urlscan.io logo urlscan.io
SecurityTrails logo

pmw.empire.ca Open in urlscan Pro
207.61.86.116  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://pmw.empire.ca/pmwweb/dynamicReport.do?win=popup&type=claimDetails&claimId=VLAD18082021-58
Effective URL: https://pmw.empire.ca/pmwweb/login.jsp
Submission: On August 20 via manual from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 9 IPs in 3 countries across 8 domains to perform 26 HTTP transactions. The main IP is 207.61.86.116, located in Kingston, Canada and belongs to AS-EMPIRELIFE, CA. The main domain is pmw.empire.ca.
TLS certificate: Issued by Entrust Certification Authority - L1K on November 25th 2020. Valid for: a year.
This is the only time pmw.empire.ca was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 8 207.61.86.116 53564 (AS-EMPIRE...)
3 2606:4700::68... 13335 (CLOUDFLAR...)
1 52.217.95.185 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
4 52.217.100.78 16509 (AMAZON-02)
1 3 142.250.185.198 15169 (GOOGLE)
4 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
26 9
8    207.61.86.116 (Kingston, Canada)

ASN53564 (AS-EMPIRELIFE, CA)
pmw.empire.ca
3    2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)
maxcdn.bootstrapcdn.com
1    52.217.95.185 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com
pmw-notices.s3.amazonaws.com
2    2a00:1450:4001:828::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
4    52.217.100.78 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com
s3.amazonaws.com
3    142.250.185.198 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f6.1e100.net
5290522.fls.doubleclick.net
4    2606:4700::6813:9408 (United States)

ASN13335 (CLOUDFLARENET, US)
script.crazyegg.com
2    2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.com
Domain Requested by
8 pmw.empire.ca 1 redirects pmw.empire.ca
4 script.crazyegg.com www.googletagmanager.com
script.crazyegg.com
4 s3.amazonaws.com pmw.empire.ca
3 5290522.fls.doubleclick.net 1 redirects www.googletagmanager.com
pmw.empire.ca
3 maxcdn.bootstrapcdn.com pmw.empire.ca
2 www.google-analytics.com www.googletagmanager.com
2 www.googletagmanager.com pmw.empire.ca
www.googletagmanager.com
1 adservice.google.com 5290522.fls.doubleclick.net
1 pmw-notices.s3.amazonaws.com pmw.empire.ca
26 9

This site contains links to these domains. Also see Links.

Domain
youtu.be
www.empire.ca
Subject Issuer Validity Valid
*.empire.ca
Entrust Certification Authority - L1K		 2020-11-25 -
2021-12-24		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-03-01 -
2022-02-28		 a year crt.sh
*.s3.amazonaws.com
DigiCert Baltimore CA-2 G2		 2021-01-11 -
2022-02-11		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-07-26 -
2021-10-18		 3 months crt.sh
s3.amazonaws.com
DigiCert Baltimore CA-2 G2		 2021-06-23 -
2022-07-24		 a year crt.sh
*.doubleclick.net
GTS CA 1C3		 2021-07-12 -
2021-10-04		 3 months crt.sh
*.google.com
GTS CA 1C3		 2021-07-12 -
2021-10-04		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://pmw.empire.ca/pmwweb/login.jsp
Frame ID: F556F6297B7E445D6305DC83040BD253
Requests: 24 HTTP requests in this frame

Frame: https://5290522.fls.doubleclick.net/activityi;dc_pre=CNWOr-6_v_ICFYoIBgAdm3wE-g;src=5290522;type=consu0;cat=consu018;ord=8341080359929;gtm=2wg8i0;auiddc=812658541.1629459015;ps=1;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp
Frame ID: 6B63ECCC7B2D48511DB3B3E006EA6E24
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Empire Life Plan Member Online Services Application

Page URL History Show full URLs

  1. https://pmw.empire.ca/pmwweb/dynamicReport.do?win=popup&type=claimDetails&claimId=VLAD18082021-58 HTTP 302
    https://pmw.empire.ca/pmwweb/login.jsp Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
  • script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /script\.crazyegg\.com\/pages\/scripts\/\d+\/\d+\.js/i
Overall confidence: 100%
Detected patterns
  • html /googletagmanager\.com\/ns\.html[^>]+><\/iframe>/i
  • html /<!-- (?:End )?Google Tag Manager -->/i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

26
Requests

100 %
HTTPS

56 %
IPv6

8
Domains

9
Subdomains

9
IPs

3
Countries

353 kB
Transfer

857 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://pmw.empire.ca/pmwweb/dynamicReport.do?win=popup&type=claimDetails&claimId=VLAD18082021-58 HTTP 302
    https://pmw.empire.ca/pmwweb/login.jsp Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 16
  • https://5290522.fls.doubleclick.net/activityi;src=5290522;type=consu0;cat=consu018;ord=8341080359929;gtm=2wg8i0;auiddc=812658541.1629459015;ps=1;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp HTTP 302
  • https://5290522.fls.doubleclick.net/activityi;dc_pre=CNWOr-6_v_ICFYoIBgAdm3wE-g;src=5290522;type=consu0;cat=consu018;ord=8341080359929;gtm=2wg8i0;auiddc=812658541.1629459015;ps=1;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp

26 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set login.jsp
pmw.empire.ca/pmwweb/
Redirect Chain
  • https://pmw.empire.ca/pmwweb/dynamicReport.do?win=popup&type=claimDetails&claimId=VLAD18082021-58
  • https://pmw.empire.ca/pmwweb/login.jsp
16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pmw.empire.ca/pmwweb/login.jsp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.61.86.116 Kingston, Canada, ASN53564 (AS-EMPIRELIFE, CA),
Reverse DNS
Software
Apache /
Resource Hash
1c288f36e865290c9fa0a685f9c6c881214398ef8cb6e4cf0d05361b277620bb

Request headers

Host
pmw.empire.ca
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
WASReqURL=https:///pmwweb/dynamicReport.do?win=popup&type=claimDetails&claimId=VLAD18082021-58
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 20 Aug 2021 11:30:14 GMT
Server
Apache
Expires
Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control
no-cache="set-cookie, set-cookie2"
Content-Type
text/html;charset=ISO-8859-1
Content-Language
en-US
Vary
Accept-Encoding
Content-Encoding
gzip
Cache-control
private
Set-Cookie
JSESSIONID=0000Enedc3cWVzC1DDnwEtGvr17:-1; Path=/; HttpOnly user_lang=en_CA; Expires=Sat, 21-Aug-21 11:30:14 GMT
Connection
close
Transfer-Encoding
chunked

Redirect headers

Date
Fri, 20 Aug 2021 11:30:13 GMT
Server
Apache
Location
https://pmw.empire.ca/pmwweb/login.jsp
Content-Length
0
Expires
Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control
no-cache="set-cookie, set-cookie2"
Content-Language
en-US
Set-Cookie
WASReqURL=https:///pmwweb/dynamicReport.do?win=popup&type=claimDetails&claimId=VLAD18082021-58; Path=/; HttpOnly SERVERID=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; HttpOnly; Secure; SameSite=Strict
Connection
close
common.js
pmw.empire.ca/pmwweb/js/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pmw.empire.ca/pmwweb/js/common.js?v=1
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/login.jsp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.61.86.116 Kingston, Canada, ASN53564 (AS-EMPIRELIFE, CA),
Reverse DNS
Software
Apache /
Resource Hash
43c2f58515288f5d6772c245a4ff3264fe8a12b4a8361af1751c0dc49254eb10

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
pmw.empire.ca
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://pmw.empire.ca/pmwweb/login.jsp
Cookie
user_lang=en_CA; WASReqURL=https:///pmwweb/dynamicReport.do?win=popup&type=claimDetails&claimId=VLAD18082021-58; JSESSIONID=0000Enedc3cWVzC1DDnwEtGvr17:-1
Connection
keep-alive
Referer
https://pmw.empire.ca/pmwweb/login.jsp
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 20 Aug 2021 11:30:14 GMT
Content-Encoding
gzip
Last-Modified
Thu, 10 Jun 2021 15:58:34 GMT
Server
Apache
Vary
Accept-Encoding
Content-Language
en-US
Cache-control
private
Transfer-Encoding
chunked
Connection
close
Content-Type
application/javascript
login.js
pmw.empire.ca/pmwweb/js/ 		1 KB
823 B 		Script
General
Check archive.org
Download Go to
Full URL
https://pmw.empire.ca/pmwweb/js/login.js
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/login.jsp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.61.86.116 Kingston, Canada, ASN53564 (AS-EMPIRELIFE, CA),
Reverse DNS
Software
Apache /
Resource Hash
ebaf85d1a8b4dc8f1a2687f462547a734cdb823c71fa9528850d3d92f94c69a9

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
pmw.empire.ca
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://pmw.empire.ca/pmwweb/login.jsp
Cookie
user_lang=en_CA; WASReqURL=https:///pmwweb/dynamicReport.do?win=popup&type=claimDetails&claimId=VLAD18082021-58; JSESSIONID=0000Enedc3cWVzC1DDnwEtGvr17:-1
Connection
keep-alive
Referer
https://pmw.empire.ca/pmwweb/login.jsp
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 20 Aug 2021 11:30:14 GMT
Content-Encoding
gzip
Last-Modified
Thu, 10 Jun 2021 15:58:34 GMT
Server
Apache
Vary
Accept-Encoding
Content-Language
en-US
Cache-control
private
Transfer-Encoding
chunked
Connection
close
Content-Type
application/javascript
popup.js
pmw.empire.ca/pmwweb/js/ 		10 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pmw.empire.ca/pmwweb/js/popup.js
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/login.jsp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.61.86.116 Kingston, Canada, ASN53564 (AS-EMPIRELIFE, CA),
Reverse DNS
Software
Apache /
Resource Hash
7c6a95d2e26541425b18ceaaf84268342dc8c561f84da2becc456e4aebe13ae3

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
pmw.empire.ca
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://pmw.empire.ca/pmwweb/login.jsp
Cookie
user_lang=en_CA; WASReqURL=https:///pmwweb/dynamicReport.do?win=popup&type=claimDetails&claimId=VLAD18082021-58; JSESSIONID=0000Enedc3cWVzC1DDnwEtGvr17:-1
Connection
keep-alive
Referer
https://pmw.empire.ca/pmwweb/login.jsp
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 20 Aug 2021 11:30:14 GMT
Content-Encoding
gzip
Last-Modified
Thu, 10 Jun 2021 15:58:34 GMT
Server
Apache
Vary
Accept-Encoding
Content-Language
en-US
Cache-control
private
Transfer-Encoding
chunked
Connection
close
Content-Type
application/javascript
jquery-3.1.0.min.js
pmw.empire.ca/pmwweb/js/ 		84 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pmw.empire.ca/pmwweb/js/jquery-3.1.0.min.js
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/login.jsp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.61.86.116 Kingston, Canada, ASN53564 (AS-EMPIRELIFE, CA),
Reverse DNS
Software
Apache /
Resource Hash
702b9e051e82b32038ffdb33a4f7eb5f7b38f4cf6f514e4182d8898f4eb0b7fb

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
pmw.empire.ca
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://pmw.empire.ca/pmwweb/login.jsp
Cookie
user_lang=en_CA; WASReqURL=https:///pmwweb/dynamicReport.do?win=popup&type=claimDetails&claimId=VLAD18082021-58; JSESSIONID=0000Enedc3cWVzC1DDnwEtGvr17:-1
Connection
keep-alive
Referer
https://pmw.empire.ca/pmwweb/login.jsp
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 20 Aug 2021 11:30:14 GMT
Content-Encoding
gzip
Last-Modified
Thu, 10 Jun 2021 15:58:34 GMT
Server
Apache
Vary
Accept-Encoding
Content-Language
en-US
Cache-control
private
Transfer-Encoding
chunked
Connection
close
Content-Type
application/javascript
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 		118 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://pmw.empire.ca
Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 20 Aug 2021 11:30:14 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
632, 617, 617, 617
age
369540
cdn-cachedat
2021-06-08 21:21:23
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:03:59 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
6d5d85fa8ef72a228a5fac3b7164378a
cf-ray
681b49d8f8e6c2a9-FRA
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
bootstrap-theme.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 		23 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap-theme.min.css
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
653e073e97423adda5bc3917a241ee8497dd38a48f14bcde0098a4e54fd0fa5e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://pmw.empire.ca
Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 20 Aug 2021 11:30:14 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
601
age
369540
cdn-cachedat
08/03/2021 14:28:52
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cdn-proxyver
1.0
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:03:59 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
c0a88d8ec5e9a8da2f07570514875c61
cf-ray
681b49d8f8e9c2a9-FRA
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ 		36 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://pmw.empire.ca
Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 20 Aug 2021 11:30:14 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
752, 617, 617, 617, 617, 617, 617, 617, 617, 617
age
75566
cdn-cachedat
2021-08-02 15:29:35
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:00 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
aff1309b09d67706f3897394e5cb0bad
cf-ray
681b49d8f8eac2a9-FRA
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
mstyle.css
pmw.empire.ca/pmwweb/theme/ 		8 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://pmw.empire.ca/pmwweb/theme/mstyle.css
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/login.jsp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.61.86.116 Kingston, Canada, ASN53564 (AS-EMPIRELIFE, CA),
Reverse DNS
Software
Apache /
Resource Hash
255649c5ef97fafe4e20cae821cc401e214325c26c03aabc940d7ae67fa2d6be

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
pmw.empire.ca
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://pmw.empire.ca/pmwweb/login.jsp
Cookie
user_lang=en_CA; WASReqURL=https:///pmwweb/dynamicReport.do?win=popup&type=claimDetails&claimId=VLAD18082021-58; JSESSIONID=0000Enedc3cWVzC1DDnwEtGvr17:-1
Connection
keep-alive
Referer
https://pmw.empire.ca/pmwweb/login.jsp
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 20 Aug 2021 11:30:14 GMT
Content-Encoding
gzip
Last-Modified
Thu, 10 Jun 2021 15:58:34 GMT
Server
Apache
Vary
Accept-Encoding
Content-Language
en-US
Cache-control
private
Transfer-Encoding
chunked
Connection
close
Content-Type
text/css
logo.jpg
pmw.empire.ca/pmwweb/images/ 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pmw.empire.ca/pmwweb/images/logo.jpg
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/login.jsp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.61.86.116 Kingston, Canada, ASN53564 (AS-EMPIRELIFE, CA),
Reverse DNS
Software
Apache /
Resource Hash
ba3b1c0e6648bab1d96ece08eb97855735b1813c386d7822e4f29d2ccc72ce11

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
pmw.empire.ca
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://pmw.empire.ca/pmwweb/login.jsp
Connection
keep-alive
Referer
https://pmw.empire.ca/pmwweb/login.jsp
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 20 Aug 2021 11:30:15 GMT
Last-Modified
Thu, 10 Jun 2021 15:58:34 GMT
Server
Apache
Content-Language
en-US
Cache-control
private
Connection
close
Content-Type
image/jpeg
Content-Length
9655
Telemedicine-PlanMemberSite-LogOn-EN.jpg
pmw-notices.s3.amazonaws.com/ 		115 KB
116 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pmw-notices.s3.amazonaws.com/Telemedicine-PlanMemberSite-LogOn-EN.jpg
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/login.jsp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.217.95.185 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
6a1376ae848e884e330513163738de276b3193361c7e28bd6001428ba53d3c35

Request headers

Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 20 Aug 2021 11:30:16 GMT
Last-Modified
Wed, 26 Aug 2020 14:46:02 GMT
Server
AmazonS3
x-amz-request-id
9YEG95CP9J8R9C58
ETag
"45f289dea7c90ed8c247a857dfe77ee9"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
117944
x-amz-id-2
nev+OuT3vjJ4UyUsNwx/T85z24j5OWuLWeSkCfOP78dD1CiGkiJq2FffaeyYn8imltcPKSCuC8Q=
gtm.js
www.googletagmanager.com/ 		176 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-KN2DJ87
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
6e5befe3fbd7dde82f6d597423708a1b9b85184ea015e563f7f4fb3787a1144f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 20 Aug 2021 11:30:15 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
56874
x-xss-protection
0
last-modified
Fri, 20 Aug 2021 09:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 20 Aug 2021 11:30:15 GMT
notice-title-en.txt
s3.amazonaws.com/pmw-notices/ 		0
529 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://s3.amazonaws.com/pmw-notices/notice-title-en.txt
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/js/jquery-3.1.0.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.217.100.78 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*/*
Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 20 Aug 2021 11:30:16 GMT
Last-Modified
Wed, 02 Jun 2021 12:23:24 GMT
Server
AmazonS3
x-amz-request-id
9YEN57HTGA69788E
ETag
"d41d8cd98f00b204e9800998ecf8427e"
Vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Access-Control-Allow-Methods
GET
Content-Type
text/plain
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3000
Accept-Ranges
bytes
Content-Length
0
x-amz-id-2
Ptwc/VrCMkUkhmV6/jfeCt5dWZjus5gMkQQwjc0mAel1VGV0c22lCpq9m9l0npWfWvheHhsymdQ=
login-notice-en.txt
s3.amazonaws.com/pmw-notices/ 		0
529 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://s3.amazonaws.com/pmw-notices/login-notice-en.txt
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/js/jquery-3.1.0.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.217.100.78 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*/*
Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 20 Aug 2021 11:30:16 GMT
Last-Modified
Wed, 02 Jun 2021 12:23:23 GMT
Server
AmazonS3
x-amz-request-id
9YERQPQJZP2F678D
ETag
"d41d8cd98f00b204e9800998ecf8427e"
Vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Access-Control-Allow-Methods
GET
Content-Type
text/plain
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3000
Accept-Ranges
bytes
Content-Length
0
x-amz-id-2
j0GY+sbR4hTydBeGdBffZqh68dHbvUn5d3NW1rytvxg7cDkMVWOsE6eLSlcJj+zJP4PiDm4h2nY=
notice-title-fr.txt
s3.amazonaws.com/pmw-notices/ 		0
529 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://s3.amazonaws.com/pmw-notices/notice-title-fr.txt
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/js/jquery-3.1.0.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.217.100.78 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*/*
Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 20 Aug 2021 11:30:16 GMT
Last-Modified
Wed, 02 Jun 2021 12:23:24 GMT
Server
AmazonS3
x-amz-request-id
9YEHJTGN91X16F9Z
ETag
"d41d8cd98f00b204e9800998ecf8427e"
Vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Access-Control-Allow-Methods
GET
Content-Type
text/plain
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3000
Accept-Ranges
bytes
Content-Length
0
x-amz-id-2
WeyIO5O693AA1rV5RWH06Th5YKqImoVtLNwOw3kfhRoag0twM+pMaciUHljMK1sjbt0YxnZ9IEs=
login-notice-fr.txt
s3.amazonaws.com/pmw-notices/ 		0
529 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://s3.amazonaws.com/pmw-notices/login-notice-fr.txt
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/js/jquery-3.1.0.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.217.100.78 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*/*
Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 20 Aug 2021 11:30:16 GMT
Last-Modified
Wed, 02 Jun 2021 12:23:23 GMT
Server
AmazonS3
x-amz-request-id
9YEZP3F517AMEAVT
ETag
"d41d8cd98f00b204e9800998ecf8427e"
Vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Access-Control-Allow-Methods
GET
Content-Type
text/plain
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3000
Accept-Ranges
bytes
Content-Length
0
x-amz-id-2
mf8aLkGaRpWoL9YITus8lKnAQfJPtCvpmJb8KwHdxSokPewKePsQS+jGFvf2/xXhhtvp/wPz+28=
js
www.googletagmanager.com/gtag/ 		165 KB
61 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-1S7M715GDE&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KN2DJ87
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
bd0b9e00c3288cd43acc4dcb79b40fc63891e64a474dd4f74186d9cecb533d8b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 20 Aug 2021 11:30:15 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
62859
x-xss-protection
0
expires
Fri, 20 Aug 2021 11:30:15 GMT
activityi;dc_pre=CNWOr-6_v_ICFYoIBgAdm3wE-g;src=5290522;type=consu0;cat=consu018;ord=8341080359929;gtm=2wg8i0;auiddc=812658541.1629459015;ps=1;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp
5290522.fls.doubleclick.net/ Frame 6B63
Redirect Chain
  • https://5290522.fls.doubleclick.net/activityi;src=5290522;type=consu0;cat=consu018;ord=8341080359929;gtm=2wg8i0;auiddc=812658541.1629459015;ps=1;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp?
  • https://5290522.fls.doubleclick.net/activityi;dc_pre=CNWOr-6_v_ICFYoIBgAdm3wE-g;src=5290522;type=consu0;cat=consu018;ord=8341080359929;gtm=2wg8i0;auiddc=812658541.1629459015;ps=1;~oref=https%3A%2F%...
414 B
364 B 		Document
General
Check archive.org
Download Go to
Full URL
https://5290522.fls.doubleclick.net/activityi;dc_pre=CNWOr-6_v_ICFYoIBgAdm3wE-g;src=5290522;type=consu0;cat=consu018;ord=8341080359929;gtm=2wg8i0;auiddc=812658541.1629459015;ps=1;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KN2DJ87
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.198 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f6.1e100.net
Software
cafe /
Resource Hash
2627c08cf74924f52d11d76edd178cd1608533794f2c8bdf9e5d0ae7f672aa88
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
5290522.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=CNWOr-6_v_ICFYoIBgAdm3wE-g;src=5290522;type=consu0;cat=consu018;ord=8341080359929;gtm=2wg8i0;auiddc=812658541.1629459015;ps=1;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://pmw.empire.ca/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
about:blank

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Fri, 20 Aug 2021 11:30:15 GMT
expires
Fri, 20 Aug 2021 11:30:15 GMT
cache-control
private, max-age=0
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
339
x-xss-protection
0
set-cookie
IDE=AHWqTUlEA-gKLd9XjMb_uRzsWB2-s05CJ_Bh0HcFFve6899eedGFqpQyQTNNIveoQyg; expires=Wed, 14-Sep-2022 11:30:15 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Fri, 20 Aug 2021 11:30:15 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://5290522.fls.doubleclick.net/activityi;dc_pre=CNWOr-6_v_ICFYoIBgAdm3wE-g;src=5290522;type=consu0;cat=consu018;ord=8341080359929;gtm=2wg8i0;auiddc=812658541.1629459015;ps=1;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
5353.js
script.crazyegg.com/pages/scripts/0018/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.crazyegg.com/pages/scripts/0018/5353.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KN2DJ87
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f0e7e77a4683487e2273e4721ff1f79dc70991b2c99f2249c1626d974342b499

Request headers

Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 20 Aug 2021 11:30:15 GMT
content-encoding
gzip
cf-cache-status
HIT
age
59174
cf-polished
origSize=4899
cf-ray
681b49de09342c4a-FRA
ce-version
11.1.323
last-modified
Thu, 19 Aug 2021 19:04:01 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
timing-allow-origin
*
cf-bgj
minify
activityi;register_conversion=1;src=5290522;type=consu0;cat=consu018;ord=8341080359929;gtm=2wg8i0;auiddc=812658541.1629459015;ps=1;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp
5290522.fls.doubleclick.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://5290522.fls.doubleclick.net/activityi;register_conversion=1;src=5290522;type=consu0;cat=consu018;ord=8341080359929;gtm=2wg8i0;auiddc=812658541.1629459015;ps=1;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp?
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.198 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f6.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
5353.json
script.crazyegg.com/pages/data-scripts/0018/ 		17 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://script.crazyegg.com/pages/data-scripts/0018/5353.json?t=1
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0018/5353.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e400a1aa8bdad2a095332d80151219ee48c4216584555c4812717c4404d2d27a

Request headers

Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 20 Aug 2021 11:30:15 GMT
content-encoding
gzip
cf-cache-status
HIT
age
59174
ce-version
11.1.323
content-length
1884
timing-allow-origin
*
last-modified
Thu, 19 Aug 2021 19:04:01 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
accept-ranges
bytes
cf-ray
681b49de2f6e4e08-FRA
11.1.323.js
script.crazyegg.com/pages/versioned/common-scripts/ 		64 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.crazyegg.com/pages/versioned/common-scripts/11.1.323.js
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0018/5353.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
714cafff07c401d54cda0b09af30d81dd5e3e2bc5891556168366fcc771a5bc4

Request headers

Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 20 Aug 2021 11:30:15 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Thu, 15 Jul 2021 13:13:31 GMT
server
cloudflare
age
2060909
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000, s-maxage=31536000
accept-ranges
bytes
cf-ray
681b49de39872c4a-FRA
content-length
21471
collect
www.google-analytics.com/g/ 		0
70 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-1S7M715GDE&gtm=2oe8i0&_p=1540967240&sr=1600x1200&ul=en-us&cid=73548670.1629459015&_s=1&dl=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp&dt=Empire%20Life%20Plan%20Member%20Online%20Services%20Application&sid=1629459015&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-1S7M715GDE&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 20 Aug 2021 11:30:15 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://pmw.empire.ca
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
5353.json
script.crazyegg.com/pages/sampling-data-scripts/0018/ 		944 B
437 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://script.crazyegg.com/pages/sampling-data-scripts/0018/5353.json?t=452627
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/11.1.323.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3222fcc0a9acb5452ce53a946dd4be7ead46ef5f0fdedb7e07fab57d479c9682

Request headers

Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 20 Aug 2021 11:30:15 GMT
content-encoding
gzip
cf-cache-status
HIT
age
278
ce-version
11.1.323
content-length
344
timing-allow-origin
*
last-modified
Fri, 20 Aug 2021 11:25:37 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
accept-ranges
bytes
cf-ray
681b49de680c4e08-FRA
dc_pre=CNWOr-6_v_ICFYoIBgAdm3wE-g;src=5290522;type=consu0;cat=consu018;ord=8341080359929;gtm=2wg8i0;auiddc=*;ps=1;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp
adservice.google.com/ddm/fls/z/ Frame 6B63 		42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CNWOr-6_v_ICFYoIBgAdm3wE-g;src=5290522;type=consu0;cat=consu018;ord=8341080359929;gtm=2wg8i0;auiddc=*;ps=1;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp
Requested by
Host: 5290522.fls.doubleclick.net
URL: https://5290522.fls.doubleclick.net/activityi;dc_pre=CNWOr-6_v_ICFYoIBgAdm3wE-g;src=5290522;type=consu0;cat=consu018;ord=8341080359929;gtm=2wg8i0;auiddc=812658541.1629459015;ps=1;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://5290522.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 20 Aug 2021 11:30:15 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/g/ 		0
54 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-1S7M715GDE&gtm=2oe8i0&_p=1540967240&sr=1600x1200&ul=en-us&cid=73548670.1629459015&_s=2&dl=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp&dt=Empire%20Life%20Plan%20Member%20Online%20Services%20Application&sid=1629459015&sct=1&seg=0&en=scroll&_et=634&epn.percent_scrolled=90
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-1S7M715GDE&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 20 Aug 2021 11:30:21 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://pmw.empire.ca
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

102 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated string| SERVLET_CONTEXT object| keyCd boolean| altKy boolean| ctlKy boolean| shiftKy object| mouseBtn object| helpWin object| detailsWin object| cardWin number| F4_KEY number| F5_KEY function| setContextRoot function| getMouseButton function| getKeyCode function| handleOnClose function| resetLocalKeyCodes function| logout function| isIE function| isNetscape5 function| highLightMenu function| restoreMenu function| highlightButton function| restoreButton function| changeBgColor function| printPage function| assureUpper function| changeLocation function| changeToDesktop function| changeToMobile function| jumpSection function| browserInnerHeight function| setContentHeight function| keepCurrentPage function| showDiv function| hideDiv function| showTr function| hideTr function| hideDatesForHistory function| getImage function| OnCancel function| loginFocus function| popUpInformation function| commonWindow function| openFAQ function| getPersonalisedForm function| remindMeLater function| getDynamicPDF function| getDynamicTaxReportPDF function| getClaimDetailsPDF function| getDetailsPDF function| getParamedicalsPDF function| getHCSAFAQPDF function| getStaticPDF function| openBooklet function| getADDBooklet function| getTCTIBooklet function| openWalletCard function| openWalletCardNew function| openPDFWindow function| openWindow function| getDefaultWaitingUrl function| baseUrl function| encodeSpecialChars function| openPopup function| closePopup function| $ function| jQuery number| MSG_LOGIN_EMPTY_USERNAME number| MSG_LOGIN_EMPTY_PASSWORD number| MSG_LOGIN_EMPTY_BOTH number| MSG_LOGIN_USERNAME_NOT_VALID number| MSG_LOGIN_PASSWORD_LENGTH number| MSG_LOGIN_PASSWORD_ONE_NUERIC number| MSG_LOGIN_PASSWORD_ONE_ALPHA object| en_CA_Login_Msg object| fr_CA_Login_Msg function| getLoginMessage function| OnSubmit function| keyhandler object| dataLayer object| google_tag_manager object| google_tag_data boolean| CE_USER_SCRIPT object| CE2 string| CE_USER_DATA_URL string| CE_USER_COMMON_SCRIPT_URL string| CE_USER_THIRDPARTY_SCRIPT_URL object| gaGlobal function| onYouTubeIframeAPIReady object| CE2BH

4 Cookies

Domain/Path Name / Value
.doubleclick.net/ Name: IDE
Value: AHWqTUlEA-gKLd9XjMb_uRzsWB2-s05CJ_Bh0HcFFve6899eedGFqpQyQTNNIveoQyg
.empire.ca/ Name: _ga
Value: GA1.1.73548670.1629459015
.empire.ca/ Name: _ga_1S7M715GDE
Value: GS1.1.1629459015.1.0.1629459015.0
.empire.ca/ Name: _gcl_au
Value: 1.1.812658541.1629459015

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5290522.fls.doubleclick.net
adservice.google.com
maxcdn.bootstrapcdn.com
pmw-notices.s3.amazonaws.com
pmw.empire.ca
s3.amazonaws.com
script.crazyegg.com
www.google-analytics.com
www.googletagmanager.com
142.250.185.198
207.61.86.116
2606:4700::6812:acf
2606:4700::6813:9408
2a00:1450:4001:809::2002
2a00:1450:4001:827::200e
2a00:1450:4001:828::2008
52.217.100.78
52.217.95.185
1c288f36e865290c9fa0a685f9c6c881214398ef8cb6e4cf0d05361b277620bb
255649c5ef97fafe4e20cae821cc401e214325c26c03aabc940d7ae67fa2d6be
2627c08cf74924f52d11d76edd178cd1608533794f2c8bdf9e5d0ae7f672aa88
3222fcc0a9acb5452ce53a946dd4be7ead46ef5f0fdedb7e07fab57d479c9682
43c2f58515288f5d6772c245a4ff3264fe8a12b4a8361af1751c0dc49254eb10
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
653e073e97423adda5bc3917a241ee8497dd38a48f14bcde0098a4e54fd0fa5e
6a1376ae848e884e330513163738de276b3193361c7e28bd6001428ba53d3c35
6e5befe3fbd7dde82f6d597423708a1b9b85184ea015e563f7f4fb3787a1144f
702b9e051e82b32038ffdb33a4f7eb5f7b38f4cf6f514e4182d8898f4eb0b7fb
714cafff07c401d54cda0b09af30d81dd5e3e2bc5891556168366fcc771a5bc4
7c6a95d2e26541425b18ceaaf84268342dc8c561f84da2becc456e4aebe13ae3
ba3b1c0e6648bab1d96ece08eb97855735b1813c386d7822e4f29d2ccc72ce11
bd0b9e00c3288cd43acc4dcb79b40fc63891e64a474dd4f74186d9cecb533d8b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e400a1aa8bdad2a095332d80151219ee48c4216584555c4812717c4404d2d27a
ebaf85d1a8b4dc8f1a2687f462547a734cdb823c71fa9528850d3d92f94c69a9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0e7e77a4683487e2273e4721ff1f79dc70991b2c99f2249c1626d974342b499
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c