cartql-app.acmecorp-prod.f5xc.app Open in urlscan Pro
72.19.3.170  Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response cartql-app.acmecorp-prod.f5xc.app/	18 KB 4 KB	881ms 368ms	Document text/html	72.19.3.170 F5
General Check archive.org Show headers Download Go to Full URL https://cartql-app.acmecorp-prod.f5xc.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 72.19.3.170 , United States, ASN35280 (F5, FR), Reverse DNS Software volt-adc / Express Resource Hash 0b8c7eecbf05da9f94f49bfc678dbe5bf545fa27077d77fff94d1a89bf55cefd Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language en-US,en;q=0.9 Response headers access-control-allow-origin * alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 7df1abfaaeb939d7-YYZ content-encoding br content-type text/html date Thu, 29 Jun 2023 22:40:32 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2UyTplW%2FrxISUlJzVzYBd%2B5bsZsJF2EWyJdjj7OrUIrv0EyXqD85QlX0g339myyjtCDGSLgTFX79nwRDxm5eIRMXkCaus6s%2BDARjHnmgi3RSWwMcbDc%2Fo18TcJ56PcWU1g%3D%3D"}],"group":"cf-nel","max_age":604800} server volt-adc strict-transport-security max-age=31536000 via 1.1 vegur x-envoy-upstream-service-time 317 x-powered-by Express
GET H2	200	css fonts.googleapis.com/	15 KB 1 KB	165ms 63ms	Stylesheet text/css	2607:f8b0:4006:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700|Source+Code+Pro:400,700 Requested by Host: cartql-app.acmecorp-prod.f5xc.app URL: https://cartql-app.acmecorp-prod.f5xc.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80b::200a Flushing, United States, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash cedcafcc30f536e1bb9b4b9658572ea66f0f2715015a2438547a1b77356cd4ca Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://cartql-app.acmecorp-prod.f5xc.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Thu, 29 Jun 2023 22:40:32 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 29 Jun 2023 22:40:32 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 29 Jun 2023 22:40:32 GMT
GET H2	200	index.css cdn.jsdelivr.net/npm/@apollographql/graphql-playground-react@1.7.33/build/static/css/	568 B 811 B	99ms 31ms	Stylesheet text/css	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@apollographql/graphql-playground-react@1.7.33/build/static/css/index.css Requested by Host: cartql-app.acmecorp-prod.f5xc.app URL: https://cartql-app.acmecorp-prod.f5xc.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 712f55736381b7d7947f8b329115ae91e1586889cbdbdfa6c819850d26bb17f5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://cartql-app.acmecorp-prod.f5xc.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload date Thu, 29 Jun 2023 22:40:32 GMT x-content-type-options nosniff content-encoding br age 2378449 x-jsd-version 1.7.33 x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 341 x-served-by cache-fra-eddf8230029-FRA, cache-chi-klot8100159-CHI x-jsd-version-type version etag W/"238-kTDaN5yh+1ZUXCkN4elFCxZBDb4" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin *
GET H2	200	middleware.js Show response cdn.jsdelivr.net/npm/@apollographql/graphql-playground-react@1.7.33/build/static/js/	2 MB 578 KB	100ms 33ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@apollographql/graphql-playground-react@1.7.33/build/static/js/middleware.js Requested by Host: cartql-app.acmecorp-prod.f5xc.app URL: https://cartql-app.acmecorp-prod.f5xc.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 45486979ceb77d1a7e26dd199c40659b8e31b2a6c3c71303526711639f13682e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://cartql-app.acmecorp-prod.f5xc.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload date Thu, 29 Jun 2023 22:40:32 GMT x-content-type-options nosniff content-encoding br age 3853860 x-jsd-version 1.7.33 x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 591134 x-served-by cache-fra-eddf8230087-FRA, cache-chi-klot8100159-CHI x-jsd-version-type version etag W/"20eb0a-eZCM+DA2aM/y7NH85O53g3XbMb0" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin *
GET H2	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 fonts.gstatic.com/s/opensans/v35/	47 KB 48 KB	145ms 45ms	Font font/woff2	2607:f8b0:4006:821::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700|Source+Code+Pro:400,700 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:821::2003 Flushing, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://cartql-app.acmecorp-prod.f5xc.app accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Tue, 27 Jun 2023 22:34:53 GMT x-content-type-options nosniff age 173140 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 48412 x-xss-protection 0 last-modified Tue, 02 May 2023 15:08:53 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 26 Jun 2024 22:34:53 GMT
GET H2	200	HI_SiYsKILxRpg3hIP6sJ7fM7PqlPevW.woff2 fonts.gstatic.com/s/sourcecodepro/v22/	19 KB 19 KB	51ms 50ms	Font font/woff2	2607:f8b0:4006:821::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcecodepro/v22/HI_SiYsKILxRpg3hIP6sJ7fM7PqlPevW.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700|Source+Code+Pro:400,700 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:821::2003 Flushing, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1c2e64053b56afdcc933af75555920cf89c08b8ca04961f4815abdbd0bdcdbc3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://cartql-app.acmecorp-prod.f5xc.app accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Sat, 24 Jun 2023 17:05:36 GMT x-content-type-options nosniff age 452097 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 19680 x-xss-protection 0 last-modified Tue, 23 Aug 2022 18:25:36 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 23 Jun 2024 17:05:36 GMT
POST H2	403	/ Show response cartql-app.acmecorp-prod.f5xc.app/	309 B 407 B	540ms 48ms	Fetch text/html	72.19.3.170 F5
General Check archive.org Show headers Download Go to Full URL https://cartql-app.acmecorp-prod.f5xc.app/ Requested by Host: cdn.jsdelivr.net URL: https://cdn.jsdelivr.net/npm/@apollographql/graphql-playground-react@1.7.33/build/static/js/middleware.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 72.19.3.170 , United States, ASN35280 (F5, FR), Reverse DNS Software volt-adc / Resource Hash d08afd7105efef33d807e1daf97f281f8ef0d386c85f26872e7e07f29c6dfac9 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept */* Referer https://cartql-app.acmecorp-prod.f5xc.app/ Apollo-Query-Plan-Experimental 1 X-Apollo-Tracing 1 accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 content-type application/json Response headers strict-transport-security max-age=31536000 date Thu, 29 Jun 2023 22:40:34 GMT server volt-adc content-length 309 content-type text/html; charset=UTF-8

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend function| _ object| schemaFetcher object| scCGSHMRCache object| s function| session object| GraphQLPlayground object| m object| p string| version object| d object| editor object| g

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://cartql-app.acmecorp-prod.f5xc.app/ Message: Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cartql-app.acmecorp-prod.f5xc.app
cdn.jsdelivr.net
fonts.googleapis.com
fonts.gstatic.com
2607:f8b0:4006:80b::200a
2607:f8b0:4006:821::2003
2a04:4e42:600::485
72.19.3.170
0b8c7eecbf05da9f94f49bfc678dbe5bf545fa27077d77fff94d1a89bf55cefd
1c2e64053b56afdcc933af75555920cf89c08b8ca04961f4815abdbd0bdcdbc3
45486979ceb77d1a7e26dd199c40659b8e31b2a6c3c71303526711639f13682e
712f55736381b7d7947f8b329115ae91e1586889cbdbdfa6c819850d26bb17f5
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
cedcafcc30f536e1bb9b4b9658572ea66f0f2715015a2438547a1b77356cd4ca
d08afd7105efef33d807e1daf97f281f8ef0d386c85f26872e7e07f29c6dfac9