urlscan.io logo urlscan.io
SecurityTrails logo

servicing-card.johnlewisfinance.com Open in urlscan Pro
217.73.37.41  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://servicing-card.johnlewisfinance.com/johnlewis/signin
Effective URL: https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/
Submission: On September 17 via manual from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 2 domains to perform 21 HTTP transactions. The main IP is 217.73.37.41, located in Germany and belongs to FDD, DE. The main domain is servicing-card.johnlewisfinance.com.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on August 15th 2019. Valid for: a year.
This is the only time servicing-card.johnlewisfinance.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 18 217.73.37.41 16072 (FDD)
2 104.111.230.61 16625 (AKAMAI-AS)
1 52.213.34.91 16509 (AMAZON-02)
21 4
Apex Domain
Subdomains		 Transfer
18 johnlewisfinance.com
servicing-card.johnlewisfinance.com
1 MB
3 monetate.net
se.monetate.net
f.monetate.net
47 KB
21 2
Domain Requested by
18 servicing-card.johnlewisfinance.com 1 redirects servicing-card.johnlewisfinance.com
2 se.monetate.net servicing-card.johnlewisfinance.com
se.monetate.net
1 f.monetate.net se.monetate.net
21 3

This site contains no links.

Subject Issuer Validity Valid
servicing-card.johnlewisfinance.com
DigiCert SHA2 Extended Validation Server CA		 2019-08-15 -
2020-08-15		 a year crt.sh
www.monetate.net
DigiCert SHA2 Secure Server CA		 2019-05-03 -
2020-08-01		 a year crt.sh
*.monetate.net
DigiCert SHA2 Secure Server CA		 2018-07-12 -
2020-09-04		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/
Frame ID: 894DEE0A75CA459AFA197730EEAD179E
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://servicing-card.johnlewisfinance.com/johnlewis/signin HTTP 302
    https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/ Page URL

Page Statistics

21
Requests

95 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

4
IPs

3
Countries

1117 kB
Transfer

4529 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://servicing-card.johnlewisfinance.com/johnlewis/signin HTTP 302
    https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set /
servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/
Redirect Chain
  • https://servicing-card.johnlewisfinance.com/johnlewis/signin
  • https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/
4 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
217.73.37.41 , Germany, ASN16072 (FDD, DE),
Reverse DNS
Software
/
Resource Hash
0b4a0dd9b23b42463a9fc347ee143bb10347b179a46fe173383e80512c8ff20c
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Strict-Transport-Security max-age=31536000; includeSubdomains; preload max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff nosniff
X-Frame-Options SAMEORIGIN SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Host
servicing-card.johnlewisfinance.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
none
Accept-Encoding
gzip, deflate, br
Cookie
NSC_KMQ-TFSWJDJOH-DBSE-TOJ-WJQ=ffffffff0940542a45525d5f4f58455e445a4a4216cb
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

Date
Tue, 17 Sep 2019 09:27:32 GMT
Strict-Transport-Security
max-age=31536000; includeSubdomains; preload max-age=31536000; includeSubDomains
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET,POST,OPTIONS
Access-Control-Max-Age
600
X-Content-Type-Options
nosniff nosniff
X-Frame-Options
SAMEORIGIN SAMEORIGIN
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control
no-cache
X-XSS-Protection
1; mode=block
Pragma
no-cache
Referrer-Policy
strict-origin-when-cross-origin
Content-Type
text/html;charset=UTF-8
Content-Language
en-US
Vary
Accept-Encoding
Content-Encoding
gzip
Set-Cookie
CURRENT_EFFECTIVE_LOCALE.5033c655-fdf9-46dd-8bda-6a9cbd1321e0=en-US; path=/gateway; HttpOnly; Max-Age=3600; Expires=Tue, 17-Sep-2019 10:27:32 GMT;Secure;HttpOnly;Secure XSRF-TOKEN=9355967a-fd1a-48c9-9fc0-b52d253dca32; path=/;Secure anonymousUserId=8a85b073-5392-4353-b777-35bb9a6606d5; path=/gateway/api; HttpOnly; Max-Age=31536000; Expires=Wed, 16-Sep-2020 09:27:32 GMT;Secure;HttpOnly;Secure ROUTEID=.1; path=/;Secure;HttpOnly;Secure
Content-Security-Policy
upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
X-Permitted-Cross-Domain-Policies
none
Content-Length
1345
Keep-Alive
timeout=5, max=391
Connection
Keep-Alive

Redirect headers

Date
Tue, 17 Sep 2019 09:27:31 GMT
Strict-Transport-Security
max-age=31536000; includeSubdomains; preload
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET,POST,OPTIONS
Access-Control-Max-Age
600
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
Location
https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/
Content-Length
257
Keep-Alive
timeout=5, max=411
Connection
Keep-Alive
Content-Type
text/html; charset=iso-8859-1
Set-Cookie
NSC_KMQ-TFSWJDJOH-DBSE-TOJ-WJQ=ffffffff0940542a45525d5f4f58455e445a4a4216cb;path=/;secure;httponly
.css
servicing-card.johnlewisfinance.com/gateway/api/portal/static/items//styles/ 		0
0
styles.1eb4912cddfb137a866b.css
servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/ 		517 KB
83 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/styles.1eb4912cddfb137a866b.css
Requested by
Host: servicing-card.johnlewisfinance.com
URL: https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
217.73.37.41 , Germany, ASN16072 (FDD, DE),
Reverse DNS
Software
/
Resource Hash
e19322177a5f26d46cad65ecc7fd404fdc7f61af455412ba89f59e33847ba84e
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Strict-Transport-Security max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 17 Sep 2019 09:27:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff, nosniff
X-Permitted-Cross-Domain-Policies
none
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,POST,OPTIONS
Connection
Keep-Alive
Vary
Accept-Encoding
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Tue, 10 Sep 2019 17:12:43 GMT
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
ETag
"03a41649fcfb7cb497159db999531c384-gzip"
Access-Control-Max-Age
600
Strict-Transport-Security
max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
Content-Language
en
Access-Control-Allow-Origin
*
Cache-Control
public; max-age=3600
Content-Security-Policy
upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Accept-Ranges
bytes
Content-Type
text/css;charset=UTF-8
Keep-Alive
timeout=5, max=389
vendor-bb-systemjs.js
servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/vendor-bb-systemjs/scripts/ 		60 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/vendor-bb-systemjs/scripts/vendor-bb-systemjs.js
Requested by
Host: servicing-card.johnlewisfinance.com
URL: https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
217.73.37.41 , Germany, ASN16072 (FDD, DE),
Reverse DNS
Software
/
Resource Hash
6a202fff38bebc732c9792c0abd1eb4b11fa26d338194d70d42a9bf0a1b1c837
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Strict-Transport-Security max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 17 Sep 2019 09:27:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff, nosniff
X-Permitted-Cross-Domain-Policies
none
Access-Control-Allow-Methods
GET,POST,OPTIONS
Connection
Keep-Alive
Vary
Accept-Encoding
Content-Length
19475
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Thu, 29 Aug 2019 14:27:41 GMT
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
ETag
"0ee3d297423d119d6728d0ed3585a34cd-gzip"
Access-Control-Max-Age
600
Strict-Transport-Security
max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
Content-Language
en
Access-Control-Allow-Origin
*
Cache-Control
public; max-age=3600
Content-Security-Policy
upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Accept-Ranges
bytes
Content-Type
application/javascript;charset=UTF-8
Keep-Alive
timeout=5, max=472
config-bb-module-loader.js
servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/config-bb-module-loader/scripts/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/config-bb-module-loader/scripts/config-bb-module-loader.js
Requested by
Host: servicing-card.johnlewisfinance.com
URL: https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
217.73.37.41 , Germany, ASN16072 (FDD, DE),
Reverse DNS
Software
/
Resource Hash
4c9e2f5fc071efd2a294c192e499efd047aca4efd2e252fc15df9aec53214624
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Strict-Transport-Security max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 17 Sep 2019 09:27:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff, nosniff
X-Permitted-Cross-Domain-Policies
none
Access-Control-Allow-Methods
GET,POST,OPTIONS
Connection
Keep-Alive
Vary
Accept-Encoding
Content-Length
3524
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Thu, 29 Aug 2019 14:27:41 GMT
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
ETag
"0e600d92dfca520eacf89c63def678d2e-gzip"
Access-Control-Max-Age
600
Strict-Transport-Security
max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
Content-Language
en
Access-Control-Allow-Origin
*
Cache-Control
public; max-age=3600
Content-Security-Policy
upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Accept-Ranges
bytes
Content-Type
application/javascript;charset=UTF-8
Keep-Alive
timeout=5, max=488
bundle0.js
servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bundle-bb-lean-client/scripts/ 		101 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bundle-bb-lean-client/scripts/bundle0.js
Requested by
Host: servicing-card.johnlewisfinance.com
URL: https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
217.73.37.41 , Germany, ASN16072 (FDD, DE),
Reverse DNS
Software
/
Resource Hash
9bbbedfd5f89bd5547d8f56d1451a7ad7a26afb3c6d13260e9beec0d1e2faaa4
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Strict-Transport-Security max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 17 Sep 2019 09:27:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff, nosniff
X-Permitted-Cross-Domain-Policies
none
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,POST,OPTIONS
Connection
Keep-Alive
Vary
Accept-Encoding
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Thu, 29 Aug 2019 14:27:41 GMT
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
ETag
"0209f1034b6c202a94b89572227163edb-gzip"
Access-Control-Max-Age
600
Strict-Transport-Security
max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
Content-Language
en
Access-Control-Allow-Origin
*
Cache-Control
public; max-age=3600
Content-Security-Policy
upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Accept-Ranges
bytes
Content-Type
application/javascript;charset=UTF-8
Keep-Alive
timeout=5, max=408
lib-bb-auth-bas.js
servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/lib-bb-auth-bas/scripts/ 		8 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/lib-bb-auth-bas/scripts/lib-bb-auth-bas.js
Requested by
Host: servicing-card.johnlewisfinance.com
URL: https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/vendor-bb-systemjs/scripts/vendor-bb-systemjs.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
217.73.37.41 , Germany, ASN16072 (FDD, DE),
Reverse DNS
Software
/
Resource Hash
d9acbf5185e9d8694e10f62b2c9d51eeeb96ce992f0090bec6f8a4325b25efe8
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Strict-Transport-Security max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/x-es-module, */*
Referer
https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

Date
Tue, 17 Sep 2019 09:27:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff, nosniff
X-Permitted-Cross-Domain-Policies
none
Access-Control-Allow-Methods
GET,POST,OPTIONS
Connection
Keep-Alive
Vary
Accept-Encoding
Content-Length
1985
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Thu, 29 Aug 2019 14:27:42 GMT
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
ETag
"0663a56089edb3d1b417ca98e6488fa28-gzip"
Access-Control-Max-Age
600
Strict-Transport-Security
max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
Content-Language
en
Access-Control-Allow-Origin
*
Cache-Control
public; max-age=3600
Content-Security-Policy
upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Accept-Ranges
bytes
Content-Type
application/javascript;charset=UTF-8
Keep-Alive
timeout=5, max=490
status
servicing-card.johnlewisfinance.com/gateway/api/auth/ 		0
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://servicing-card.johnlewisfinance.com/gateway/api/auth/status
Requested by
Host: servicing-card.johnlewisfinance.com
URL: https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bundle-bb-lean-client/scripts/bundle0.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
217.73.37.41 , Germany, ASN16072 (FDD, DE),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Strict-Transport-Security max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/
X-XSRF-TOKEN
9355967a-fd1a-48c9-9fc0-b52d253dca32
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json

Response headers

Date
Tue, 17 Sep 2019 09:27:32 GMT
Strict-Transport-Security
max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff, nosniff
X-Permitted-Cross-Domain-Policies
none
Connection
Keep-Alive
Content-Length
0
X-XSS-Protection
1; mode=block
Pragma
no-cache
Referrer-Policy
strict-origin-when-cross-origin
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET,POST,OPTIONS
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Content-Security-Policy
upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Keep-Alive
timeout=5, max=489
Expires
0
page_1550859167391.xml
servicing-card.johnlewisfinance.com/gateway/api/portals/jlp/pages/ 		38 KB
5 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://servicing-card.johnlewisfinance.com/gateway/api/portals/jlp/pages/page_1550859167391.xml?lang=en-US
Requested by
Host: servicing-card.johnlewisfinance.com
URL: https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bundle-bb-lean-client/scripts/bundle0.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
217.73.37.41 , Germany, ASN16072 (FDD, DE),
Reverse DNS
Software
/
Resource Hash
add2261dfcb1bf0751e2cabb434eb47f33a4dcf36cc2873e35e10ced27d03edd
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Strict-Transport-Security max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/
X-XSRF-TOKEN
9355967a-fd1a-48c9-9fc0-b52d253dca32
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/xml

Response headers

Date
Tue, 17 Sep 2019 09:27:33 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff, nosniff
X-Permitted-Cross-Domain-Policies
none
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
Vary
Accept-Encoding
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET,POST,OPTIONS
Content-Language
en-US
Access-Control-Allow-Origin
*
Connection
Keep-Alive
Content-Security-Policy
upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Content-Type
application/xml;charset=UTF-8
Keep-Alive
timeout=5, max=388
runtime.06daa30a2963fa413676.js
servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/ 		1 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/runtime.06daa30a2963fa413676.js
Requested by
Host: servicing-card.johnlewisfinance.com
URL: https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bundle-bb-lean-client/scripts/bundle0.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
217.73.37.41 , Germany, ASN16072 (FDD, DE),
Reverse DNS
Software
/
Resource Hash
eb3d5f2600910179bef8b0709214b7c721ea66e92ebb35bc282264beb2631eaf
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Strict-Transport-Security max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 17 Sep 2019 09:27:33 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff, nosniff
X-Permitted-Cross-Domain-Policies
none
Access-Control-Allow-Methods
GET,POST,OPTIONS
Connection
Keep-Alive
Vary
Accept-Encoding
Content-Length
712
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Tue, 10 Sep 2019 17:12:43 GMT
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
ETag
"0cd1ce3e306bf57f272364d1cc0249d6e-gzip"
Access-Control-Max-Age
600
Strict-Transport-Security
max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
Content-Language
en
Access-Control-Allow-Origin
*
Cache-Control
public; max-age=3600
Content-Security-Policy
upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Accept-Ranges
bytes
Content-Type
application/javascript;charset=UTF-8
Keep-Alive
timeout=5, max=487
polyfills.a93dc8cfbb67070d1e5c.js
servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/ 		156 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/polyfills.a93dc8cfbb67070d1e5c.js
Requested by
Host: servicing-card.johnlewisfinance.com
URL: https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bundle-bb-lean-client/scripts/bundle0.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
217.73.37.41 , Germany, ASN16072 (FDD, DE),
Reverse DNS
Software
/
Resource Hash
00a6e2f2047af74d2ba5030767e62aea1e4a0f537c1ea78ee9a5fcd50e4d7269
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Strict-Transport-Security max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 17 Sep 2019 09:27:33 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff, nosniff
X-Permitted-Cross-Domain-Policies
none
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,POST,OPTIONS
Connection
Keep-Alive
Vary
Accept-Encoding
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Tue, 10 Sep 2019 17:12:43 GMT
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
ETag
"08aa63537306c9ab50514713bc3ed919b-gzip"
Access-Control-Max-Age
600
Strict-Transport-Security
max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
Content-Language
en
Access-Control-Allow-Origin
*
Cache-Control
public; max-age=3600
Content-Security-Policy
upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Accept-Ranges
bytes
Content-Type
application/javascript;charset=UTF-8
Keep-Alive
timeout=5, max=471
main.441d9cad0e948f57c752.js
servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/ 		3 MB
707 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/main.441d9cad0e948f57c752.js
Requested by
Host: servicing-card.johnlewisfinance.com
URL: https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bundle-bb-lean-client/scripts/bundle0.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
217.73.37.41 , Germany, ASN16072 (FDD, DE),
Reverse DNS
Software
/
Resource Hash
f464f7992276b1f0ee4f1719e47aaeb1725f936f55473f265aa0c32162f979bd
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Strict-Transport-Security max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 17 Sep 2019 09:27:33 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff, nosniff
X-Permitted-Cross-Domain-Policies
none
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,POST,OPTIONS
Connection
Keep-Alive
Vary
Accept-Encoding
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Tue, 10 Sep 2019 17:12:43 GMT
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
ETag
"02663a59f49fd01bc4c68ce3bd739f801-gzip"
Access-Control-Max-Age
600
Strict-Transport-Security
max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
Content-Language
en
Access-Control-Allow-Origin
*
Cache-Control
public; max-age=3600
Content-Security-Policy
upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Accept-Ranges
bytes
Content-Type
application/javascript;charset=UTF-8
Keep-Alive
timeout=5, max=407
monetate.js
servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/assets/js/ 		37 B
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/assets/js/monetate.js
Requested by
Host: servicing-card.johnlewisfinance.com
URL: https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/main.441d9cad0e948f57c752.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
217.73.37.41 , Germany, ASN16072 (FDD, DE),
Reverse DNS
Software
/
Resource Hash
e636d4c931ee1387da11a50332c70fd0bc301c1d5231dbc5b864e06f2d51abcb
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Strict-Transport-Security max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 17 Sep 2019 09:27:33 GMT
Strict-Transport-Security
max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff, nosniff
X-Permitted-Cross-Domain-Policies
none
Connection
Keep-Alive
Content-Length
37
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Tue, 10 Sep 2019 17:12:43 GMT
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
ETag
"0d4b41db9483567977e52ee4805f3fbd2"
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET,POST,OPTIONS
Content-Language
en
Access-Control-Allow-Origin
*
Cache-Control
public; max-age=3600
Content-Security-Policy
upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Accept-Ranges
bytes
Content-Type
application/javascript;charset=UTF-8
Keep-Alive
timeout=5, max=485
entry.js
se.monetate.net/js/2/a-0f7c2d73/p/johnlewisfinance.com/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://se.monetate.net/js/2/a-0f7c2d73/p/johnlewisfinance.com/entry.js
Requested by
Host: servicing-card.johnlewisfinance.com
URL: https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/main.441d9cad0e948f57c752.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.230.61 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-230-61.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
8c777fd591a32e1a19313b823fe949259c1aa5aa66d51ba0d6f78401799c43af

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicing-card.johnlewisfinance.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 17 Sep 2019 09:27:33 GMT
content-encoding
gzip
last-modified
Mon, 09 Sep 2019 14:03:26 GMT
server
Apache
etag
"c19b7dda60de27c6ee70658d31ffcfba:1568037806"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
3010
johnlewis-logo.png
servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/assets/images/ 		23 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/assets/images/johnlewis-logo.png
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
217.73.37.41 , Germany, ASN16072 (FDD, DE),
Reverse DNS
Software
/
Resource Hash
f6c902601fcf1269e64ece29edfc064716b37c0e315adc1e5138ed73cbf7ecf0
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Strict-Transport-Security max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 17 Sep 2019 09:27:33 GMT
Strict-Transport-Security
max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff, nosniff
X-Permitted-Cross-Domain-Policies
none
Transfer-Encoding
chunked
Connection
Keep-Alive
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Tue, 10 Sep 2019 17:12:43 GMT
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
ETag
"08fbbcc729531b2c41ac135617dd5b7ef"
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET,POST,OPTIONS
Content-Language
en
Access-Control-Allow-Origin
*
Cache-Control
public; max-age=3600
Content-Security-Policy
upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Accept-Ranges
bytes
Content-Type
image/png;charset=UTF-8
Keep-Alive
timeout=5, max=484
GillSansforJL-Regular.0c1e8a33920d65c6b468.woff
servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/ 		30 KB
31 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/GillSansforJL-Regular.0c1e8a33920d65c6b468.woff
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
217.73.37.41 , Germany, ASN16072 (FDD, DE),
Reverse DNS
Software
/
Resource Hash
8d32c1c14fe07e0e204077bb04f2348f35fefa3e801ee5e417a8d9b04be497b4
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Strict-Transport-Security max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/styles.1eb4912cddfb137a866b.css
Origin
https://servicing-card.johnlewisfinance.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 17 Sep 2019 09:27:33 GMT
Strict-Transport-Security
max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff, nosniff
X-Permitted-Cross-Domain-Policies
none
Transfer-Encoding
chunked
Connection
Keep-Alive
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Tue, 10 Sep 2019 17:12:43 GMT
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
ETag
"00c1e8a33920d65c6b468be77b2c453f3"
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET,POST,OPTIONS
Content-Language
en
Access-Control-Allow-Origin
*
Cache-Control
public; max-age=3600
Content-Security-Policy
upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Accept-Ranges
bytes
Content-Type
application/font-woff;charset=UTF-8
Keep-Alive
timeout=5, max=483
GillSansforJL-Light.5475dfc41307909ee640.woff
servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/ 		38 KB
40 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/GillSansforJL-Light.5475dfc41307909ee640.woff
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
217.73.37.41 , Germany, ASN16072 (FDD, DE),
Reverse DNS
Software
/
Resource Hash
a24b950ac6b1f6a7b348bc2e0be039beb5de26f5a240f38f2e8a2f5d7efc3160
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Strict-Transport-Security max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/styles.1eb4912cddfb137a866b.css
Origin
https://servicing-card.johnlewisfinance.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 17 Sep 2019 09:27:33 GMT
Strict-Transport-Security
max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff, nosniff
X-Permitted-Cross-Domain-Policies
none
Transfer-Encoding
chunked
Connection
Keep-Alive
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Tue, 10 Sep 2019 17:12:43 GMT
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
ETag
"05475dfc41307909ee64011ef59289fdc"
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET,POST,OPTIONS
Content-Language
en
Access-Control-Allow-Origin
*
Cache-Control
public; max-age=3600
Content-Security-Policy
upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Accept-Ranges
bytes
Content-Type
application/font-woff;charset=UTF-8
Keep-Alive
timeout=5, max=446
custom.js
se.monetate.net/js/3/a-0f7c2d73/p/johnlewisfinance.com/t1547135491/7cc444512177254f/ 		122 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://se.monetate.net/js/3/a-0f7c2d73/p/johnlewisfinance.com/t1547135491/7cc444512177254f/custom.js
Requested by
Host: se.monetate.net
URL: https://se.monetate.net/js/2/a-0f7c2d73/p/johnlewisfinance.com/entry.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.230.61 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-230-61.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
80954093e3bee49f24fb6a3418f7a62ed826f9533b89854332281c9254b03ff7

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicing-card.johnlewisfinance.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 17 Sep 2019 09:27:33 GMT
content-encoding
gzip
last-modified
Mon, 09 Sep 2019 14:03:25 GMT
server
Apache
etag
"3ab8a6c17904ce2469601144f154c715:1568037805"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=315360000
accept-ranges
bytes
timing-allow-origin
*
1850090060-0
f.monetate.net/trk/4/s/a-0f7c2d73/p/johnlewisfinance.com/ 		1 KB
841 B 		Script
General
Check archive.org
Download Go to
Full URL
https://f.monetate.net/trk/4/s/a-0f7c2d73/p/johnlewisfinance.com/1850090060-0?mr=t1547135491&mi=%272.1375498497.1568712453746%27&mt=!n&cs=!t&e=!(viewPage,gt)&pt=unknown&r=%27%27&sw=1600&sh=1200&sc=24&j=!f&u=%27https://servicing-card.johnlewisfinance.com/gateway/api/portal/jlp/login/%23/%27&fl=!f&hvc=!t&eoq=!t
Requested by
Host: se.monetate.net
URL: https://se.monetate.net/js/3/a-0f7c2d73/p/johnlewisfinance.com/t1547135491/7cc444512177254f/custom.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.213.34.91 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-213-34-91.eu-west-1.compute.amazonaws.com
Software
Monetate /
Resource Hash
8514601d7de496453615fed5d8ad70aee521ae785ef5cda558fca0fa76c6bb06

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicing-card.johnlewisfinance.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 17 Sep 2019 09:27:33 GMT
Content-Encoding
gzip
Server
Monetate
Vary
Accept-Encoding
Content-Type
application/x-javascript; charset=utf-8
Cache-Control
no-cache
Server-Timing
total;dur=9.5
Timing-Allow-Origin
*
Content-Length
525
Expires
Mon, 17 Sep 2018 09:27:33 GMT
footer-link.52f975db6ef971857974.png
servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/ 		18 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/footer-link.52f975db6ef971857974.png
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
217.73.37.41 , Germany, ASN16072 (FDD, DE),
Reverse DNS
Software
/
Resource Hash
edd97ef81151a462dc9b6512697c30dbdb6952a6dfe31ecada99c0af98f755eb
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Strict-Transport-Security max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/styles.1eb4912cddfb137a866b.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 17 Sep 2019 09:27:34 GMT
Strict-Transport-Security
max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff, nosniff
X-Permitted-Cross-Domain-Policies
none
Transfer-Encoding
chunked
Connection
Keep-Alive
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Tue, 10 Sep 2019 17:12:43 GMT
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
ETag
"052f975db6ef9718579744e9aaf61bf4a"
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET,POST,OPTIONS
Content-Language
en
Access-Control-Allow-Origin
*
Cache-Control
public; max-age=3600
Content-Security-Policy
upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Accept-Ranges
bytes
Content-Type
image/png;charset=UTF-8
Keep-Alive
timeout=5, max=403
MaterialIcons-Regular.570eb83859dc23dd0eec.woff2
servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/ 		43 KB
45 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/MaterialIcons-Regular.570eb83859dc23dd0eec.woff2
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
217.73.37.41 , Germany, ASN16072 (FDD, DE),
Reverse DNS
Software
/
Resource Hash
a87d66c91b2e7dc5530aef76c03bd6a3d25ea5826110bf4803b561b811cc8726
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Strict-Transport-Security max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/styles.1eb4912cddfb137a866b.css
Origin
https://servicing-card.johnlewisfinance.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 17 Sep 2019 09:27:34 GMT
Strict-Transport-Security
max-age=31536000; includeSubdomains; preload, max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff, nosniff
X-Permitted-Cross-Domain-Policies
none
Transfer-Encoding
chunked
Connection
Keep-Alive
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Last-Modified
Tue, 10 Sep 2019 17:12:43 GMT
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
ETag
"0570eb83859dc23dd0eec423a49e147fe"
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET,POST,OPTIONS
Content-Language
en
Access-Control-Allow-Origin
*
Cache-Control
public; max-age=3600
Content-Security-Policy
upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Accept-Ranges
bytes
Content-Type
application/font-woff2;charset=UTF-8
Keep-Alive
timeout=5, max=463

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
servicing-card.johnlewisfinance.com
URL
https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items//styles/.css

Verdicts & Comments Add Verdict or Comment

52 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| BB object| $__curScript function| URLPolyfill object| SystemJS object| System object| config-bb-module-loader undefined| require object| cxp undefined| define object| webpackJsonp object| core object| __core-js_shared__ object| true function| Zone function| __zone_symbol__Promise function| __zone_symbol__ZoneAwarePromise function| __zone_symbol__setTimeout function| __zone_symbol__clearTimeout function| __zone_symbol__setInterval function| __zone_symbol__clearInterval function| __zone_symbol__requestAnimationFrame function| __zone_symbol__cancelAnimationFrame function| __zone_symbol__webkitRequestAnimationFrame function| __zone_symbol__webkitCancelAnimationFrame function| __zone_symbol__alert function| __zone_symbol__prompt function| __zone_symbol__confirm function| __zone_symbol__MutationObserver function| __zone_symbol__WebKitMutationObserver function| __zone_symbol__IntersectionObserver function| __zone_symbol__FileReader boolean| __Zone_enable_cross_context_check function| saveAs object| cptable object| ng object| __zone_symbol__popstatefalse object| __zone_symbol__hashchangefalse function| getAngularTestability function| getAllAngularTestabilities function| getAllAngularRootElements object| frameworkStabilizers number| monetateT object| monetate object| __zone_symbol__beforeunloadfalse object| monetateQ object| sessioncamConfiguration function| __zone_symbol__addEventListener function| __zone_symbol__removeEventListener undefined| __zone_symbol__eventListeners undefined| __zone_symbol__removeAllListeners function| eventListeners function| removeAllListeners

5 Cookies

Domain/Path Name / Value
servicing-card.johnlewisfinance.com/ Name: ROUTEID
Value: .1
servicing-card.johnlewisfinance.com/ Name: XSRF-TOKEN
Value: 9355967a-fd1a-48c9-9fc0-b52d253dca32
servicing-card.johnlewisfinance.com/gateway Name: CURRENT_EFFECTIVE_LOCALE.5033c655-fdf9-46dd-8bda-6a9cbd1321e0
Value: en-US
servicing-card.johnlewisfinance.com/ Name: NSC_KMQ-TFSWJDJOH-DBSE-TOJ-WJQ
Value: ffffffff0940542a45525d5f4f58455e445a4a4216cb
servicing-card.johnlewisfinance.com/gateway/api Name: anonymousUserId
Value: 8a85b073-5392-4353-b777-35bb9a6606d5

2 Console Messages

Source Level URL
Text
console-api error URL: https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/main.441d9cad0e948f57c752.js(Line 1)
Message:
ERROR
console-api error URL: https://servicing-card.johnlewisfinance.com/gateway/api/portal/static/items/bb-cards-app-ang/en-US/dist/main.441d9cad0e948f57c752.js(Line 1)
Message:
ERROR

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests;style-src 'self' blob: https: 'unsafe-inline'; script-src 'self' data https: 'unsafe-eval' 'unsafe-inline';font-src 'self' data: https: 'unsafe-inline';default-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleadservices.com www.awin1.com www.zenaps.com *.facebook.com *.doubleclick.net googletagmanager.com www.google-analytics.com www.google.com tagmanager.google.com *.2o7.net *.omtrdc.net *.demdex.net ajax.googleapis.com www.googletagmanager.com fonts.googleapis.com c.la3-c2-chi.salesforceliveagent.com *.theaa.com www.google-analytics.com stats.g.doubleclick.net www.google.co.uk *.postoffice.co.uk www.googletagmanager.com *.gstatic.com *.globalsiteanalytics.com *.monetate.net;
Strict-Transport-Security max-age=31536000; includeSubdomains; preload max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff nosniff
X-Frame-Options SAMEORIGIN SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

f.monetate.net
se.monetate.net
servicing-card.johnlewisfinance.com
servicing-card.johnlewisfinance.com
104.111.230.61
217.73.37.41
52.213.34.91
00a6e2f2047af74d2ba5030767e62aea1e4a0f537c1ea78ee9a5fcd50e4d7269
0b4a0dd9b23b42463a9fc347ee143bb10347b179a46fe173383e80512c8ff20c
4c9e2f5fc071efd2a294c192e499efd047aca4efd2e252fc15df9aec53214624
6a202fff38bebc732c9792c0abd1eb4b11fa26d338194d70d42a9bf0a1b1c837
80954093e3bee49f24fb6a3418f7a62ed826f9533b89854332281c9254b03ff7
8514601d7de496453615fed5d8ad70aee521ae785ef5cda558fca0fa76c6bb06
8c777fd591a32e1a19313b823fe949259c1aa5aa66d51ba0d6f78401799c43af
8d32c1c14fe07e0e204077bb04f2348f35fefa3e801ee5e417a8d9b04be497b4
9bbbedfd5f89bd5547d8f56d1451a7ad7a26afb3c6d13260e9beec0d1e2faaa4
a24b950ac6b1f6a7b348bc2e0be039beb5de26f5a240f38f2e8a2f5d7efc3160
a87d66c91b2e7dc5530aef76c03bd6a3d25ea5826110bf4803b561b811cc8726
add2261dfcb1bf0751e2cabb434eb47f33a4dcf36cc2873e35e10ced27d03edd
d9acbf5185e9d8694e10f62b2c9d51eeeb96ce992f0090bec6f8a4325b25efe8
e19322177a5f26d46cad65ecc7fd404fdc7f61af455412ba89f59e33847ba84e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e636d4c931ee1387da11a50332c70fd0bc301c1d5231dbc5b864e06f2d51abcb
eb3d5f2600910179bef8b0709214b7c721ea66e92ebb35bc282264beb2631eaf
edd97ef81151a462dc9b6512697c30dbdb6952a6dfe31ecada99c0af98f755eb
f464f7992276b1f0ee4f1719e47aaeb1725f936f55473f265aa0c32162f979bd
f6c902601fcf1269e64ece29edfc064716b37c0e315adc1e5138ed73cbf7ecf0