Request saml2 Show response
login.microsoftonline.com/759f9e8b-cf6d-4ef2-b0bc-dd4bdf1e7c56/ 38 KB
16 KB 212ms
212ms Document
text/html 2603:1026:3000:d0::
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.microsoftonline.com/759f9e8b-cf6d-4ef2-b0bc-dd4bdf1e7c56/saml2?sso_reload=true

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2603:1026:3000:d0:: Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

df55039777fc9fb5d01907a9af7faf61d1cf228b5a368410e6e708e98daae622

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Content-Type: application/x-www-form-urlencoded
Origin: https://login.microsoftonline.com
Referer: https://login.microsoftonline.com/759f9e8b-cf6d-4ef2-b0bc-dd4bdf1e7c56/saml2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Cache-Control: no-store, no-cache
Content-Encoding: gzip
Content-Length: 14255
Content-Type: text/html; charset=utf-8
Date: Fri, 21 Jun 2024 04:30:59 GMT
Expires: -1
Link: <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msftauth.net>; rel=dns-prefetch,<https://aadcdn.msauth.net>; rel=dns-prefetch
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: on
X-Frame-Options: DENY
X-XSS-Protection: 0
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]}
x-ms-ests-server: 2.1.18348.7 - SCUS ProdSlices
x-ms-request-id: c22363ff-76b0-42d4-8a65-5b79549e1f00
x-ms-srs: 1.P

GET
H2 200 converged.v2.login.min_mc5ac6ol0l4d2iaqspstyg2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ 111 KB
20 KB 167ms
40ms Stylesheet
text/css 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_mc5ac6ol0l4d2iaqspstyg2.css
Requested by: Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/759f9e8b-cf6d-4ef2-b0bc-dd4bdf1e7c56/saml2?sso_reload=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4C8E) /
Resource Hash: 8b81b6dbb9af6502d78abe8a85d135861848e0597989901da42c62ecb841a07d

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://login.microsoftonline.com/
Origin: https://login.microsoftonline.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 21 Jun 2024 04:30:59 GMT
content-encoding: gzip
content-md5: Xt+D0D6ntnvS81Ry5DXRfg==
age: 2709643
x-cache: HIT
content-length: 20390
x-ms-lease-status: unlocked
last-modified: Thu, 16 May 2024 00:59:03 GMT
server: ECAcc (frc/4C8E)
etag: 0x8DC7543615A617D
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 20adcbed-001e-005b-2dee-aa1c02000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 ConvergedLogin_PCore_HynxqeZdtbyHDb4R-n7Odg2.js Show response
aadcdn.msftauth.net/shared/1.0/content/js/ 437 KB
119 KB 167ms
41ms Script
application/x-javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_HynxqeZdtbyHDb4R-n7Odg2.js
Requested by: Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/759f9e8b-cf6d-4ef2-b0bc-dd4bdf1e7c56/saml2?sso_reload=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CAF) /
Resource Hash: 88ae81949d2a30a87f03bb65424966f8d7e43ca03a4a6162788d999e68a7da1c

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://login.microsoftonline.com/
Origin: https://login.microsoftonline.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 21 Jun 2024 04:30:59 GMT
content-encoding: gzip
content-md5: 18ZWYPnf6mGxsQRNHmTkcw==
age: 1292260
x-cache: HIT
content-length: 121711
x-ms-lease-status: unlocked
last-modified: Thu, 30 May 2024 22:52:14 GMT
server: ECAcc (frc/4CAF)
etag: 0x8DC80FB2622B37C
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: ed486ad0-e01e-003d-1cd3-b7a42c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 ux.converged.login.strings-de.min_t2egxy3e-i7icwo0cfhacq2.js Show response
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ 61 KB
17 KB 245ms
119ms Script
application/x-javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-de.min_t2egxy3e-i7icwo0cfhacq2.js
Requested by: Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/759f9e8b-cf6d-4ef2-b0bc-dd4bdf1e7c56/saml2?sso_reload=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4C87) /
Resource Hash: 39b715d1182468688af4ed263098873e8e65bf3dd938ab51ac8fae81d8f04d3d

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://login.microsoftonline.com/
Origin: https://login.microsoftonline.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 21 Jun 2024 04:30:59 GMT
content-encoding: gzip
content-md5: hMQnnlZDgFUCnuSdMmb7Ag==
age: 1899401
x-cache: HIT
content-length: 17574
x-ms-lease-status: unlocked
last-modified: Wed, 29 May 2024 00:50:38 GMT
server: ECAcc (frc/4C87)
etag: 0x8DC7F795BADC172
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 6b9f72bd-901e-0032-444d-b22d33000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H/1.1 200
OK Me.htm
login.live.com/ 0
0 498ms
129ms Other
text/html 20.190.160.22
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.live.com/Me.htm?v=3
Requested by: Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/759f9e8b-cf6d-4ef2-b0bc-dd4bdf1e7c56/saml2?sso_reload=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.190.160.22 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://login.microsoftonline.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

GET
H2 200 convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js Show response
aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/ 219 KB
54 KB 361ms
42ms Script
application/x-javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js
Requested by: Host: aadcdn.msftauth.net
URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_HynxqeZdtbyHDb4R-n7Odg2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4C84) /
Resource Hash: 474ce0790ceb18a100cebaf1ac0915a51389fcae0830c3b44bfa1e365d40b2b4

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://login.microsoftonline.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 21 Jun 2024 04:31:00 GMT
content-encoding: gzip
content-md5: P5ihddUjL2Zb7/wjNS1xdg==
age: 6825411
x-cache: HIT
content-length: 54318
x-ms-lease-status: unlocked
last-modified: Thu, 28 Mar 2024 21:23:30 GMT
server: ECAcc (frc/4C84)
etag: 0x8DC4F6D50F3D2E7
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 0d451fae-201e-00dd-7d80-85b15b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 favicon
aadcdn.msftauthimages.net/dbd5a2dd-i-mmildvfltfs4lboqybskg6zhgp2pbfxug8ai8qjg8/logintenantbranding/0/ 3 KB
3 KB 357ms
43ms Other
image/* 2620:1ec:bdf::60
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauthimages.net/dbd5a2dd-i-mmildvfltfs4lboqybskg6zhgp2pbfxug8ai8qjg8/logintenantbranding/0/favicon?ts=638176166493025340
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::60 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: ef5195db22ba3dbfbc4d38eaba92bfe12bd1f7a037c16006c29804c104470622

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://login.microsoftonline.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 21 Jun 2024 04:31:00 GMT
x-cache: TCP_HIT
x-cache-info: L1_T2
x-fd-int-roxy-purgeid: 0
content-length: 2921
x-ms-lease-status: unlocked
last-modified: Thu, 20 Apr 2023 19:44:09 GMT
etag: 0x8DB41D79C44A068
x-azure-ref: 20240621T043100Z-17d856f55775txl8zetsgkg6cw00000003r00000000045x8
content-type: image/*
access-control-allow-origin: *
x-ms-request-id: 28f1272f-e01e-0070-447b-c3bea4000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 illustration
aadcdn.msftauthimages.net/dbd5a2dd-i-mmildvfltfs4lboqybskg6zhgp2pbfxug8ai8qjg8/logintenantbranding/0/ 70 KB
71 KB 90ms
89ms Image
image/* 2620:1ec:bdf::60
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauthimages.net/dbd5a2dd-i-mmildvfltfs4lboqybskg6zhgp2pbfxug8ai8qjg8/logintenantbranding/0/illustration?ts=638179342038297762
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::60 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 4e53931f27637b4e535bb69bf3adfcb0634962c06e6455eeb90758ee69ad568a

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://login.microsoftonline.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 21 Jun 2024 04:31:00 GMT
x-cache: TCP_HIT
x-cache-info: L1_T2
x-fd-int-roxy-purgeid: 50755578
content-length: 71783
x-ms-lease-status: unlocked
last-modified: Mon, 24 Apr 2023 11:56:44 GMT
etag: 0x8DB44BAF98D944F
x-azure-ref: 20240621T043100Z-17d856f55775txl8zetsgkg6cw00000003r00000000045xf
content-type: image/*
access-control-allow-origin: *
x-ms-request-id: 3ed1e0a7-c01e-0058-0d91-c3df0c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 bannerlogo
aadcdn.msftauthimages.net/dbd5a2dd-i-mmildvfltfs4lboqybskg6zhgp2pbfxug8ai8qjg8/logintenantbranding/0/ 9 KB
10 KB 49ms
49ms Image
image/* 2620:1ec:bdf::60
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauthimages.net/dbd5a2dd-i-mmildvfltfs4lboqybskg6zhgp2pbfxug8ai8qjg8/logintenantbranding/0/bannerlogo?ts=638176208709547766
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::60 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: cf50a5f7569ebe4607324b61b3bc378ad01c14bb6a68c18fbacb434650e8a199

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://login.microsoftonline.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 21 Jun 2024 04:31:00 GMT
x-cache: TCP_HIT
x-cache-info: L1_T2
x-fd-int-roxy-purgeid: 0
content-length: 9670
x-ms-lease-status: unlocked
last-modified: Thu, 20 Apr 2023 20:54:31 GMT
etag: 0x8DB41E17067D9F5
x-azure-ref: 20240621T043100Z-17d856f55775txl8zetsgkg6cw00000003r00000000045xg
content-type: image/*
access-control-allow-origin: *
x-ms-request-id: 97594366-801e-0049-5a7b-c345b8000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js Show response
aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/ 111 KB
35 KB 40ms
40ms Script
application/x-javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js
Requested by: Host: aadcdn.msftauth.net
URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_HynxqeZdtbyHDb4R-n7Odg2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4C9C) /
Resource Hash: 4be11c075187615adaf493d54cb7b05556e76806aed2b3b082d72952d0025be5

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://login.microsoftonline.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 21 Jun 2024 04:31:00 GMT
content-encoding: gzip
content-md5: /PcUcu/J5hSxDf1JmAX3KQ==
age: 6825410
x-cache: HIT
content-length: 35807
x-ms-lease-status: unlocked
last-modified: Thu, 28 Mar 2024 21:23:33 GMT
server: ECAcc (frc/4C9C)
etag: 0x8DC4F6D5254E400
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: af16a545-201e-00b5-6680-85ab68000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
aadcdn.msftauth.net/shared/1.0/content/images/ 2 KB
784 B 40ms
39ms Image
image/svg+xml 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CA2) /
Resource Hash: 8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://login.microsoftonline.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 21 Jun 2024 04:31:00 GMT
content-encoding: gzip
content-md5: R2FAVxfpONfnQAuxVxXbHg==
age: 7692661
x-cache: HIT
content-length: 621
x-ms-lease-status: unlocked
last-modified: Wed, 24 May 2023 10:11:52 GMT
server: ECAcc (frc/4CA2)
etag: 0x8DB5C3F4BB4F03C
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: cc0763e7-101e-0082-0a9c-7d5b77000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

Verdicts & Comments Add Verdict or Comment

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

19 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
cloud.workhuman.com/microsites	1970-01-21 06:14:40	Name: client Value: allscripts
.workhuman.com/	1970-01-21 01:48:16	Name: optimizelyEndUserId Value: oeu1718944257764r0.23273791791519716
cloud.workhuman.com/	1970-01-20 21:39:09	Name: AWSALB Value: N+SE+nTOZt+83eZT5IFcRnRpJWnEIwhSc5vkXKI06wKRrkKLIXibb7ISxcnh/TNZKS0aysFWluVY0N7KQP8piY2vSZXsXUDcJEs5RPDgtfVYmYJYLE+yOI+cEK3l
cloud.workhuman.com/	1970-01-20 21:39:09	Name: AWSALBCORS Value: N+SE+nTOZt+83eZT5IFcRnRpJWnEIwhSc5vkXKI06wKRrkKLIXibb7ISxcnh/TNZKS0aysFWluVY0N7KQP8piY2vSZXsXUDcJEs5RPDgtfVYmYJYLE+yOI+cEK3l
cloud.workhuman.com/	1970-01-21 06:14:40	Name: cf_client Value: allscripts
cloud.workhuman.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: CEBE0E7A6EA04DF34FF3BB523D5FF95C
idp.workhuman.com/	1969-12-31 23:59:59	Name: PF Value: 2vWpmK414GSDcOgc5N1tVs
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: esctx-0ydNGPmP3l0 Value: AQABCQEAAAApTwJmzXqdR4BN2miheQMYc3SQCCB3VOtU6OQ-GBDNDF5-zhbHn51RTFPqVU4x_Us5yr6_IcZDpMeMahXY7Jy7UoeWGnfYBN6LtmFYividX_iOhbGyznyhNb_Ygz0dOWwr75TkOlx0Z9waGkPOkXETyDC65pkks6UeElaeczUAoSAA
login.microsoftonline.com/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
login.microsoftonline.com/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: AADSSO Value: NA\|NoExtension
login.microsoftonline.com/	1970-01-20 21:29:04	Name: SSOCOOKIEPULLED Value: 1
login.microsoftonline.com/	1970-01-20 22:12:16	Name: buid Value: 0.AX0Ai56fdW3P8k6wvN1L3x58VqdrXc_rD3dAot1-l7zEXQ61AAA.AQABGgEAAAApTwJmzXqdR4BN2miheQMYNuS1CeHfv6O5bNkg3ZCV0PUQGl-Tros5PwbAjkklLeFUl2jeZppwpTbPldYwNvHs99nCyTlFBR2YSXYaNhqpYDNtz_F0P54QeCKspf-5LF8gAA
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: esctx Value: PAQABBwEAAAApTwJmzXqdR4BN2miheQMYGvRfgINHCW9Vh9_d3_IOCdwBlX46L-wGtLP3ffbSOecr3Guj-4bpfLxlPTr8tZz4xrNeucTVhx7Z6Is0M0Jd1ez_3Q2d96pB32ax0S10ByVa97-cnU44a5C3NiyOjhJdso5zDsjniY2AB4isgmK_3La2MjrWxZM8v9tf2jKtm9MgAA
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: esctx-jMux0m7Wwow Value: AQABCQEAAAApTwJmzXqdR4BN2miheQMYiNx4CxnekyszTltTayt_F-dv4AUSlhbt4rARh04bijGWtjZ8pl1pZqkX4zS3Ryh_PnCCSex6G02XEu-gI1My-S1rxwnM0kHoHUiDQL81OVjYFBIovq61lV1WnvHC2I7nILEPWCdHVtfwJjtWTSyb1iAA
login.microsoftonline.com/	1970-01-20 22:12:16	Name: fpc Value: AlZzhV1t-NlDsuYvUUdRrz4b5aMHAQAAAAL5Bt4OAAAA
.login.microsoftonline.com/	1970-01-21 06:50:40	Name: brcap Value: 0
.login.live.com/	1969-12-31 23:59:59	Name: uaid Value: 5a5b5c0b98c742efabda50c4b54a55a8
.login.live.com/	1969-12-31 23:59:59	Name: MSPRequ Value: id=N&lt=1718944260&co=1

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://cloud.workhuman.com/microsites/login/userSessionAuthToken Message: Failed to load resource: the server responded with a status of 500 ()
recommendation	verbose	URL: https://login.microsoftonline.com/759f9e8b-cf6d-4ef2-b0bc-dd4bdf1e7c56/saml2?sso_reload=true Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a15928870500.cdn.optimizely.com
aadcdn.msauth.net
aadcdn.msftauth.net
aadcdn.msftauthimages.net
cdn.optimizely.com
click1.workhuman.com
cloud.workhuman.com
fonts.googleapis.com
fonts.gstatic.com
idp.workhuman.com
login.live.com
login.microsoftonline.com
108.138.26.115
2.17.191.240
20.190.160.22
2603:1026:3000:d0::
2606:2800:233:1cb7:261b:1f9c:2074:3c
2620:1ec:bdf::60
2a00:1450:4001:813::2003
2a00:1450:4001:829::200a
2a02:26f0:3500:88e::13b8
3.161.82.96
23804c857c0f312172654571928d8945eb9585b94f6d4be9c59a37eae054c0fd
39b715d1182468688af4ed263098873e8e65bf3dd938ab51ac8fae81d8f04d3d
436cabd0ad9c329d0e5ddf738a3900dce25af815391c1e77040455c987aff059
474ce0790ceb18a100cebaf1ac0915a51389fcae0830c3b44bfa1e365d40b2b4
4be11c075187615adaf493d54cb7b05556e76806aed2b3b082d72952d0025be5
4e53931f27637b4e535bb69bf3adfcb0634962c06e6455eeb90758ee69ad568a
80b51eb98df76e4f9d7dd4e13ee821497cdb52835b67b74defb5a723b3ea13b6
827ab7fc325db6ee87f3f6de2751537f5c4fd0af99b4529d67c6d14550b60cb7
88ae81949d2a30a87f03bb65424966f8d7e43ca03a4a6162788d999e68a7da1c
8b81b6dbb9af6502d78abe8a85d135861848e0597989901da42c62ecb841a07d
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
a1c310bb179f9ee07bfdabae6a2e7258c9cfcc1d1f432278ccb1857ea77ca2f1
a2c1e11873b5b4850a8075b28c33c3d472ccab0b0d26f49a8a053a3d402b43c3
a8e429611131e3fdc2018ec943a36100dbabb4aaa788c8dead6bdcf927917293
ba4683c3c73b625f118fae001687c193015267eb3ac2ae52308faed2888bfef2
bab01fd3f530deb371256cf74b6f5d41d8dbf01954fd5ac397955f831de9cf05
cf50a5f7569ebe4607324b61b3bc378ad01c14bb6a68c18fbacb434650e8a199
d769b53f88f76cead15659b3d35f69de84e91d99aed129868d307eccbf559784
df55039777fc9fb5d01907a9af7faf61d1cf228b5a368410e6e708e98daae622
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef5195db22ba3dbfbc4d38eaba92bfe12bd1f7a037c16006c29804c104470622
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

login.microsoftonline.com Open in urlscan Pro 2603:1026:3000:d0:: Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

27 Requests

100 %HTTPS

60 %IPv6

9 Domains

12 Subdomains

9 IPs

4 Countries

886 kBTransfer

2813 kBSize

19 Cookies

3 Outgoing links

Page URL History

Redirected requests

27 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

23 JavaScript Global Variables

login.microsoftonline.com Open in urlscan Pro
2603:1026:3000:d0:: Public Scan

Screenshot
Live screenshot

Full Image

27
Requests

100 %
HTTPS

60 %
IPv6

9
Domains

12
Subdomains

9
IPs

4
Countries

886 kB
Transfer

2813 kB
Size

19
Cookies

27 HTTP transactions
0 data transactions