paywithbank-dev.americanexpress.com Open in urlscan Pro
139.71.66.166  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response paywithbank-dev.americanexpress.com/	842 B 3 KB	979ms 168ms	Document text/html	139.71.66.166 AMERICAN-EXPRESS
General Check archive.org Show headers Download Go to Full URL https://paywithbank-dev.americanexpress.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 139.71.66.166 , United States, ASN6307 (AMERICAN-EXPRESS, US), Reverse DNS paywithbank-dev.americanexpress.com Software / Resource Hash 8465fb893f0c60bc76f94337f97673c461792c9d71de750126a2083d6f911869 Security Headers Name Value Content-Security-Policy connect-src 'self' https://paywithbankapi-dev.americanexpress.com/ https://*.evidon.com/; media-src 'none'; frame-ancestors 'none'; report-uri https://csp.tsrs.cloud/r/8134b5005b6985aecac8fe6fcea646a83e7d6714; font-src https://www.aexp-static.com/; object-src 'none'; worker-src 'none'; script-src https://c.evidon.com/ https://www.gstatic.com/ 'unsafe-inline' 'self' 'unsafe-eval' https://apis.google.com/; form-action 'none'; style-src 'unsafe-inline'; base-uri 'none'; frame-src 'none'; img-src 'self' data: https:; block-all-mixed-content; Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Frame-Options deny X-Xss-Protection 1 Request headers Host paywithbank-dev.americanexpress.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Accept-Language de-DE,de;q=0.9 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Access-Control-Allow-Origin https://paywithbank-dev.americanexpress.com Access-Control-Allow-Methods GET, POST, PUT, DELETE, OPTIONS, HEAD Access-Control-Allow-Headers Origin, Content-Type, Authorization, Content-Length, X-Requested-With, Accept, X-Forwarded-For, tracking_id, x-pisp-jwt-token, x-pwb-jwt-token, x-ls-id, x-browser-app-version, x-browser-user-agent, User-Agent, sdk_version, sdk_version_number, sdk_build_date Access-Control-Expose-Headers tracking_id, x-pisp-jwt-token, x-pwb-jwt-token, x-ls-id, x-browser-app-version, x-browser-user-agent Access-Control-Request-Method * X-Frame-Options deny Access-Control-Allow-Credentials true X-XSS-Protection 1 Cache-Control no-store, no-cache, must-revalidate Strict-Transport-Security max-age=63072000; includeSubDomains; preload Vary Origin Accept-Ranges bytes Last-Modified Fri, 03 Sep 2021 22:12:42 GMT ETag W/"34a-17badb89b90" Content-Type text/html; charset=UTF-8 Content-Security-Policy connect-src 'self' https://paywithbankapi-dev.americanexpress.com/ https://*.evidon.com/; media-src 'none'; frame-ancestors 'none'; report-uri https://csp.tsrs.cloud/r/8134b5005b6985aecac8fe6fcea646a83e7d6714; font-src https://www.aexp-static.com/; object-src 'none'; worker-src 'none'; script-src https://c.evidon.com/ https://www.gstatic.com/ 'unsafe-inline' 'self' 'unsafe-eval' https://apis.google.com/; form-action 'none'; style-src 'unsafe-inline'; base-uri 'none'; frame-src 'none'; img-src 'self' data: https:; block-all-mixed-content; Date Sun, 12 Sep 2021 08:38:21 GMT Connection keep-alive Keep-Alive timeout=100 Set-Cookie TS01fcf672=018b11f77a35179238ab2dc48caf662338b9e7c63d974a7b9528aa4885fae2f03ca8c7e639984908281f8f5ccda6b63b6a258ceedc; Path=/; Domain=.paywithbank-dev.americanexpress.com Transfer-Encoding chunked
GET H/1.1	200 OK	Cookie set client.js Show response paywithbank-dev.americanexpress.com/payments/v1/pisp/	297 KB 299 KB	172ms 171ms	Script application/javascript	139.71.66.166 AMERICAN-EXPRESS
General Check archive.org Show headers Download Go to Full URL https://paywithbank-dev.americanexpress.com/payments/v1/pisp/client.js?v12903 Requested by Host: paywithbank-dev.americanexpress.com URL: https://paywithbank-dev.americanexpress.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 139.71.66.166 , United States, ASN6307 (AMERICAN-EXPRESS, US), Reverse DNS paywithbank-dev.americanexpress.com Software / Resource Hash c868e0292d358f647f20f7cc789981ff08fa20aefe0e1812ede119c9ca7d50af Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Frame-Options deny X-Xss-Protection 1 Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host paywithbank-dev.americanexpress.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept */* Cache-Control no-cache Sec-Fetch-Dest script Referer https://paywithbank-dev.americanexpress.com/ Cookie TS01fcf672=018b11f77a35179238ab2dc48caf662338b9e7c63d974a7b9528aa4885fae2f03ca8c7e639984908281f8f5ccda6b63b6a258ceedc Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://paywithbank-dev.americanexpress.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Strict-Transport-Security max-age=63072000; includeSubDomains; preload Access-Control-Request-Method * ETag W/"4a279-17badb89b90" X-B3-TraceId 20000000371716317bd9284a61000000 Content-Security-Policy-Report-Only connect-src 'self' https://paywithbankapi-dev.americanexpress.com/ https://*.evidon.com/; form-action 'none'; report-uri https://csp.tsrs.cloud/r/8134b5005b6985aecac8fe6fcea646a83e7d6714; style-src 'unsafe-inline'; img-src 'self' data: https:; object-src 'none'; script-src https://c.evidon.com/ https://www.gstatic.com/ 'unsafe-inline' 'self' 'unsafe-eval' https://apis.google.com/; worker-src 'none'; font-src https://www.aexp-static.com/; block-all-mixed-content;base-uri 'none'; frame-src 'none'; media-src 'none'; frame-ancestors 'none'; Connection keep-alive Vary Origin X-XSS-Protection 1 Access-Control-Allow-Headers Origin, Content-Type, Authorization, Content-Length, X-Requested-With, Accept, X-Forwarded-For, tracking_id, x-pisp-jwt-token, x-pwb-jwt-token, x-ls-id, x-browser-app-version, x-browser-user-agent, User-Agent, sdk_version, sdk_version_number, sdk_build_date Last-Modified Fri, 03 Sep 2021 22:12:42 GMT X-B3-SpanId 17bd9284a61bf000 Date Sun, 12 Sep 2021 08:38:21 GMT X-Frame-Options deny Access-Control-Allow-Methods GET, POST, PUT, DELETE, OPTIONS, HEAD Content-Type application/javascript; charset=UTF-8 Access-Control-Allow-Origin https://paywithbank-dev.americanexpress.com Access-Control-Expose-Headers tracking_id, x-pisp-jwt-token, x-pwb-jwt-token, x-ls-id, x-browser-app-version, x-browser-user-agent Cache-Control no-store, no-cache, must-revalidate Transfer-Encoding chunked X-B3-Sampled 1 Set-Cookie TS01fcf672=018b11f77a35179238ab2dc48caf662338b9e7c63d974a7b9528aa4885fae2f03ca8c7e639984908281f8f5ccda6b63b6a258ceedc; Path=/; Domain=.paywithbank-dev.americanexpress.com Accept-Ranges bytes Keep-Alive timeout=100 Access-Control-Allow-Credentials true
GET H2	200	0fababca-4914-46dd-9b0f-efbd51f67ae8-3.woff www.aexp-static.com/nav/ngn/fonts/	37 KB 38 KB	294ms 9ms	Font font/woff	104.117.208.213 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.aexp-static.com/nav/ngn/fonts/0fababca-4914-46dd-9b0f-efbd51f67ae8-3.woff Requested by Host: paywithbank-dev.americanexpress.com URL: https://paywithbank-dev.americanexpress.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.117.208.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-117-208-213.deploy.static.akamaitechnologies.com Software / Resource Hash 568d1bad8ef5d3ee9e14e5bdc304985d4d9a8d791bfe4fdb689fc2bef638466c Request headers Referer https://paywithbank-dev.americanexpress.com/ Origin https://paywithbank-dev.americanexpress.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Sun, 12 Sep 2021 08:38:22 GMT last-modified Wed, 15 Aug 2018 20:46:09 GMT etag "5b749111-943d" access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD content-type font/woff access-control-allow-origin * cache-control max-age=15552000 access-control-allow-credentials true accept-ranges bytes timing-allow-origin * access-control-allow-headers Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With content-length 37949 expires Tue, 02 Mar 2021 18:25:18 GMT
GET H2	200	3be50273-0b2e-4aef-ae68-882eacd611f9-3.woff www.aexp-static.com/nav/ngn/fonts/	36 KB 37 KB	301ms 17ms	Font font/woff	104.117.208.213 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.aexp-static.com/nav/ngn/fonts/3be50273-0b2e-4aef-ae68-882eacd611f9-3.woff Requested by Host: paywithbank-dev.americanexpress.com URL: https://paywithbank-dev.americanexpress.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.117.208.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-117-208-213.deploy.static.akamaitechnologies.com Software / Resource Hash 48050d8eeb740bb31aaad9eb82bcd4a493b474c9385eeda5fc2ca2ea279cffad Request headers Referer https://paywithbank-dev.americanexpress.com/ Origin https://paywithbank-dev.americanexpress.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Sun, 12 Sep 2021 08:38:22 GMT last-modified Wed, 15 Aug 2018 20:46:09 GMT etag "5b749111-9121" access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD content-type font/woff access-control-allow-origin * cache-control max-age=15552000 access-control-allow-credentials true accept-ranges bytes timing-allow-origin * access-control-allow-headers Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With content-length 37153 expires Mon, 29 Mar 2021 21:38:37 GMT
GET H/1.1	200 OK	pwb-logo-single-pink.svg qicm.americanexpress.com/Internet/IMDC/paywithbank/svg/	19 KB 7 KB	885ms 169ms	Image image/svg+xml	12.105.185.175 AMERICAN-EXPRESS
General Check archive.org Show headers Download Go to Show image Full URL https://qicm.americanexpress.com/Internet/IMDC/paywithbank/svg/pwb-logo-single-pink.svg Requested by Host: paywithbank-dev.americanexpress.com URL: https://paywithbank-dev.americanexpress.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 12.105.185.175 , United States, ASN6307 (AMERICAN-EXPRESS, US), Reverse DNS qicm.americanexpress.com Software / Resource Hash 4f868be14b1c02c922444a553a65cfc2b87a0bc7e6f7674d08b22f09d47ab00d Security Headers Name Value Strict-Transport-Security max-age=16070400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://paywithbank-dev.americanexpress.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Sun, 12 Sep 2021 08:38:23 GMT Content-Encoding gzip X-Content-Type-Options nosniff Last-Modified Thu, 01 Jul 2021 17:08:53 GMT ETag "4c1b-5c612e4c3de5e-gzip" X-Frame-Options SAMEORIGIN Connection close Content-Type image/svg+xml Access-Control-Allow-Origin * Cache-Control public, max-age=86400, must-revalidate Strict-Transport-Security max-age=16070400 Accept-Ranges bytes Vary Accept-Encoding Content-Length 6481 X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	error.png qicm.americanexpress.com/Internet/IMDC/paywithbank/images/	6 KB 6 KB	882ms 166ms	Image image/png	12.105.185.175 AMERICAN-EXPRESS
General Check archive.org Show headers Download Go to Show image Full URL https://qicm.americanexpress.com/Internet/IMDC/paywithbank/images/error.png?version=v12903 Requested by Host: paywithbank-dev.americanexpress.com URL: https://paywithbank-dev.americanexpress.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 12.105.185.175 , United States, ASN6307 (AMERICAN-EXPRESS, US), Reverse DNS qicm.americanexpress.com Software / Resource Hash 47e6da8cab53ec9cdae2e9496c6a90913f84765f8d6056b3a2ab56056d41b121 Security Headers Name Value Strict-Transport-Security max-age=16070400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://paywithbank-dev.americanexpress.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Sun, 12 Sep 2021 08:38:23 GMT Content-Encoding gzip X-Content-Type-Options nosniff Last-Modified Tue, 30 Mar 2021 21:08:44 GMT ETag "172b-5bec767517563-gzip" X-Frame-Options SAMEORIGIN Connection close Content-Type image/png Access-Control-Allow-Origin * Cache-Control public, max-age=86400, must-revalidate Strict-Transport-Security max-age=16070400 Accept-Ranges bytes Vary Accept-Encoding Content-Length 5954 X-XSS-Protection 1; mode=block

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

paywithbank-dev.americanexpress.com
qicm.americanexpress.com
www.aexp-static.com
104.117.208.213
12.105.185.175
139.71.66.166
47e6da8cab53ec9cdae2e9496c6a90913f84765f8d6056b3a2ab56056d41b121
48050d8eeb740bb31aaad9eb82bcd4a493b474c9385eeda5fc2ca2ea279cffad
4f868be14b1c02c922444a553a65cfc2b87a0bc7e6f7674d08b22f09d47ab00d
568d1bad8ef5d3ee9e14e5bdc304985d4d9a8d791bfe4fdb689fc2bef638466c
8465fb893f0c60bc76f94337f97673c461792c9d71de750126a2083d6f911869
c868e0292d358f647f20f7cc789981ff08fa20aefe0e1812ede119c9ca7d50af