URL: https://testsso.phototag.app/
Submission: On October 27 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 17 HTTP transactions. The main IP is 35.230.180.219, located in Washington, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is testsso.phototag.app.
TLS certificate: Issued by R3 on October 27th 2023. Valid for: 3 months.
This is the only time testsso.phototag.app was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
13 35.230.180.219 396982 (GOOGLE-CL...)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
17 3
Apex Domain
Subdomains
Transfer
13 phototag.app
testsso.phototag.app
3 MB
3 gstatic.com
fonts.gstatic.com
157 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 31
1 KB
17 3
Domain Requested by
13 testsso.phototag.app testsso.phototag.app
3 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com testsso.phototag.app
17 3

This site contains no links.

Subject Issuer Validity Valid
testsso.phototag.app
R3
2023-10-27 -
2024-01-25
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2023-10-09 -
2024-01-01
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2023-10-09 -
2024-01-01
3 months crt.sh

This page contains 1 frames:

Primary Page: https://testsso.phototag.app/
Frame ID: 26EF9358FE1875C7021182A55B3DA25B
Requests: 17 HTTP requests in this frame

Screenshot

Page Title

PhotoTag

Detected technologies

Overall confidence: 100%
Detected patterns
  • <div data-app[^>]+class="v-application

Overall confidence: 100%
Detected patterns
  • <[^>]+\sdata-v(?:ue)?-

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

17
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

3708 kB
Transfer

3712 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
testsso.phototag.app/
696 B
955 B
Document
General
Full URL
https://testsso.phototag.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.230.180.219 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
219.180.230.35.bc.googleusercontent.com
Software
Caddy /
Resource Hash
a2238e1fbd89c6f61ca57564bd03a14e9b7533f3e8decc102e2ce33d438da508
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-eval' 'unsafe-inline' 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
content-length
696
content-security-policy
script-src 'unsafe-eval' 'unsafe-inline' 'self';
content-type
text/html; charset=utf-8
date
Fri, 27 Oct 2023 13:29:22 GMT
etag
"s33jncjc"
last-modified
Wed, 25 Oct 2023 18:06:48 GMT
referrer-policy
no-referrer-when-downgrade
server
Caddy
strict-transport-security
max-age=31536000; includeSubDomains
x-frame-options
SAMEORIGIN
css
fonts.googleapis.com/
9 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto:300,400,500,700|Material+Icons
Requested by
Host: testsso.phototag.app
URL: https://testsso.phototag.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
5ea2107bf656126005f1c080359c253eec21c21da412a7f6c8d1e7977ee3bda2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://testsso.phototag.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Fri, 27 Oct 2023 13:29:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 27 Oct 2023 13:29:22 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 27 Oct 2023 13:29:22 GMT
app.58de815117f1e9b9b226f90bb757b878.css
testsso.phototag.app/static/css/
831 KB
831 KB
Stylesheet
General
Full URL
https://testsso.phototag.app/static/css/app.58de815117f1e9b9b226f90bb757b878.css
Requested by
Host: testsso.phototag.app
URL: https://testsso.phototag.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.230.180.219 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
219.180.230.35.bc.googleusercontent.com
Software
Caddy /
Resource Hash
e45c336ad25e43b8748afb8c1ba2307ea900baa2dd374b2f548d21a2026fd89e
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-eval' 'unsafe-inline' 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://testsso.phototag.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-security-policy
script-src 'unsafe-eval' 'unsafe-inline' 'self';
strict-transport-security
max-age=31536000; includeSubDomains
referrer-policy
no-referrer-when-downgrade
date
Fri, 27 Oct 2023 13:29:22 GMT
last-modified
Wed, 25 Oct 2023 18:06:48 GMT
server
Caddy
etag
"s33jnci8k5"
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
accept-ranges
bytes
content-length
850901
manifest.625a04f2abef27d6b946.js
testsso.phototag.app/static/js/
1 KB
2 KB
Script
General
Full URL
https://testsso.phototag.app/static/js/manifest.625a04f2abef27d6b946.js
Requested by
Host: testsso.phototag.app
URL: https://testsso.phototag.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.230.180.219 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
219.180.230.35.bc.googleusercontent.com
Software
Caddy /
Resource Hash
b3a8bc12d93ad3e743a99cdeb18c61b86d4425b11f3dcebbc8cd50b29843852f
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-eval' 'unsafe-inline' 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://testsso.phototag.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-security-policy
script-src 'unsafe-eval' 'unsafe-inline' 'self';
strict-transport-security
max-age=31536000; includeSubDomains
referrer-policy
no-referrer-when-downgrade
date
Fri, 27 Oct 2023 13:29:22 GMT
last-modified
Wed, 25 Oct 2023 18:06:48 GMT
server
Caddy
etag
"s33jnc15z"
x-frame-options
SAMEORIGIN
content-type
application/javascript
accept-ranges
bytes
content-length
1511
vendor.d027943e5de5abc68185.js
testsso.phototag.app/static/js/
2 MB
2 MB
Script
General
Full URL
https://testsso.phototag.app/static/js/vendor.d027943e5de5abc68185.js
Requested by
Host: testsso.phototag.app
URL: https://testsso.phototag.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.230.180.219 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
219.180.230.35.bc.googleusercontent.com
Software
Caddy /
Resource Hash
656a6b1b7ae5b257fdf921a6e4eabf25668f1bc5228e88eb299e1f55a2128204
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-eval' 'unsafe-inline' 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://testsso.phototag.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-security-policy
script-src 'unsafe-eval' 'unsafe-inline' 'self';
strict-transport-security
max-age=31536000; includeSubDomains
referrer-policy
no-referrer-when-downgrade
date
Fri, 27 Oct 2023 13:29:22 GMT
last-modified
Wed, 25 Oct 2023 18:06:48 GMT
server
Caddy
etag
"s33jnc1b90y"
x-frame-options
SAMEORIGIN
content-type
application/javascript
accept-ranges
bytes
content-length
2204530
app.ac039ee207684738b5fc.js
testsso.phototag.app/static/js/
165 KB
165 KB
Script
General
Full URL
https://testsso.phototag.app/static/js/app.ac039ee207684738b5fc.js
Requested by
Host: testsso.phototag.app
URL: https://testsso.phototag.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.230.180.219 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
219.180.230.35.bc.googleusercontent.com
Software
Caddy /
Resource Hash
cfd70de5e4d22893ed03217ccf21a304f3de46fc1ae6ddb7e1e4c2d553b3cf35
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-eval' 'unsafe-inline' 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://testsso.phototag.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-security-policy
script-src 'unsafe-eval' 'unsafe-inline' 'self';
strict-transport-security
max-age=31536000; includeSubDomains
referrer-policy
no-referrer-when-downgrade
date
Fri, 27 Oct 2023 13:29:22 GMT
last-modified
Wed, 25 Oct 2023 18:06:48 GMT
server
Caddy
etag
"s33jnc3m9v"
x-frame-options
SAMEORIGIN
content-type
application/javascript
accept-ranges
bytes
content-length
168835
flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2
fonts.gstatic.com/s/materialicons/v140/
125 KB
126 KB
Font
General
Full URL
https://fonts.gstatic.com/s/materialicons/v140/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700|Material+Icons
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://testsso.phototag.app
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Tue, 24 Oct 2023 09:56:40 GMT
x-content-type-options
nosniff
age
271963
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
128352
x-xss-protection
0
last-modified
Tue, 07 Mar 2023 19:51:56 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 23 Oct 2024 09:56:40 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/
16 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700|Material+Icons
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://testsso.phototag.app
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Thu, 26 Oct 2023 18:20:08 GMT
x-content-type-options
nosniff
age
68955
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15920
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:45 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 25 Oct 2024 18:20:08 GMT
materialdesignicons-webfont.66e43f0.woff2
testsso.phototag.app/static/fonts/
373 KB
373 KB
Font
General
Full URL
https://testsso.phototag.app/static/fonts/materialdesignicons-webfont.66e43f0.woff2
Requested by
Host: testsso.phototag.app
URL: https://testsso.phototag.app/static/css/app.58de815117f1e9b9b226f90bb757b878.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.230.180.219 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
219.180.230.35.bc.googleusercontent.com
Software
Caddy /
Resource Hash
633d596f7288835ff04eba1105f41cf6fe5c9ffed41f2cb20a3f00fb035c0c8b
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-eval' 'unsafe-inline' 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://testsso.phototag.app/static/css/app.58de815117f1e9b9b226f90bb757b878.css
Origin
https://testsso.phototag.app
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-security-policy
script-src 'unsafe-eval' 'unsafe-inline' 'self';
strict-transport-security
max-age=31536000; includeSubDomains
referrer-policy
no-referrer-when-downgrade
date
Fri, 27 Oct 2023 13:29:23 GMT
last-modified
Wed, 25 Oct 2023 18:06:48 GMT
server
Caddy
etag
"s33jnc86ig"
x-frame-options
SAMEORIGIN
content-type
font/woff2
accept-ranges
bytes
content-length
381688
me
testsso.phototag.app/api/users/
9 B
37 B
XHR
General
Full URL
https://testsso.phototag.app/api/users/me
Requested by
Host: testsso.phototag.app
URL: https://testsso.phototag.app/static/js/vendor.d027943e5de5abc68185.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.230.180.219 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
219.180.230.35.bc.googleusercontent.com
Software
Caddy /
Resource Hash
cdb3c88c2e8d457126297f70184537d9f6fc0b3039f2f48c313ba77d758ff654
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-eval' 'unsafe-inline' 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Accept
application/json, text/plain, */*
Referer
https://testsso.phototag.app/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-security-policy
script-src 'unsafe-eval' 'unsafe-inline' 'self';
date
Fri, 27 Oct 2023 13:29:23 GMT
referrer-policy
no-referrer-when-downgrade
strict-transport-security
max-age=31536000; includeSubDomains
server
Caddy
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
content-type
text/plain; charset=utf-8
content-length
9
image-categories
testsso.phototag.app/api/
9 B
84 B
XHR
General
Full URL
https://testsso.phototag.app/api/image-categories
Requested by
Host: testsso.phototag.app
URL: https://testsso.phototag.app/static/js/vendor.d027943e5de5abc68185.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.230.180.219 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
219.180.230.35.bc.googleusercontent.com
Software
Caddy /
Resource Hash
cdb3c88c2e8d457126297f70184537d9f6fc0b3039f2f48c313ba77d758ff654
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-eval' 'unsafe-inline' 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Accept
application/json, text/plain, */*
Referer
https://testsso.phototag.app/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-security-policy
script-src 'unsafe-eval' 'unsafe-inline' 'self';
date
Fri, 27 Oct 2023 13:29:23 GMT
referrer-policy
no-referrer-when-downgrade
strict-transport-security
max-age=31536000; includeSubDomains
server
Caddy
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
content-type
text/plain; charset=utf-8
content-length
9
available
testsso.phototag.app/auth/okta/
0
19 B
XHR
General
Full URL
https://testsso.phototag.app/auth/okta/available
Requested by
Host: testsso.phototag.app
URL: https://testsso.phototag.app/static/js/vendor.d027943e5de5abc68185.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.230.180.219 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
219.180.230.35.bc.googleusercontent.com
Software
Caddy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-eval' 'unsafe-inline' 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

Accept
application/json, text/plain, */*
Referer
https://testsso.phototag.app/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-security-policy
script-src 'unsafe-eval' 'unsafe-inline' 'self';
date
Fri, 27 Oct 2023 13:29:23 GMT
referrer-policy
no-referrer-when-downgrade
strict-transport-security
max-age=31536000; includeSubDomains
server
Caddy
content-length
0
x-frame-options
SAMEORIGIN
logo.png
testsso.phototag.app/static/
11 KB
12 KB
Image
General
Full URL
https://testsso.phototag.app/static/logo.png
Requested by
Host: testsso.phototag.app
URL: https://testsso.phototag.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.230.180.219 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
219.180.230.35.bc.googleusercontent.com
Software
Caddy /
Resource Hash
a18f84c74eeb13e7db412d522e10151b7544b8761769800f9d47f24b79dcd316
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-eval' 'unsafe-inline' 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://testsso.phototag.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-security-policy
script-src 'unsafe-eval' 'unsafe-inline' 'self';
strict-transport-security
max-age=31536000; includeSubDomains
referrer-policy
no-referrer-when-downgrade
date
Fri, 27 Oct 2023 13:29:23 GMT
last-modified
Wed, 25 Oct 2023 18:06:48 GMT
server
Caddy
etag
"s33jnc92c"
x-frame-options
SAMEORIGIN
content-type
image/png
accept-ranges
bytes
content-length
11748
images
testsso.phototag.app/api/
9 B
37 B
XHR
General
Full URL
https://testsso.phototag.app/api/images?limit=30
Requested by
Host: testsso.phototag.app
URL: https://testsso.phototag.app/static/js/vendor.d027943e5de5abc68185.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.230.180.219 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
219.180.230.35.bc.googleusercontent.com
Software
Caddy /
Resource Hash
cdb3c88c2e8d457126297f70184537d9f6fc0b3039f2f48c313ba77d758ff654
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-eval' 'unsafe-inline' 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Accept
application/json, text/plain, */*
Referer
https://testsso.phototag.app/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-security-policy
script-src 'unsafe-eval' 'unsafe-inline' 'self';
date
Fri, 27 Oct 2023 13:29:23 GMT
referrer-policy
no-referrer-when-downgrade
strict-transport-security
max-age=31536000; includeSubDomains
server
Caddy
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
content-type
text/plain; charset=utf-8
content-length
9
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700|Material+Icons
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://testsso.phototag.app
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Fri, 27 Oct 2023 04:06:52 GMT
x-content-type-options
nosniff
age
33751
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15744
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 26 Oct 2024 04:06:52 GMT
available
testsso.phototag.app/auth/okta/
0
17 B
XHR
General
Full URL
https://testsso.phototag.app/auth/okta/available
Requested by
Host: testsso.phototag.app
URL: https://testsso.phototag.app/static/js/vendor.d027943e5de5abc68185.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.230.180.219 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
219.180.230.35.bc.googleusercontent.com
Software
Caddy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-eval' 'unsafe-inline' 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

Accept
application/json, text/plain, */*
Referer
https://testsso.phototag.app/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-security-policy
script-src 'unsafe-eval' 'unsafe-inline' 'self';
date
Fri, 27 Oct 2023 13:29:23 GMT
referrer-policy
no-referrer-when-downgrade
strict-transport-security
max-age=31536000; includeSubDomains
server
Caddy
content-length
0
x-frame-options
SAMEORIGIN
okta.png
testsso.phototag.app/static/
12 KB
12 KB
Image
General
Full URL
https://testsso.phototag.app/static/okta.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.230.180.219 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
219.180.230.35.bc.googleusercontent.com
Software
Caddy /
Resource Hash
3ceb0406f498f2dbcbe99877e5fc63b6365567cc2fca7b861bfcb4b7806f06e6
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-eval' 'unsafe-inline' 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://testsso.phototag.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-security-policy
script-src 'unsafe-eval' 'unsafe-inline' 'self';
strict-transport-security
max-age=31536000; includeSubDomains
referrer-policy
no-referrer-when-downgrade
date
Fri, 27 Oct 2023 13:29:23 GMT
last-modified
Wed, 25 Oct 2023 18:06:48 GMT
server
Caddy
etag
"s33jnc9jf"
x-frame-options
SAMEORIGIN
content-type
image/png
accept-ranges
bytes
content-length
12363

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| webpackJsonp function| setImmediate function| clearImmediate object| __core-js_shared__ object| Bus

0 Cookies

3 Console Messages

Source Level URL
Text
network error URL: https://testsso.phototag.app/api/image-categories
Message:
Failed to load resource: the server responded with a status of 401 ()
network error URL: https://testsso.phototag.app/api/images?limit=30
Message:
Failed to load resource: the server responded with a status of 401 ()
network error URL: https://testsso.phototag.app/api/users/me
Message:
Failed to load resource: the server responded with a status of 401 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy script-src 'unsafe-eval' 'unsafe-inline' 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN