pra.pages.dev Open in urlscan Pro
188.114.97.3 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://pra.pages.dev/
Effective URL:
https://pra.pages.dev/apps/wealth
Submission Tags: @ecarlesi possiblethreat phishing Search All
Submission: On October 18 via api (October 18th 2024, 9:58:22 am UTC) from IT — Scanned from NL

Summary HTTP 16 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 3 domains to perform 16 HTTP transactions. The main IP is 188.114.97.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is pra.pages.dev.
TLS certificate: Issued by WE1 on October 8th 2024. Valid for: 3 months.

This is the only time pra.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 8	188.114.97.3 188.114.97.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.32.27.86 13.32.27.86	16509 (AMAZON-02) (AMAZON-02)
2	18.235.153.102 18.235.153.102	14618 (AMAZON-AES) (AMAZON-AES)
4	151.101.3.9 151.101.3.9	54113 (FASTLY) (FASTLY)
2	54.157.194.5 54.157.194.5	14618 (AMAZON-AES) (AMAZON-AES)
16	5

8 188.114.97.3 (Amsterdam, Netherlands) 1 redirects

ASN13335 (CLOUDFLARENET, US)

pra.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.86 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-86.fra56.r.cloudfront.net

cdn.heapanalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.235.153.102 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-235-153-102.compute-1.amazonaws.com

heapanalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.3.9 (San Francisco, United States)

ASN54113 (FASTLY, US)

sdk.split.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.157.194.5 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-157-194-5.compute-1.amazonaws.com

auth.split.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	pages.dev 1 redirects pra.pages.dev	1 MB
6	split.io sdk.split.io — Cisco Umbrella Rank: 2699 auth.split.io — Cisco Umbrella Rank: 3347	3 KB
3	heapanalytics.com cdn.heapanalytics.com — Cisco Umbrella Rank: 852 heapanalytics.com — Cisco Umbrella Rank: 666	38 KB
16	3

	Domain	Requested by
8	pra.pages.dev	1 redirects pra.pages.dev
4	sdk.split.io	pra.pages.dev
2	auth.split.io	pra.pages.dev
2	heapanalytics.com	pra.pages.dev
1	cdn.heapanalytics.com	pra.pages.dev
16	5

This site contains links to these domains. Also see Links.

Domain
information.moodysanalytics.com

Subject Issuer	Validity	Valid
pra.pages.dev WE1	`2024-10-08` - `2025-01-06`	3 months	crt.sh
cdn.heapanalytics.com Amazon RSA 2048 M02	`2024-05-29` - `2025-06-26`	a year	crt.sh
heapanalytics.com Amazon RSA 2048 M03	`2024-10-10` - `2025-11-08`	a year	crt.sh
*.split.io GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-04-04` - `2025-05-06`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://pra.pages.dev/apps/wealth
Frame ID: A5350C017E99360919E4127B7122B85B
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

PFaroe Wealth - Login

Page URL History Show full URLs

http://pra.pages.dev/ HTTP 307
https://pra.pages.dev/ HTTP 301
https://pra.pages.dev/apps/wealth Page URL

Detected technologies

Heap (Analytics) Expand

Overall confidence: 100%
Detected patterns

heap-\d+\.js

Page Statistics

16
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

5
Subdomains

5
IPs

2
Countries

1158 kB
Transfer

4253 kB
Size

4
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://information.moodysanalytics.com/000000AIZRNEICYCJ
Title: What's New?

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://pra.pages.dev/ HTTP 307
https://pra.pages.dev/ HTTP 301
https://pra.pages.dev/apps/wealth Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request wealth Show response
pra.pages.dev/apps/
Redirect Chain

http://pra.pages.dev/
https://pra.pages.dev/
https://pra.pages.dev/apps/wealth

1 KB
2 KB

97ms
96ms

Document
text/html

188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pra.pages.dev/apps/wealth

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9578af34ac796dd0fa31b3635e42635c790005d63bba69af13e90f2d5c4ea58e

Security Headers

Name

Value

Content-Security-Policy

connect-src 'self' https://rum.pfaroe.com https://*.split.io https://www.datadoghq-browser-agent.com wss: https://api.pfaroe.com/ https://heapanalytics.com *.auryc.com https://riskfirst.auth0.com; font-src 'self' data: https://optimizer.pfaroe.com https://heapanalytics.com *.auryc.com; img-src 'self' data: https://*.wp.com/ https://s.gravatar.com/ https://heapanalytics.com blob:; script-src 'self' 'unsafe-eval' https://optimizer.pfaroe.com https://cdn.heapanalytics.com https://heapanalytics.com 'unsafe-inline' https://cdn.heapanalytics.com/js/replay/libs/latest/auryc.lib.js https://cdn.heapanalytics.com/js/replay/libs/latest/auryc.worker.js; style-src 'self' 'unsafe-inline' https://optimizer.pfaroe.com https://heapanalytics.com; worker-src 'self' blob:; base-uri 'self'; default-src 'none'; form-action 'self'; manifest-src 'self'; frame-src https://riskfirst.auth0.com

X-Content-Type-Options

nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-ray: 8d47ab44390d4d8a-FRA
content-encoding: br
content-security-policy: connect-src 'self' https://rum.pfaroe.com https://*.split.io https://www.datadoghq-browser-agent.com wss: https://api.pfaroe.com/ https://heapanalytics.com *.auryc.com https://riskfirst.auth0.com; font-src 'self' data: https://optimizer.pfaroe.com https://heapanalytics.com *.auryc.com; img-src 'self' data: https://*.wp.com/ https://s.gravatar.com/ https://heapanalytics.com blob:; script-src 'self' 'unsafe-eval' https://optimizer.pfaroe.com https://cdn.heapanalytics.com https://heapanalytics.com 'unsafe-inline' https://cdn.heapanalytics.com/js/replay/libs/latest/auryc.lib.js https://cdn.heapanalytics.com/js/replay/libs/latest/auryc.worker.js; style-src 'self' 'unsafe-inline' https://optimizer.pfaroe.com https://heapanalytics.com; worker-src 'self' blob:; base-uri 'self'; default-src 'none'; form-action 'self'; manifest-src 'self'; frame-src https://riskfirst.auth0.com
content-type: text/html; charset=utf-8
date: Fri, 18 Oct 2024 09:58:17 GMT
etag: W/"6118cfc1a7f6410e0e690e5007045b94"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2oZ5nA0OeJW9LnU6u3TyXFYFs41OsjCN3t5twwq5gfYEUmCETr7hMh4eLs%2BCzN4ePAMZiT3DLUoN65g%2FP%2B%2F%2BViJCL2RaWZ0z0zfDquHCFxFf0ip3sx4Cn2E%2B5aK0iQSm"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding
x-content-type-options: nosniff

Redirect headers

alt-svc: h3=":443"; ma=86400
cf-ray: 8d47ab43c8b14d8a-FRA
content-length: 0
date: Fri, 18 Oct 2024 09:58:16 GMT
location: https://pra.pages.dev/apps/wealth
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0WF5gEax%2BNT0LG40%2BNxyu5tWEzYlDPNynzHdXCGcA8nR0J8Iog83Jgv896y4rvQi1I98OiB4uwbcKczoqH05jxDNSAQHN%2BFI73KabY3kUa5k2FZGCBm89ca3dZvz5FB0"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding

GET
H3 200 env.js Show response
pra.pages.dev/apps/wealth/ 321 B
700 B 39ms
38ms Script
text/javascript 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pra.pages.dev/apps/wealth/env.js?version=20241015.1
Requested by: Host: pra.pages.dev
URL: https://pra.pages.dev/apps/wealth
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a7b303a34e03c4d520b9b89adcb9700f3ff7b1dac3fe7e41c2bd152280deaeed

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pra.pages.dev/apps/wealth

Response headers

cache-control: public, max-age=31536000, immutable
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=exHIEJavduHkfT439M6VtdH3bDswXGnPGc0z6StUJTo3bo9dJeOgYBW8UvYGhOyh9CI1VjA619qw%2FvFUMN8ToAfqeR%2FJCx2oPWBJv4qJab6IoVUdnX21Tk3%2B%2F%2FLF42Nj"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d47ab44e9be4d8a-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 09:58:17 GMT
content-type: text/javascript
vary: Accept-Encoding
server: cloudflare

GET
H3 200 main.e6f5a4bc.js Show response
pra.pages.dev/apps/wealth/static/js/ 4 MB
1 MB 75ms
75ms Script
application/javascript 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pra.pages.dev/apps/wealth/static/js/main.e6f5a4bc.js

Requested by

Host: pra.pages.dev
URL: https://pra.pages.dev/apps/wealth

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6f29891ea8a305bbafb4a39f142c12126cb9a82b4cb85e53e17189753dd61da8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pra.pages.dev/apps/wealth

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
etag: W/"4c580cdc3a10acfe1cffda8a85173878"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Oy%2FfrnXpwUtn1ftS3iSyAljvqgWye30dDnTXyQ0X%2B0Ddp8z9qR2iajjusrMaST%2BpM4y4mcgq0rtIYAebaMh0uR8tYtUiuNWcN7ERfchVJ76RIe1ord4KRFEoOdLCU3ee"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d47ab44e9c24d8a-FRA
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 09:58:17 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H3 200 main.5854466c.css
pra.pages.dev/apps/wealth/static/css/ 13 KB
3 KB 47ms
47ms Stylesheet
text/css 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pra.pages.dev/apps/wealth/static/css/main.5854466c.css

Requested by

Host: pra.pages.dev
URL: https://pra.pages.dev/apps/wealth

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b0f96136d776746ca92a5e315d2ebcaea5594772f177f9d045e9c075919f2ebd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pra.pages.dev/apps/wealth

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
etag: W/"9073fb07c28f7dbf927c2c1aa238fcbc"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gU2om7bwIaK4uSYp1w5H4yxCnFznVZnxwRPRXZnhECS0%2FwifwAb9zesvpBXr2vy3Ym%2BuRbGysnimxiL3zTdoNvCwPAGrMGV2xelE%2BRyH6F3Fzh4L7jS%2FAnneuq8P4gKB"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d47ab44e9c54d8a-FRA
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 09:58:17 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 heap-2858426534.js Show response
cdn.heapanalytics.com/js/ 117 KB
38 KB 213ms
159ms Script
application/javascript 13.32.27.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.heapanalytics.com/js/heap-2858426534.js

Requested by

Host: pra.pages.dev
URL: https://pra.pages.dev/apps/wealth

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.27.86 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-27-86.fra56.r.cloudfront.net

Software

nginx / Express

Resource Hash

7410d062ce80865b8a94e9d870759e253bcf6731efa302800a2edcc627cd105d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pra.pages.dev/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=120
content-encoding: br
etag: W/"1d4bc-1rKoZGgJt5bIEfydxYV4IV/Dq9s"
cross-origin-resource-policy: cross-origin
via: 1.1 28b0f9ae51406f70504a784d296a3a48.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: TeBCH2Mn2FFoMhknLT-MwV9KzsdxZ-fMR0hQlsUNNL6hNE2XL_9zZA==
date: Fri, 18 Oct 2024 09:58:17 GMT
content-type: application/javascript; charset=utf-8
x-powered-by: Express
server: nginx
x-amz-cf-pop: FRA56-C2
vary: Accept-Encoding

GET
H2 200 h
heapanalytics.com/ 37 B
378 B 405ms
102ms Image
image/gif 18.235.153.102
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heapanalytics.com/h?a=2858426534&u=6950986010918646&v=5850325566801398&s=5274056392800430&b=web&tv=4.0&z=0&h=%2Fapps%2Fwealth&d=pra.pages.dev&t=PFaroe%20Wealth&ts=1729245497364&sch=1200&scw=1600&st=1729245497366&lv=4.23.4&ld=cdn.heapanalytics.com

Requested by

Host: pra.pages.dev
URL: https://pra.pages.dev/apps/wealth

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.235.153.102 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-235-153-102.compute-1.amazonaws.com

Software

nginx /

Resource Hash

bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pra.pages.dev/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
pragma: no-cache
etag: W/"25-4iFqfptz9csCeTUceM5hwzR1zqc"
access-control-allow-methods: POST, PUT, GET
access-control-allow-origin: *
content-length: 37
date: Fri, 18 Oct 2024 09:58:17 GMT
content-type: image/gif
server: nginx
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

OPTIONS
H2 200 anonymous
sdk.split.io/api/mySegments/ 0
0 229ms
41ms Preflight 151.101.3.9
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.split.io/api/mySegments/anonymous

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.3.9 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Varnish /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15770000; includeSubdomains

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,splitsdkversion
Access-Control-Request-Method: GET
Origin: https://pra.pages.dev
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-headers: X-Requested-With, Origin, Content-Type, Accept, Authorization, Content-Length, X-User-Token, X-Request-ID, SplitSDKMachineName, SplitSDKMachineIP, SplitSDKVersion, Cache-Control
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
access-control-allow-origin: https://pra.pages.dev
access-control-max-age: 7200
allow: HEAD,GET,OPTIONS,POST,PUT,DELETE
content-length: 37
date: Fri, 18 Oct 2024 09:58:17 GMT
retry-after: 0
server: Varnish
strict-transport-security: max-age=15770000; includeSubdomains
vary: Cookie
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 0
x-served-by: cache-mad2200138-MAD
x-timer: S1729245498.919737,VS0,VE0

OPTIONS
H2 200 splitChanges
sdk.split.io/api/ 0
0 229ms
42ms Preflight 151.101.3.9
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.split.io/api/splitChanges?s=1.1&since=-1&names=DC-Wealth-DatadogRumSessionReplay,DC-Wealth-EnterButtonPathingInFunds,DC-Wealth-MetricSelect,DC-Wealth-ModelingCategorization,DC-Wealth-ProjectConfigurationValidation,DC-Wealth-ValidationWarnings

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.3.9 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Varnish /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15770000; includeSubdomains

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,splitsdkversion
Access-Control-Request-Method: GET
Origin: https://pra.pages.dev
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-headers: X-Requested-With, Origin, Content-Type, Accept, Authorization, Content-Length, X-User-Token, X-Request-ID, SplitSDKMachineName, SplitSDKMachineIP, SplitSDKVersion, Cache-Control
access-control-allow-methods: GET,PUT,POST,PATCH,DELETE,OPTIONS
access-control-allow-origin: https://pra.pages.dev
access-control-max-age: 7200
allow: HEAD,GET,OPTIONS,POST,PUT,DELETE
content-length: 37
date: Fri, 18 Oct 2024 09:58:17 GMT
retry-after: 0
server: Varnish
strict-transport-security: max-age=15770000; includeSubdomains
vary: Cookie
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 0
x-served-by: cache-mad2200138-MAD
x-timer: S1729245498.919764,VS0,VE0

GET
H2 200 anonymous Show response
sdk.split.io/api/mySegments/ 17 B
421 B 44ms
42ms Fetch
application/json 151.101.3.9
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://sdk.split.io/api/mySegments/anonymous

Requested by

Host: pra.pages.dev
URL: https://pra.pages.dev/apps/wealth/static/js/main.e6f5a4bc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.3.9 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

2070e9ec5ea66461693a174cf782efa1090e0ca1988968cc1115d019e7b80a95

Security Headers

Name	Value
Strict-Transport-Security	max-age=15770000; includeSubdomains

Request headers

Authorization: Bearer 2ahffjer14gchhee1j0ikcdg5nchi7006og6
Referer: https://pra.pages.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json
Content-Type: application/json
SplitSDKVersion: react-1.12.0

Response headers

access-control-expose-headers: Access-Control-Allow-Origin,X-Request-Id
content-encoding: gzip
etag: "1000002"
age: 10898
x-cache: MISS, HIT
trace: cache-iad-kcgs7200106-IAD-97912aec-08f1-471e-bb0b-f6c15625f20f; cache-mad22047-MAD-e9ee3ca7-4487-4050-839e-a397f5b3140c
date: Fri, 18 Oct 2024 09:58:17 GMT
content-type: application/json; charset=utf-8
x-served-by: cache-iad-kcgs7200106-IAD, cache-mad2200138-MAD
x-cache-hits: 0, 0
vary: Accept-Encoding, Origin, Authorization
strict-transport-security: max-age=15770000; includeSubdomains
cache-control: no-transform, max-age=60, s-maxage=60
x-timer: S1729245498.965071,VS0,VE1
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 41

GET
H2 200 splitChanges Show response
sdk.split.io/api/ 4 KB
907 B 46ms
45ms Fetch
application/json 151.101.3.9
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: pra.pages.dev
URL: https://pra.pages.dev/apps/wealth/static/js/main.e6f5a4bc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.3.9 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

02c94bafdb36acffb92a0931638ec1873eca2e6094114fad3812bf11b3e5be59

Security Headers

Name	Value
Strict-Transport-Security	max-age=15770000; includeSubdomains

Request headers

Authorization: Bearer 2ahffjer14gchhee1j0ikcdg5nchi7006og6
Referer: https://pra.pages.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json
Content-Type: application/json
SplitSDKVersion: react-1.12.0

Response headers

access-control-expose-headers: Access-Control-Allow-Origin,X-Request-Id
content-encoding: gzip
etag: "1726662386145"
age: 162447
x-cache: HIT, HIT
trace: cache-iad-kiad7000147-IAD-926e0a56-d08a-4755-a503-e3b0ead2dfed; cache-mad22047-MAD-53f6b7be-57c3-4216-b767-2796d8034078
date: Fri, 18 Oct 2024 09:58:17 GMT
content-type: application/json; charset=utf-8
last-modified: Wed, 18 Sep 2024 12:26:26 GMT
x-served-by: cache-iad-kiad7000147-IAD, cache-mad2200138-MAD
x-cache-hits: 15, 0
vary: Accept-Encoding, Origin, Authorization
strict-transport-security: max-age=15770000; includeSubdomains
cache-control: no-transform, max-age=60, s-maxage=60
x-timer: S1729245498.965162,VS0,VE1
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 657

GET
H3 200 398.9dc3ba0b.chunk.js Show response
pra.pages.dev/apps/wealth/static/js/ 21 KB
4 KB 52ms
52ms Script
application/javascript 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pra.pages.dev/apps/wealth/static/js/398.9dc3ba0b.chunk.js

Requested by

Host: pra.pages.dev
URL: https://pra.pages.dev/apps/wealth/static/js/main.e6f5a4bc.js

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

181caf34dab3a4e740dc3d7a988ff6cada37f5477c5e68324b76d0f34c5d5945

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pra.pages.dev/apps/wealth/login

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
etag: W/"8144da72e1168072e5a37b8fa1dfb8b6"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YyPgi6mnCzIG7hDk9a0y1%2F25WKBLO9iGYsq9XvcAG9pbOjDqClKWCHjMLBzlLiMgmpz47X9GStNw5r9SgadGbDIOU%2BTajTTerUQ6%2Fy43lT%2B4qb%2BPs6e7TdU8SwNc0qe%2B"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d47ab48cdc84d8a-FRA
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 09:58:17 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H3 200 491.d0e8cf49.chunk.js Show response
pra.pages.dev/apps/wealth/static/js/ 1 KB
1 KB 68ms
67ms Script
application/javascript 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pra.pages.dev/apps/wealth/static/js/491.d0e8cf49.chunk.js

Requested by

Host: pra.pages.dev
URL: https://pra.pages.dev/apps/wealth/static/js/main.e6f5a4bc.js

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af288decdc607121161aab2d42c126eac515029e0ce61457c2417d2612edacad

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pra.pages.dev/apps/wealth/login

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
etag: W/"93900ada2b47b7a646dbf5f3ca857d19"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dk121Z0IDE4T%2BjoM1kd0TKwqqMaJF%2BHYsskI9oy7Yum4JoMtKGFV1uvlhrmYugfHh0U1o%2Bd6%2BvQ%2FuPr5QV%2B3fnT2etOvKD%2B85V%2BvQ7uhDDto4uMXhG4LGDP0sx177Tnb"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d47ab48ddce4d8a-FRA
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 09:58:17 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

OPTIONS
H/1.1 200
OK auth
auth.split.io/api/v2/ 0
0 430ms
104ms Preflight
application/json 54.157.194.5
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.split.io/api/v2/auth?s=1.1&users=anonymous

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.157.194.5 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-157-194-5.compute-1.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=15770000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,splitsdkversion
Access-Control-Request-Method: GET
Origin: https://pra.pages.dev
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Origin, Content-Type, Accept, Authorization, Content-Length, X-User-Token, X-Request-ID, SplitSDKMachineName, SplitSDKMachineIP, SplitSDKVersion
Access-Control-Allow-Methods: GET, OPTIONS
Access-Control-Allow-Origin: https://pra.pages.dev
Connection: keep-alive
Content-Length: 4
Content-Type: application/json; charset=utf-8
Date: Fri, 18 Oct 2024 09:58:18 GMT
Strict-Transport-Security: max-age=15770000; includeSubDomains
content-security-policy: frame-ancestors 'self'
x-content-type-options: nosniff
x-frame-options: DENY
x-permitted-cross-domain-policies: master-only

GET
H/1.1 200
OK auth Show response
auth.split.io/api/v2/ 679 B
1 KB 106ms
106ms Fetch
application/json 54.157.194.5
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.split.io/api/v2/auth?s=1.1&users=anonymous

Requested by

Host: pra.pages.dev
URL: https://pra.pages.dev/apps/wealth/static/js/main.e6f5a4bc.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.157.194.5 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-157-194-5.compute-1.amazonaws.com

Software

Resource Hash

a502114278604bb3b8d63a41024067fd2bfb31e0279a3a95d6d9ba2e2aaba681

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=15770000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Authorization: Bearer 2ahffjer14gchhee1j0ikcdg5nchi7006og6
Referer: https://pra.pages.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json
Content-Type: application/json
SplitSDKVersion: react-1.12.0

Response headers

x-frame-options: DENY
Strict-Transport-Security: max-age=15770000; includeSubDomains
content-security-policy: frame-ancestors 'self'
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, OPTIONS
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
Access-Control-Allow-Origin: https://pra.pages.dev
Content-Length: 679
Date: Fri, 18 Oct 2024 09:58:18 GMT
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Headers: X-Requested-With, Origin, Content-Type, Accept, Authorization, Content-Length, X-User-Token, X-Request-ID, SplitSDKMachineName, SplitSDKMachineIP, SplitSDKVersion

GET
H2 200 h
heapanalytics.com/ 37 B
377 B 104ms
104ms Image
image/gif 18.235.153.102
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://heapanalytics.com/h?a=2858426534&u=6950986010918646&v=2061935969661762&s=5274056392800430&b=web&tv=4.0&z=2&h=%2Fapps%2Fwealth%2Flogin&d=pra.pages.dev&t=PFaroe%20Wealth&ts=1729245497727&pr=%2Fapps%2Fwealth&sp=z&sp=0&sp=ts&sp=1729245497364&sp=d&sp=pra.pages.dev&sp=h&sp=%2Fapps%2Fwealth&sp=t&sp=PFaroe%20Wealth&sch=1200&scw=1600&st=1729245497727&lv=4.23.4&ld=cdn.heapanalytics.com

Requested by

Host: pra.pages.dev
URL: https://pra.pages.dev/apps/wealth/login

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.235.153.102 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-235-153-102.compute-1.amazonaws.com

Software

nginx /

Resource Hash

bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pra.pages.dev/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
pragma: no-cache
etag: W/"25-4iFqfptz9csCeTUceM5hwzR1zqc"
access-control-allow-methods: POST, PUT, GET
access-control-allow-origin: *
content-length: 37
date: Fri, 18 Oct 2024 09:58:17 GMT
content-type: image/gif
server: nginx
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

GET
H3 200 favicon.ico
pra.pages.dev/apps/wealth/ 1 KB
868 B 39ms
39ms Other
image/vnd.microsoft.icon 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pra.pages.dev/apps/wealth/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

095bd655ea3010a9e00fc651b0aae3aabb64deaeb9cf8bce97008394dd1baf32

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://pra.pages.dev/apps/wealth/login

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
etag: W/"e103390375c68e8643d8e139ac7308aa"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=371a%2BflLQRrLBm%2Fz6eqqqkpljtOdQVLSmfthhAXCkQszk%2BugvOQRp3GxnD60GIPuDSGklw4Cz90ooO919ZVOXjcW9gUTla6IpdApTwJeFtHJOnPJqZXJXcbsYk0CcQqF"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d47ab49eefc4d8a-FRA
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 09:58:17 GMT
content-type: image/vnd.microsoft.icon
vary: Accept-Encoding
server: cloudflare

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| heap object| CONFIG object| webpackChunkpra object| DD_RUM

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.pra.pages.dev/	1970-01-21 00:20:47	Name: __cf_bm Value: VHR02tUE2A25glCrn6kfGeIylrwWWiOmARjteteHnaM-1729245496-1.0.1.1-ja_ztXu0KrzsFCd28F3ZFASifLSDh_NhGlCKPSSIB87OLM1ef8zn_kEVektKsdm.nOQ53J23hOvLe.gdAvEyWA
.pra.pages.dev/	1970-01-21 09:48:43	Name: _hp2_id.2858426534 Value: %7B%22userId%22%3A%226950986010918646%22%2C%22pageviewId%22%3A%222061935969661762%22%2C%22sessionId%22%3A%225274056392800430%22%2C%22identity%22%3Anull%2C%22trackerVersion%22%3A%224.0%22%7D
.pra.pages.dev/	1970-01-21 00:20:47	Name: _hp2_ses_props.2858426534 Value: %7B%22ts%22%3A1729245497364%2C%22d%22%3A%22pra.pages.dev%22%2C%22h%22%3A%22%2Fapps%2Fwealth%22%7D
pra.pages.dev/	1970-01-21 00:20:46	Name: _dd_s Value: rum=1&id=9caa56ac-b11e-4c86-8e9d-d76620f220de&created=1729245498001&expire=1729246398001

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	connect-src 'self' https://rum.pfaroe.com https://.split.io https://www.datadoghq-browser-agent.com wss: https://api.pfaroe.com/ https://heapanalytics.com .auryc.com https://riskfirst.auth0.com; font-src 'self' data: https://optimizer.pfaroe.com https://heapanalytics.com .auryc.com; img-src 'self' data: https://.wp.com/ https://s.gravatar.com/ https://heapanalytics.com blob:; script-src 'self' 'unsafe-eval' https://optimizer.pfaroe.com https://cdn.heapanalytics.com https://heapanalytics.com 'unsafe-inline' https://cdn.heapanalytics.com/js/replay/libs/latest/auryc.lib.js https://cdn.heapanalytics.com/js/replay/libs/latest/auryc.worker.js; style-src 'self' 'unsafe-inline' https://optimizer.pfaroe.com https://heapanalytics.com; worker-src 'self' blob:; base-uri 'self'; default-src 'none'; form-action 'self'; manifest-src 'self'; frame-src https://riskfirst.auth0.com
X-Content-Type-Options	nosniff

Header

Value

Content-Security-Policy

X-Content-Type-Options

nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

auth.split.io
cdn.heapanalytics.com
heapanalytics.com
pra.pages.dev
sdk.split.io
13.32.27.86
151.101.3.9
18.235.153.102
188.114.97.3
54.157.194.5
02c94bafdb36acffb92a0931638ec1873eca2e6094114fad3812bf11b3e5be59
095bd655ea3010a9e00fc651b0aae3aabb64deaeb9cf8bce97008394dd1baf32
181caf34dab3a4e740dc3d7a988ff6cada37f5477c5e68324b76d0f34c5d5945
2070e9ec5ea66461693a174cf782efa1090e0ca1988968cc1115d019e7b80a95
6f29891ea8a305bbafb4a39f142c12126cb9a82b4cb85e53e17189753dd61da8
7410d062ce80865b8a94e9d870759e253bcf6731efa302800a2edcc627cd105d
9578af34ac796dd0fa31b3635e42635c790005d63bba69af13e90f2d5c4ea58e
a502114278604bb3b8d63a41024067fd2bfb31e0279a3a95d6d9ba2e2aaba681
a7b303a34e03c4d520b9b89adcb9700f3ff7b1dac3fe7e41c2bd152280deaeed
af288decdc607121161aab2d42c126eac515029e0ce61457c2417d2612edacad
b0f96136d776746ca92a5e315d2ebcaea5594772f177f9d045e9c075919f2ebd
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

pra.pages.dev Open in urlscan Pro 188.114.97.3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

0 %IPv6

3 Domains

5 Subdomains

5 IPs

2 Countries

1158 kBTransfer

4253 kBSize

4 Cookies

1 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

4 Cookies

Security Headers

Indicators

pra.pages.dev Open in urlscan Pro
188.114.97.3 Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

5
Subdomains

5
IPs

2
Countries

1158 kB
Transfer

4253 kB
Size

4
Cookies

16 HTTP transactions
0 data transactions