access.nationwideexcessandsurplus.com Open in urlscan Pro
2.19.97.11 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://bulletins.nationwideexcessandsurplus.com/bulletins/views/viewDocument.html?Id=24-04045
Effective URL:
https://access.nationwideexcessandsurplus.com/nes-login/login?redirectUri=https://identity.nationwide.com/as/HCXP5rfqyY/resume/as/authorizatio...
Submission: On January 25 via api (January 25th 2024, 6:01:29 pm UTC) from US — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 8 IPs in 2 countries across 7 domains to perform 12 HTTP transactions. The main IP is 2.19.97.11, located in Düsseldorf, Germany and belongs to AKAMAI-ASN1, NL. The main domain is access.nationwideexcessandsurplus.com. The Cisco Umbrella rank of the primary domain is 690675.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on March 24th 2023. Valid for: a year.

This is the only time access.nationwideexcessandsurplus.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.126.37.145 104.126.37.145	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 1	104.126.37.131 104.126.37.131	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2.19.97.11 2.19.97.11	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a02:26f0:310... 2a02:26f0:3100:795::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	151.101.194.137 151.101.194.137	54113 (FASTLY) (FASTLY)
1	2a02:26f0:350... 2a02:26f0:3500:991::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 2	193.108.153.26 193.108.153.26	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 2	2a02:26f0:350... 2a02:26f0:3500:16::215:1486	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
12	8

1 104.126.37.145 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a104-126-37-145.deploy.static.akamaitechnologies.com

bulletins.nationwideexcessandsurplus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.126.37.131 (Frankfurt am Main, Germany) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)
PTR: a104-126-37-131.deploy.static.akamaitechnologies.com

identity.nationwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2.19.97.11 (Düsseldorf, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-19-97-11.deploy.static.akamaitechnologies.com

access.nationwideexcessandsurplus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:3100:795::11a6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

s.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
684dd32d.akstat.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.194.137 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:991::11a6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

c.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 193.108.153.26 (Frankfurt am Main, Germany) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)
PTR: a193-108-153-26.deploy.static.akamaitechnologies.com

trial-eum-clientnsv4-s.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
kqj27jobnsmruznsuh4a-pdokdu-a0a0c72aa-clientnsv4-s.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:3500:16::215:1486 (Frankfurt am Main, Germany) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)

trial-eum-clienttons-s.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
eaarwyaqcaaaekqce3ydkaaaczs3fipy-pdokdu-64ef1779c-clienttons-s.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	nationwideexcessandsurplus.com bulletins.nationwideexcessandsurplus.com access.nationwideexcessandsurplus.com — Cisco Umbrella Rank: 690675	68 KB
4	akamaihd.net 2 redirects trial-eum-clientnsv4-s.akamaihd.net — Cisco Umbrella Rank: 2583 kqj27jobnsmruznsuh4a-pdokdu-a0a0c72aa-clientnsv4-s.akamaihd.net trial-eum-clienttons-s.akamaihd.net — Cisco Umbrella Rank: 2585 eaarwyaqcaaaekqce3ydkaaaczs3fipy-pdokdu-64ef1779c-clienttons-s.akamaihd.net	1 KB
2	go-mpulse.net s.go-mpulse.net — Cisco Umbrella Rank: 1389 c.go-mpulse.net — Cisco Umbrella Rank: 624	50 KB
1	akstat.io 684dd32d.akstat.io — Cisco Umbrella Rank: 70311	216 B
1	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 600	29 KB
1	nationwide.com 1 redirects identity.nationwide.com — Cisco Umbrella Rank: 107096	1 KB
0	nr-data.net Failed bam.nr-data.net Failed
12	7

	Domain	Requested by
4	access.nationwideexcessandsurplus.com	bulletins.nationwideexcessandsurplus.com access.nationwideexcessandsurplus.com
1	eaarwyaqcaaaekqce3ydkaaaczs3fipy-pdokdu-64ef1779c-clienttons-s.akamaihd.net
1	trial-eum-clienttons-s.akamaihd.net	1 redirects
1	kqj27jobnsmruznsuh4a-pdokdu-a0a0c72aa-clientnsv4-s.akamaihd.net
1	trial-eum-clientnsv4-s.akamaihd.net	1 redirects
1	684dd32d.akstat.io	s.go-mpulse.net
1	c.go-mpulse.net	access.nationwideexcessandsurplus.com
1	js-agent.newrelic.com	access.nationwideexcessandsurplus.com
1	s.go-mpulse.net	access.nationwideexcessandsurplus.com
1	identity.nationwide.com	1 redirects
1	bulletins.nationwideexcessandsurplus.com
0	bam.nr-data.net Failed	access.nationwideexcessandsurplus.com
12	12

This site contains no links.

Subject Issuer	Validity	Valid
bulletins.nationwideexcessandsurplus.com DigiCert TLS RSA SHA256 2020 CA1	`2023-03-24` - `2024-02-13`	a year	crt.sh
access.nationwideexcessandsurplus.com DigiCert TLS RSA SHA256 2020 CA1	`2023-03-24` - `2024-02-13`	a year	crt.sh
akstat.io DigiCert TLS RSA SHA256 2020 CA1	`2023-04-05` - `2024-04-04`	a year	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-01-15` - `2025-02-15`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://access.nationwideexcessandsurplus.com/nes-login/login?redirectUri=https://identity.nationwide.com/as/HCXP5rfqyY/resume/as/authorization.ping&tsms=1706205685762
Frame ID: F3D4C1B2AD23F664A06FD842FD086EB9
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login

Page URL History Show full URLs

https://bulletins.nationwideexcessandsurplus.com/bulletins/views/viewDocument.html?Id=24-04045 Page URL
https://identity.nationwide.com/as/authorization.oauth2?response_type=code&client_id=PAaccesswebsessionB2BES... HTTP 302
https://access.nationwideexcessandsurplus.com/nes-login/login?redirectUri=https://identity.nationwide.com/as/HCXP5rfqyY/re... Page URL

Page Statistics

12
Requests

75 %
HTTPS

38 %
IPv6

7
Domains

12
Subdomains

8
IPs

2
Countries

148 kB
Transfer

618 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bulletins.nationwideexcessandsurplus.com/bulletins/views/viewDocument.html?Id=24-04045 Page URL
https://identity.nationwide.com/as/authorization.oauth2?response_type=code&client_id=PAaccesswebsessionB2BESS&redirect_uri=https%3A%2F%2Fbulletins.nationwideexcessandsurplus.com%2Fpa%2Foidc%2Fcb&state=eyJ6aXAiOiJERUYiLCJhbGciOiJkaXIiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2Iiwia2lkIjoiMXFVN0dlWFNidERWY3N6V1VJZEU0aVBHcEFnIiwic3VmZml4IjoiSmdxaGJ2LjE3MDY0NjQ4ODQifQ..FM9ptSMIKP85mvNGhE_Lig.QTAu-4DUkv4QWOonpNjM6LX5jWfB4of8wed1ghY8j4bjnPLaWGGwhl8BdjbJCMeHGg6Yx981giViafgMC21lZC1h_1nQgMXyvRq-iLtdc9mW5ieetp-rdhmLAMd6RQWPTXV583UTTDJE81olhdl0sGWIiGpdouws-6NEwkaAymE.26oOhirJmaF1UnRUJBbGnw&nonce=XlLBUgckO95SW0olIMzL128xKTVwKMb7du_g7_vP_0M&acr_values=BSAOAuthB2BESS%20BSAOAuthB2BSSC%20ReqParameters%20LSPA_DSSO_NWIEForm%20LSPA_DSSO2DMRacf_FormB2BPCIA%20LSPA_B2BTPIForm_NoRecaptcha%20NBS_Login_Policy&scope=openid%20address%20email%20phone%20profile&vnd_pi_requested_resource=https%3A%2F%2Fbulletins.nationwideexcessandsurplus.com%2Fbulletins%2Fviews%2FviewDocument.html%3FId%3D24-04045&vnd_pi_application_name=ESS-Bulletins-3822-BSAOAuthB2BESS HTTP 302
https://access.nationwideexcessandsurplus.com/nes-login/login?redirectUri=https://identity.nationwide.com/as/HCXP5rfqyY/resume/as/authorization.ping&tsms=1706205685762 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 9

https://trial-eum-clientnsv4-s.akamaihd.net/eum/getdns.txt?c=pdokdunq0 HTTP 302
https://kqj27jobnsmruznsuh4a-pdokdu-a0a0c72aa-clientnsv4-s.akamaihd.net/eum/results.txt

Request Chain 10

https://trial-eum-clienttons-s.akamaihd.net/eum/getdns.txt?c=pdokdunq0 HTTP 302
https://eaarwyaqcaaaekqce3ydkaaaczs3fipy-pdokdu-64ef1779c-clienttons-s.akamaihd.net/eum/results.txt

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 401 viewDocument.html Show response
bulletins.nationwideexcessandsurplus.com/bulletins/views/ 3 KB
3 KB 588ms
442ms Document
text/html 104.126.37.145
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://bulletins.nationwideexcessandsurplus.com/bulletins/views/viewDocument.html?Id=24-04045

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.126.37.145 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a104-126-37-145.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

6aecd23bd50132bc6b3023465bbd778ca73d8c7df93a9cdd76d7033b90966d43

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; style-src 'self'; script-src 'self' 'unsafe-inline'; font-src 'self'; object-src 'none';
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store
content-length: 2657
content-security-policy: default-src 'self'; style-src 'self'; script-src 'self' 'unsafe-inline'; font-src 'self'; object-src 'none';
content-type: text/html; charset=UTF-8
date: Thu, 25 Jan 2024 18:01:24 GMT
pragma: no-cache
referrer-policy: origin
server: Apache
server-timing: cdn-cache; desc=MISS edge; dur=361 origin; dur=48 ak_p; desc="1706205684415_1753097613_173826094_40959_9464_18_63_255";dur=1
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
www-authenticate: Bearer realm="bulletins.nationwideexcessandsurplus.com:443/"
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2

200

Primary Request login Show response
access.nationwideexcessandsurplus.com/nes-login/
Redirect Chain

https://identity.nationwide.com/as/authorization.oauth2?response_type=code&client_id=PAaccesswebsessionB2BESS&redirect_uri=https%3A%2F%2Fbulletins.nationwideexcessandsurplus.com%2Fpa%2Foidc%2Fcb&st...
https://access.nationwideexcessandsurplus.com/nes-login/login?redirectUri=https://identity.nationwide.com/as/HCXP5rfqyY/resume/as/authorization.ping&tsms=1706205685762

60 KB
22 KB

790ms
626ms

Document
text/html

2.19.97.11
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://access.nationwideexcessandsurplus.com/nes-login/login?redirectUri=https://identity.nationwide.com/as/HCXP5rfqyY/resume/as/authorization.ping&tsms=1706205685762

Requested by

Host: bulletins.nationwideexcessandsurplus.com
URL: https://bulletins.nationwideexcessandsurplus.com/bulletins/views/viewDocument.html?Id=24-04045

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.97.11 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-19-97-11.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

4b5dc3eb63734bfc6a0b304dc0c5bfbc692fee51fad3d0e16bbf4e314b6ceca6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://bulletins.nationwideexcessandsurplus.com/bulletins/views/viewDocument.html?Id=24-04045
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://nationwideexcessandsurplus.com
cache-control: max-age=1
content-encoding: gzip
content-language: de-DE
content-length: 21433
content-type: text/html;charset=ISO-8859-1
date: Thu, 25 Jan 2024 18:01:26 GMT
referrer-policy: origin
server: Apache
server-timing: cdn-cache; desc=MISS edge; dur=468 origin; dur=41 ak_p; desc="1706205685972_34824455_527860472_50991_6088_32_45_255";dur=1
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
vary: Accept-Encoding
x-akamai-transformed: 9 - 0 pmb=mRUM,2
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN SAMEORIGIN
x-xss-protection: 1; mode=block

Redirect headers

cache-control: no-cache, no-store
content-length: 0
content-security-policy: script-src https://*.pingone.com https://*.nwie.net https://*.nationwide.com https://onyourside.sharepoint.com https://www.google.com/ https://www.gstatic.com/ 'unsafe-inline' 'unsafe-eval' ; child-src https://*.pingone.com https://*.nwie.net https://*.nationwide.com https://onyourside.sharepoint.com https://www.google.com/ https://www.gstatic.com/ ; frame-ancestors https://*.pingone.com https://*.nwie.net https://*.nationwide.com https://*.harleysvillegroup.com https://*.alliedinsurance.com https://*.nwagri.com https://onyourside.sharepoint.com https://*.nationwideexcessandsurplus.com https://nationwideexcessandsurplus.com https://*.nationwideagribusiness.com https://*.nbs-paygate.com https://nbs-paygate.com https://*.nbsbrokerage-secure.com https://nbsbrokerage-secure.com https://*.iiieando.com https://nationwidefinancial.com https://*.nationwidefinancial.com https://*.nwservicecenter.com https://nfs.com https://*.nfs.com https://*.smartplanbynationwide.com https://smartplanbynationwide.com https://*.sscinc.com https://*.petinsurance.com https://nationwideprivateclient.com https://www.nationwideprivateclient.com ; object-src https://*.pingone.com https://*.nwie.net https://*.nationwide.com https://onyourside.sharepoint.com ;
content-type: text/html;charset=utf-8
date: Thu, 25 Jan 2024 18:01:25 GMT
location: https://access.nationwideexcessandsurplus.com/nes-login/login?redirectUri=https://identity.nationwide.com/as/HCXP5rfqyY/resume/as/authorization.ping&tsms=1706205685762
pragma: no-cache
referrer-policy: origin
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

GET
H2 200 bootstrap.css
access.nationwideexcessandsurplus.com/nesui/resources/ui-framework/css/bootstrap-3.1/ 112 KB
17 KB 552ms
552ms Stylesheet
text/css 2.19.97.11
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://access.nationwideexcessandsurplus.com/nesui/resources/ui-framework/css/bootstrap-3.1/bootstrap.css

Requested by

Host: access.nationwideexcessandsurplus.com
URL: https://access.nationwideexcessandsurplus.com/nes-login/login?redirectUri=https://identity.nationwide.com/as/HCXP5rfqyY/resume/as/authorization.ping&tsms=1706205685762

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.97.11 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-19-97-11.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

a1b85fe1021bc68f5f52b9f697835f01505d1cfa409dbb8247f2ae00093138cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://access.nationwideexcessandsurplus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 18:01:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
server-timing: cdn-cache; desc=HIT, edge; dur=333, ak_p; desc="1706205686661_34824455_527861055_33864_5707_32_0_255";dur=1
content-length: 17300
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Tue, 05 Dec 2023 10:42:18 GMT
server: Apache
x-frame-options: SAMEORIGIN, SAMEORIGIN
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: https://nationwideexcessandsurplus.com
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers, Accept-Encoding
access-control-allow-credentials: true
cache-control: max-age=0
accept-ranges: bytes

GET
H2 200 ui-framework-theme.css
access.nationwideexcessandsurplus.com/nesui/resources/ui-framework/css/themes/ 145 KB
24 KB 961ms
960ms Stylesheet
text/css 2.19.97.11
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://access.nationwideexcessandsurplus.com/nesui/resources/ui-framework/css/themes/ui-framework-theme.css

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.97.11 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-19-97-11.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

56feff63ed3b80bcdb2c2232072690032829a148f759b912174696ab6f474a17

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://access.nationwideexcessandsurplus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 18:01:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
server-timing: cdn-cache; desc=HIT, edge; dur=712, ak_p; desc="1706205686655_34824455_527861056_71187_5829_33_0_255";dur=1
content-length: 24274
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Tue, 05 Dec 2023 10:42:18 GMT
server: Apache
x-frame-options: SAMEORIGIN, SAMEORIGIN
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: https://nationwideexcessandsurplus.com
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers, Accept-Encoding
access-control-allow-credentials: true
cache-control: max-age=1
accept-ranges: bytes

GET
H2 200 ladda-themeless.min.css
access.nationwideexcessandsurplus.com/nes-login/resources/app/ladda/dist/ 8 KB
2 KB 367ms
367ms Stylesheet
text/css 2.19.97.11
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://access.nationwideexcessandsurplus.com/nes-login/resources/app/ladda/dist/ladda-themeless.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.97.11 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-19-97-11.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

77b5594e53fd3f7653099dc1925f1a199ffe56ce22f9ba5c38635f89b53bf8b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://access.nationwideexcessandsurplus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 18:01:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
server-timing: cdn-cache; desc=HIT, edge; dur=314, ak_p; desc="1706205686668_34824455_527861069_31529_5602_32_0_255";dur=1
content-length: 1155
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Tue, 05 Dec 2023 10:42:18 GMT
server: Apache
x-frame-options: SAMEORIGIN, SAMEORIGIN
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: https://nationwideexcessandsurplus.com
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers, Accept-Encoding
access-control-allow-credentials: true
cache-control: max-age=1
accept-ranges: bytes

GET
H2 200 8RZR7-BGHGJ-526LQ-9Y4VC-4CSVR Show response
s.go-mpulse.net/boomerang/ 205 KB
49 KB 106ms
28ms Script
application/javascript 2a02:26f0:3100:795::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.go-mpulse.net/boomerang/8RZR7-BGHGJ-526LQ-9Y4VC-4CSVR
Requested by: Host: access.nationwideexcessandsurplus.com
URL: https://access.nationwideexcessandsurplus.com/nes-login/login?redirectUri=https://identity.nationwide.com/as/HCXP5rfqyY/resume/as/authorization.ping&tsms=1706205685762
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:3100:795::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://access.nationwideexcessandsurplus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 18:01:27 GMT
content-encoding: br
customappheader: mpulse-ab-boomr__git__2226cf4__git__2226cf4__p19.alsi10-lite
last-modified: Sun, 21 Jan 2024 13:53:27 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=604800
timing-allow-origin: *
content-length: 50393

GET
H2 200 nr-spa-1.250.0.min.js Show response
js-agent.newrelic.com/ 86 KB
29 KB 78ms
21ms Script
application/javascript 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-spa-1.250.0.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.194.137 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

8aaf0af04baf8eaa35b1ac46ed02d131a8d3c44896b92a45fa1555c70ebc94c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://access.nationwideexcessandsurplus.com/
Origin: https://access.nationwideexcessandsurplus.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-amz-version-id: 9CPSHfU_b43id9HPDI1ELov4Sz01U0Ym
content-encoding: br
via: 1.1 varnish
date: Thu, 25 Jan 2024 18:01:27 GMT
strict-transport-security: max-age=300
x-amz-request-id: Y8X089R670KABAR2
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 28786
x-amz-id-2: yxunnlth4kIZ7bGH6TQSAMYePrRUkg0/RGFWFX3C1ywxQBIbeqTcNDs0Yt+1kM6l/9mNrCyQlIY=
x-served-by: cache-fra-eddf8230126-FRA
last-modified: Tue, 09 Jan 2024 19:15:56 GMT
server: AmazonS3
x-timer: S1706205688.684159,VS0,VE0
etag: "6e3b65f7f44fa4b3bf86d1f0187490ce"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 413921

POST undefined
bam.nr-data.net/1/ 0
0

GET
H/1.1 200
OK config.json Show response
c.go-mpulse.net/api/ 781 B
1 KB 175ms
77ms XHR
application/json 2a02:26f0:3500:991::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/config.json?key=8RZR7-BGHGJ-526LQ-9Y4VC-4CSVR&d=access.nationwideexcessandsurplus.com&t=5687352&v=1.720.0&sl=0&si=81b21997-0684-440f-8f8f-31cdace32961-s7twqd&plugins=AK,ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao=&ak.ai=904840
Requested by: Host: access.nationwideexcessandsurplus.com
URL: https://access.nationwideexcessandsurplus.com/nes-login/login?redirectUri=https://identity.nationwide.com/as/HCXP5rfqyY/resume/as/authorization.ping&tsms=1706205685762
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:3500:991::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: ca9f7c565d6334fff519cd78e55584b8d6545baadc46f85a34ed287dcb8e6303

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://access.nationwideexcessandsurplus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 25 Jan 2024 18:01:27 GMT
Cache-Control: private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 781
Content-Type: application/json

POST
H2 204 /
684dd32d.akstat.io/ 0
216 B 199ms
198ms Ping
image/gif 2a02:26f0:3100:795::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://684dd32d.akstat.io/

Requested by

Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/8RZR7-BGHGJ-526LQ-9Y4VC-4CSVR

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:3100:795::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://access.nationwideexcessandsurplus.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Thu, 25 Jan 2024 18:01:28 GMT
content-type: image/gif
access-control-allow-origin: https://access.nationwideexcessandsurplus.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 0
expires: Thu, 25 Jan 2024 18:01:28 GMT

GET
H/1.1

200
OK

results.txt Show response
kqj27jobnsmruznsuh4a-pdokdu-a0a0c72aa-clientnsv4-s.akamaihd.net/eum/
Redirect Chain

https://trial-eum-clientnsv4-s.akamaihd.net/eum/getdns.txt?c=pdokdunq0
https://kqj27jobnsmruznsuh4a-pdokdu-a0a0c72aa-clientnsv4-s.akamaihd.net/eum/results.txt

8 B
312 B

352ms
158ms

XHR
text/plain

193.108.153.26
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://kqj27jobnsmruznsuh4a-pdokdu-a0a0c72aa-clientnsv4-s.akamaihd.net/eum/results.txt
Protocol: HTTP/1.1
Server: 193.108.153.26 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a193-108-153-26.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://access.nationwideexcessandsurplus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Thu, 25 Jan 2024 18:01:29 GMT
Last-Modified: Wed, 08 May 2013 07:51:12 GMT
Server: AkamaiNetStorage
ETag: "402e7a087747cb56c718bde84651f96a:1367999472"
Content-Type: text/plain
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 8

Redirect headers

Location: https://kqj27jobnsmruznsuh4a-pdokdu-a0a0c72aa-clientnsv4-s.akamaihd.net/eum/results.txt
Access-Control-Allow-Origin: *
Date: Thu, 25 Jan 2024 18:01:28 GMT
Server: AkamaiGHost
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

results.txt Show response
eaarwyaqcaaaekqce3ydkaaaczs3fipy-pdokdu-64ef1779c-clienttons-s.akamaihd.net/eum/
Redirect Chain

https://trial-eum-clienttons-s.akamaihd.net/eum/getdns.txt?c=pdokdunq0
https://eaarwyaqcaaaekqce3ydkaaaczs3fipy-pdokdu-64ef1779c-clienttons-s.akamaihd.net/eum/results.txt

8 B
312 B

183ms
36ms

XHR
text/plain

2a02:26f0:3500:16::215:1486
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://eaarwyaqcaaaekqce3ydkaaaczs3fipy-pdokdu-64ef1779c-clienttons-s.akamaihd.net/eum/results.txt
Protocol: HTTP/1.1
Server: 2a02:26f0:3500:16::215:1486 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://access.nationwideexcessandsurplus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Thu, 25 Jan 2024 18:01:28 GMT
Last-Modified: Wed, 08 May 2013 07:51:12 GMT
Server: AkamaiNetStorage
ETag: "402e7a087747cb56c718bde84651f96a:1367999472"
Content-Type: text/plain
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 8

Redirect headers

Location: https://eaarwyaqcaaaekqce3ydkaaaczs3fipy-pdokdu-64ef1779c-clienttons-s.akamaihd.net/eum/results.txt
Access-Control-Allow-Origin: *
Date: Thu, 25 Jan 2024 18:01:28 GMT
Server: AkamaiGHost
Connection: keep-alive
Content-Length: 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/1/undefined?a=undefined&v=1.250.0&t=Unnamed%20Transaction&rst=2793&ck=0&s=e494462ed028a2c7&ref=https://access.nationwideexcessandsurplus.com/nes-login/login&hr=0&af=err,xhr,stn,ins,spa&be=1704&fe=994&dc=992&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1706205684921,%22n%22:0,%22f%22:914,%22dn%22:1001,%22dne%22:1001,%22c%22:1001,%22s%22:1033,%22ce%22:1078,%22rq%22:1078,%22rp%22:1704,%22rpe%22:1710,%22di%22:2696,%22ds%22:2696,%22de%22:2696,%22dc%22:2696,%22l%22:2696,%22le%22:2698%7D,%22navigation%22:%7B%7D%7D&fp=2696

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
access.nationwideexcessandsurplus.com/nes-login	1969-12-31 23:59:59	Name: JSESSIONID Value: 9064858CD97085B4F28E78EA3636C6B6
bulletins.nationwideexcessandsurplus.com/	1969-12-31 23:59:59	Name: nonce.Jgqhbv.1706464884 Value: 4e69b78f-5a01-466d-b2e2-8f0dcac3aba9
identity.nationwide.com/	1969-12-31 23:59:59	Name: PF Value: Nn8ztQkbklJxxLGKJ3hcGO

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://bulletins.nationwideexcessandsurplus.com/bulletins/views/viewDocument.html?Id=24-04045 Message: Failed to load resource: the server responded with a status of 401 ()
javascript	error	URL: https://access.nationwideexcessandsurplus.com/nes-login/login?redirectUri=https://identity.nationwide.com/as/HCXP5rfqyY/resume/as/authorization.ping&tsms=1706205685762 Message: Access to XMLHttpRequest at 'https://bam.nr-data.net/1/undefined?a=undefined&v=1.250.0&t=Unnamed%20Transaction&rst=2793&ck=0&s=e494462ed028a2c7&ref=https://access.nationwideexcessandsurplus.com/nes-login/login&hr=0&af=err,xhr,stn,ins,spa&be=1704&fe=994&dc=992&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1706205684921,%22n%22:0,%22f%22:914,%22dn%22:1001,%22dne%22:1001,%22c%22:1001,%22s%22:1033,%22ce%22:1078,%22rq%22:1078,%22rp%22:1704,%22rpe%22:1710,%22di%22:2696,%22ds%22:2696,%22de%22:2696,%22dc%22:2696,%22l%22:2696,%22le%22:2698%7D,%22navigation%22:%7B%7D%7D&fp=2696' from origin 'https://access.nationwideexcessandsurplus.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://bam.nr-data.net/1/undefined?a=undefined&v=1.250.0&t=Unnamed%20Transaction&rst=2793&ck=0&s=e494462ed028a2c7&ref=https://access.nationwideexcessandsurplus.com/nes-login/login&hr=0&af=err,xhr,stn,ins,spa&be=1704&fe=994&dc=992&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1706205684921,%22n%22:0,%22f%22:914,%22dn%22:1001,%22dne%22:1001,%22c%22:1001,%22s%22:1033,%22ce%22:1078,%22rq%22:1078,%22rp%22:1704,%22rpe%22:1710,%22di%22:2696,%22ds%22:2696,%22de%22:2696,%22dc%22:2696,%22l%22:2696,%22le%22:2698%7D,%22navigation%22:%7B%7D%7D&fp=2696 Message: Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self'; style-src 'self'; script-src 'self' 'unsafe-inline'; font-src 'self'; object-src 'none';
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

684dd32d.akstat.io
access.nationwideexcessandsurplus.com
bam.nr-data.net
bulletins.nationwideexcessandsurplus.com
c.go-mpulse.net
eaarwyaqcaaaekqce3ydkaaaczs3fipy-pdokdu-64ef1779c-clienttons-s.akamaihd.net
identity.nationwide.com
js-agent.newrelic.com
kqj27jobnsmruznsuh4a-pdokdu-a0a0c72aa-clientnsv4-s.akamaihd.net
s.go-mpulse.net
trial-eum-clientnsv4-s.akamaihd.net
trial-eum-clienttons-s.akamaihd.net
bam.nr-data.net
104.126.37.131
104.126.37.145
151.101.194.137
193.108.153.26
2.19.97.11
2a02:26f0:3100:795::11a6
2a02:26f0:3500:16::215:1486
2a02:26f0:3500:991::11a6
09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4
4b5dc3eb63734bfc6a0b304dc0c5bfbc692fee51fad3d0e16bbf4e314b6ceca6
56feff63ed3b80bcdb2c2232072690032829a148f759b912174696ab6f474a17
662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f
6aecd23bd50132bc6b3023465bbd778ca73d8c7df93a9cdd76d7033b90966d43
77b5594e53fd3f7653099dc1925f1a199ffe56ce22f9ba5c38635f89b53bf8b5
8aaf0af04baf8eaa35b1ac46ed02d131a8d3c44896b92a45fa1555c70ebc94c9
a1b85fe1021bc68f5f52b9f697835f01505d1cfa409dbb8247f2ae00093138cc
ca9f7c565d6334fff519cd78e55584b8d6545baadc46f85a34ed287dcb8e6303
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

access.nationwideexcessandsurplus.com Open in urlscan Pro 2.19.97.11 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

12 Requests

75 %HTTPS

38 %IPv6

7 Domains

12 Subdomains

8 IPs

2 Countries

148 kBTransfer

618 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Failed requests

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

3 Cookies

3 Console Messages

Security Headers

Indicators

access.nationwideexcessandsurplus.com Open in urlscan Pro
2.19.97.11 Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

75 %
HTTPS

38 %
IPv6

7
Domains

12
Subdomains

8
IPs

2
Countries

148 kB
Transfer

618 kB
Size

3
Cookies

12 HTTP transactions
0 data transactions