accounts.hgv.it Open in urlscan Pro
199.36.158.100 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://serviceportal.hgv.it/
Effective URL:
https://accounts.hgv.it/login?flow=06252055-d1ac-48be-b2b1-4b05a128caa2
Submission: On July 30 via automatic, source certstream-suspicious (July 30th 2024, 6:31:37 pm UTC) — Scanned from IT

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 1 domains to perform 16 HTTP transactions. The main IP is 199.36.158.100, located in United States and belongs to FASTLY, US. The main domain is accounts.hgv.it.
TLS certificate: Issued by WR3 on June 2nd 2024. Valid for: 3 months.

This is the only time accounts.hgv.it was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
7	34.111.24.152 34.111.24.152	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 2	2606:4700::68... 2606:4700::6812:1cc9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	199.36.158.100 199.36.158.100	54113 (FASTLY) (FASTLY)
2	104.18.28.201 104.18.28.201	13335 (CLOUDFLAR...) (CLOUDFLARENET)
16	5

7 34.111.24.152 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 152.24.111.34.bc.googleusercontent.com

serviceportal.hgv.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:1cc9 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

api.accounts.hgv.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 199.36.158.100 (United States)

ASN54113 (FASTLY, US)

accounts.hgv.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.28.201 (None, )

ASN13335 (CLOUDFLARENET, US)

api.accounts.hgv.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	hgv.it 1 redirects serviceportal.hgv.it api.accounts.hgv.it accounts.hgv.it	487 KB
16	1

	Domain	Requested by
7	serviceportal.hgv.it	serviceportal.hgv.it
6	accounts.hgv.it	serviceportal.hgv.it accounts.hgv.it
4	api.accounts.hgv.it	1 redirects serviceportal.hgv.it accounts.hgv.it
16	3

This site contains no links.

Subject Issuer	Validity	Valid
serviceportal.hgv.it WR3	`2024-07-30` - `2024-10-28`	3 months	crt.sh
api.accounts.hgv.it WE1	`2024-07-28` - `2024-10-26`	3 months	crt.sh
accounts.hgv.it WR3	`2024-06-02` - `2024-08-31`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://accounts.hgv.it/login?flow=06252055-d1ac-48be-b2b1-4b05a128caa2
Frame ID: 8EB66694D2FAE0C420C93B341BE9A864
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

HGV Konto

Page URL History Show full URLs

https://serviceportal.hgv.it/ Page URL
https://api.accounts.hgv.it/self-service/login/browser?return_to=https://serviceportal.hgv.it/ HTTP 303
https://accounts.hgv.it/login?flow=06252055-d1ac-48be-b2b1-4b05a128caa2 Page URL

Page Statistics

16
Requests

100 %
HTTPS

25 %
IPv6

1
Domains

3
Subdomains

5
IPs

2
Countries

486 kB
Transfer

1680 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://serviceportal.hgv.it/ Page URL
https://api.accounts.hgv.it/self-service/login/browser?return_to=https://serviceportal.hgv.it/ HTTP 303
https://accounts.hgv.it/login?flow=06252055-d1ac-48be-b2b1-4b05a128caa2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
serviceportal.hgv.it/ 554 B
861 B 469ms
61ms Document
text/html 34.111.24.152
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://serviceportal.hgv.it/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.111.24.152 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

152.24.111.34.bc.googleusercontent.com

Software

Google Frontend /

Resource Hash

df58523c0983059a79ea40d6b9540c7b5441fd4c9608163bfdec2d2434844485

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';object-src 'self' blob:;script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self' https://api.accounts.hgv.it https://service.hgv.it o179954.ingest.sentry.io;frame-src 'self' blob:;font-src 'self';frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-store
content-encoding: gzip
content-length: 339
content-security-policy: default-src 'none';object-src 'self' blob:;script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self' https://api.accounts.hgv.it https://service.hgv.it o179954.ingest.sentry.io;frame-src 'self' blob:;font-src 'self';frame-ancestors 'self'
content-type: text/html; charset=utf-8
date: Tue, 30 Jul 2024 18:31:31 GMT
referrer-policy: no-referrer-when-downgrade
server: Google Frontend
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 google
x-cloud-trace-context: 186bcfed06eaedcb82423b1cb97fbd11
x-content-type-options: nosniff

GET
H2 200 index-Cvlm6xJ5.js Show response
serviceportal.hgv.it/assets/ 1 MB
312 KB 72ms
71ms Script
text/javascript 34.111.24.152
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://serviceportal.hgv.it/assets/index-Cvlm6xJ5.js

Requested by

Host: serviceportal.hgv.it
URL: https://serviceportal.hgv.it/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.111.24.152 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

152.24.111.34.bc.googleusercontent.com

Software

Google Frontend /

Resource Hash

b409e1a476843d2eb17cbce823e783065e1b7eb59ed48bf1951e90118410d879

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';object-src 'self' blob:;script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self' https://api.accounts.hgv.it https://service.hgv.it o179954.ingest.sentry.io;frame-src 'self' blob:;font-src 'self';frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://serviceportal.hgv.it/
Origin: https://serviceportal.hgv.it
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'none';object-src 'self' blob:;script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self' https://api.accounts.hgv.it https://service.hgv.it o179954.ingest.sentry.io;frame-src 'self' blob:;font-src 'self';frame-ancestors 'self'
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
content-encoding: gzip
server: Google Frontend
date: Tue, 30 Jul 2024 18:31:31 GMT
via: 1.1 google
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=31536000, immutable
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 index-Bc-x_k6y.css
serviceportal.hgv.it/assets/ 55 KB
12 KB 69ms
68ms Stylesheet
text/css 34.111.24.152
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://serviceportal.hgv.it/assets/index-Bc-x_k6y.css

Requested by

Host: serviceportal.hgv.it
URL: https://serviceportal.hgv.it/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.111.24.152 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

152.24.111.34.bc.googleusercontent.com

Software

Google Frontend /

Resource Hash

485e5507dd791a07422243d03d3624178bc5cbf2184fc58767e2f96f420a73da

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';object-src 'self' blob:;script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self' https://api.accounts.hgv.it https://service.hgv.it o179954.ingest.sentry.io;frame-src 'self' blob:;font-src 'self';frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://serviceportal.hgv.it/
Origin: https://serviceportal.hgv.it
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'none';object-src 'self' blob:;script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self' https://api.accounts.hgv.it https://service.hgv.it o179954.ingest.sentry.io;frame-src 'self' blob:;font-src 'self';frame-ancestors 'self'
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
content-encoding: gzip
server: Google Frontend
date: Tue, 30 Jul 2024 18:31:31 GMT
via: 1.1 google
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000, immutable
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3 401 members
serviceportal.hgv.it/api/ 123 B
139 B 144ms
144ms Fetch
application/json 34.111.24.152
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://serviceportal.hgv.it/api/members?page=1&limit=2

Requested by

Host: serviceportal.hgv.it
URL: https://serviceportal.hgv.it/assets/index-Cvlm6xJ5.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.111.24.152 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

152.24.111.34.bc.googleusercontent.com

Software

Google Frontend /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://serviceportal.hgv.it/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'none'; frame-ancestors 'none'
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
content-encoding: gzip
server: Google Frontend
date: Tue, 30 Jul 2024 18:31:32 GMT
via: 1.1 google
vary: Accept-Encoding
content-type: application/json
x-cloud-trace-context: 68fcbef866a71e2c0a502d826dfb3c20
cache-control: no-store
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 117

GET
H3 401 me
serviceportal.hgv.it/api/ 123 B
139 B 142ms
122ms Fetch
application/json 34.111.24.152
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://serviceportal.hgv.it/api/me

Requested by

Host: serviceportal.hgv.it
URL: https://serviceportal.hgv.it/assets/index-Cvlm6xJ5.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.111.24.152 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

152.24.111.34.bc.googleusercontent.com

Software

Google Frontend /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://serviceportal.hgv.it/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'none'; frame-ancestors 'none'
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
content-encoding: gzip
server: Google Frontend
date: Tue, 30 Jul 2024 18:31:32 GMT
via: 1.1 google
vary: Accept-Encoding
content-type: application/json
x-cloud-trace-context: 1a7e31b5f95b3f404aa5f70a03e2d59e
cache-control: no-store
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 117

GET
H3 401 members
serviceportal.hgv.it/api/ 123 B
139 B 138ms
118ms Fetch
application/json 34.111.24.152
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://serviceportal.hgv.it/api/members?page=1&limit=1

Requested by

Host: serviceportal.hgv.it
URL: https://serviceportal.hgv.it/assets/index-Cvlm6xJ5.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.111.24.152 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

152.24.111.34.bc.googleusercontent.com

Software

Google Frontend /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://serviceportal.hgv.it/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'none'; frame-ancestors 'none'
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
content-encoding: gzip
server: Google Frontend
date: Tue, 30 Jul 2024 18:31:32 GMT
via: 1.1 google
vary: Accept-Encoding
content-type: application/json
x-cloud-trace-context: edc9fb63c380cdd6594d93949345c595
cache-control: no-store
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 117

GET
H2 401 whoami
api.accounts.hgv.it/sessions/ 206 B
0 606ms
137ms Fetch
application/json 2606:4700::6812:1cc9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.accounts.hgv.it/sessions/whoami

Requested by

Host: serviceportal.hgv.it
URL: https://serviceportal.hgv.it/assets/index-Cvlm6xJ5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1cc9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://serviceportal.hgv.it/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

ory-network-ingress: T
date: Tue, 30 Jul 2024 18:31:32 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
ory-session-cache-for: 60
alt-svc: h3=":443"; ma=86400
content-length: 206
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
ory-network-region: euw
vary: Origin,Origin,Cookie, Accept-Encoding
x-frame-options: DENY
content-type: application/json
access-control-allow-origin: https://serviceportal.hgv.it
access-control-expose-headers: Cache-Control, Expires, Last-Modified, Pragma, Content-Length, Content-Language, Content-Type
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), usb=()
ory-session-edge-status: MISS
x-ratelimit-limit: 500, 800;w=1, 18000;w=60, 500;w=1
x-ratelimit-reset: 1
cf-ray: 8ab76d1dade0bad5-MXP
x-ratelimit-remaining: 499

GET
H3 200 favicon.svg
serviceportal.hgv.it/ 1 KB
786 B 27ms
26ms Other
image/svg+xml 34.111.24.152
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://serviceportal.hgv.it/favicon.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

34.111.24.152 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

152.24.111.34.bc.googleusercontent.com

Software

Google Frontend /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';object-src 'self' blob:;script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self' https://api.accounts.hgv.it https://service.hgv.it o179954.ingest.sentry.io;frame-src 'self' blob:;font-src 'self';frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://serviceportal.hgv.it/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'none';object-src 'self' blob:;script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self' https://api.accounts.hgv.it https://service.hgv.it o179954.ingest.sentry.io;frame-src 'self' blob:;font-src 'self';frame-ancestors 'self'
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: no-referrer-when-downgrade
x-content-type-options: nosniff
content-encoding: gzip
server: Google Frontend
date: Tue, 30 Jul 2024 18:31:32 GMT
via: 1.1 google
vary: Accept-Encoding
content-type: image/svg+xml
x-cloud-trace-context: 5517bbfb48d8636d8c1b9321cc7376f9
cache-control: public, max-age=31536000, immutable
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 763

GET
H2

200

Primary Request login Show response
accounts.hgv.it/
Redirect Chain

https://api.accounts.hgv.it/self-service/login/browser?return_to=https://serviceportal.hgv.it/
https://accounts.hgv.it/login?flow=06252055-d1ac-48be-b2b1-4b05a128caa2

459 B
804 B

615ms
71ms

Document
text/html

199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.hgv.it/login?flow=06252055-d1ac-48be-b2b1-4b05a128caa2

Requested by

Host: serviceportal.hgv.it
URL: https://serviceportal.hgv.it/assets/index-Cvlm6xJ5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

2f527e8860d8a84961430fd9b1e097173dec8b790a84d1fe47b173d533de865d

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';script-src 'self';script-src-elem 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self' https://api.accounts.hgv.it https://iam.hgvapis.it o179954.ingest.sentry.io;frame-src 'none';font-src 'self';frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://serviceportal.hgv.it/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: public, max-age=10
content-encoding: br
content-length: 176
content-security-policy: default-src 'none';script-src 'self';script-src-elem 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self' https://api.accounts.hgv.it https://iam.hgvapis.it o179954.ingest.sentry.io;frame-src 'none';font-src 'self';frame-ancestors 'none'
content-type: text/html; charset=utf-8
date: Tue, 30 Jul 2024 18:31:34 GMT
etag: "8e407e1c7621e810bd7d21f5c3e6aeac366008094c8102935beb0d511983ab87-br"
last-modified: Tue, 30 Jul 2024 06:30:11 GMT
referrer-policy: no-referrer
strict-transport-security: max-age=31536000; includeSubDomains
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
x-cache-hits: 0
x-content-type-options: nosniff
x-served-by: cache-mxp6941-MXP
x-timer: S1722364294.961135,VS0,VE46

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8ab76d1ffa52bad5-MXP
content-length: 102
content-type: text/html; charset=utf-8
date: Tue, 30 Jul 2024 18:31:33 GMT
location: https://accounts.hgv.it/login?flow=06252055-d1ac-48be-b2b1-4b05a128caa2
ory-network-ingress: T
ory-network-region: euw
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), usb=()
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
vary: Origin,Origin,Cookie
via: 1.1 google
x-content-type-options: nosniff
x-frame-options: DENY
x-ratelimit-limit: 400, 400;w=1, 9000;w=60, 500;w=1
x-ratelimit-remaining: 399
x-ratelimit-reset: 1

GET
H2 200 index-BUrwe3JF.js Show response
accounts.hgv.it/assets/ 511 KB
113 KB 19ms
18ms Script
text/javascript 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.hgv.it/assets/index-BUrwe3JF.js

Requested by

Host: accounts.hgv.it
URL: https://accounts.hgv.it/login?flow=06252055-d1ac-48be-b2b1-4b05a128caa2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

80eea9828bc3375f8b7cfe5460dec5f2136504a35f528b8763e600c071ac26f7

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';script-src 'self';script-src-elem 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self' https://api.accounts.hgv.it https://iam.hgvapis.it o179954.ingest.sentry.io;frame-src 'none';font-src 'self';frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://accounts.hgv.it
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'none';script-src 'self';script-src-elem 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self' https://api.accounts.hgv.it https://iam.hgvapis.it o179954.ingest.sentry.io;frame-src 'none';font-src 'self';frame-ancestors 'none'
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 30 Jul 2024 18:31:34 GMT
x-cache: HIT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 115369
x-served-by: cache-mxp6941-MXP
referrer-policy: no-referrer
last-modified: Tue, 30 Jul 2024 06:30:11 GMT
x-timer: S1722364294.051666,VS0,VE1
etag: "4d93732518195e9fa2cd409a0d80edb553809d7c3f9e7937a8ea82c413fbac78-br"
vary: x-fh-requested-host, accept-encoding
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=31536000, immutable
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 index-DiQmQpl0.css
accounts.hgv.it/assets/ 31 KB
6 KB 52ms
51ms Stylesheet
text/css 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.hgv.it/assets/index-DiQmQpl0.css

Requested by

Host: accounts.hgv.it
URL: https://accounts.hgv.it/login?flow=06252055-d1ac-48be-b2b1-4b05a128caa2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

21ec9dfc2c66ed98eb7e7c50e4acbea011589e3db12d3d4d3360830ce0791f26

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';script-src 'self';script-src-elem 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self' https://api.accounts.hgv.it https://iam.hgvapis.it o179954.ingest.sentry.io;frame-src 'none';font-src 'self';frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://accounts.hgv.it
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'none';script-src 'self';script-src-elem 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self' https://api.accounts.hgv.it https://iam.hgvapis.it o179954.ingest.sentry.io;frame-src 'none';font-src 'self';frame-ancestors 'none'
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 30 Jul 2024 18:31:34 GMT
x-cache: HIT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 5522
x-served-by: cache-mxp6941-MXP
referrer-policy: no-referrer
last-modified: Tue, 30 Jul 2024 06:30:11 GMT
x-timer: S1722364294.051622,VS0,VE1
etag: "ed73dcd95b5f21a99e8a47cd3a33b8d65e65987e530c961c16cc719470e117bb-br"
vary: x-fh-requested-host, accept-encoding
content-type: text/css; charset=utf-8
cache-control: public, max-age=31536000, immutable
accept-ranges: bytes
x-cache-hits: 0

GET
H3 200 flows Show response
api.accounts.hgv.it/self-service/login/ 2 KB
2 KB 128ms
127ms XHR
application/json 104.18.28.201
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.accounts.hgv.it/self-service/login/flows?id=06252055-d1ac-48be-b2b1-4b05a128caa2

Requested by

Host: accounts.hgv.it
URL: https://accounts.hgv.it/assets/index-BUrwe3JF.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.28.201 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3ee80edc48ec562fcfa948039b27d009947e3677dc044b4f4cdfea45d8f5b4bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept: application/json, text/plain, */*
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

ory-network-ingress: T
date: Tue, 30 Jul 2024 18:31:34 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: gzip
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
ory-network-region: euw
vary: Origin,Origin,Cookie
x-frame-options: DENY
content-type: application/json; charset=utf-8
access-control-allow-origin: https://accounts.hgv.it
access-control-expose-headers: Cache-Control, Expires, Last-Modified, Pragma, Content-Length, Content-Language, Content-Type
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), usb=()
x-ratelimit-reset: 1
x-ratelimit-limit: 400, 400;w=1, 9000;w=60, 500;w=1
cf-ray: 8ab76d27ec6cbaab-MXP
x-ratelimit-remaining: 399

GET
H3 401 whoami Show response
api.accounts.hgv.it/sessions/ 206 B
1 KB 161ms
155ms XHR
application/json 104.18.28.201
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.accounts.hgv.it/sessions/whoami

Requested by

Host: accounts.hgv.it
URL: https://accounts.hgv.it/assets/index-BUrwe3JF.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.28.201 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6ca4e1504d7a5ecbdf77f260bbc1c1eea3c084de97b5430c1b9600bb0c3a4970

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept: application/json, text/plain, */*
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

ory-network-ingress: T
date: Tue, 30 Jul 2024 18:31:34 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
ory-session-cache-for: 60
alt-svc: h3=":443"; ma=86400
content-length: 206
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
ory-network-region: euw
vary: Origin,Origin,Cookie, Accept-Encoding
x-frame-options: DENY
content-type: application/json
access-control-allow-origin: https://accounts.hgv.it
access-control-expose-headers: Cache-Control, Expires, Last-Modified, Pragma, Content-Length, Content-Language, Content-Type
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), usb=()
ory-session-edge-status: MISS
x-ratelimit-limit: 500, 800;w=1, 18000;w=60, 500;w=1
x-ratelimit-reset: 1
cf-ray: 8ab76d27fc85baab-MXP
x-ratelimit-remaining: 498

GET
H3 200 favicon.svg
accounts.hgv.it/ 1 KB
1 KB 22ms
22ms Other
image/svg+xml 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.hgv.it/favicon.svg

Protocol

Security

QUIC, , AES_256_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

fdde588a10d5a7702ce02d892b01f5d65486c9b7f1494c04da5045ea98adc1a3

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';script-src 'self';script-src-elem 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self' https://api.accounts.hgv.it https://iam.hgvapis.it o179954.ingest.sentry.io;frame-src 'none';font-src 'self';frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'none';script-src 'self';script-src-elem 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self' https://api.accounts.hgv.it https://iam.hgvapis.it o179954.ingest.sentry.io;frame-src 'none';font-src 'self';frame-ancestors 'none'
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 30 Jul 2024 18:31:34 GMT
x-cache: HIT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 693
x-served-by: cache-mxp6957-MXP
referrer-policy: no-referrer
last-modified: Tue, 30 Jul 2024 06:30:11 GMT
x-timer: S1722364295.516179,VS0,VE1
etag: "4c58e5e9ee0d062be843da773a403b88544daa4a7c2bcb79cc401d60d143327e-br"
vary: x-fh-requested-host, accept-encoding
content-type: image/svg+xml
cache-control: public, max-age=31536000, immutable
accept-ranges: bytes
x-cache-hits: 0

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fba934b090b2f9968723b7b5d2f21224d94dab2bb1723585802f617c27c36187

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 open-sans-latin-400-normal-Cjao0ETp.woff2
accounts.hgv.it/assets/ 18 KB
19 KB 25ms
24ms Font
font/woff2 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.hgv.it/assets/open-sans-latin-400-normal-Cjao0ETp.woff2

Requested by

Host: accounts.hgv.it
URL: https://accounts.hgv.it/assets/index-DiQmQpl0.css

Protocol

Security

QUIC, , AES_256_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e7af9d60d875eb1c1b1037bbbfdec41fcb096d0ebcf98a48717ad8b07906ced6

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';script-src 'self';script-src-elem 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self' https://api.accounts.hgv.it https://iam.hgvapis.it o179954.ingest.sentry.io;frame-src 'none';font-src 'self';frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://accounts.hgv.it
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'none';script-src 'self';script-src-elem 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self' https://api.accounts.hgv.it https://iam.hgvapis.it o179954.ingest.sentry.io;frame-src 'none';font-src 'self';frame-ancestors 'none'
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
date: Tue, 30 Jul 2024 18:31:34 GMT
x-cache: HIT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 18668
x-served-by: cache-mxp6957-MXP
referrer-policy: no-referrer
last-modified: Tue, 30 Jul 2024 06:30:11 GMT
x-timer: S1722364295.604164,VS0,VE1
etag: "a6d83fe53c61597de1266b5e4df4743c693ae80c890ee9c1a5cdde908f2c35bf"
vary: x-fh-requested-host, accept-encoding
content-type: font/woff2
cache-control: public, max-age=31536000, immutable
accept-ranges: bytes
x-cache-hits: 0

GET
H3 200 open-sans-latin-600-normal-Dhnuc7ye.woff2
accounts.hgv.it/assets/ 18 KB
19 KB 23ms
23ms Font
font/woff2 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.hgv.it/assets/open-sans-latin-600-normal-Dhnuc7ye.woff2

Requested by

Host: accounts.hgv.it
URL: https://accounts.hgv.it/assets/index-DiQmQpl0.css

Protocol

Security

QUIC, , AES_256_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

7f7fcda5f37c18def2314b911b02417b773c4f459df0d25931ffa7389b872b89

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';script-src 'self';script-src-elem 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self' https://api.accounts.hgv.it https://iam.hgvapis.it o179954.ingest.sentry.io;frame-src 'none';font-src 'self';frame-ancestors 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://accounts.hgv.it
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'none';script-src 'self';script-src-elem 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self' https://api.accounts.hgv.it https://iam.hgvapis.it o179954.ingest.sentry.io;frame-src 'none';font-src 'self';frame-ancestors 'none'
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
date: Tue, 30 Jul 2024 18:31:34 GMT
x-cache: HIT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 18596
x-served-by: cache-mxp6957-MXP
referrer-policy: no-referrer
last-modified: Tue, 30 Jul 2024 06:30:11 GMT
x-timer: S1722364295.604220,VS0,VE1
etag: "30f9d430612fbef254e24005257a23cfdb0a5882bc93766382a6deda9d2547ba"
vary: x-fh-requested-host, accept-encoding
content-type: font/woff2
cache-control: public, max-age=31536000, immutable
accept-ranges: bytes
x-cache-hits: 0

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| __REACT_INTL_CONTEXT__ string| __reactRouterVersion

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
api.accounts.hgv.it/	1970-01-20 22:26:07	Name: __cflb Value: 04dTofjtHwhfCny3TibYMM4LURzprwaLZZCWEH7BgF
.hgv.it/	1970-01-21 07:11:40	Name: csrf_token_08c109866b1aa722ec57d2d3fde7e268e49d5609fdb3e79c4308a4a40d40aaad Value: kMF7r52pQJS+1n912D2hHgkBCRdEpB6X/rIJuCKAoGc=
.api.accounts.hgv.it/	1970-01-20 22:26:06	Name: __cf_bm Value: Nic65DRRiSx4Jqd2KfQzAa2GgicxqFiQ7DjsnfxR88M-1722364294-1.0.1.1-sw4aibEhG8.4nwIClFquIspXuGKWm7etRR1KCTUtQFMwnGoa3endT6CHj97RekOWBAeVlkl30iTtWAFKAxoZjQ
.api.accounts.hgv.it/	1969-12-31 23:59:59	Name: _cfuvid Value: lYMn.1rTB8CsSPflIqi5pG2ZEdvy7OKmuaowh2VeCTU-1722364294528-0.0.1.1-604800000

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://serviceportal.hgv.it/api/members?page=1&limit=2 Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://serviceportal.hgv.it/api/me Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://serviceportal.hgv.it/api/members?page=1&limit=1 Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://api.accounts.hgv.it/sessions/whoami Message: Failed to load resource: the server responded with a status of 401 ()
network	error	URL: https://api.accounts.hgv.it/sessions/whoami Message: Failed to load resource: the server responded with a status of 401 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'none';object-src 'self' blob:;script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self' https://api.accounts.hgv.it https://service.hgv.it o179954.ingest.sentry.io;frame-src 'self' blob:;font-src 'self';frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.hgv.it
api.accounts.hgv.it
serviceportal.hgv.it
104.18.28.201
199.36.158.100
2606:4700::6812:1cc9
34.111.24.152
21ec9dfc2c66ed98eb7e7c50e4acbea011589e3db12d3d4d3360830ce0791f26
2f527e8860d8a84961430fd9b1e097173dec8b790a84d1fe47b173d533de865d
3ee80edc48ec562fcfa948039b27d009947e3677dc044b4f4cdfea45d8f5b4bc
485e5507dd791a07422243d03d3624178bc5cbf2184fc58767e2f96f420a73da
6ca4e1504d7a5ecbdf77f260bbc1c1eea3c084de97b5430c1b9600bb0c3a4970
7f7fcda5f37c18def2314b911b02417b773c4f459df0d25931ffa7389b872b89
80eea9828bc3375f8b7cfe5460dec5f2136504a35f528b8763e600c071ac26f7
b409e1a476843d2eb17cbce823e783065e1b7eb59ed48bf1951e90118410d879
df58523c0983059a79ea40d6b9540c7b5441fd4c9608163bfdec2d2434844485
e7af9d60d875eb1c1b1037bbbfdec41fcb096d0ebcf98a48717ad8b07906ced6
fba934b090b2f9968723b7b5d2f21224d94dab2bb1723585802f617c27c36187
fdde588a10d5a7702ce02d892b01f5d65486c9b7f1494c04da5045ea98adc1a3

accounts.hgv.it Open in urlscan Pro 199.36.158.100 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

16 Requests

100 %HTTPS

25 %IPv6

1 Domains

3 Subdomains

5 IPs

2 Countries

486 kBTransfer

1680 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

4 Cookies

5 Console Messages

Security Headers

Indicators

accounts.hgv.it Open in urlscan Pro
199.36.158.100 Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

25 %
IPv6

1
Domains

3
Subdomains

5
IPs

2
Countries

486 kB
Transfer

1680 kB
Size

4
Cookies

16 HTTP transactions
1 data transactions