Submitted URL: https://login.ny.gov/
Effective URL: https://my.ny.gov/LoginV4/login.xhtml
Submission Tags: falconsandbox
Submission: On December 17 via api from US — Scanned from US

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 42 HTTP transactions. The main IP is 161.11.228.17, located in Albany, United States and belongs to NYS, US. The main domain is my.ny.gov. The Cisco Umbrella rank of the primary domain is 82140.
TLS certificate: Issued by GlobalSign Atlas R3 OV TLS CA 2024 Q4 on November 5th 2024. Valid for: a year.
This is the only time my.ny.gov was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 34.223.206.18 16509 (AMAZON-02)
4 13.33.252.118 16509 (AMAZON-02)
4 161.11.228.17 26854 (NYS)
42 4
Apex Domain
Subdomains
Transfer
5 ny.gov
login.ny.gov — Cisco Umbrella Rank: 85669
my.ny.gov — Cisco Umbrella Rank: 82140
188 KB
4 oktacdn.com
ok5static.oktacdn.com — Cisco Umbrella Rank: 21805
248 KB
0 Failed
function sub() { [native code] }. Failed
42 3
Domain Requested by
4 my.ny.gov my.ny.gov
4 ok5static.oktacdn.com login.ny.gov
1 login.ny.gov
0 burp Failed
0 127.0.0.1 Failed my.ny.gov
0 rumola Failed my.ny.gov
0 invalid Failed my.ny.gov
42 7

This site contains no links.

Subject Issuer Validity Valid
login.ny.gov
R10
2024-11-21 -
2025-02-19
3 months crt.sh
*.oktacdn.com
DigiCert TLS RSA SHA256 2020 CA1
2023-12-15 -
2025-01-02
a year crt.sh
*.ny.gov
GlobalSign Atlas R3 OV TLS CA 2024 Q4
2024-11-05 -
2025-11-05
a year crt.sh

This page contains 1 frames:

Frame: https://my.ny.gov/LoginV4/login.xhtml
Frame ID: 60BC6A66A8CD2C241E82656C7A718BF4
Requests: 46 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://login.ny.gov/ Page URL
  2. https://my.ny.gov/LoginV4/login.xhtml Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

42
Requests

21 %
HTTPS

0 %
IPv6

3
Domains

7
Subdomains

4
IPs

1
Countries

436 kB
Transfer

1008 kB
Size

7
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://login.ny.gov/ Page URL
  2. https://my.ny.gov/LoginV4/login.xhtml Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

42 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
login.ny.gov/
30 KB
11 KB
Document
General
Full URL
https://login.ny.gov/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.223.206.18 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-223-206-18.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
ffe9c65ecf544b6fe22fd3f6ee0d69e382fa1e684c900532aba7b82822e5ff86
Security Headers
Name Value
Content-Security-Policy default-src 'self' nys.okta.com login.ny.gov *.oktacdn.com; connect-src 'self' nys.okta.com nys-admin.okta.com login.ny.gov *.oktacdn.com *.mixpanel.com *.mapbox.com *.mtls.okta.com nys.kerberos.okta.com nys.mtls.okta.com https://oinmanager.okta.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; script-src 'unsafe-inline' 'nonce-6JnjofBJB_PUq6NL9Kc2ng' 'unsafe-eval' 'self' 'report-sample' nys.okta.com login.ny.gov *.oktacdn.com; style-src 'unsafe-inline' 'self' nys.okta.com login.ny.gov *.oktacdn.com; frame-src 'self' nys.okta.com nys-admin.okta.com login.ny.gov login.okta.com; img-src 'self' nys.okta.com login.ny.gov *.oktacdn.com *.tiles.mapbox.com *.mapbox.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com blob:; font-src 'self' nys.okta.com login.ny.gov data: *.oktacdn.com fonts.gstatic.com; frame-ancestors 'self' https://apps.labor.ny.gov
Strict-Transport-Security max-age=315360000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Connection
Keep-Alive
Content-Encoding
gzip
Content-Type
text/html;charset=utf-8
Date
Tue, 17 Dec 2024 22:21:58 GMT
Keep-Alive
timeout=5, max=100
Server
nginx
Strict-Transport-Security
max-age=315360000; includeSubDomains
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Robots-Tag
noindex,nofollow
accept-ch
Sec-CH-UA-Platform-Version
cache-control
no-cache, no-store
content-language
en
content-security-policy
default-src 'self' nys.okta.com login.ny.gov *.oktacdn.com; connect-src 'self' nys.okta.com nys-admin.okta.com login.ny.gov *.oktacdn.com *.mixpanel.com *.mapbox.com *.mtls.okta.com nys.kerberos.okta.com nys.mtls.okta.com https://oinmanager.okta.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; script-src 'unsafe-inline' 'nonce-6JnjofBJB_PUq6NL9Kc2ng' 'unsafe-eval' 'self' 'report-sample' nys.okta.com login.ny.gov *.oktacdn.com; style-src 'unsafe-inline' 'self' nys.okta.com login.ny.gov *.oktacdn.com; frame-src 'self' nys.okta.com nys-admin.okta.com login.ny.gov login.okta.com; img-src 'self' nys.okta.com login.ny.gov *.oktacdn.com *.tiles.mapbox.com *.mapbox.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com blob:; font-src 'self' nys.okta.com login.ny.gov data: *.oktacdn.com fonts.gstatic.com; frame-ancestors 'self' https://apps.labor.ny.gov
expires
0
p3p
CP="HONK"
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-okta-request-id
Z2H5hoLVYWMUEVPz1oyc3QAAAzU
x-rate-limit-limit
30000
x-rate-limit-remaining
30000
x-rate-limit-reset
1734474134
x-xss-protection
0
jquery-1.12.4.2ef93d9aedc4198ec425a799a371292d.js
ok5static.oktacdn.com/assets/js/
289 KB
101 KB
Script
General
Full URL
https://ok5static.oktacdn.com/assets/js/jquery-1.12.4.2ef93d9aedc4198ec425a799a371292d.js
Requested by
Host: login.ny.gov
URL: https://login.ny.gov/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.33.252.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-252-118.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
43e51f129fb6eb0f52aee5fb4857f14796f9a5b38e66f445658db1ac1fb7298e
Security Headers
Name Value
Strict-Transport-Security max-age=315360000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://login.ny.gov
Referer
https://login.ny.gov/

Response headers

content-encoding
gzip
etag
W/"2ef93d9aedc4198ec425a799a371292d"
age
1196321
expires
Thu, 04 Dec 2025 02:03:17 GMT
x-cache
Hit from cloudfront
x-amz-cf-id
TX7R5pFA-UCPJCbzOnbYfaaONa4yWBiWGtNwQ8S4dfrm5epXN8stWg==
date
Wed, 04 Dec 2024 02:03:17 GMT
content-type
application/javascript
last-modified
Tue, 06 Dec 2022 21:58:14 GMT
vary
Accept-Encoding
strict-transport-security
max-age=315360000; includeSubDomains
cache-control
max-age=31536000, public,max-age=31536000,s-maxage=1814400
via
1.1 5a917b0edc7c6d2cee02a076aac1e824.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-amz-meta-sha1sum
26667ee897b9e91a9b54c3d4aa445649aa92543d
x-amz-cf-pop
JFK50-P10
server
nginx
interstitial.c280c95e9e8c971dad6d6dd597ab23f8.css
ok5static.oktacdn.com/assets/css/sections/
8 KB
3 KB
Stylesheet
General
Full URL
https://ok5static.oktacdn.com/assets/css/sections/interstitial.c280c95e9e8c971dad6d6dd597ab23f8.css
Requested by
Host: login.ny.gov
URL: https://login.ny.gov/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.33.252.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-252-118.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
d952fafe2ace405711d16dd5b78225162c199fffc0132fb1d85b612b629c5e22
Security Headers
Name Value
Strict-Transport-Security max-age=315360000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://login.ny.gov/

Response headers

content-encoding
gzip
etag
W/"c280c95e9e8c971dad6d6dd597ab23f8"
age
189724
expires
Mon, 15 Dec 2025 17:39:54 GMT
x-cache
Hit from cloudfront
x-amz-cf-id
LVYHWzxmocxjttYVRaaQl2QbutpX9zlxevW0hqZNZnwaoyctUZ0qqA==
date
Sun, 15 Dec 2024 17:39:54 GMT
content-type
text/css
last-modified
Tue, 05 Dec 2023 18:37:10 GMT
vary
Accept-Encoding
strict-transport-security
max-age=315360000; includeSubDomains
cache-control
max-age=31536000, public,max-age=31536000,s-maxage=1814400
via
1.1 b1422ccb486c8b395d3da3c4f22f7644.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-amz-meta-sha1sum
254ba22d6a26decbf68aac1f9710e47a39cc4bfa
x-amz-cf-pop
JFK50-P10
server
nginx
interstitial-dark-blue-brand.d4ca51b5579d1772af159f12276beb72.gif
ok5static.oktacdn.com/assets/img/ui/indicators/
143 KB
144 KB
Image
General
Full URL
https://ok5static.oktacdn.com/assets/img/ui/indicators/interstitial-dark-blue-brand.d4ca51b5579d1772af159f12276beb72.gif
Requested by
Host: login.ny.gov
URL: https://login.ny.gov/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.33.252.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-252-118.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=315360000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://login.ny.gov/

Response headers

etag
"d4ca51b5579d1772af159f12276beb72"
age
698981
expires
Tue, 09 Dec 2025 20:12:17 GMT
x-cache
Hit from cloudfront
x-amz-cf-id
0CdqUlovODEHnCNSPb9eMv-6DRD9iA6FF6WrcgvFWkWEATF4Gg8i7A==
date
Mon, 09 Dec 2024 20:12:17 GMT
content-type
image/gif
last-modified
Wed, 15 Dec 2021 01:25:34 GMT
strict-transport-security
max-age=315360000; includeSubDomains
cache-control
max-age=31536000, public,max-age=31536000,s-maxage=1814400
via
1.1 b1422ccb486c8b395d3da3c4f22f7644.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
146495
x-amz-cf-pop
JFK50-P10
server
nginx
interstitial.3bb1b1dab07d5557b70fe16c1da0276e.js
ok5static.oktacdn.com/assets/js/app/sso/
576 B
829 B
Script
General
Full URL
https://ok5static.oktacdn.com/assets/js/app/sso/interstitial.3bb1b1dab07d5557b70fe16c1da0276e.js
Requested by
Host: login.ny.gov
URL: https://login.ny.gov/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.33.252.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-252-118.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
d67f33137e87a6a11f9b298e5a4aefe0c3094930d5ad4fcce9e828e0d6a5d3b8
Security Headers
Name Value
Strict-Transport-Security max-age=315360000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://login.ny.gov
Referer
https://login.ny.gov/

Response headers

content-encoding
gzip
etag
W/"3bb1b1dab07d5557b70fe16c1da0276e"
age
912474
expires
Sun, 07 Dec 2025 08:54:04 GMT
x-cache
Hit from cloudfront
x-amz-cf-id
zp5FWRp97h3rtL49aWApL3V1fCCyGhd0e812AqFW9AHFMUDAu10K3w==
date
Sat, 07 Dec 2024 08:54:10 GMT
content-type
application/javascript
last-modified
Wed, 17 Jan 2024 19:33:25 GMT
vary
Accept-Encoding
strict-transport-security
max-age=315360000; includeSubDomains
cache-control
max-age=31536000, public,max-age=31536000,s-maxage=1814400
via
1.1 5a917b0edc7c6d2cee02a076aac1e824.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-amz-meta-sha1sum
ae20c501108c474c6d4f9657041db2260164e0a0
x-amz-cf-pop
JFK50-P10
server
nginx
Primary Request login.xhtml
my.ny.gov/LoginV4/
10 KB
11 KB
Document
General
Full URL
https://my.ny.gov/LoginV4/login.xhtml
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
161.11.228.17 Albany, United States, ASN26854 (NYS, US),
Reverse DNS
Software
/
Resource Hash
3179b85ddbbff30d06acb81961e4b1a170c2c49fbeb0b04ef7a3fa7ce3bf0587
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://login.ny.gov
Referer
https://login.ny.gov/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Cache-Control
no-store, must-revalidate, no-cache, max-age=0
Content-Length
10382
Content-Type
text/html
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
0850721fd0ab20008b75cb3aafbd157a9768ad580740d43a2edbc08fdeff9dbaf94d0c27592a43ba
my.ny.gov/TSPD/
440 KB
128 KB
Script
General
Full URL
https://my.ny.gov/TSPD/0850721fd0ab20008b75cb3aafbd157a9768ad580740d43a2edbc08fdeff9dbaf94d0c27592a43ba?type=11
Requested by
Host: my.ny.gov
URL: https://my.ny.gov/LoginV4/login.xhtml
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
161.11.228.17 Albany, United States, ASN26854 (NYS, US),
Reverse DNS
Software
/
Resource Hash
285a8f55ccf8b8a9529c032c669c55b9a5f60aac26c2e3888199df3a51b20f7c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://my.ny.gov/LoginV4/login.xhtml

Response headers

X-Content-Type-Options
nosniff
Cache-Control
public, max-age=86400
Content-Length
130792
Content-Encoding
gzip
X-XSS-Protection
1; mode=block
Content-Type
text/javascript
X-Frame-Options
SAMEORIGIN
0850721fd0ab20008b75cb3aafbd157a9768ad580740d43a2edbc08fdeff9dbaf94d0c27592a43ba
my.ny.gov/TSPD/
52 KB
37 KB
Script
General
Full URL
https://my.ny.gov/TSPD/0850721fd0ab20008b75cb3aafbd157a9768ad580740d43a2edbc08fdeff9dbaf94d0c27592a43ba?type=12
Requested by
Host: my.ny.gov
URL: https://my.ny.gov/LoginV4/login.xhtml
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
161.11.228.17 Albany, United States, ASN26854 (NYS, US),
Reverse DNS
Software
/
Resource Hash
552f179b8856e5355d6d5865abf56d10af6a0e698c3a8ea2b5610c459fbe37a3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://my.ny.gov/LoginV4/login.xhtml

Response headers

X-Content-Type-Options
nosniff
Cache-Control
public, max-age=86400
Content-Length
37876
Content-Encoding
gzip
X-XSS-Protection
1; mode=block
Content-Type
text/javascript
X-Frame-Options
SAMEORIGIN
truncated
/
34 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/gif
truncated
/
67 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
60d20c34efdd7103c273f54369cfc42c6d0a39126ce22298f2d31924b4ca5a56

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
truncated
/
34 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/gif
truncated
/
35 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
483d244f19d7105fd875ee8d01223fb50c32409a0a33e6998b0ab644bbdc4a62

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/jpg
0850721fd0ab2800645ca04f987be3fbd3cd1e61b9ce814f0bcadcbcd5771abb22233a924decd6110c05d1e363fdc268
my.ny.gov/TSPD/
566 B
789 B
XHR
General
Full URL
https://my.ny.gov/TSPD/0850721fd0ab2800645ca04f987be3fbd3cd1e61b9ce814f0bcadcbcd5771abb22233a924decd6110c05d1e363fdc268?type=13
Requested by
Host: my.ny.gov
URL: https://my.ny.gov/TSPD/0850721fd0ab20008b75cb3aafbd157a9768ad580740d43a2edbc08fdeff9dbaf94d0c27592a43ba?type=11
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
161.11.228.17 Albany, United States, ASN26854 (NYS, US),
Reverse DNS
Software
/
Resource Hash
67169383d5fa0553d95e150f59a319f1952845386d2920a6906d6744c3897cba
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://my.ny.gov/LoginV4/login.xhtml

Response headers

X-Content-Type-Options
nosniff
Cache-Control
no-store, must-revalidate, no-cache, max-age=0
Content-Length
566
X-XSS-Protection
1; mode=block
Content-Type
text/html
X-Frame-Options
SAMEORIGIN
/
invalid/
0
0

/
invalid/
0
0

/
invalid/
0
0

rumola48.png
rumola/content/
0
0

/
invalid/
0
0

/
invalid/
0
0

/
invalid/
0
0

/
invalid/
0
0

/
invalid/
0
0

/
invalid/
0
0

/
invalid/
0
0

/
invalid/
0
0

/
invalid/
0
0

/
invalid/
0
0

/
invalid/
0
0

/
invalid/
0
0

/
invalid/
0
0

/
invalid/
0
0

/
invalid/
0
0

/
invalid/
0
0

/
invalid/
0
0

/
invalid/
0
0

/
invalid/
0
0

/
invalid/
0
0

/
invalid/
0
0

404
127.0.0.1/
0
0

random_url
127.0.0.1/
0
0

400_random_url_with_numbers_403
127.0.0.1/
0
0

200
127.0.0.1/
0
0

403
127.0.0.1/
0
0

302
127.0.0.1/
0
0

favicon.ico
burp/
0
0

login.xhtml
my.ny.gov/LoginV4/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
invalid
URL
chrome-extension://invalid/
Domain
invalid
URL
chrome-extension://invalid/
Domain
invalid
URL
chrome-extension://invalid/
Domain
rumola
URL
chrome://rumola/content/rumola48.png
Domain
invalid
URL
chrome-extension://invalid/
Domain
invalid
URL
chrome-extension://invalid/
Domain
invalid
URL
chrome-extension://invalid/
Domain
invalid
URL
chrome-extension://invalid/
Domain
invalid
URL
chrome-extension://invalid/
Domain
invalid
URL
chrome-extension://invalid/
Domain
invalid
URL
chrome-extension://invalid/
Domain
invalid
URL
chrome-extension://invalid/
Domain
invalid
URL
chrome-extension://invalid/
Domain
invalid
URL
chrome-extension://invalid/
Domain
invalid
URL
chrome-extension://invalid/
Domain
invalid
URL
chrome-extension://invalid/
Domain
invalid
URL
chrome-extension://invalid/
Domain
invalid
URL
chrome-extension://invalid/
Domain
invalid
URL
chrome-extension://invalid/
Domain
invalid
URL
chrome-extension://invalid/
Domain
invalid
URL
chrome-extension://invalid/
Domain
invalid
URL
chrome-extension://invalid/
Domain
invalid
URL
chrome-extension://invalid/
Domain
invalid
URL
chrome-extension://invalid/
Domain
invalid
URL
chrome-extension://invalid/
Domain
127.0.0.1
URL
http://127.0.0.1:8888/404
Domain
127.0.0.1
URL
http://127.0.0.1:8888/random_url
Domain
127.0.0.1
URL
http://127.0.0.1:8888/400_random_url_with_numbers_403
Domain
127.0.0.1
URL
http://127.0.0.1:8888/200
Domain
127.0.0.1
URL
http://127.0.0.1:8888/403
Domain
127.0.0.1
URL
http://127.0.0.1:8888/302
Domain
burp
URL
https://burp/favicon.ico
Domain
my.ny.gov
URL
https://my.ny.gov/LoginV4/login.xhtml

Verdicts & Comments Add Verdict or Comment

95 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| bobcmn string| failureConfig object| Ea object| D function| eb object| F object| ib function| jb function| lb object| qb function| rb boolean| sb object| wb object| xb function| yb function| zb function| debugLog object| Ab object| Bb object| Cb string| Eb object| Fb object| Hb object| J string| Ib string| Jb object| Kb object| Lb number| Ob number| Pb number| Qb number| Sb object| Tb function| Ub object| Vb object| Wb object| Xb object| Yb object| Zb function| $b object| ac object| bc object| cc object| dc object| ec object| gc object| hc number| j object| jc object| kc object| lc object| mc object| nc object| oc object| pc object| qc object| rc object| sc object| tc object| uc object| vc object| wc object| xc object| zc object| Ac object| Bc function| Cc object| Dc object| Ec object| Fc object| Gc object| Hc object| Ic number| Jc string| Kc object| Lc object| Mc object| Nc object| Oc object| Pc number| activeGroups object| K object| html5 function| yepnope object| webrootkit_fnlist_exclude object| Rc string| Qc string| blobfp string| slobfp object| fpdefs number| _r3 number| _m number| bb string| prop object| obj

7 Cookies

Domain/Path Name / Value
my.ny.gov/LoginV4 Name: TS443d8d13075
Value: 0502b1010850721fd0ab2800645ca04f987be3fbd3cd1e61b9ce814f0bcadcbcd5771abb22233a924decd6110c05d1e363fdc268:088379056804a000928460a5dd0b80e09d1df6ae2af9125b406c04441ef4b60f9c4cb017ab61beca40cbeb6b45c6da24828ccdb5c7a135c4c23b2c937d50295dc307adba40d7d7cc198aa2679ad40c6b0a469506a8cbf69a0ec0c8775d6fc9db5fcffbc0ea9d2ccaf38a1639a531fe06d5be60c201e109a56c4b0f089d23fa4e6e0b990b3e7f3c784c9a2770f5456ff5655cb4bf8ad8d7f0a7a748c7bb48a829c97df051f798eae5a0010850721fd0ab2800645ca04f987be3fbd3cd1e61b9ce814f0bcadcbcd5771abb22233a924decd6110c05d1e363fdc2680883790568109800ddfd98b6d01080adb267b9b6398872fa248c3571d8ed9dd30f3ba5c8f37ec8ce3a98d50e8b1b5b4e4130b69ac722a364a873748dd6e66e4c8bc20741c609fcb5ab6c9fb6a3ff9e290203786536527608ccda16b1149dda026f53db5ed4e838c1a3c1f3cb9eb72c4f8e7a71c6de74fc7f89ffd3db41543107144d0697377b67474201781b4c17a61c9e567eb06003bf7d6d22565b2aac0fd6002900application%2fx%2dwww%2dform%2durlencodede0000850721fd0ab2000339b9113264668cfaf675929f8a0ddbdaf5cfa28c32c34789f39cdaab2eea2bf0865ee04780a40007cee8a7263651835856451f6fbb1ce9b0bda02ab4e57075e66ce6a90e9fce59f6e66af1d322e291e8fae47ee06f10b0a43ea0d33e33e37a937821a49faf508871d00https%3a%2f%2flogin.ny.gov%2f
login.ny.gov/ Name: JSESSIONID
Value: CB07E271472924AC1A620ABC1FE45389
login.ny.gov/ Name: DT
Value: DI1IvMP71eKQfmwRbGhPV0ceQ
my.ny.gov/ Name: TS443d8d13029
Value: 0850721fd0ab280091dc68b8095c1a32e8d9678d0a49fe8810d44add73a8220facdd4293631088abfd31482d627b3794
my.ny.gov/ Name: TS55d6f691027
Value: 0850721fd0ab200098f59239c274e0651b7591fb097e957a9db045db60834dbd6cbbfd13cbaa5f4408af358dd1113000e246d79e79143439456f84464657ed5b609ef3d2c10c6b6464a99b751976c0275a88cc236deac1679276c0995055657a
my.ny.gov/ Name: TS00000000076
Value: 0850721fd0ab2800645ca04f987be3fbd3cd1e61b9ce814f0bcadcbcd5771abb22233a924decd6110c05d1e363fdc268088379056809d000c3f9231447006f722d3d25bb4e072a60db3113e474dd4edded5e6cd30e1bcbf952ddf99aa98c62e8fc95894dce863f7ba49a14d6e77951cb5f627b8bf2b2b950cf0e53b3519b7e12cb1fb0edf1b0fb98f4d50e386dae4a8b11ffe4e61a524e85ca52a1c712706dd3171ddde9c974102bcff6ae15e45a318319ecb93202526123523b127d8b34a801ccb570d56dad8dceade5118661ab78b1e030d8b0ef325e54aadb3f079fa5a5e4a87759376cf83a8a3c811ecec12f153fef6b49c6f7f9cc555e9818f80f4f29b8407eb7f1392379f4
my.ny.gov/ Name: TSPD_101_DID
Value: 0850721fd0ab2800645ca04f987be3fbd3cd1e61b9ce814f0bcadcbcd5771abb22233a924decd6110c05d1e363fdc2680883790568063800a604360f754f64b2aa2393cadc46ce4cf85abac6e9cc3c9800dd87186f66005095fdde7da763f6d2a0b120c66c8d0b21bf7c48d44c7f8dad

32 Console Messages

Source Level URL
Text
rendering warning URL: https://my.ny.gov/LoginV4/login.xhtml(Line 26)
Message:
[GroupMarkerNotSet(crbug.com/242999)!:A0B01908A4250000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
deprecation warning URL: https://my.ny.gov/TSPD/0850721fd0ab20008b75cb3aafbd157a9768ad580740d43a2edbc08fdeff9dbaf94d0c27592a43ba?type=11(Line 1493)
Message:
The ScriptProcessorNode is deprecated. Use AudioWorkletNode instead. (https://bit.ly/audio-worklet)
rendering warning URL: https://my.ny.gov/LoginV4/login.xhtml
Message:
[GroupMarkerNotSet(crbug.com/242999)!:A0801908A4250000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
rendering warning URL: https://my.ny.gov/LoginV4/login.xhtml
Message:
[GroupMarkerNotSet(crbug.com/242999)!:A0E0A505A4250000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
javascript error URL: https://my.ny.gov/TSPD/0850721fd0ab20008b75cb3aafbd157a9768ad580740d43a2edbc08fdeff9dbaf94d0c27592a43ba?type=11(Line 1966)
Message:
Not allowed to load local resource: chrome://rumola/content/rumola48.png
security warning URL: https://my.ny.gov/LoginV4/login.xhtml
Message:
Mixed Content: The page at 'https://my.ny.gov/LoginV4/login.xhtml' was loaded over HTTPS, but requested an insecure element 'http://burp/favicon.ico'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
network error URL: https://burp/favicon.ico
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
rendering warning URL: https://my.ny.gov/LoginV4/login.xhtml
Message:
[GroupMarkerNotSet(crbug.com/242999)!:A080A505A4250000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self' nys.okta.com login.ny.gov *.oktacdn.com; connect-src 'self' nys.okta.com nys-admin.okta.com login.ny.gov *.oktacdn.com *.mixpanel.com *.mapbox.com *.mtls.okta.com nys.kerberos.okta.com nys.mtls.okta.com https://oinmanager.okta.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; script-src 'unsafe-inline' 'nonce-6JnjofBJB_PUq6NL9Kc2ng' 'unsafe-eval' 'self' 'report-sample' nys.okta.com login.ny.gov *.oktacdn.com; style-src 'unsafe-inline' 'self' nys.okta.com login.ny.gov *.oktacdn.com; frame-src 'self' nys.okta.com nys-admin.okta.com login.ny.gov login.okta.com; img-src 'self' nys.okta.com login.ny.gov *.oktacdn.com *.tiles.mapbox.com *.mapbox.com data: data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com blob:; font-src 'self' nys.okta.com login.ny.gov data: *.oktacdn.com fonts.gstatic.com; frame-ancestors 'self' https://apps.labor.ny.gov
Strict-Transport-Security max-age=315360000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0