urlscan.io logo urlscan.io
SecurityTrails logo

meridian.cobr-21.merx-test.merx.fluxtest.app Open in urlscan Pro
3.105.70.153  Public Scan

Go To Rescan Add Verdict Report
URL: https://meridian.cobr-21.merx-test.merx.fluxtest.app/
Submission: On February 13 via automatic, source certstream-suspicious — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 3.105.70.153, located in Sydney, Australia and belongs to AMAZON-02, US. The main domain is meridian.cobr-21.merx-test.merx.fluxtest.app.
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on February 13th 2024. Valid for: 3 months.
This is the only time meridian.cobr-21.merx-test.merx.fluxtest.app was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
6 3.105.70.153 16509 (AMAZON-02)
6 1
Apex Domain
Subdomains		 Transfer
6 fluxtest.app
meridian.cobr-21.merx-test.merx.fluxtest.app
417 KB
6 1
Domain Requested by
6 meridian.cobr-21.merx-test.merx.fluxtest.app meridian.cobr-21.merx-test.merx.fluxtest.app
6 1

This site contains links to these domains. Also see Links.

Domain
www.meridian.cobr-21.merx-test.merx.fluxtest.app
www.google.com
Subject Issuer Validity Valid
meridian.cobr-21.merx-test.merx.fluxtest.app
ZeroSSL RSA Domain Secure Site CA		 2024-02-13 -
2024-05-13		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://meridian.cobr-21.merx-test.merx.fluxtest.app/
Frame ID: 4E8AA248755625DB83135E23ED6AD0D4
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Meridian Login

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

417 kB
Transfer

1428 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
meridian.cobr-21.merx-test.merx.fluxtest.app/ 		5 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://meridian.cobr-21.merx-test.merx.fluxtest.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.105.70.153 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-105-70-153.ap-southeast-2.compute.amazonaws.com
Software
envoy /
Resource Hash
8309d2c7da641f636d56766ce8805d8149053ac3ed1ea699e6f32de4432546ec
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

cache-control
no-store
content-security-policy-report-only
default-src 'self' https://tags.tiqcdn.com/utag/meridianenergy/flux https://tags.tiqcdn.com/utag/meridianenergy/psnz-flux https://ci.cdn.fluxci.com/ https://www.googletagmanager.com https://maps.googleapis.com/maps/api https://www.google-analytics.com https://app.launchdarkly.com https://events.launchdarkly.com https://clientstream.launchdarkly.com; img-src 'self' data: http://www.w3.org/2000/svg https://heapanalytics.com https://ci.cdn.fluxci.com/ https://*.mypurecloud.com.au https://*.apse2.pure.cloud; object-src https://*.mypurecloud.com.au https://*.apse2.pure.cloud; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://cdn.heapanalytics.com https://heapanalytics.com http://www.googletagmanager.com http://cdn.heapanalytics.com https://ci.cdn.fluxci.com/ https://*.nr-data.net https://*.newrelic.com https://*.mypurecloud.com.au https://*.apse2.pure.cloud; style-src 'self' 'unsafe-inline' https://heapanalytics.com https://ci.cdn.fluxci.com/; connect-src 'self' https://app.launchdarkly.com https://events.launchdarkly.com https://*.mypurecloud.com.au https://*.nr-data.net https://shyrka-prod-apse2.s3.ap-southeast-2.amazonaws.com https://*.newrelic.com https://*.apse2.pure.cloud wss://*.mypurecloud.com.au wss://*.apse2.pure.cloud; media-src https://*.mypurecloud.com.au https://*.apse2.pure.cloud; child-src https://*.mypurecloud.com.au https://*.apse2.pure.cloud; report-uri /csp_violations
content-type
text/html; charset=utf-8
date
Tue, 13 Feb 2024 19:25:49 GMT
etag
W/"8309d2c7da641f636d56766ce8805d81"
link
</assets/meridian/assets/stylesheets/login-0d321e3fc76ae52cd496a24c6865d27fd28649a8a461b5edf010b64c38043f1a.css>; rel=preload; as=style; nopush,</assets/vendor-9fd240a8a4ebd83357d4744aacca9e77e3d9d7fba486422adef482efccd86e15.js>; rel=preload; as=script; nopush
referrer-policy
strict-origin-when-cross-origin
server
envoy
strict-transport-security
max-age=63072000; includeSubDomains
x-content-type-options
nosniff
x-download-options
noopen
x-envoy-upstream-service-time
22
x-frame-options
SAMEORIGIN
x-permitted-cross-domain-policies
none
x-request-id
f1e49756-9641-4848-a30f-4fca6a72a332
x-runtime
0.018479
x-ua-compatible
IE=Edge,chrome=1
x-xss-protection
0
login-0d321e3fc76ae52cd496a24c6865d27fd28649a8a461b5edf010b64c38043f1a.css
meridian.cobr-21.merx-test.merx.fluxtest.app/assets/meridian/assets/stylesheets/ 		21 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://meridian.cobr-21.merx-test.merx.fluxtest.app/assets/meridian/assets/stylesheets/login-0d321e3fc76ae52cd496a24c6865d27fd28649a8a461b5edf010b64c38043f1a.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.105.70.153 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-105-70-153.ap-southeast-2.compute.amazonaws.com
Software
envoy /
Resource Hash
0d321e3fc76ae52cd496a24c6865d27fd28649a8a461b5edf010b64c38043f1a
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://meridian.cobr-21.merx-test.merx.fluxtest.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Tue, 13 Feb 2024 19:25:49 GMT
content-encoding
gzip
strict-transport-security
max-age=63072000; includeSubDomains
last-modified
Tue, 13 Feb 2024 19:15:48 GMT
server
envoy
vary
Accept-Encoding
content-type
text/css
x-envoy-upstream-service-time
2
content-length
3724
vendor-9fd240a8a4ebd83357d4744aacca9e77e3d9d7fba486422adef482efccd86e15.js
meridian.cobr-21.merx-test.merx.fluxtest.app/assets/ 		1 MB
346 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://meridian.cobr-21.merx-test.merx.fluxtest.app/assets/vendor-9fd240a8a4ebd83357d4744aacca9e77e3d9d7fba486422adef482efccd86e15.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.105.70.153 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-105-70-153.ap-southeast-2.compute.amazonaws.com
Software
envoy /
Resource Hash
9fd240a8a4ebd83357d4744aacca9e77e3d9d7fba486422adef482efccd86e15
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://meridian.cobr-21.merx-test.merx.fluxtest.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Tue, 13 Feb 2024 19:25:49 GMT
content-encoding
gzip
strict-transport-security
max-age=63072000; includeSubDomains
last-modified
Tue, 13 Feb 2024 19:15:48 GMT
server
envoy
vary
Accept-Encoding
content-type
application/javascript
x-envoy-upstream-service-time
3
content-length
353637
logotype-bright-0e4e81edfa578aee802380da3b2bea15ffc2936d6cf0abdf5b60100800bfca10.svg
meridian.cobr-21.merx-test.merx.fluxtest.app/assets/meridian/assets/images/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://meridian.cobr-21.merx-test.merx.fluxtest.app/assets/meridian/assets/images/logotype-bright-0e4e81edfa578aee802380da3b2bea15ffc2936d6cf0abdf5b60100800bfca10.svg
Requested by
Host: meridian.cobr-21.merx-test.merx.fluxtest.app
URL: https://meridian.cobr-21.merx-test.merx.fluxtest.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.105.70.153 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-105-70-153.ap-southeast-2.compute.amazonaws.com
Software
envoy /
Resource Hash
0e4e81edfa578aee802380da3b2bea15ffc2936d6cf0abdf5b60100800bfca10
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://meridian.cobr-21.merx-test.merx.fluxtest.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Tue, 13 Feb 2024 19:25:49 GMT
strict-transport-security
max-age=63072000; includeSubDomains
x-envoy-upstream-service-time
3
last-modified
Tue, 13 Feb 2024 19:11:58 GMT
server
envoy
content-length
4072
content-type
image/svg+xml
centra_no2-book-8ee40ef7a00fdaea24cc20df280227d3570f5ec47802871d13b4a0079e390a96.woff
meridian.cobr-21.merx-test.merx.fluxtest.app/assets/ 		57 KB
57 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://meridian.cobr-21.merx-test.merx.fluxtest.app/assets/centra_no2-book-8ee40ef7a00fdaea24cc20df280227d3570f5ec47802871d13b4a0079e390a96.woff
Requested by
Host: meridian.cobr-21.merx-test.merx.fluxtest.app
URL: https://meridian.cobr-21.merx-test.merx.fluxtest.app/assets/meridian/assets/stylesheets/login-0d321e3fc76ae52cd496a24c6865d27fd28649a8a461b5edf010b64c38043f1a.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.105.70.153 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-105-70-153.ap-southeast-2.compute.amazonaws.com
Software
envoy /
Resource Hash
8ee40ef7a00fdaea24cc20df280227d3570f5ec47802871d13b4a0079e390a96
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

Referer
https://meridian.cobr-21.merx-test.merx.fluxtest.app/assets/meridian/assets/stylesheets/login-0d321e3fc76ae52cd496a24c6865d27fd28649a8a461b5edf010b64c38043f1a.css
Origin
https://meridian.cobr-21.merx-test.merx.fluxtest.app
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Tue, 13 Feb 2024 19:25:49 GMT
strict-transport-security
max-age=63072000; includeSubDomains
x-envoy-upstream-service-time
3
last-modified
Tue, 13 Feb 2024 19:11:57 GMT
server
envoy
content-length
57980
content-type
application/font-woff
cookie_test
meridian.cobr-21.merx-test.merx.fluxtest.app/customer/ 		2 B
392 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://meridian.cobr-21.merx-test.merx.fluxtest.app/customer/cookie_test
Requested by
Host: meridian.cobr-21.merx-test.merx.fluxtest.app
URL: https://meridian.cobr-21.merx-test.merx.fluxtest.app/assets/vendor-9fd240a8a4ebd83357d4744aacca9e77e3d9d7fba486422adef482efccd86e15.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.105.70.153 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-105-70-153.ap-southeast-2.compute.amazonaws.com
Software
envoy /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept
text/javascript, text/html, application/xml, text/xml, */*
X-Prototype-Version
1.7
Referer
https://meridian.cobr-21.merx-test.merx.fluxtest.app/
X-Requested-With
XMLHttpRequest
X-CSRF-Token
DDXJMYO9PFX4xktvFc8uLASckFZhGOaI27P02fUbWFxTpNnb6whVfnWBezrfxUgYUyjxarVsm981GzvXS8abBg
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Tue, 13 Feb 2024 19:25:49 GMT
strict-transport-security
max-age=63072000; includeSubDomains
x-content-type-options
nosniff
x-permitted-cross-domain-policies
none
content-security-policy-report-only
default-src 'self' https://tags.tiqcdn.com/utag/meridianenergy/flux https://tags.tiqcdn.com/utag/meridianenergy/psnz-flux https://ci.cdn.fluxci.com/ https://www.googletagmanager.com https://maps.googleapis.com/maps/api https://www.google-analytics.com https://app.launchdarkly.com https://events.launchdarkly.com https://clientstream.launchdarkly.com; img-src 'self' data: http://www.w3.org/2000/svg https://heapanalytics.com https://ci.cdn.fluxci.com/ https://*.mypurecloud.com.au https://*.apse2.pure.cloud; object-src https://*.mypurecloud.com.au https://*.apse2.pure.cloud; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://cdn.heapanalytics.com https://heapanalytics.com http://www.googletagmanager.com http://cdn.heapanalytics.com https://ci.cdn.fluxci.com/ https://*.nr-data.net https://*.newrelic.com https://*.mypurecloud.com.au https://*.apse2.pure.cloud; style-src 'self' 'unsafe-inline' https://heapanalytics.com https://ci.cdn.fluxci.com/; connect-src 'self' https://app.launchdarkly.com https://events.launchdarkly.com https://*.mypurecloud.com.au https://*.nr-data.net https://shyrka-prod-apse2.s3.ap-southeast-2.amazonaws.com https://*.newrelic.com https://*.apse2.pure.cloud wss://*.mypurecloud.com.au wss://*.apse2.pure.cloud; media-src https://*.mypurecloud.com.au https://*.apse2.pure.cloud; child-src https://*.mypurecloud.com.au https://*.apse2.pure.cloud; report-uri /csp_violations
x-envoy-upstream-service-time
39
x-xss-protection
0
x-request-id
91cf26e7-588a-4946-b34a-9bf335af715f
x-ua-compatible
IE=Edge,chrome=1
x-runtime
0.036552
referrer-policy
strict-origin-when-cross-origin
server
envoy
etag
W/"565339bc4d33d72817b583024112eb7f"
x-download-options
noopen
vary
Accept
x-frame-options
SAMEORIGIN
content-type
text/plain; charset=utf-8
cache-control
no-store

Verdicts & Comments Add Verdict or Comment

51 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| Prototype object| Abstract object| Try object| Class function| PeriodicalExecuter function| Template object| $break object| Enumerable function| $A function| $w function| $H function| Hash function| $R function| ObjectRange object| Ajax function| $ object| Form object| Field function| $F object| Toggle object| Insertion object| $continue object| Position object| Effect object| Droppables object| Draggables function| Draggable function| SortableObserver object| Sortable object| Autocompleter object| swfobject function| extraButtonsPlugin function| partialFocusPlugin object| UI function| AutoComplete object| Modernizr object| html5 function| yepnope function| jQuery function| Tether function| Drop function| _ function| $$ undefined| Sizzle function| Selector function| flatpickr_v2_6_3 function| FlatpickrInstance object| jQuery18307822048338759569 object| LDClient boolean| isIE10 boolean| isIE11

2 Cookies

Domain/Path Name / Value
meridian.cobr-21.merx-test.merx.fluxtest.app/ Name: cookie_test
Value: meridian
meridian.cobr-21.merx-test.merx.fluxtest.app/ Name: nz_session
Value: tE5yPfO%2BFoyQSMdMuFablZlqjraSuBvaJiOTijLcYq3gwdaqVxrM%2Fm2xUG%2F%2F54ujJRS9VMn%2Fq%2BtfPWmFVpqsaVPPFf6HFPmwhMlO%2BeJkcNcJkRgrEUrVy6LFdL62vVNQREBEfBqdbUsmvrxdFPsliW2uJkYtdOpOUtZQxrQfVp%2FqAeuC4aiPN2vmmEmztw%3D%3D--%2BikaoRNtf%2Bylr5Gu--77If3wY3fmJMuCmezwI6IA%3D%3D

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0