urlscan.io logo urlscan.io
SecurityTrails logo

meridian.cobr-21-test.merx-test.merx.fluxtest.app Open in urlscan Pro
52.63.191.154  Public Scan

Go To Rescan Add Verdict Report
URL: https://meridian.cobr-21-test.merx-test.merx.fluxtest.app/
Submission: On February 15 via automatic, source certstream-suspicious — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 52.63.191.154, located in Sydney, Australia and belongs to AMAZON-02, US. The main domain is meridian.cobr-21-test.merx-test.merx.fluxtest.app.
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on February 15th 2024. Valid for: 3 months.
This is the only time meridian.cobr-21-test.merx-test.merx.fluxtest.app was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
6 52.63.191.154 16509 (AMAZON-02)
6 1
Apex Domain
Subdomains		 Transfer
6 fluxtest.app
meridian.cobr-21-test.merx-test.merx.fluxtest.app
417 KB
6 1
Domain Requested by
6 meridian.cobr-21-test.merx-test.merx.fluxtest.app meridian.cobr-21-test.merx-test.merx.fluxtest.app
6 1

This site contains links to these domains. Also see Links.

Domain
www.meridian.cobr-21-test.merx-test.merx.fluxtest.app
www.google.com
Subject Issuer Validity Valid
*.cobr-21-test.merx-test.merx.fluxtest.app
ZeroSSL RSA Domain Secure Site CA		 2024-02-15 -
2024-05-15		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://meridian.cobr-21-test.merx-test.merx.fluxtest.app/
Frame ID: A148C7A92ED9DA84B170F8062F5A7DB3
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Meridian Login

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

417 kB
Transfer

1428 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
meridian.cobr-21-test.merx-test.merx.fluxtest.app/ 		5 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://meridian.cobr-21-test.merx-test.merx.fluxtest.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.63.191.154 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-63-191-154.ap-southeast-2.compute.amazonaws.com
Software
envoy /
Resource Hash
91e6a91cde2c8f74c53bb91edf4732e6f51f710751f0357d0ccb1edc850dbeec
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

cache-control
no-store
content-security-policy-report-only
default-src 'self' https://tags.tiqcdn.com/utag/meridianenergy/flux https://tags.tiqcdn.com/utag/meridianenergy/psnz-flux https://ci.cdn.fluxci.com/ https://www.googletagmanager.com https://maps.googleapis.com/maps/api https://www.google-analytics.com https://app.launchdarkly.com https://events.launchdarkly.com https://clientstream.launchdarkly.com; img-src 'self' data: http://www.w3.org/2000/svg https://heapanalytics.com https://ci.cdn.fluxci.com/ https://*.mypurecloud.com.au https://*.apse2.pure.cloud; object-src https://*.mypurecloud.com.au https://*.apse2.pure.cloud; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://cdn.heapanalytics.com https://heapanalytics.com http://www.googletagmanager.com http://cdn.heapanalytics.com https://ci.cdn.fluxci.com/ https://*.nr-data.net https://*.newrelic.com https://*.mypurecloud.com.au https://*.apse2.pure.cloud; style-src 'self' 'unsafe-inline' https://heapanalytics.com https://ci.cdn.fluxci.com/; connect-src 'self' https://app.launchdarkly.com https://events.launchdarkly.com https://*.mypurecloud.com.au https://*.nr-data.net https://shyrka-prod-apse2.s3.ap-southeast-2.amazonaws.com https://*.newrelic.com https://*.apse2.pure.cloud wss://*.mypurecloud.com.au wss://*.apse2.pure.cloud; media-src https://*.mypurecloud.com.au https://*.apse2.pure.cloud; child-src https://*.mypurecloud.com.au https://*.apse2.pure.cloud; report-uri /csp_violations
content-type
text/html; charset=utf-8
date
Thu, 15 Feb 2024 04:09:36 GMT
etag
W/"91e6a91cde2c8f74c53bb91edf4732e6"
link
</assets/meridian/assets/stylesheets/login-0d321e3fc76ae52cd496a24c6865d27fd28649a8a461b5edf010b64c38043f1a.css>; rel=preload; as=style; nopush,</assets/vendor-9fd240a8a4ebd83357d4744aacca9e77e3d9d7fba486422adef482efccd86e15.js>; rel=preload; as=script; nopush
referrer-policy
strict-origin-when-cross-origin
server
envoy
strict-transport-security
max-age=63072000; includeSubDomains
x-content-type-options
nosniff
x-download-options
noopen
x-envoy-upstream-service-time
27
x-frame-options
SAMEORIGIN
x-permitted-cross-domain-policies
none
x-request-id
f4670d9d-d2c0-4b62-bf34-c8a65d1307b2
x-runtime
0.022644
x-ua-compatible
IE=Edge,chrome=1
x-xss-protection
0
login-0d321e3fc76ae52cd496a24c6865d27fd28649a8a461b5edf010b64c38043f1a.css
meridian.cobr-21-test.merx-test.merx.fluxtest.app/assets/meridian/assets/stylesheets/ 		21 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://meridian.cobr-21-test.merx-test.merx.fluxtest.app/assets/meridian/assets/stylesheets/login-0d321e3fc76ae52cd496a24c6865d27fd28649a8a461b5edf010b64c38043f1a.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.63.191.154 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-63-191-154.ap-southeast-2.compute.amazonaws.com
Software
envoy /
Resource Hash
0d321e3fc76ae52cd496a24c6865d27fd28649a8a461b5edf010b64c38043f1a
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://meridian.cobr-21-test.merx-test.merx.fluxtest.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Thu, 15 Feb 2024 04:09:36 GMT
content-encoding
gzip
strict-transport-security
max-age=63072000; includeSubDomains
last-modified
Thu, 15 Feb 2024 02:48:29 GMT
server
envoy
vary
Accept-Encoding
content-type
text/css
x-envoy-upstream-service-time
2
content-length
3724
vendor-9fd240a8a4ebd83357d4744aacca9e77e3d9d7fba486422adef482efccd86e15.js
meridian.cobr-21-test.merx-test.merx.fluxtest.app/assets/ 		1 MB
346 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://meridian.cobr-21-test.merx-test.merx.fluxtest.app/assets/vendor-9fd240a8a4ebd83357d4744aacca9e77e3d9d7fba486422adef482efccd86e15.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.63.191.154 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-63-191-154.ap-southeast-2.compute.amazonaws.com
Software
envoy /
Resource Hash
9fd240a8a4ebd83357d4744aacca9e77e3d9d7fba486422adef482efccd86e15
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://meridian.cobr-21-test.merx-test.merx.fluxtest.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Thu, 15 Feb 2024 04:09:36 GMT
content-encoding
gzip
strict-transport-security
max-age=63072000; includeSubDomains
last-modified
Thu, 15 Feb 2024 02:48:29 GMT
server
envoy
vary
Accept-Encoding
content-type
application/javascript
x-envoy-upstream-service-time
3
content-length
353637
logotype-bright-0e4e81edfa578aee802380da3b2bea15ffc2936d6cf0abdf5b60100800bfca10.svg
meridian.cobr-21-test.merx-test.merx.fluxtest.app/assets/meridian/assets/images/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://meridian.cobr-21-test.merx-test.merx.fluxtest.app/assets/meridian/assets/images/logotype-bright-0e4e81edfa578aee802380da3b2bea15ffc2936d6cf0abdf5b60100800bfca10.svg
Requested by
Host: meridian.cobr-21-test.merx-test.merx.fluxtest.app
URL: https://meridian.cobr-21-test.merx-test.merx.fluxtest.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.63.191.154 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-63-191-154.ap-southeast-2.compute.amazonaws.com
Software
envoy /
Resource Hash
0e4e81edfa578aee802380da3b2bea15ffc2936d6cf0abdf5b60100800bfca10
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://meridian.cobr-21-test.merx-test.merx.fluxtest.app/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Thu, 15 Feb 2024 04:09:36 GMT
strict-transport-security
max-age=63072000; includeSubDomains
x-envoy-upstream-service-time
2
last-modified
Thu, 15 Feb 2024 02:44:10 GMT
server
envoy
content-length
4072
content-type
image/svg+xml
centra_no2-book-8ee40ef7a00fdaea24cc20df280227d3570f5ec47802871d13b4a0079e390a96.woff
meridian.cobr-21-test.merx-test.merx.fluxtest.app/assets/ 		57 KB
57 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://meridian.cobr-21-test.merx-test.merx.fluxtest.app/assets/centra_no2-book-8ee40ef7a00fdaea24cc20df280227d3570f5ec47802871d13b4a0079e390a96.woff
Requested by
Host: meridian.cobr-21-test.merx-test.merx.fluxtest.app
URL: https://meridian.cobr-21-test.merx-test.merx.fluxtest.app/assets/meridian/assets/stylesheets/login-0d321e3fc76ae52cd496a24c6865d27fd28649a8a461b5edf010b64c38043f1a.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.63.191.154 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-63-191-154.ap-southeast-2.compute.amazonaws.com
Software
envoy /
Resource Hash
8ee40ef7a00fdaea24cc20df280227d3570f5ec47802871d13b4a0079e390a96
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

Referer
https://meridian.cobr-21-test.merx-test.merx.fluxtest.app/assets/meridian/assets/stylesheets/login-0d321e3fc76ae52cd496a24c6865d27fd28649a8a461b5edf010b64c38043f1a.css
Origin
https://meridian.cobr-21-test.merx-test.merx.fluxtest.app
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Thu, 15 Feb 2024 04:09:36 GMT
strict-transport-security
max-age=63072000; includeSubDomains
x-envoy-upstream-service-time
3
last-modified
Thu, 15 Feb 2024 02:44:09 GMT
server
envoy
content-length
57980
content-type
application/font-woff
cookie_test
meridian.cobr-21-test.merx-test.merx.fluxtest.app/customer/ 		2 B
386 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://meridian.cobr-21-test.merx-test.merx.fluxtest.app/customer/cookie_test
Requested by
Host: meridian.cobr-21-test.merx-test.merx.fluxtest.app
URL: https://meridian.cobr-21-test.merx-test.merx.fluxtest.app/assets/vendor-9fd240a8a4ebd83357d4744aacca9e77e3d9d7fba486422adef482efccd86e15.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.63.191.154 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-63-191-154.ap-southeast-2.compute.amazonaws.com
Software
envoy /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept
text/javascript, text/html, application/xml, text/xml, */*
X-Prototype-Version
1.7
Referer
https://meridian.cobr-21-test.merx-test.merx.fluxtest.app/
X-Requested-With
XMLHttpRequest
X-CSRF-Token
hj18pbtzyP-K7bU6lZ1hvzxUJH1H9pFgeOlIy1tKzo5G1x-PWhV97wN8l0H_JRAMJIJRzxaAeCGiPm-ydUK6gQ
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Thu, 15 Feb 2024 04:09:36 GMT
strict-transport-security
max-age=63072000; includeSubDomains
x-content-type-options
nosniff
x-permitted-cross-domain-policies
none
content-security-policy-report-only
default-src 'self' https://tags.tiqcdn.com/utag/meridianenergy/flux https://tags.tiqcdn.com/utag/meridianenergy/psnz-flux https://ci.cdn.fluxci.com/ https://www.googletagmanager.com https://maps.googleapis.com/maps/api https://www.google-analytics.com https://app.launchdarkly.com https://events.launchdarkly.com https://clientstream.launchdarkly.com; img-src 'self' data: http://www.w3.org/2000/svg https://heapanalytics.com https://ci.cdn.fluxci.com/ https://*.mypurecloud.com.au https://*.apse2.pure.cloud; object-src https://*.mypurecloud.com.au https://*.apse2.pure.cloud; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://cdn.heapanalytics.com https://heapanalytics.com http://www.googletagmanager.com http://cdn.heapanalytics.com https://ci.cdn.fluxci.com/ https://*.nr-data.net https://*.newrelic.com https://*.mypurecloud.com.au https://*.apse2.pure.cloud; style-src 'self' 'unsafe-inline' https://heapanalytics.com https://ci.cdn.fluxci.com/; connect-src 'self' https://app.launchdarkly.com https://events.launchdarkly.com https://*.mypurecloud.com.au https://*.nr-data.net https://shyrka-prod-apse2.s3.ap-southeast-2.amazonaws.com https://*.newrelic.com https://*.apse2.pure.cloud wss://*.mypurecloud.com.au wss://*.apse2.pure.cloud; media-src https://*.mypurecloud.com.au https://*.apse2.pure.cloud; child-src https://*.mypurecloud.com.au https://*.apse2.pure.cloud; report-uri /csp_violations
x-envoy-upstream-service-time
83
x-xss-protection
0
x-request-id
f7652ba2-1a4f-4d1f-bb39-d2e753bf61db
x-ua-compatible
IE=Edge,chrome=1
x-runtime
0.081362
referrer-policy
strict-origin-when-cross-origin
server
envoy
etag
W/"565339bc4d33d72817b583024112eb7f"
x-download-options
noopen
vary
Accept
x-frame-options
SAMEORIGIN
content-type
text/plain; charset=utf-8
cache-control
no-store

Verdicts & Comments Add Verdict or Comment

51 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| Prototype object| Abstract object| Try object| Class function| PeriodicalExecuter function| Template object| $break object| Enumerable function| $A function| $w function| $H function| Hash function| $R function| ObjectRange object| Ajax function| $ object| Form object| Field function| $F object| Toggle object| Insertion object| $continue object| Position object| Effect object| Droppables object| Draggables function| Draggable function| SortableObserver object| Sortable object| Autocompleter object| swfobject function| extraButtonsPlugin function| partialFocusPlugin object| UI function| AutoComplete object| Modernizr object| html5 function| yepnope function| jQuery function| Tether function| Drop function| _ function| $$ undefined| Sizzle function| Selector function| flatpickr_v2_6_3 function| FlatpickrInstance object| jQuery183033703113373768034 object| LDClient boolean| isIE10 boolean| isIE11

2 Cookies

Domain/Path Name / Value
meridian.cobr-21-test.merx-test.merx.fluxtest.app/ Name: cookie_test
Value: meridian
meridian.cobr-21-test.merx-test.merx.fluxtest.app/ Name: nz_session
Value: dBzRRkJGHFkYW%2B0%2BhahQArLKYOHx7f0IPaez8RpckaJmjnjC25Lhc1aSUACGJRv%2B%2FaamizyzRvevOpGzvywKWLt5q3PXe1ycRGGrMpprdwqT%2Fli7bduEwk1t8dc%2BcujmZPFqYaXvA4regRdmQ0VPEX8ySVGMd0QyfsgS8VjqMFaStcrnse2kM6uT5TJomA%3D%3D--GPD0g7E3N2zRQm65--DvsJw7hyPSllgXNJACHNlg%3D%3D

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0