urlscan.io logo urlscan.io
SecurityTrails logo

discover.acf.hhs.gov Open in urlscan Pro
3.223.70.54  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://discover.acf.hhs.gov/workspace/settings/notifications
Effective URL: https://discover.acf.hhs.gov/multipass/login/all?redirect-uri=%2Fworkspace%2Fsettings%2Fnotifications
Submission: On October 14 via manual from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 12 HTTP transactions. The main IP is 3.223.70.54, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is discover.acf.hhs.gov.
TLS certificate: Issued by Entrust Certification Authority - L1K on June 13th 2024. Valid for: a year.
This is the only time discover.acf.hhs.gov was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 14 3.223.70.54 14618 (AMAZON-AES)
12 1
Apex Domain
Subdomains		 Transfer
14 hhs.gov
discover.acf.hhs.gov
540 KB
12 1
Domain Requested by
14 discover.acf.hhs.gov 2 redirects discover.acf.hhs.gov
12 1

This site contains no links.

Subject Issuer Validity Valid
discover.acf.hhs.gov
Entrust Certification Authority - L1K		 2024-06-13 -
2025-06-23		 a year crt.sh

This page contains 1 frames:

Primary Page: https://discover.acf.hhs.gov/multipass/login/all?redirect-uri=%2Fworkspace%2Fsettings%2Fnotifications
Frame ID: 99A8715AAC435259E05EC9834ECFD1CF
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Login | Palantir

Page URL History Show full URLs

  1. https://discover.acf.hhs.gov/workspace/settings/notifications HTTP 307
    https://discover.acf.hhs.gov/multipass/login?redirect-uri=%2Fworkspace%2Fsettings%2Fnotifications HTTP 303
    https://discover.acf.hhs.gov/multipass/login/all?redirect-uri=%2Fworkspace%2Fsettings%2Fnotifications Page URL

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

539 kB
Transfer

1773 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://discover.acf.hhs.gov/workspace/settings/notifications HTTP 307
    https://discover.acf.hhs.gov/multipass/login?redirect-uri=%2Fworkspace%2Fsettings%2Fnotifications HTTP 303
    https://discover.acf.hhs.gov/multipass/login/all?redirect-uri=%2Fworkspace%2Fsettings%2Fnotifications Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request all
discover.acf.hhs.gov/multipass/login/
Redirect Chain
  • https://discover.acf.hhs.gov/workspace/settings/notifications
  • https://discover.acf.hhs.gov/multipass/login?redirect-uri=%2Fworkspace%2Fsettings%2Fnotifications
  • https://discover.acf.hhs.gov/multipass/login/all?redirect-uri=%2Fworkspace%2Fsettings%2Fnotifications
631 B
728 B 		Document
General
Check archive.org
Download Go to
Full URL
https://discover.acf.hhs.gov/multipass/login/all?redirect-uri=%2Fworkspace%2Fsettings%2Fnotifications
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.223.70.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-70-54.compute-1.amazonaws.com
Software
envoy /
Resource Hash
2b3cf84ca6370dcbd2946015f175052d285fb8b2fa262ef5657dbae10d01f2d7
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control
no-cache, no-store, must-revalidate
content-length
631
content-security-policy
default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
content-type
text/html; charset=UTF-8
date
Mon, 14 Oct 2024 20:52:02 GMT
node-selection-strategy
BALANCED
referrer-policy
strict-origin-when-cross-origin strict-origin-when-cross-origin
response-code-details
details: via_upstream
response-flags
-
server
envoy
server-timing
server;dur=0.646
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-b3-traceid
a240faf84ba410c2
x-content-type-options
nosniff
x-envoy-upstream-service-time
1
x-frame-options
sameorigin
x-robots-tag
noindex
x-xss-protection
1; mode=block

Redirect headers

cache-control
no-cache, no-store, must-revalidate
content-length
0
content-security-policy
default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
date
Mon, 14 Oct 2024 20:52:02 GMT
location
/multipass/login/all?redirect-uri=%2Fworkspace%2Fsettings%2Fnotifications
node-selection-strategy
BALANCED
referrer-policy
strict-origin-when-cross-origin strict-origin-when-cross-origin
response-code-details
details: via_upstream
response-flags
-
server
envoy
server-timing
server;dur=0.469
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-b3-traceid
7f522bf36ebd9efe
x-content-type-options
nosniff
x-envoy-upstream-service-time
1
x-frame-options
sameorigin
x-robots-tag
noindex
x-xss-protection
1; mode=block
multipass-login.js
discover.acf.hhs.gov/assets/static/multipass-login/3.1788.0/default/asset/ 		762 KB
232 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://discover.acf.hhs.gov/assets/static/multipass-login/3.1788.0/default/asset/multipass-login.js
Requested by
Host: discover.acf.hhs.gov
URL: https://discover.acf.hhs.gov/multipass/login/all?redirect-uri=%2Fworkspace%2Fsettings%2Fnotifications
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.223.70.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-70-54.compute-1.amazonaws.com
Software
envoy /
Resource Hash
afdddda9cdb9f73e48800306b0aa2aba28f949a4ec5621de7ad609ada101ef7c
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://discover.acf.hhs.gov/multipass/login/all?redirect-uri=%2Fworkspace%2Fsettings%2Fnotifications

Response headers

node-selection-strategy
BALANCED
x-robots-tag
noindex
content-encoding
gzip
etag
c3c3a889a681da2084017025ebf51c8e--gzip
response-code-details
details: via_upstream
x-content-type-options
nosniff
response-flags
-
server-timing
server;dur=16.694
date
Mon, 14 Oct 2024 20:52:02 GMT
last-modified
Mon, 14 Oct 2024 17:21:22 GMT
content-type
application/javascript; charset=utf-8
x-frame-options
sameorigin
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
cache-control
public, max-age=31536000, immutable
x-envoy-upstream-service-time
18
x-asset-size
780112
referrer-policy
strict-origin-when-cross-origin, strict-origin-when-cross-origin
accept-ranges
bytes
x-b3-traceid
ccf1c46b8935a06f
x-xss-protection
1; mode=block
server
envoy
multipass-login.css
discover.acf.hhs.gov/assets/static/multipass-login/3.1788.0/default/asset/ 		306 KB
38 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://discover.acf.hhs.gov/assets/static/multipass-login/3.1788.0/default/asset/multipass-login.css
Requested by
Host: discover.acf.hhs.gov
URL: https://discover.acf.hhs.gov/multipass/login/all?redirect-uri=%2Fworkspace%2Fsettings%2Fnotifications
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.223.70.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-70-54.compute-1.amazonaws.com
Software
envoy /
Resource Hash
3325505b60a1933730305045c41af728f5b82d262cbbc6eea50e3bb4091acbfb
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://discover.acf.hhs.gov/multipass/login/all?redirect-uri=%2Fworkspace%2Fsettings%2Fnotifications

Response headers

node-selection-strategy
BALANCED
x-robots-tag
noindex
content-encoding
gzip
etag
5443c416d29d8df90eec6517208847c9--gzip
response-code-details
details: via_upstream
x-content-type-options
nosniff
response-flags
-
server-timing
server;dur=12.293
date
Mon, 14 Oct 2024 20:52:02 GMT
last-modified
Mon, 14 Oct 2024 17:21:22 GMT
content-type
text/css; charset=utf-8
x-frame-options
sameorigin
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
cache-control
public, max-age=31536000, immutable
x-envoy-upstream-service-time
14
x-asset-size
312903
referrer-policy
strict-origin-when-cross-origin, strict-origin-when-cross-origin
accept-ranges
bytes
x-b3-traceid
f73b279e8ba64f53
x-xss-protection
1; mode=block
server
envoy
translations
discover.acf.hhs.gov/multipass/api/ 		2 B
117 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://discover.acf.hhs.gov/multipass/api/translations
Requested by
Host: discover.acf.hhs.gov
URL: https://discover.acf.hhs.gov/assets/static/multipass-login/3.1788.0/default/asset/multipass-login.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.223.70.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-70-54.compute-1.amazonaws.com
Software
envoy /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://discover.acf.hhs.gov/multipass/login/all?redirect-uri=%2Fworkspace%2Fsettings%2Fnotifications
Fetch-User-Agent
multipass-login/ conjure-typescript-runtime/2.9.0
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
accept
application/json
Content-Type
application/json

Response headers

node-selection-strategy
BALANCED
x-robots-tag
noindex
response-code-details
details: via_upstream
x-content-type-options
nosniff
response-flags
-
server-timing
server;dur=0.076
date
Mon, 14 Oct 2024 20:52:03 GMT
content-type
application/json
x-frame-options
sameorigin
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
cache-control
no-cache, no-store, must-revalidate
x-envoy-upstream-service-time
0
referrer-policy
strict-origin-when-cross-origin, strict-origin-when-cross-origin
x-b3-traceid
0a16fd2e946c8d09
content-length
2
x-xss-protection
1; mode=block
server
envoy
favicon.ico
discover.acf.hhs.gov/assets/static/multipass-login/3.1788.0/default/asset/ 		6 KB
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://discover.acf.hhs.gov/assets/static/multipass-login/3.1788.0/default/asset/favicon.ico
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.223.70.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-70-54.compute-1.amazonaws.com
Software
envoy /
Resource Hash
e4d6166d8f25b090b3b83713bd2a88c05874f45baf92b5a5764d1e1741a88e5a
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://discover.acf.hhs.gov/multipass/login/all?redirect-uri=%2Fworkspace%2Fsettings%2Fnotifications

Response headers

node-selection-strategy
BALANCED
x-robots-tag
noindex
content-encoding
gzip
etag
14a29cadc193ff3c2ac68cefa49c6739--gzip
response-code-details
details: via_upstream
x-content-type-options
nosniff
response-flags
-
server-timing
server;dur=9.602
date
Mon, 14 Oct 2024 20:52:03 GMT
last-modified
Mon, 14 Oct 2024 17:21:22 GMT
content-type
text/plain; charset=utf-8
x-frame-options
sameorigin
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
cache-control
public, max-age=31536000, immutable
x-envoy-upstream-service-time
10
x-asset-size
6518
referrer-policy
strict-origin-when-cross-origin, strict-origin-when-cross-origin
accept-ranges
bytes
x-b3-traceid
716c73265e904c80
content-length
905
x-xss-protection
1; mode=block
server
envoy
configuration
discover.acf.hhs.gov/multipass/api/login/ 		34 B
115 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://discover.acf.hhs.gov/multipass/api/login/configuration
Requested by
Host: discover.acf.hhs.gov
URL: https://discover.acf.hhs.gov/assets/static/multipass-login/3.1788.0/default/asset/multipass-login.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.223.70.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-70-54.compute-1.amazonaws.com
Software
envoy /
Resource Hash
1087504e28d02d66468161df3bb7afc771a02288aa142b1eadb5f209c4f3a491
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://discover.acf.hhs.gov/multipass/login/all?redirect-uri=%2Fworkspace%2Fsettings%2Fnotifications
Fetch-User-Agent
multipass-login/ conjure-typescript-runtime/2.9.0
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
accept
application/json
Content-Type
application/json

Response headers

node-selection-strategy
BALANCED
x-robots-tag
noindex
response-code-details
details: via_upstream
x-content-type-options
nosniff
response-flags
-
server-timing
server;dur=5.456
date
Mon, 14 Oct 2024 20:52:03 GMT
content-type
application/json
x-frame-options
sameorigin
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
cache-control
no-cache, no-store, must-revalidate
x-envoy-upstream-service-time
6
referrer-policy
strict-origin-when-cross-origin, strict-origin-when-cross-origin
x-b3-traceid
59d0e35b0281a466
content-length
34
x-xss-protection
1; mode=block
server
envoy
7130bfd617067e53f080.woff2
discover.acf.hhs.gov/assets/static/multipass-login/3.1788.0/default/asset/fonts/ 		77 KB
77 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://discover.acf.hhs.gov/assets/static/multipass-login/3.1788.0/default/asset/fonts/7130bfd617067e53f080.woff2
Requested by
Host: discover.acf.hhs.gov
URL: https://discover.acf.hhs.gov/assets/static/multipass-login/3.1788.0/default/asset/multipass-login.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.223.70.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-70-54.compute-1.amazonaws.com
Software
envoy /
Resource Hash
62a82826a81520ec0ba40014a92b76554fb7b0fe0caea249a6393c4556c26152
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://discover.acf.hhs.gov
Referer
https://discover.acf.hhs.gov/assets/static/multipass-login/3.1788.0/default/asset/multipass-login.css

Response headers

node-selection-strategy
BALANCED
x-robots-tag
noindex
content-encoding
gzip
etag
f7f9978d32587e45cabc40fb0eb1b758--gzip
response-code-details
details: via_upstream
x-content-type-options
nosniff
response-flags
-
server-timing
server;dur=9.430
date
Mon, 14 Oct 2024 20:52:03 GMT
last-modified
Mon, 14 Oct 2024 17:21:22 GMT
content-type
text/plain; charset=utf-8
x-frame-options
sameorigin
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
cache-control
public, max-age=31536000, immutable
x-envoy-upstream-service-time
10
x-asset-size
78672
referrer-policy
strict-origin-when-cross-origin, strict-origin-when-cross-origin
accept-ranges
bytes
x-b3-traceid
cf01850ef91d6ee2
x-xss-protection
1; mode=block
server
envoy
blueprint-icons-split-paths-by-size-loader.05bbcbb35c280db67077.js
discover.acf.hhs.gov/assets/static/multipass-login/3.1788.0/default/asset/ 		1 KB
598 B 		Script
General
Check archive.org
Download Go to
Full URL
https://discover.acf.hhs.gov/assets/static/multipass-login/3.1788.0/default/asset/blueprint-icons-split-paths-by-size-loader.05bbcbb35c280db67077.js
Requested by
Host: discover.acf.hhs.gov
URL: https://discover.acf.hhs.gov/assets/static/multipass-login/3.1788.0/default/asset/multipass-login.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.223.70.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-70-54.compute-1.amazonaws.com
Software
envoy /
Resource Hash
16cf84010243fd52087a7acfd0ef733261909fcc454ca767fd9d2cdc356c227a
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://discover.acf.hhs.gov/multipass/login/all

Response headers

node-selection-strategy
BALANCED
x-robots-tag
noindex
content-encoding
gzip
etag
4e39b32f3c7f96e2a649e1898c36ba3e--gzip
response-code-details
details: via_upstream
x-content-type-options
nosniff
response-flags
-
server-timing
server;dur=9.605
date
Mon, 14 Oct 2024 20:52:03 GMT
last-modified
Mon, 14 Oct 2024 17:21:22 GMT
content-type
application/javascript; charset=utf-8
x-frame-options
sameorigin
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
cache-control
public, max-age=31536000, immutable
x-envoy-upstream-service-time
10
x-asset-size
1336
referrer-policy
strict-origin-when-cross-origin, strict-origin-when-cross-origin
accept-ranges
bytes
x-b3-traceid
9e32f5fb82cac585
content-length
480
x-xss-protection
1; mode=block
server
envoy
notification
discover.acf.hhs.gov/multipass/api/ 		0
65 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://discover.acf.hhs.gov/multipass/api/notification
Requested by
Host: discover.acf.hhs.gov
URL: https://discover.acf.hhs.gov/assets/static/multipass-login/3.1788.0/default/asset/multipass-login.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.223.70.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-70-54.compute-1.amazonaws.com
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://discover.acf.hhs.gov/multipass/login/all
Fetch-User-Agent
multipass-login/ conjure-typescript-runtime/2.9.0
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
accept
text/plain
Content-Type
application/json

Response headers

node-selection-strategy
BALANCED
x-robots-tag
noindex
response-code-details
details: via_upstream
x-content-type-options
nosniff
response-flags
-
server-timing
server;dur=0.082
date
Mon, 14 Oct 2024 20:52:03 GMT
content-type
text/plain
x-frame-options
sameorigin
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
cache-control
no-cache, no-store, must-revalidate
x-envoy-upstream-service-time
0
referrer-policy
strict-origin-when-cross-origin, strict-origin-when-cross-origin
x-b3-traceid
f3109dbca242b519
content-length
0
x-xss-protection
1; mode=block
server
envoy
realms-scoped
discover.acf.hhs.gov/multipass/api/ 		254 B
635 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://discover.acf.hhs.gov/multipass/api/realms-scoped?username=
Requested by
Host: discover.acf.hhs.gov
URL: https://discover.acf.hhs.gov/assets/static/multipass-login/3.1788.0/default/asset/multipass-login.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.223.70.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-70-54.compute-1.amazonaws.com
Software
envoy /
Resource Hash
79c5cad4c11e50532b8ca421ee188f6768f0bb3da8138fff681c5c3b1162353a
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://discover.acf.hhs.gov/multipass/login/all
Fetch-User-Agent
multipass-login/ conjure-typescript-runtime/2.9.0
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
accept
application/json
Content-Type
application/json

Response headers

node-selection-strategy
BALANCED
x-robots-tag
noindex
response-code-details
details: via_upstream
x-content-type-options
nosniff
response-flags
-
server-timing
server;dur=105.038
date
Mon, 14 Oct 2024 20:52:04 GMT
content-type
application/json
x-frame-options
sameorigin
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
cache-control
no-cache, no-store, must-revalidate
x-envoy-upstream-service-time
105
referrer-policy
strict-origin-when-cross-origin, strict-origin-when-cross-origin
x-b3-traceid
11ba91f488dbc454
content-length
254
x-xss-protection
1; mode=block
server
envoy
favicon.ico
discover.acf.hhs.gov/assets/static/multipass-login/3.1788.0/default/asset/ 		6 KB
0 		Other
General
Check archive.org
Download Go to
Full URL
https://discover.acf.hhs.gov/assets/static/multipass-login/3.1788.0/default/asset/favicon.ico
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.223.70.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-70-54.compute-1.amazonaws.com
Software
envoy /
Resource Hash
e4d6166d8f25b090b3b83713bd2a88c05874f45baf92b5a5764d1e1741a88e5a
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://discover.acf.hhs.gov/multipass/login/all

Response headers

node-selection-strategy
BALANCED
x-robots-tag
noindex
content-encoding
gzip
etag
14a29cadc193ff3c2ac68cefa49c6739--gzip
response-code-details
details: via_upstream
x-content-type-options
nosniff
response-flags
-
server-timing
server;dur=9.602
date
Mon, 14 Oct 2024 20:52:03 GMT
last-modified
Mon, 14 Oct 2024 17:21:22 GMT
content-type
text/plain; charset=utf-8
x-frame-options
sameorigin
content-security-policy
default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
cache-control
public, max-age=31536000, immutable
x-envoy-upstream-service-time
10
x-asset-size
6518
referrer-policy
strict-origin-when-cross-origin, strict-origin-when-cross-origin
accept-ranges
bytes
x-b3-traceid
716c73265e904c80
content-length
905
x-xss-protection
1; mode=block
server
envoy
blueprint-icons-16px-paths.228432d9628331c119c7.js
discover.acf.hhs.gov/assets/static/multipass-login/3.1788.0/default/asset/ 		614 KB
189 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://discover.acf.hhs.gov/assets/static/multipass-login/3.1788.0/default/asset/blueprint-icons-16px-paths.228432d9628331c119c7.js
Requested by
Host: discover.acf.hhs.gov
URL: https://discover.acf.hhs.gov/assets/static/multipass-login/3.1788.0/default/asset/multipass-login.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
3.223.70.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-70-54.compute-1.amazonaws.com
Software
envoy /
Resource Hash
c26f89fa1fb3357324188d77cf1ab2b231e8a1420bd3229c1e820884055980d7
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://discover.acf.hhs.gov/multipass/login/all

Response headers

node-selection-strategy
BALANCED
x-robots-tag
noindex
content-encoding
gzip
etag
f6565f9b2f1147452ae2b44bef902127--gzip
response-code-details
details: via_upstream
x-content-type-options
nosniff
response-flags
-
server-timing
server;dur=11.998
date
Mon, 14 Oct 2024 20:52:04 GMT
last-modified
Mon, 14 Oct 2024 17:21:22 GMT
content-type
application/javascript; charset=utf-8
x-frame-options
sameorigin
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
cache-control
public, max-age=31536000, immutable
x-envoy-upstream-service-time
12
x-asset-size
629017
referrer-policy
strict-origin-when-cross-origin, strict-origin-when-cross-origin
accept-ranges
bytes
x-b3-traceid
7c22108ea942c391
x-xss-protection
1; mode=block
server
envoy

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| multipassLoginJsonpFunction function| clearImmediate function| setImmediate object| __repl_v0 object| repl object| __SCOPED_TOKEN

2 Cookies

Domain/Path Name / Value
discover.acf.hhs.gov/multipass/ Name: PALANTIR_REDIRECT_FULL_URI-3e7a9095-dfb3-4464-bf0e-21412c195f1d
Value: /workspace/settings/notifications
discover.acf.hhs.gov/ Name: TEST_COOKIE
Value: can_set_cookie

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block