sso.changehealthcare.com Open in urlscan Pro
45.223.19.78 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://hsc.changehealthcare.com/
Effective URL:
https://sso.changehealthcare.com/as/authorization.oauth2?client_id=HSC_SuperApp-g8m0niooy36z17sckpqo&response_type=token%20id_tok...
Submission Tags: @phishunt_io
Submission: On October 27 via api (October 27th 2021, 10:52:11 pm UTC) from US — Scanned from DE

Summary HTTP 18 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 18 HTTP transactions. The main IP is 45.223.19.78, located in United States and belongs to INCAPSULA, US. The main domain is sso.changehealthcare.com.
TLS certificate: Issued by Sectigo RSA Extended Validation Secur... on May 20th 2021. Valid for: a year.

This is the only time sso.changehealthcare.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
7	170.138.40.214 170.138.40.214	14045 (CHANGEHEA...) (CHANGEHEALTHCARE)
8	45.223.19.78 45.223.19.78	19551 (INCAPSULA) (INCAPSULA)
2	143.204.101.13 143.204.101.13	16509 (AMAZON-02) (AMAZON-02)
18	4

7 170.138.40.214 (United States)

ASN14045 (CHANGEHEALTHCARE, US)

hsc.changehealthcare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 45.223.19.78 (United States)

ASN19551 (INCAPSULA, US)

sso.changehealthcare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.101.13 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-101-13.fra50.r.cloudfront.net

daks2k3a4ib2z.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	changehealthcare.com hsc.changehealthcare.com sso.changehealthcare.com	1 MB
2	cloudfront.net daks2k3a4ib2z.cloudfront.net	39 KB
0	amazonaws.com Failed internal-reactui-masthead-beacon-1115649197.us-east-1.elb.amazonaws.com Failed
18	3

	Domain	Requested by
8	sso.changehealthcare.com	hsc.changehealthcare.com sso.changehealthcare.com
7	hsc.changehealthcare.com	hsc.changehealthcare.com
2	daks2k3a4ib2z.cloudfront.net	sso.changehealthcare.com
0	internal-reactui-masthead-beacon-1115649197.us-east-1.elb.amazonaws.com Failed	hsc.changehealthcare.com
18	4

This site contains links to these domains. Also see Links.

Domain
www.changehealthcare.com
www.facebook.com
twitter.com
www.linkedin.com

Subject Issuer	Validity	Valid
hsc.changehealthcare.com Sectigo RSA Extended Validation Secure Server CA	`2021-04-17` - `2022-04-17`	a year	crt.sh
sso.changehealthcare.com Sectigo RSA Extended Validation Secure Server CA	`2021-05-20` - `2022-05-20`	a year	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://sso.changehealthcare.com/as/authorization.oauth2?client_id=HSC_SuperApp-g8m0niooy36z17sckpqo&response_type=token%20id_token&redirect_uri=https%3A%2F%2Fhsc.changehealthcare.com%2Fauth&scope=profile%20email%20openid&nonce=555677483
Frame ID: 335A1BF6108E58529F92EBD827B7D182
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Change Healthcare Sign On

Page URL History Show full URLs

https://hsc.changehealthcare.com/ Page URL
https://sso.changehealthcare.com/as/authorization.oauth2?client_id=HSC_SuperApp-g8m0niooy36z17sckpqo&response... Page URL

Page Statistics

18
Requests

94 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

4
IPs

1
Countries

1356 kB
Transfer

1519 kB
Size

6
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://www.changehealthcare.com/support
Title: Help & Support

Search URL Search Domain Scan URL

URL: https://www.changehealthcare.com/about
Title: About Us

Search URL Search Domain Scan URL

URL: https://www.changehealthcare.com/privacy-notice
Title: Privacy Notice

Search URL Search Domain Scan URL

URL: https://www.facebook.com/changehealthcare/

Search URL Search Domain Scan URL

URL: https://twitter.com/Change_HC

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/960104/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://hsc.changehealthcare.com/ Page URL
https://sso.changehealthcare.com/as/authorization.oauth2?client_id=HSC_SuperApp-g8m0niooy36z17sckpqo&response_type=token%20id_token&redirect_uri=https%3A%2F%2Fhsc.changehealthcare.com%2Fauth&scope=profile%20email%20openid&nonce=555677483 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
hsc.changehealthcare.com/ 5 KB
6 KB 1311ms
225ms Document
text/html 170.138.40.214
CHANGEHEALTHCARE

General

Check archive.org

Show headers Download Go to

Full URL

https://hsc.changehealthcare.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

170.138.40.214 , United States, ASN14045 (CHANGEHEALTHCARE, US),

Reverse DNS

Software

envoy / Express

Resource Hash

2c0e8161b78dd9e009f53546082db1caf7c5f16d28fd9c88d55f011d31a00bf4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Wed, 27 Oct 2021 22:52:04 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 5405
Connection: keep-alive
x-powered-by: Express
accept-ranges: bytes
cache-control: public, max-age=0
last-modified: Wed, 20 Oct 2021 08:33:13 GMT
etag: W/"151d-17c9cd53d28"
x-envoy-upstream-service-time: 1
server: envoy
Strict-Transport-Security: max-age=31536000; includeSubDomains

GET
H/1.1 200
OK env-config.js Show response
hsc.changehealthcare.com/ 203 B
621 B 139ms
139ms Script
application/javascript 170.138.40.214
CHANGEHEALTHCARE

General

Check archive.org

Show headers Download Go to

Full URL

https://hsc.changehealthcare.com/env-config.js

Requested by

Host: hsc.changehealthcare.com
URL: https://hsc.changehealthcare.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

170.138.40.214 , United States, ASN14045 (CHANGEHEALTHCARE, US),

Reverse DNS

Software

envoy / Express

Resource Hash

12bad1d038c926c3aa05f27156b601de3fb248463731cbd8c405c44308e782b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hsc.changehealthcare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Wed, 27 Oct 2021 22:52:04 GMT
last-modified: Wed, 27 Oct 2021 00:04:05 GMT
server: envoy
x-powered-by: Express
etag: W/"cb-17cbf0fa285"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: application/javascript; charset=UTF-8
cache-control: public, max-age=0
x-envoy-upstream-service-time: 0
Connection: keep-alive
accept-ranges: bytes
Content-Length: 203

GET
H/1.1 200
OK 21.4b93881d.chunk.css
hsc.changehealthcare.com/static/css/ 3 KB
3 KB 279ms
139ms Stylesheet
text/css 170.138.40.214
CHANGEHEALTHCARE

General

Check archive.org

Show headers Download Go to

Full URL

https://hsc.changehealthcare.com/static/css/21.4b93881d.chunk.css

Requested by

Host: hsc.changehealthcare.com
URL: https://hsc.changehealthcare.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

170.138.40.214 , United States, ASN14045 (CHANGEHEALTHCARE, US),

Reverse DNS

Software

envoy / Express

Resource Hash

29166bbcde5c1d0c1caad26ec0502966ca63d7b68f6b0890bf29892d281b5690

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hsc.changehealthcare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Wed, 27 Oct 2021 22:52:05 GMT
last-modified: Wed, 20 Oct 2021 08:33:12 GMT
server: envoy
x-powered-by: Express
etag: W/"b30-17c9cd53940"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: text/css; charset=UTF-8
cache-control: public, max-age=0
x-envoy-upstream-service-time: 0
Connection: keep-alive
accept-ranges: bytes
Content-Length: 2864

GET
H/1.1 200
OK main.2bf4b62b.chunk.css
hsc.changehealthcare.com/static/css/ 7 KB
7 KB 579ms
352ms Stylesheet
text/css 170.138.40.214
CHANGEHEALTHCARE

General

Check archive.org

Show headers Download Go to

Full URL

https://hsc.changehealthcare.com/static/css/main.2bf4b62b.chunk.css

Requested by

Host: hsc.changehealthcare.com
URL: https://hsc.changehealthcare.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

170.138.40.214 , United States, ASN14045 (CHANGEHEALTHCARE, US),

Reverse DNS

Software

envoy / Express

Resource Hash

47b5d054b9f8e0c119e74f3402b38837bc3b86cb511ac36e8c91e9a2fba7ede3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hsc.changehealthcare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Wed, 27 Oct 2021 22:52:05 GMT
last-modified: Wed, 20 Oct 2021 08:33:12 GMT
server: envoy
x-powered-by: Express
etag: W/"1ad6-17c9cd53940"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: text/css; charset=UTF-8
cache-control: public, max-age=0
x-envoy-upstream-service-time: 2
Connection: keep-alive
accept-ranges: bytes
Content-Length: 6870

GET
H/1.1 200
OK 21.1f045e1f.chunk.js Show response
hsc.changehealthcare.com/static/js/ 1 MB
1 MB 688ms
461ms Script
application/javascript 170.138.40.214
CHANGEHEALTHCARE

General

Check archive.org

Show headers Download Go to

Full URL

https://hsc.changehealthcare.com/static/js/21.1f045e1f.chunk.js

Requested by

Host: hsc.changehealthcare.com
URL: https://hsc.changehealthcare.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

170.138.40.214 , United States, ASN14045 (CHANGEHEALTHCARE, US),

Reverse DNS

Software

envoy / Express

Resource Hash

a26a05bafa471d0dda9608ed94d88a969265c0b17ddd9904951d671c8e7d24c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hsc.changehealthcare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Wed, 27 Oct 2021 22:52:05 GMT
last-modified: Wed, 20 Oct 2021 08:33:13 GMT
server: envoy
x-powered-by: Express
etag: W/"1227f2-17c9cd53d28"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: application/javascript; charset=UTF-8
cache-control: public, max-age=0
x-envoy-upstream-service-time: 1
Connection: keep-alive
accept-ranges: bytes
Content-Length: 1189874

GET
H/1.1 200
OK main.aa44626d.chunk.js Show response
hsc.changehealthcare.com/static/js/ 83 KB
84 KB 702ms
475ms Script
application/javascript 170.138.40.214
CHANGEHEALTHCARE

General

Check archive.org

Show headers Download Go to

Full URL

https://hsc.changehealthcare.com/static/js/main.aa44626d.chunk.js

Requested by

Host: hsc.changehealthcare.com
URL: https://hsc.changehealthcare.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

170.138.40.214 , United States, ASN14045 (CHANGEHEALTHCARE, US),

Reverse DNS

Software

envoy / Express

Resource Hash

928c4c79150f9085d933c0935e3f5d0e324682fc135e7af9fc940160cd0e51c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hsc.changehealthcare.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Wed, 27 Oct 2021 22:52:05 GMT
last-modified: Wed, 20 Oct 2021 08:33:12 GMT
server: envoy
x-powered-by: Express
etag: W/"14c91-17c9cd53940"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: application/javascript; charset=UTF-8
cache-control: public, max-age=0
x-envoy-upstream-service-time: 6
Connection: keep-alive
accept-ranges: bytes
Content-Length: 85137

GET
H/1.1 200
OK core-sans-c-400.woff2
hsc.changehealthcare.com/static/media/ 19 KB
19 KB 138ms
138ms Font
font/woff2 170.138.40.214
CHANGEHEALTHCARE

General

Check archive.org

Show headers Download Go to

Full URL

https://hsc.changehealthcare.com/static/media/core-sans-c-400.woff2

Requested by

Host: hsc.changehealthcare.com
URL: https://hsc.changehealthcare.com/login

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

170.138.40.214 , United States, ASN14045 (CHANGEHEALTHCARE, US),

Reverse DNS

Software

envoy / Express

Resource Hash

3208706a7ca7ffd3992c8fa26b075f300454de0378cd033d5037ccc490ddf107

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://hsc.changehealthcare.com/login
Origin: https://hsc.changehealthcare.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Wed, 27 Oct 2021 22:52:07 GMT
last-modified: Wed, 20 Oct 2021 08:30:58 GMT
server: envoy
x-powered-by: Express
etag: W/"4bf4-17c9cd32dd0"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: font/woff2
cache-control: public, max-age=0
x-envoy-upstream-service-time: 0
Connection: keep-alive
accept-ranges: bytes
Content-Length: 19444

POST uicl-analytics
internal-reactui-masthead-beacon-1115649197.us-east-1.elb.amazonaws.com/ 0
0

GET
DATA 200
OK truncated
/ 10 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 606c32b91d23113f339eab23d8863f27cd072ef58e032cca84a984b51291e499

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 Primary Request authorization.oauth2 Show response
sso.changehealthcare.com/as/ 7 KB
3 KB 600ms
340ms Document
text/html 45.223.19.78
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://sso.changehealthcare.com/as/authorization.oauth2?client_id=HSC_SuperApp-g8m0niooy36z17sckpqo&response_type=token%20id_token&redirect_uri=https%3A%2F%2Fhsc.changehealthcare.com%2Fauth&scope=profile%20email%20openid&nonce=555677483

Requested by

Host: hsc.changehealthcare.com
URL: https://hsc.changehealthcare.com/static/js/21.1f045e1f.chunk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.223.19.78 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

57da8cbc7921176632f4b779c240608f93b0b94290018b7f65c70e70677892d9

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://hsc.changehealthcare.com/

Response headers

date: Wed, 27 Oct 2021 22:52:10 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
x-frame-options: SAMEORIGIN
cache-control: no-cache, no-store
pragma: no-cache
content-type: text/html;charset=utf-8
x-cdn: Imperva
content-encoding: gzip
x-iinfo: 8-43830024-43830025 nNYN RT(1635375129894 0) q(0 0 3 1) r(4 4) U5

GET
H2 200 uicl.css
sso.changehealthcare.com/assets/css/ 16 KB
3 KB 130ms
129ms Stylesheet
text/css 45.223.19.78
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://sso.changehealthcare.com/assets/css/uicl.css

Requested by

Host: sso.changehealthcare.com
URL: https://sso.changehealthcare.com/as/authorization.oauth2?client_id=HSC_SuperApp-g8m0niooy36z17sckpqo&response_type=token%20id_token&redirect_uri=https%3A%2F%2Fhsc.changehealthcare.com%2Fauth&scope=profile%20email%20openid&nonce=555677483

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.223.19.78 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

32e88218d34bae7f05bbcc236a23c7ade60d42b17c14f7fb3734df6d93acf2cf

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sso.changehealthcare.com/as/authorization.oauth2?client_id=HSC_SuperApp-g8m0niooy36z17sckpqo&response_type=token%20id_token&redirect_uri=https%3A%2F%2Fhsc.changehealthcare.com%2Fauth&scope=profile%20email%20openid&nonce=555677483
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 22:52:10 GMT
content-encoding: gzip
last-modified: Tue, 26 Oct 2021 01:38:54 GMT
x-cdn: Imperva
x-frame-options: SAMEORIGIN
content-type: text/css
x-iinfo: 8-43830033-43830025 pNYN RT(1635375130254 0) q(0 0 0 -1) r(1 1) U5
cache-control: max-age=0, must-revalidate

GET
H2 200 logo.svg
sso.changehealthcare.com/assets/images/ 10 KB
4 KB 355ms
354ms Image
image/svg+xml 45.223.19.78
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sso.changehealthcare.com/assets/images/logo.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.223.19.78 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

36e137269724b33298ff908f84e627c03cd7f75f3a1f7773d4f3993eece52823

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sso.changehealthcare.com/as/authorization.oauth2?client_id=HSC_SuperApp-g8m0niooy36z17sckpqo&response_type=token%20id_token&redirect_uri=https%3A%2F%2Fhsc.changehealthcare.com%2Fauth&scope=profile%20email%20openid&nonce=555677483
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 22:52:10 GMT
content-encoding: gzip
last-modified: Tue, 26 Oct 2021 01:38:54 GMT
x-cdn: Imperva
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-iinfo: 8-43830034-43830035 nNYN RT(1635375130258 0) q(0 0 2 -1) r(3 3) U5
cache-control: max-age=0, must-revalidate

GET
H2 200 facebook.svg
sso.changehealthcare.com/assets/images/ 2 KB
757 B 356ms
355ms Image
image/svg+xml 45.223.19.78
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sso.changehealthcare.com/assets/images/facebook.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.223.19.78 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

dc86d5a2c722b9fbc5c64368a60cb3455584d246ee3394e87f6c411bc3af32cf

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sso.changehealthcare.com/as/authorization.oauth2?client_id=HSC_SuperApp-g8m0niooy36z17sckpqo&response_type=token%20id_token&redirect_uri=https%3A%2F%2Fhsc.changehealthcare.com%2Fauth&scope=profile%20email%20openid&nonce=555677483
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 22:52:10 GMT
content-encoding: gzip
last-modified: Tue, 26 Oct 2021 01:38:54 GMT
x-cdn: Imperva
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-iinfo: 8-43830036-43830037 nNYN RT(1635375130260 0) q(0 0 2 -1) r(3 3) U5
cache-control: max-age=0, must-revalidate

GET
H2 200 twitter.svg
sso.changehealthcare.com/assets/images/ 2 KB
1 KB 356ms
355ms Image
image/svg+xml 45.223.19.78
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sso.changehealthcare.com/assets/images/twitter.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.223.19.78 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

24be8897ecb75cecd093317af2bff32ca0757761bd09f8ea06862119eb42caf6

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sso.changehealthcare.com/as/authorization.oauth2?client_id=HSC_SuperApp-g8m0niooy36z17sckpqo&response_type=token%20id_token&redirect_uri=https%3A%2F%2Fhsc.changehealthcare.com%2Fauth&scope=profile%20email%20openid&nonce=555677483
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 22:52:10 GMT
content-encoding: gzip
last-modified: Tue, 26 Oct 2021 01:38:54 GMT
x-cdn: Imperva
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-iinfo: 8-43830038-43830039 nNYN RT(1635375130262 0) q(0 0 2 -1) r(3 3) U5
cache-control: max-age=0, must-revalidate

GET
H2 200 linkedin.svg
sso.changehealthcare.com/assets/images/ 2 KB
926 B 346ms
345ms Image
image/svg+xml 45.223.19.78
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sso.changehealthcare.com/assets/images/linkedin.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.223.19.78 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

4903b3eb9d38221f3993fee58b31b703bece7813fe50cbc516f0f9586d546bd1

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sso.changehealthcare.com/as/authorization.oauth2?client_id=HSC_SuperApp-g8m0niooy36z17sckpqo&response_type=token%20id_token&redirect_uri=https%3A%2F%2Fhsc.changehealthcare.com%2Fauth&scope=profile%20email%20openid&nonce=555677483
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 22:52:10 GMT
content-encoding: gzip
last-modified: Tue, 26 Oct 2021 01:38:54 GMT
x-cdn: Imperva
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
x-iinfo: 8-43830040-43830041 nNYN RT(1635375130264 0) q(0 0 2 -1) r(3 3) U5
cache-control: max-age=0, must-revalidate

GET
H2 200 _Incapsula_Resource Show response
sso.changehealthcare.com/ 154 KB
22 KB 42ms
41ms Script
application/javascript 45.223.19.78
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://sso.changehealthcare.com/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=341335443
Requested by: Host: sso.changehealthcare.com
URL: https://sso.changehealthcare.com/as/authorization.oauth2?client_id=HSC_SuperApp-g8m0niooy36z17sckpqo&response_type=token%20id_token&redirect_uri=https%3A%2F%2Fhsc.changehealthcare.com%2Fauth&scope=profile%20email%20openid&nonce=555677483
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.223.19.78 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: 4139f7176c81f6b1f532d35497b063e16de6732a57cfad1a9486fab032848541

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sso.changehealthcare.com/as/authorization.oauth2?client_id=HSC_SuperApp-g8m0niooy36z17sckpqo&response_type=token%20id_token&redirect_uri=https%3A%2F%2Fhsc.changehealthcare.com%2Fauth&scope=profile%20email%20openid&nonce=555677483
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-encoding: gzip
cache-control: no-cache, no-store
x-robots-tag: noindex
content-length: 22115
content-type: application/javascript

GET
H2 200 597ba6e2b036170001603e56_coresansc45-webfont.woff2
daks2k3a4ib2z.cloudfront.net/597ba6e2b036170001603d02/ 19 KB
20 KB 63ms
16ms Font
application/octet-stream 143.204.101.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://daks2k3a4ib2z.cloudfront.net/597ba6e2b036170001603d02/597ba6e2b036170001603e56_coresansc45-webfont.woff2
Requested by: Host: sso.changehealthcare.com
URL: https://sso.changehealthcare.com/assets/css/uicl.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.101.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-101-13.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3208706a7ca7ffd3992c8fa26b075f300454de0378cd033d5037ccc490ddf107

Request headers

Referer: https://sso.changehealthcare.com/
Origin: https://sso.changehealthcare.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 28 Jul 2021 05:50:41 GMT
via: 1.1 a1098f0eeab192209962e3a9d76d0339.cloudfront.net (CloudFront)
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
age: 7923690
x-cache: Hit from cloudfront
content-length: 19444
last-modified: Fri, 28 Jul 2017 21:04:37 GMT
server: AmazonS3
etag: "a7818393d03efbf80203e85e5163b820"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
x-amz-version-id: 6NE3qd8qZ.cqPoD2hzUb7pC3tVG.3xXT
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-type: application/octet-stream
x-amz-cf-id: eOQshcmKvOXyR1oTQNz6nPJTYmoV5F9SgJfdX5uCy2-tPd2vE9bBxQ==

GET
H2 200 597ba6e2b036170001603e4f_coresansc65-webfont.woff2
daks2k3a4ib2z.cloudfront.net/597ba6e2b036170001603d02/ 19 KB
19 KB 69ms
24ms Font
application/octet-stream 143.204.101.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://daks2k3a4ib2z.cloudfront.net/597ba6e2b036170001603d02/597ba6e2b036170001603e4f_coresansc65-webfont.woff2
Requested by: Host: sso.changehealthcare.com
URL: https://sso.changehealthcare.com/assets/css/uicl.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.101.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-101-13.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 29e9c9cfc49bfa84bc710db327660208f6a5b331cd30c3fdb0dd401f1063f911

Request headers

Referer: https://sso.changehealthcare.com/
Origin: https://sso.changehealthcare.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 07:55:27 GMT
via: 1.1 a1098f0eeab192209962e3a9d76d0339.cloudfront.net (CloudFront)
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
age: 6274604
x-cache: Hit from cloudfront
content-length: 19168
last-modified: Fri, 28 Jul 2017 21:04:37 GMT
server: AmazonS3
etag: "7b1d1d65de4a3e9337ae48de3111ac7a"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
x-amz-version-id: KAuUNDeZ.vjCOvThFhGW1b8V0mN2A_SX
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-type: application/octet-stream
x-amz-cf-id: pPLp84dNYmw8it2P8VKoDZ1DsboCh9oJJKeKtuLhRVj975tCgOY25Q==

GET
H2 200 _Incapsula_Resource
sso.changehealthcare.com/ 1 B
89 B 18ms
17ms Image
text/plain 45.223.19.78
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sso.changehealthcare.com/_Incapsula_Resource?SWKMTFSR=1&e=0.6752168753437993
Requested by: Host: sso.changehealthcare.com
URL: https://sso.changehealthcare.com/as/authorization.oauth2?client_id=HSC_SuperApp-g8m0niooy36z17sckpqo&response_type=token%20id_token&redirect_uri=https%3A%2F%2Fhsc.changehealthcare.com%2Fauth&scope=profile%20email%20openid&nonce=555677483
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.223.19.78 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sso.changehealthcare.com/as/authorization.oauth2?client_id=HSC_SuperApp-g8m0niooy36z17sckpqo&response_type=token%20id_token&redirect_uri=https%3A%2F%2Fhsc.changehealthcare.com%2Fauth&scope=profile%20email%20openid&nonce=555677483
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

cache-control: no-cache, no-store
x-robots-tag: noindex
content-length: 1
content-type: text/plain

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: internal-reactui-masthead-beacon-1115649197.us-east-1.elb.amazonaws.com
URL: http://internal-reactui-masthead-beacon-1115649197.us-east-1.elb.amazonaws.com/uicl-analytics

Verdicts & Comments Add Verdict or Comment

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
sso.changehealthcare.com/	1970-01-19 22:16:15	Name: ADRUM_BTa Value: R:33\|g:b7731de9-572a-4d35-bb39-94967a44d325\|n:chc-test_8a3b962e-37b6-4851-b09d-517c23d205c5
sso.changehealthcare.com/	1970-01-19 22:16:15	Name: SameSite Value: None
sso.changehealthcare.com/	1969-12-31 23:59:59	Name: PF Value: hb73UaArTLFOwM7mKOTvdd
.changehealthcare.com/	1969-12-31 23:59:59	Name: nlbi_2570831 Value: A55HGZZYzwmIbVbpryf6bAAAAAB/ZZ0HfkJLFNAGGVAY7vt4
.changehealthcare.com/	1970-01-20 07:00:55	Name: visid_incap_2570831 Value: uBQNxj70T+OIOqBHrIDWGBnYeWEAAAAAQUIPAAAAAAB511vpczbLpvlyEZkl+OXO
.changehealthcare.com/	1969-12-31 23:59:59	Name: incap_ses_1094_2570831 Value: GBDJNoVdNVVd2o45yasuDxrYeWEAAAAAVmEpG9WTgOO3yr06wqvynQ==

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://hsc.changehealthcare.com/static/js/21.1f045e1f.chunk.js(Line 1) Message: Mixed Content: The page at 'https://hsc.changehealthcare.com/login' was loaded over HTTPS, but requested an insecure resource 'http://internal-reactui-masthead-beacon-1115649197.us-east-1.elb.amazonaws.com/uicl-analytics'. This request has been blocked; the content must be served over HTTPS.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

daks2k3a4ib2z.cloudfront.net
hsc.changehealthcare.com
internal-reactui-masthead-beacon-1115649197.us-east-1.elb.amazonaws.com
sso.changehealthcare.com
internal-reactui-masthead-beacon-1115649197.us-east-1.elb.amazonaws.com
143.204.101.13
170.138.40.214
45.223.19.78
12bad1d038c926c3aa05f27156b601de3fb248463731cbd8c405c44308e782b0
24be8897ecb75cecd093317af2bff32ca0757761bd09f8ea06862119eb42caf6
29166bbcde5c1d0c1caad26ec0502966ca63d7b68f6b0890bf29892d281b5690
29e9c9cfc49bfa84bc710db327660208f6a5b331cd30c3fdb0dd401f1063f911
2c0e8161b78dd9e009f53546082db1caf7c5f16d28fd9c88d55f011d31a00bf4
3208706a7ca7ffd3992c8fa26b075f300454de0378cd033d5037ccc490ddf107
32e88218d34bae7f05bbcc236a23c7ade60d42b17c14f7fb3734df6d93acf2cf
36e137269724b33298ff908f84e627c03cd7f75f3a1f7773d4f3993eece52823
4139f7176c81f6b1f532d35497b063e16de6732a57cfad1a9486fab032848541
47b5d054b9f8e0c119e74f3402b38837bc3b86cb511ac36e8c91e9a2fba7ede3
4903b3eb9d38221f3993fee58b31b703bece7813fe50cbc516f0f9586d546bd1
57da8cbc7921176632f4b779c240608f93b0b94290018b7f65c70e70677892d9
606c32b91d23113f339eab23d8863f27cd072ef58e032cca84a984b51291e499
928c4c79150f9085d933c0935e3f5d0e324682fc135e7af9fc940160cd0e51c3
a26a05bafa471d0dda9608ed94d88a969265c0b17ddd9904951d671c8e7d24c8
dc86d5a2c722b9fbc5c64368a60cb3455584d246ee3394e87f6c411bc3af32cf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

sso.changehealthcare.com Open in urlscan Pro 45.223.19.78 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

18 Requests

94 %HTTPS

0 %IPv6

3 Domains

4 Subdomains

4 IPs

1 Countries

1356 kBTransfer

1519 kBSize

6 Cookies

6 Outgoing links

Page URL History

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

18 JavaScript Global Variables

6 Cookies

1 Console Messages

Security Headers

Indicators

sso.changehealthcare.com Open in urlscan Pro
45.223.19.78 Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

94 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

4
IPs

1
Countries

1356 kB
Transfer

1519 kB
Size

6
Cookies

18 HTTP transactions
1 data transactions