urlscan.io logo urlscan.io
SecurityTrails logo

mfa.qaaon.gs.com Open in urlscan Pro
23.36.163.238  Public Scan

Go To Rescan Add Verdict Report
URL: https://mfa.qaaon.gs.com/goform/formWsc
Submission: On November 15 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 23.36.163.238, located in Frankfurt am Main, Germany and belongs to AKAMAI-ASN1, NL. The main domain is mfa.qaaon.gs.com.
TLS certificate: Issued by DigiCert EV RSA CA G2 on June 22nd 2023. Valid for: a year.
This is the only time mfa.qaaon.gs.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
10 23.36.163.238 20940 (AKAMAI-ASN1)
10 2
Apex Domain
Subdomains		 Transfer
10 gs.com
mfa.qaaon.gs.com
567 KB
10 1
Domain Requested by
10 mfa.qaaon.gs.com mfa.qaaon.gs.com
10 1

This site contains no links.

Subject Issuer Validity Valid
cdn-ak-pwm-cw-2.gs.com
DigiCert EV RSA CA G2		 2023-06-22 -
2024-06-21		 a year crt.sh

This page contains 1 frames:

Primary Page: https://mfa.qaaon.gs.com/goform/formWsc
Frame ID: 8A2117CF7B73FF5B0D1AEF1801A8EA99
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

MFA

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

567 kB
Transfer

2110 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request formWsc
mfa.qaaon.gs.com/goform/ 		1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://mfa.qaaon.gs.com/goform/formWsc
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.36.163.238 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-36-163-238.deploy.static.akamaitechnologies.com
Software
GS /
Resource Hash
23b2a4585fe65f12cf22ead35455901e322084111152fd1918a347dc096bd562
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://assets.adobedtm.com https://v.gs.com https://*.online-metrix.net; connect-src 'self' https://*.eum.appd.gs.com https://idfs-qa.gs.com https://v.gs.com https://*.online-metrix.net; img-src 'self' https://v.gs.com https://*.online-metrix.net data: https://goldmansachs.d2.sc.omtrdc.net https://gspwm.d2.sc.omtrdc.net; style-src 'self' 'unsafe-inline' ; font-src 'self' data:;frame-src 'self' https://v.gs.com https://*.online-metrix.net; frame-ancestors 'self'; object-src 'self' https://v.gs.com https://*.online-metrix.net ;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
cache-control
no-store, no-cache
content-encoding
gzip
content-length
812
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://assets.adobedtm.com https://v.gs.com https://*.online-metrix.net; connect-src 'self' https://*.eum.appd.gs.com https://idfs-qa.gs.com https://v.gs.com https://*.online-metrix.net; img-src 'self' https://v.gs.com https://*.online-metrix.net data: https://goldmansachs.d2.sc.omtrdc.net https://gspwm.d2.sc.omtrdc.net; style-src 'self' 'unsafe-inline' ; font-src 'self' data:;frame-src 'self' https://v.gs.com https://*.online-metrix.net; frame-ancestors 'self'; object-src 'self' https://v.gs.com https://*.online-metrix.net ;
content-type
text/html
date
Wed, 15 Nov 2023 19:28:25 GMT
etag
"5f5-6094053fe5e00-gzip"
last-modified
Fri, 03 Nov 2023 14:29:12 GMT
pragma
no-cache
server
GS
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
www-authenticate
Bearer error="invalid_request", error_description="No bearer token found in the request"
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-pwm-req-uuid
1700076505361853
x-xss-protection
1; mode=block
app.4d28b7b58dbb343ecb3e.css
mfa.qaaon.gs.com/error/css/ 		629 KB
136 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://mfa.qaaon.gs.com/error/css/app.4d28b7b58dbb343ecb3e.css
Requested by
Host: mfa.qaaon.gs.com
URL: https://mfa.qaaon.gs.com/goform/formWsc
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.36.163.238 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-36-163-238.deploy.static.akamaitechnologies.com
Software
GS /
Resource Hash
3b09e1199b1b529fde738de8d92e1dee614541d33ca6bc50c3d6e70c8c84879b
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://assets.adobedtm.com https://v.gs.com https://*.online-metrix.net; connect-src 'self' https://*.eum.appd.gs.com https://idfs-qa.gs.com https://v.gs.com https://*.online-metrix.net; img-src 'self' https://v.gs.com https://*.online-metrix.net data: https://goldmansachs.d2.sc.omtrdc.net https://gspwm.d2.sc.omtrdc.net; style-src 'self' 'unsafe-inline' ; font-src 'self' data:;frame-src 'self' https://v.gs.com https://*.online-metrix.net; frame-ancestors 'self'; object-src 'self' https://v.gs.com https://*.online-metrix.net ;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://mfa.qaaon.gs.com/goform/formWsc
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://assets.adobedtm.com https://v.gs.com https://*.online-metrix.net; connect-src 'self' https://*.eum.appd.gs.com https://idfs-qa.gs.com https://v.gs.com https://*.online-metrix.net; img-src 'self' https://v.gs.com https://*.online-metrix.net data: https://goldmansachs.d2.sc.omtrdc.net https://gspwm.d2.sc.omtrdc.net; style-src 'self' 'unsafe-inline' ; font-src 'self' data:;frame-src 'self' https://v.gs.com https://*.online-metrix.net; frame-ancestors 'self'; object-src 'self' https://v.gs.com https://*.online-metrix.net ;
date
Wed, 15 Nov 2023 19:28:25 GMT
content-length
138119
x-xss-protection
1; mode=block
last-modified
Fri, 03 Nov 2023 14:29:12 GMT
server
GS
x-pwm-req-uuid
1699125464844060
etag
"9d443-6094053fe5e00-gzip"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=85972
accept-ranges
bytes
expires
Thu, 16 Nov 2023 19:21:17 GMT
app.a4c461112e9941b2ffa9.js
mfa.qaaon.gs.com/error/js/ 		95 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mfa.qaaon.gs.com/error/js/app.a4c461112e9941b2ffa9.js
Requested by
Host: mfa.qaaon.gs.com
URL: https://mfa.qaaon.gs.com/goform/formWsc
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.36.163.238 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-36-163-238.deploy.static.akamaitechnologies.com
Software
GS /
Resource Hash
9ba9af4d82225853fbb89802b3eb92e6b5f741bd15a288b9f5ae4348e50a17c8
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://assets.adobedtm.com https://v.gs.com https://*.online-metrix.net; connect-src 'self' https://*.eum.appd.gs.com https://idfs-qa.gs.com https://v.gs.com https://*.online-metrix.net; img-src 'self' https://v.gs.com https://*.online-metrix.net data: https://goldmansachs.d2.sc.omtrdc.net https://gspwm.d2.sc.omtrdc.net; style-src 'self' 'unsafe-inline' ; font-src 'self' data:;frame-src 'self' https://v.gs.com https://*.online-metrix.net; frame-ancestors 'self'; object-src 'self' https://v.gs.com https://*.online-metrix.net ;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://mfa.qaaon.gs.com/goform/formWsc
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://assets.adobedtm.com https://v.gs.com https://*.online-metrix.net; connect-src 'self' https://*.eum.appd.gs.com https://idfs-qa.gs.com https://v.gs.com https://*.online-metrix.net; img-src 'self' https://v.gs.com https://*.online-metrix.net data: https://goldmansachs.d2.sc.omtrdc.net https://gspwm.d2.sc.omtrdc.net; style-src 'self' 'unsafe-inline' ; font-src 'self' data:;frame-src 'self' https://v.gs.com https://*.online-metrix.net; frame-ancestors 'self'; object-src 'self' https://v.gs.com https://*.online-metrix.net ;
date
Wed, 15 Nov 2023 19:28:25 GMT
content-length
24198
x-xss-protection
1; mode=block
last-modified
Fri, 03 Nov 2023 14:29:12 GMT
server
GS
x-pwm-req-uuid
1699120552880852
etag
"17aa3-6094053fe5e00-gzip"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=76174
accept-ranges
bytes
expires
Thu, 16 Nov 2023 16:37:59 GMT
vendor.1c7b783ccb803c323f24.js
mfa.qaaon.gs.com/error/js/ 		1 MB
349 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mfa.qaaon.gs.com/error/js/vendor.1c7b783ccb803c323f24.js
Requested by
Host: mfa.qaaon.gs.com
URL: https://mfa.qaaon.gs.com/goform/formWsc
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.36.163.238 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-36-163-238.deploy.static.akamaitechnologies.com
Software
GS /
Resource Hash
cebff420f812d19a306f596601c59061183957c5670c82776faeeb387cfce986
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://assets.adobedtm.com https://v.gs.com https://*.online-metrix.net; connect-src 'self' https://*.eum.appd.gs.com https://idfs-qa.gs.com https://v.gs.com https://*.online-metrix.net; img-src 'self' https://v.gs.com https://*.online-metrix.net data: https://goldmansachs.d2.sc.omtrdc.net https://gspwm.d2.sc.omtrdc.net; style-src 'self' 'unsafe-inline' ; font-src 'self' data:;frame-src 'self' https://v.gs.com https://*.online-metrix.net; frame-ancestors 'self'; object-src 'self' https://v.gs.com https://*.online-metrix.net ;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://mfa.qaaon.gs.com/goform/formWsc
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://assets.adobedtm.com https://v.gs.com https://*.online-metrix.net; connect-src 'self' https://*.eum.appd.gs.com https://idfs-qa.gs.com https://v.gs.com https://*.online-metrix.net; img-src 'self' https://v.gs.com https://*.online-metrix.net data: https://goldmansachs.d2.sc.omtrdc.net https://gspwm.d2.sc.omtrdc.net; style-src 'self' 'unsafe-inline' ; font-src 'self' data:;frame-src 'self' https://v.gs.com https://*.online-metrix.net; frame-ancestors 'self'; object-src 'self' https://v.gs.com https://*.online-metrix.net ;
date
Wed, 15 Nov 2023 19:28:25 GMT
content-length
356162
x-xss-protection
1; mode=block
last-modified
Fri, 03 Nov 2023 14:29:12 GMT
server
GS
x-pwm-req-uuid
1699120552342695
etag
"14b340-6094053fe5e00-gzip"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=85228
accept-ranges
bytes
expires
Thu, 16 Nov 2023 19:08:53 GMT
data-en-us.json
mfa.qaaon.gs.com/error/data/ 		5 KB
3 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mfa.qaaon.gs.com/error/data/data-en-us.json
Requested by
Host: mfa.qaaon.gs.com
URL: https://mfa.qaaon.gs.com/error/js/app.a4c461112e9941b2ffa9.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.36.163.238 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-36-163-238.deploy.static.akamaitechnologies.com
Software
GS /
Resource Hash
4ebbfa170b1a678b29de07d356fe1127282a96e9c8be46a61534b0639e71584b
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://assets.adobedtm.com https://v.gs.com https://*.online-metrix.net; connect-src 'self' https://*.eum.appd.gs.com https://idfs-qa.gs.com https://v.gs.com https://*.online-metrix.net; img-src 'self' https://v.gs.com https://*.online-metrix.net data: https://goldmansachs.d2.sc.omtrdc.net https://gspwm.d2.sc.omtrdc.net; style-src 'self' 'unsafe-inline' ; font-src 'self' data:;frame-src 'self' https://v.gs.com https://*.online-metrix.net; frame-ancestors 'self'; object-src 'self' https://v.gs.com https://*.online-metrix.net ;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept
application/json
Referer
https://mfa.qaaon.gs.com/goform/formWsc
accept-language
de-DE,de;q=0.9
x-requested-by
Any
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type
application/json

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://assets.adobedtm.com https://v.gs.com https://*.online-metrix.net; connect-src 'self' https://*.eum.appd.gs.com https://idfs-qa.gs.com https://v.gs.com https://*.online-metrix.net; img-src 'self' https://v.gs.com https://*.online-metrix.net data: https://goldmansachs.d2.sc.omtrdc.net https://gspwm.d2.sc.omtrdc.net; style-src 'self' 'unsafe-inline' ; font-src 'self' data:;frame-src 'self' https://v.gs.com https://*.online-metrix.net; frame-ancestors 'self'; object-src 'self' https://v.gs.com https://*.online-metrix.net ;
date
Wed, 15 Nov 2023 19:28:25 GMT
content-length
2026
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Fri, 03 Nov 2023 14:29:12 GMT
server
GS
x-pwm-req-uuid
1700076505863586
etag
"15d1-6094053fe5e00-gzip"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/json
cache-control
no-store, no-cache
accept-ranges
bytes
contact-details.json
mfa.qaaon.gs.com/error/data/ 		485 B
1007 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mfa.qaaon.gs.com/error/data/contact-details.json
Requested by
Host: mfa.qaaon.gs.com
URL: https://mfa.qaaon.gs.com/error/js/app.a4c461112e9941b2ffa9.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.36.163.238 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-36-163-238.deploy.static.akamaitechnologies.com
Software
GS /
Resource Hash
6219f81f4a2d5ecd4f94db688526a5649eb3c08b720bb1eb6be3976ac993f5b5
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://assets.adobedtm.com https://v.gs.com https://*.online-metrix.net; connect-src 'self' https://*.eum.appd.gs.com https://idfs-qa.gs.com https://v.gs.com https://*.online-metrix.net; img-src 'self' https://v.gs.com https://*.online-metrix.net data: https://goldmansachs.d2.sc.omtrdc.net https://gspwm.d2.sc.omtrdc.net; style-src 'self' 'unsafe-inline' ; font-src 'self' data:;frame-src 'self' https://v.gs.com https://*.online-metrix.net; frame-ancestors 'self'; object-src 'self' https://v.gs.com https://*.online-metrix.net ;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept
application/json
Referer
https://mfa.qaaon.gs.com/goform/formWsc
accept-language
de-DE,de;q=0.9
x-requested-by
Any
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type
application/json

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://assets.adobedtm.com https://v.gs.com https://*.online-metrix.net; connect-src 'self' https://*.eum.appd.gs.com https://idfs-qa.gs.com https://v.gs.com https://*.online-metrix.net; img-src 'self' https://v.gs.com https://*.online-metrix.net data: https://goldmansachs.d2.sc.omtrdc.net https://gspwm.d2.sc.omtrdc.net; style-src 'self' 'unsafe-inline' ; font-src 'self' data:;frame-src 'self' https://v.gs.com https://*.online-metrix.net; frame-ancestors 'self'; object-src 'self' https://v.gs.com https://*.online-metrix.net ;
date
Wed, 15 Nov 2023 19:28:25 GMT
content-length
236
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Fri, 03 Nov 2023 14:29:12 GMT
server
GS
x-pwm-req-uuid
1700076505864160
etag
"1e5-6094053fe5e00-gzip"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/json
cache-control
no-store, no-cache
accept-ranges
bytes
app-configs.json
mfa.qaaon.gs.com/error/data/ 		509 B
995 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mfa.qaaon.gs.com/error/data/app-configs.json
Requested by
Host: mfa.qaaon.gs.com
URL: https://mfa.qaaon.gs.com/error/js/app.a4c461112e9941b2ffa9.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.36.163.238 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-36-163-238.deploy.static.akamaitechnologies.com
Software
GS /
Resource Hash
3ab24b6d7a1606d456f4ba35e99449bdc2db2500aba66b3be1960789880557c5
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://assets.adobedtm.com https://v.gs.com https://*.online-metrix.net; connect-src 'self' https://*.eum.appd.gs.com https://idfs-qa.gs.com https://v.gs.com https://*.online-metrix.net; img-src 'self' https://v.gs.com https://*.online-metrix.net data: https://goldmansachs.d2.sc.omtrdc.net https://gspwm.d2.sc.omtrdc.net; style-src 'self' 'unsafe-inline' ; font-src 'self' data:;frame-src 'self' https://v.gs.com https://*.online-metrix.net; frame-ancestors 'self'; object-src 'self' https://v.gs.com https://*.online-metrix.net ;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept
application/json
Referer
https://mfa.qaaon.gs.com/goform/formWsc
accept-language
de-DE,de;q=0.9
x-requested-by
Any
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type
application/json

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://assets.adobedtm.com https://v.gs.com https://*.online-metrix.net; connect-src 'self' https://*.eum.appd.gs.com https://idfs-qa.gs.com https://v.gs.com https://*.online-metrix.net; img-src 'self' https://v.gs.com https://*.online-metrix.net data: https://goldmansachs.d2.sc.omtrdc.net https://gspwm.d2.sc.omtrdc.net; style-src 'self' 'unsafe-inline' ; font-src 'self' data:;frame-src 'self' https://v.gs.com https://*.online-metrix.net; frame-ancestors 'self'; object-src 'self' https://v.gs.com https://*.online-metrix.net ;
date
Wed, 15 Nov 2023 19:28:25 GMT
content-length
225
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Fri, 03 Nov 2023 14:29:12 GMT
server
GS
x-pwm-req-uuid
1700076505909113
etag
"1fd-6094053fe5e00-gzip"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/json
cache-control
no-store, no-cache
accept-ranges
bytes
app.b8d38c59.jpg
mfa.qaaon.gs.com/error/assets/ 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mfa.qaaon.gs.com/error/assets/app.b8d38c59.jpg
Requested by
Host: mfa.qaaon.gs.com
URL: https://mfa.qaaon.gs.com/error/css/app.4d28b7b58dbb343ecb3e.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.36.163.238 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-36-163-238.deploy.static.akamaitechnologies.com
Software
GS /
Resource Hash
b6944af219f8b84d452b1ee65e01327e620c3c20e6a04534134fe1d35d8eaf4e
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://assets.adobedtm.com https://v.gs.com https://*.online-metrix.net; connect-src 'self' https://*.eum.appd.gs.com https://idfs-qa.gs.com https://v.gs.com https://*.online-metrix.net; img-src 'self' https://v.gs.com https://*.online-metrix.net data: https://goldmansachs.d2.sc.omtrdc.net https://gspwm.d2.sc.omtrdc.net; style-src 'self' 'unsafe-inline' ; font-src 'self' data:;frame-src 'self' https://v.gs.com https://*.online-metrix.net; frame-ancestors 'self'; object-src 'self' https://v.gs.com https://*.online-metrix.net ;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://mfa.qaaon.gs.com/error/css/app.4d28b7b58dbb343ecb3e.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://assets.adobedtm.com https://v.gs.com https://*.online-metrix.net; connect-src 'self' https://*.eum.appd.gs.com https://idfs-qa.gs.com https://v.gs.com https://*.online-metrix.net; img-src 'self' https://v.gs.com https://*.online-metrix.net data: https://goldmansachs.d2.sc.omtrdc.net https://gspwm.d2.sc.omtrdc.net; style-src 'self' 'unsafe-inline' ; font-src 'self' data:;frame-src 'self' https://v.gs.com https://*.online-metrix.net; frame-ancestors 'self'; object-src 'self' https://v.gs.com https://*.online-metrix.net ;
date
Wed, 15 Nov 2023 19:28:25 GMT
content-length
27605
x-xss-protection
1; mode=block
last-modified
Fri, 03 Nov 2023 14:29:12 GMT
server
GS
x-pwm-req-uuid
1699211684294873
etag
"70e8-6094053fe5e00-gzip"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
image/jpeg
cache-control
max-age=285435
accept-ranges
bytes
expires
Sun, 19 Nov 2023 02:45:40 GMT
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
acc9d64067d653dec5096c0f2deee4e2d11af3291497ab30c4de72efcecb9d04

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type
image/gif
app.a9ed4901.woff
mfa.qaaon.gs.com/error/assets/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://mfa.qaaon.gs.com/error/assets/app.a9ed4901.woff
Requested by
Host: mfa.qaaon.gs.com
URL: https://mfa.qaaon.gs.com/error/css/app.4d28b7b58dbb343ecb3e.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.36.163.238 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-36-163-238.deploy.static.akamaitechnologies.com
Software
GS /
Resource Hash
a7cfca37b568b5c3f3cc72035a795b149222c2d91fc9d12a97650eeb4d9082d9
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://assets.adobedtm.com https://v.gs.com https://*.online-metrix.net; connect-src 'self' https://*.eum.appd.gs.com https://idfs-qa.gs.com https://v.gs.com https://*.online-metrix.net; img-src 'self' https://v.gs.com https://*.online-metrix.net data: https://goldmansachs.d2.sc.omtrdc.net https://gspwm.d2.sc.omtrdc.net; style-src 'self' 'unsafe-inline' ; font-src 'self' data:;frame-src 'self' https://v.gs.com https://*.online-metrix.net; frame-ancestors 'self'; object-src 'self' https://v.gs.com https://*.online-metrix.net ;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://mfa.qaaon.gs.com/error/css/app.4d28b7b58dbb343ecb3e.css
Origin
https://mfa.qaaon.gs.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://assets.adobedtm.com https://v.gs.com https://*.online-metrix.net; connect-src 'self' https://*.eum.appd.gs.com https://idfs-qa.gs.com https://v.gs.com https://*.online-metrix.net; img-src 'self' https://v.gs.com https://*.online-metrix.net data: https://goldmansachs.d2.sc.omtrdc.net https://gspwm.d2.sc.omtrdc.net; style-src 'self' 'unsafe-inline' ; font-src 'self' data:;frame-src 'self' https://v.gs.com https://*.online-metrix.net; frame-ancestors 'self'; object-src 'self' https://v.gs.com https://*.online-metrix.net ;
date
Wed, 15 Nov 2023 19:28:26 GMT
content-length
22077
x-xss-protection
1; mode=block
last-modified
Fri, 03 Nov 2023 14:29:12 GMT
server
GS
x-pwm-req-uuid
1699211687440963
etag
"5670-6094053fe5e00-gzip"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/font-woff
cache-control
max-age=394854
accept-ranges
bytes
expires
Mon, 20 Nov 2023 09:09:20 GMT
finish
mfa.qaaon.gs.com/service-mfa/user/ 		1 KB
2 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mfa.qaaon.gs.com/service-mfa/user/finish
Requested by
Host: mfa.qaaon.gs.com
URL: https://mfa.qaaon.gs.com/error/js/app.a4c461112e9941b2ffa9.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.36.163.238 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-36-163-238.deploy.static.akamaitechnologies.com
Software
GS /
Resource Hash
23b2a4585fe65f12cf22ead35455901e322084111152fd1918a347dc096bd562
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://assets.adobedtm.com https://v.gs.com https://*.online-metrix.net; connect-src 'self' https://*.eum.appd.gs.com https://idfs-qa.gs.com https://v.gs.com https://*.online-metrix.net; img-src 'self' https://v.gs.com https://*.online-metrix.net data: https://goldmansachs.d2.sc.omtrdc.net https://gspwm.d2.sc.omtrdc.net; style-src 'self' 'unsafe-inline' ; font-src 'self' data:;frame-src 'self' https://v.gs.com https://*.online-metrix.net; frame-ancestors 'self'; object-src 'self' https://v.gs.com https://*.online-metrix.net ;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept
application/json
Referer
https://mfa.qaaon.gs.com/goform/formWsc
accept-language
de-DE,de;q=0.9
x-requested-by
Any
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type
application/json

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
www-authenticate
Bearer error="invalid_request", error_description="No bearer token found in the request"
x-content-type-options
nosniff
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://assets.adobedtm.com https://v.gs.com https://*.online-metrix.net; connect-src 'self' https://*.eum.appd.gs.com https://idfs-qa.gs.com https://v.gs.com https://*.online-metrix.net; img-src 'self' https://v.gs.com https://*.online-metrix.net data: https://goldmansachs.d2.sc.omtrdc.net https://gspwm.d2.sc.omtrdc.net; style-src 'self' 'unsafe-inline' ; font-src 'self' data:;frame-src 'self' https://v.gs.com https://*.online-metrix.net; frame-ancestors 'self'; object-src 'self' https://v.gs.com https://*.online-metrix.net ;
date
Wed, 15 Nov 2023 19:28:26 GMT
content-length
812
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Fri, 03 Nov 2023 14:29:12 GMT
server
GS
x-pwm-req-uuid
1700076506135442
etag
"5f5-6094053fe5e00-gzip"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/html
cache-control
no-store, no-cache
accept-ranges
bytes

Verdicts & Comments Add Verdict or Comment

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| webpackJsonp object| __core-js_shared__ object| core object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| __$$GLOBAL_REWIRE_REGISTRY__ function| __rewire_reset_all__ number| __$$GLOBAL_REWIRE_NEXT_MODULE_ID__ object| Backbone number| __mobxInstanceCount object| intlTelInputUtils function| _

0 Cookies

3 Console Messages

Source Level URL
Text
network error URL: https://mfa.qaaon.gs.com/goform/formWsc
Message:
Failed to load resource: the server responded with a status of 401 ()
rendering warning URL: https://mfa.qaaon.gs.com/goform/formWsc(Line 5)
Message:
The key "/>" is not recognized and ignored.
network error URL: https://mfa.qaaon.gs.com/service-mfa/user/finish
Message:
Failed to load resource: the server responded with a status of 401 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://assets.adobedtm.com https://v.gs.com https://*.online-metrix.net; connect-src 'self' https://*.eum.appd.gs.com https://idfs-qa.gs.com https://v.gs.com https://*.online-metrix.net; img-src 'self' https://v.gs.com https://*.online-metrix.net data: https://goldmansachs.d2.sc.omtrdc.net https://gspwm.d2.sc.omtrdc.net; style-src 'self' 'unsafe-inline' ; font-src 'self' data:;frame-src 'self' https://v.gs.com https://*.online-metrix.net; frame-ancestors 'self'; object-src 'self' https://v.gs.com https://*.online-metrix.net ;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block