accounts.spotify.com Open in urlscan Pro
2600:1901:1:7c5:: Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.spotify.com/account/subscription/receipt/2572339004282105-1-1.
Effective URL:
https://accounts.spotify.com/login?continue=https%3A%2F%2Fwww.spotify.com%2Fca-en%2Faccount%2Forder-history%2F
Submission: On November 07 via api (November 7th 2024, 3:32:18 pm UTC) from BE — Scanned from CA

Summary HTTP 24 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 7 IPs in 1 countries across 4 domains to perform 24 HTTP transactions. The main IP is 2600:1901:1:7c5::, located in United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is accounts.spotify.com. The Cisco Umbrella rank of the primary domain is 11411.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on February 5th 2024. Valid for: a year.

This is the only time accounts.spotify.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 5	2600:1901:1:7... 2600:1901:1:7c5::	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	35.186.224.24 35.186.224.24	15169 (GOOGLE) (GOOGLE)
5	2a04:4e42:4f:... 2a04:4e42:4f::760	54113 (FASTLY) (FASTLY)
5	2600:141b:1c0... 2600:141b:1c00:10::172c:c9a9	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	142.251.40.228 142.251.40.228	15169 (GOOGLE) (GOOGLE)
1	142.251.40.227 142.251.40.227	15169 (GOOGLE) (GOOGLE)
6	2600:1901:1:6... 2600:1901:1:6ac::	15169 (GOOGLE) (GOOGLE)
2	35.186.224.31 35.186.224.31	15169 (GOOGLE) (GOOGLE)
24	7

5 2600:1901:1:7c5:: (United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)

www.spotify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
accounts.spotify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
apresolve.spotify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.224.24 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 24.224.186.35.bc.googleusercontent.com

www.spotify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a04:4e42:4f::760 (United States)

ASN54113 (FASTLY, US)

accounts.scdn.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:141b:1c00:10::172c:c9a9 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

encore.scdn.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.40.228 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s39-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.40.227 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s39-in-f3.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2600:1901:1:6ac:: (United States)

ASN15169 (GOOGLE, US)

guc3-spclient.spotify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.186.224.31 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 31.224.186.35.bc.googleusercontent.com

guc3-spclient.spotify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	spotify.com 3 redirects www.spotify.com — Cisco Umbrella Rank: 2645 accounts.spotify.com — Cisco Umbrella Rank: 11411 apresolve.spotify.com — Cisco Umbrella Rank: 937 guc3-spclient.spotify.com — Cisco Umbrella Rank: 1822	8 KB
10	scdn.co accounts.scdn.co — Cisco Umbrella Rank: 30406 encore.scdn.co — Cisco Umbrella Rank: 7306	904 KB
2	google.com www.google.com — Cisco Umbrella Rank: 3	1 KB
1	gstatic.com www.gstatic.com	215 KB
24	4

	Domain	Requested by
8	guc3-spclient.spotify.com	accounts.scdn.co
5	encore.scdn.co	accounts.scdn.co
5	accounts.scdn.co	accounts.spotify.com
3	www.spotify.com	3 redirects
2	www.google.com	accounts.scdn.co www.gstatic.com
2	apresolve.spotify.com	accounts.scdn.co
1	www.gstatic.com	www.google.com
1	accounts.spotify.com
24	8

This site contains links to these domains. Also see Links.

Domain
policies.google.com

Subject Issuer	Validity	Valid
*.spotify.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-05` - `2025-02-04`	a year	crt.sh
*.scdn.co GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-04-09` - `2025-05-11`	a year	crt.sh
*.google.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.gstatic.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://accounts.spotify.com/login?continue=https%3A%2F%2Fwww.spotify.com%2Fca-en%2Faccount%2Forder-history%2F
Frame ID: B35C26559A9D7D3CE693ED135C564A5F
Requests: 20 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6LfCVLAUAAAAALFwwRnnCJ12DalriUGbj8FW_J39&co=aHR0cHM6Ly9hY2NvdW50cy5zcG90aWZ5LmNvbTo0NDM.&hl=en&v=-ZG7BC9TxCVEbzIO2m429usb&size=invisible&cb=89de3h9255xw
Frame ID: D07252B0CABF346444F5E081490F2423
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login - Spotify

Page URL History Show full URLs

https://www.spotify.com/account/subscription/receipt/2572339004282105-1-1. HTTP 302
https://www.spotify.com/ca-en/account/subscription/receipt/2572339004282105-1-1. HTTP 301
http://www.spotify.com/ca-en/account/order-history/ HTTP 307
https://www.spotify.com/ca-en/account/order-history/ HTTP 302
https://accounts.spotify.com/login?continue=https%3A%2F%2Fwww.spotify.com%2Fca-en%2Faccount%2Forder-histo... Page URL

Page Statistics

24
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

8
Subdomains

7
IPs

1
Countries

1127 kB
Transfer

2625 kB
Size

11
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://policies.google.com/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://policies.google.com/terms
Title: Terms of Service

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.spotify.com/account/subscription/receipt/2572339004282105-1-1. HTTP 302
https://www.spotify.com/ca-en/account/subscription/receipt/2572339004282105-1-1. HTTP 301
http://www.spotify.com/ca-en/account/order-history/ HTTP 307
https://www.spotify.com/ca-en/account/order-history/ HTTP 302
https://accounts.spotify.com/login?continue=https%3A%2F%2Fwww.spotify.com%2Fca-en%2Faccount%2Forder-history%2F Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

24 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request login Show response
accounts.spotify.com/
Redirect Chain

https://www.spotify.com/account/subscription/receipt/2572339004282105-1-1.
https://www.spotify.com/ca-en/account/subscription/receipt/2572339004282105-1-1.
http://www.spotify.com/ca-en/account/order-history/
https://www.spotify.com/ca-en/account/order-history/
https://accounts.spotify.com/login?continue=https%3A%2F%2Fwww.spotify.com%2Fca-en%2Faccount%2Forder-history%2F

7 KB
6 KB

88ms
68ms

Document
text/html

2600:1901:1:7c5::
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.spotify.com/login?continue=https%3A%2F%2Fwww.spotify.com%2Fca-en%2Faccount%2Forder-history%2F

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:1:7c5:: , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

envoy /

Resource Hash

89484220600d480887cda10a47f73e626943548bd07b0b249d59f85731427b93

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://www.google-analytics.com https://ssl.google-analytics.com https://www.google.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ https://cdn.cookielaw.org/scripttemplates/ https://.onetrust.com https://.googletagmanager.com 'sha256-DdOTSPXUa4upGVO8zYWD1wUUqxjFKJFyE/4ha4Fe9XE=' https://accounts.scdn.co; img-src 'self' https://i.imgur.com https://d2mv8tnci56s9d.cloudfront.net https://profile-images.scdn.co https://.scdn.co https://graph.facebook.com https://fbcdn-profile-a.akamaihd.net https://.fbcdn.net https://platform-lookaside.fbsbx.com https://www.google.com https://www.google-analytics.com https://stats.g.doubleclick.net https://.googletagmanager.com data: https://accounts.scdn.co; font-src 'self' data: https://sp-bootstrap.global.ssl.fastly.net https://fonts.gstatic.com https://.scdn.co; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/css2; frame-src 'self' https://www.spotify.com https://www.google.com https://app.adjust.com https://itunes.apple.com itms-apps: https://www.google.com/recaptcha/; connect-src 'self' https://.spotify.com https://.google-analytics.com https://.ingest.sentry.io/ https://.googletagmanager.com;
Strict-Transport-Security	max-age=31536000
X-Content-Security-Policy	default-src 'self'; script-src 'self' https://www.google-analytics.com https://ssl.google-analytics.com https://www.google.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ https://cdn.cookielaw.org/scripttemplates/ https://.onetrust.com https://.googletagmanager.com 'sha256-DdOTSPXUa4upGVO8zYWD1wUUqxjFKJFyE/4ha4Fe9XE=' https://accounts.scdn.co; img-src 'self' https://i.imgur.com https://d2mv8tnci56s9d.cloudfront.net https://profile-images.scdn.co https://.scdn.co https://graph.facebook.com https://fbcdn-profile-a.akamaihd.net https://.fbcdn.net https://platform-lookaside.fbsbx.com https://www.google.com https://www.google-analytics.com https://stats.g.doubleclick.net https://.googletagmanager.com data: https://accounts.scdn.co; font-src 'self' data: https://sp-bootstrap.global.ssl.fastly.net https://fonts.gstatic.com https://.scdn.co; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/css2; frame-src 'self' https://www.spotify.com https://www.google.com https://app.adjust.com https://itunes.apple.com itms-apps: https://www.google.com/recaptcha/; connect-src 'self' https://.spotify.com https://.google-analytics.com https://.ingest.sentry.io/ https://.googletagmanager.com;
X-Content-Type-Options	nosniff
X-Frame-Options	deny

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-security-policy: default-src 'self'; script-src 'self' https://www.google-analytics.com https://ssl.google-analytics.com https://www.google.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ https://cdn.cookielaw.org/scripttemplates/ https://*.onetrust.com https://*.googletagmanager.com 'sha256-DdOTSPXUa4upGVO8zYWD1wUUqxjFKJFyE/4ha4Fe9XE=' https://accounts.scdn.co; img-src 'self' https://i.imgur.com https://d2mv8tnci56s9d.cloudfront.net https://profile-images.scdn.co https://*.scdn.co https://graph.facebook.com https://fbcdn-profile-a.akamaihd.net https://*.fbcdn.net https://platform-lookaside.fbsbx.com https://www.google.com https://www.google-analytics.com https://stats.g.doubleclick.net https://*.googletagmanager.com data: https://accounts.scdn.co; font-src 'self' data: https://sp-bootstrap.global.ssl.fastly.net https://fonts.gstatic.com https://*.scdn.co; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/css2; frame-src 'self' https://www.spotify.com https://www.google.com https://app.adjust.com https://itunes.apple.com itms-apps: https://www.google.com/recaptcha/; connect-src 'self' https://*.spotify.com https://*.google-analytics.com https://*.ingest.sentry.io/ https://*.googletagmanager.com;
content-type: text/html;charset=utf-8
date: Thu, 07 Nov 2024 15:32:08 GMT
pragma: no-cache
server: envoy
sp-trace-id: af0652d3ac469732
strict-transport-security: max-age=31536000
vary: Accept-Encoding
via: HTTP/2 edgeproxy, 1.1 google
x-content-security-policy: default-src 'self'; script-src 'self' https://www.google-analytics.com https://ssl.google-analytics.com https://www.google.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ https://cdn.cookielaw.org/scripttemplates/ https://*.onetrust.com https://*.googletagmanager.com 'sha256-DdOTSPXUa4upGVO8zYWD1wUUqxjFKJFyE/4ha4Fe9XE=' https://accounts.scdn.co; img-src 'self' https://i.imgur.com https://d2mv8tnci56s9d.cloudfront.net https://profile-images.scdn.co https://*.scdn.co https://graph.facebook.com https://fbcdn-profile-a.akamaihd.net https://*.fbcdn.net https://platform-lookaside.fbsbx.com https://www.google.com https://www.google-analytics.com https://stats.g.doubleclick.net https://*.googletagmanager.com data: https://accounts.scdn.co; font-src 'self' data: https://sp-bootstrap.global.ssl.fastly.net https://fonts.gstatic.com https://*.scdn.co; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/css2; frame-src 'self' https://www.spotify.com https://www.google.com https://app.adjust.com https://itunes.apple.com itms-apps: https://www.google.com/recaptcha/; connect-src 'self' https://*.spotify.com https://*.google-analytics.com https://*.ingest.sentry.io/ https://*.googletagmanager.com;
x-content-type-options: nosniff
x-envoy-upstream-service-time: 18
x-frame-options: deny
x-ua-compatible: IE=edge

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-security-policy: base-uri 'none'; connect-src https: wss:; form-action https:; frame-ancestors 'self' https://*.spotify.com https://*.spotify.net; object-src 'none'
content-type: text/html
date: Thu, 07 Nov 2024 15:32:08 GMT
location: https://accounts.spotify.com/login?continue=https%3A%2F%2Fwww.spotify.com%2Fca-en%2Faccount%2Forder-history%2F
server: envoy
sp-trace-id: 27c7656b4fb19bb8
strict-transport-security: max-age=31536000
vary: Accept-Encoding
via: HTTP/2 edgeproxy, 1.1 google
x-content-type-options: nosniff
x-envoy-upstream-service-time: 47
x-frame-options: deny

GET
H/1.1 200
OK indexReact.c42685c9d238dfb950c0.js Show response
accounts.scdn.co/sso/js/ 1 MB
358 KB 129ms
17ms Script
text/javascript 2a04:4e42:4f::760
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://accounts.scdn.co/sso/js/indexReact.c42685c9d238dfb950c0.js
Requested by: Host: accounts.spotify.com
URL: https://accounts.spotify.com/login?continue=https%3A%2F%2Fwww.spotify.com%2Fca-en%2Faccount%2Forder-history%2F
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4f::760 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 6549a7238a69d08fd60bce0a4363915942fe4b0c4304d68edb51d0e325f572ab

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://accounts.spotify.com/

Response headers

x-goog-metageneration: 1
Content-Encoding: gzip
x-amz-meta-goog-reserved-file-mtime: 1730813293
ETag: "6a5b9e9d6aa189b77782465c36c11a82"
Age: 179540
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1556576
X-Cache: HIT, HIT
Date: Thu, 07 Nov 2024 15:32:08 GMT
Last-Modified: Tue, 05 Nov 2024 13:30:09 GMT
Content-Type: text/javascript
X-Served-By: cache-chi-kigq8000158-CHI, cache-yul1970070-YUL
X-Cache-Hits: 59, 1022
Cache-Control: public, max-age=31536000, no-transform
Connection: keep-alive
x-amz-checksum-crc32c: 73XxZw==
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
x-goog-generation: 1730813409052654
Content-Length: 365402

GET
H2 200 SpotifyMixUI-Regular-cc3b1de388efa4cbca6c75cebc24585e.woff2
encore.scdn.co/fonts/ 35 KB
35 KB 397ms
56ms Font
font/woff 2600:141b:1c00:10::172c:c9a9
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://encore.scdn.co/fonts/SpotifyMixUI-Regular-cc3b1de388efa4cbca6c75cebc24585e.woff2

Requested by

Host: accounts.scdn.co
URL: https://accounts.scdn.co/sso/js/indexReact.c42685c9d238dfb950c0.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:1c00:10::172c:c9a9 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

91623228bbcef3805f91d3df656132fcf95b5572bf345039eedc91a136b7ed09

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://accounts.spotify.com
Referer: https://accounts.spotify.com/

Response headers

access-control-max-age: 86400
content-encoding: gzip
etag: "b7f76367a4827918777a80c836e579c6"
access-control-allow-methods: GET
expires: Thu, 07 Nov 2024 15:32:09 GMT
date: Thu, 07 Nov 2024 15:32:09 GMT
last-modified: Mon, 20 May 2024 10:12:27 GMT
content-type: font/woff
vary: Accept-Encoding
access-control-allow-headers: range
strict-transport-security: max-age=15768000
cache-control: public, max-age=31536000
x-amz-checksum-crc32c: lJoHOA==
accept-ranges: bytes
access-control-allow-origin: *
content-length: 35561

GET
H2 200 SpotifyMixUITitleVariable-8769ccfde3379b7ebcadd9529b49d0cc.woff2
encore.scdn.co/fonts/ 374 KB
373 KB 442ms
101ms Font
font/woff 2600:141b:1c00:10::172c:c9a9
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://encore.scdn.co/fonts/SpotifyMixUITitleVariable-8769ccfde3379b7ebcadd9529b49d0cc.woff2

Requested by

Host: accounts.scdn.co
URL: https://accounts.scdn.co/sso/js/indexReact.c42685c9d238dfb950c0.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:1c00:10::172c:c9a9 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

406312aa9e36de68c1c1975221e22ccd619a390f5fe9665ce64eff29ae32ba4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://accounts.spotify.com
Referer: https://accounts.spotify.com/

Response headers

access-control-max-age: 86400
content-encoding: gzip
etag: "8c2f2b5166c31039f2bc1c69a40e99ac"
access-control-allow-methods: GET
expires: Thu, 07 Nov 2024 15:32:09 GMT
date: Thu, 07 Nov 2024 15:32:09 GMT
last-modified: Mon, 20 May 2024 10:12:30 GMT
content-type: font/woff
vary: Accept-Encoding
access-control-allow-headers: range
strict-transport-security: max-age=15768000
cache-control: public, max-age=31536000
x-amz-checksum-crc32c: oB8zEA==
accept-ranges: bytes
access-control-allow-origin: *
content-length: 381882

GET
H2 200 SpotifyMixUITitle-Bold-37290f1de77f297fcc26d71e9afcf43f.woff2
encore.scdn.co/fonts/ 43 KB
43 KB 441ms
100ms Font
font/woff 2600:141b:1c00:10::172c:c9a9
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://encore.scdn.co/fonts/SpotifyMixUITitle-Bold-37290f1de77f297fcc26d71e9afcf43f.woff2

Requested by

Host: accounts.scdn.co
URL: https://accounts.scdn.co/sso/js/indexReact.c42685c9d238dfb950c0.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:1c00:10::172c:c9a9 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

9164e08c61e16f0dfb8390517c3c0730252208aebf0e1c8b924b67bf47d368db

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://accounts.spotify.com
Referer: https://accounts.spotify.com/

Response headers

access-control-max-age: 86400
content-encoding: gzip
etag: "409dcc80f1e8f58c4bdd3c601df2a450"
access-control-allow-methods: GET
expires: Thu, 07 Nov 2024 15:32:09 GMT
date: Thu, 07 Nov 2024 15:32:09 GMT
last-modified: Mon, 20 May 2024 10:12:27 GMT
content-type: font/woff
vary: Accept-Encoding
access-control-allow-headers: range
strict-transport-security: max-age=15768000
cache-control: public, max-age=31536000
x-amz-checksum-crc32c: FRnhDg==
accept-ranges: bytes
access-control-allow-origin: *
content-length: 44123

GET
H2 200 SpotifyMixUI-Bold-4264b799009b1db5c491778b1bc8e5b7.woff2
encore.scdn.co/fonts/ 40 KB
41 KB 376ms
35ms Font
font/woff 2600:141b:1c00:10::172c:c9a9
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://encore.scdn.co/fonts/SpotifyMixUI-Bold-4264b799009b1db5c491778b1bc8e5b7.woff2

Requested by

Host: accounts.scdn.co
URL: https://accounts.scdn.co/sso/js/indexReact.c42685c9d238dfb950c0.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:1c00:10::172c:c9a9 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

4252606cf3c6b177ae87bf37e83c73db1895a99d44b9c6965309cd343124c9ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://accounts.spotify.com
Referer: https://accounts.spotify.com/

Response headers

access-control-max-age: 86400
content-encoding: gzip
etag: "61b62cce587e38f4dee4c6c17bcd5a0e"
access-control-allow-methods: GET
expires: Thu, 07 Nov 2024 15:32:09 GMT
date: Thu, 07 Nov 2024 15:32:09 GMT
last-modified: Mon, 20 May 2024 10:12:25 GMT
content-type: font/woff
vary: Accept-Encoding
access-control-allow-headers: range
strict-transport-security: max-age=15768000
cache-control: public, max-age=31536000
x-amz-checksum-crc32c: yXssgQ==
accept-ranges: bytes
access-control-allow-origin: *
content-length: 41320

GET
H2 200 SpotifyMixUITitle-Extrabold-ba6c73cd7f82c81e49cf2204017803ed.woff2
encore.scdn.co/fonts/ 49 KB
49 KB 368ms
28ms Font
font/woff 2600:141b:1c00:10::172c:c9a9
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://encore.scdn.co/fonts/SpotifyMixUITitle-Extrabold-ba6c73cd7f82c81e49cf2204017803ed.woff2

Requested by

Host: accounts.scdn.co
URL: https://accounts.scdn.co/sso/js/indexReact.c42685c9d238dfb950c0.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:1c00:10::172c:c9a9 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

85564946a706be50f09f4602bb41d3c21aaa57bd492603a269b2d30657ddf668

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://accounts.spotify.com
Referer: https://accounts.spotify.com/

Response headers

access-control-max-age: 86400
content-encoding: gzip
etag: "fc5000ee57f75cc38e8a0b93db6d92be"
access-control-allow-methods: GET
expires: Thu, 07 Nov 2024 15:32:09 GMT
date: Thu, 07 Nov 2024 15:32:09 GMT
last-modified: Mon, 20 May 2024 10:12:28 GMT
content-type: font/woff
vary: Accept-Encoding
access-control-allow-headers: range
strict-transport-security: max-age=15768000
cache-control: public, max-age=31536000
x-amz-checksum-crc32c: xITAzA==
accept-ranges: bytes
access-control-allow-origin: *
content-length: 49597

GET
H2 200 / Show response
apresolve.spotify.com/ 273 B
309 B 338ms
46ms XHR
application/json 2600:1901:1:7c5::
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://apresolve.spotify.com/?type=dealer&type=spclient

Requested by

Host: accounts.scdn.co
URL: https://accounts.scdn.co/sso/js/indexReact.c42685c9d238dfb950c0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:1:7c5:: , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

envoy /

Resource Hash

ba693c29cbb459fc1fc2b410d929bef612ef5f67ab56c2c6f3ef61e5c7ae606c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://accounts.spotify.com/

Response headers

strict-transport-security: max-age=31536000
cache-control: no-cache
content-encoding: gzip
x-content-type-options: nosniff
via: HTTP/2 edgeproxy, 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 107
date: Thu, 07 Nov 2024 15:32:09 GMT
content-type: application/json; charset=utf-8
server: envoy

GET
H2 200 / Show response
apresolve.spotify.com/ 273 B
161 B 393ms
52ms XHR
application/json 2600:1901:1:7c5::
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://apresolve.spotify.com/?type=dealer&type=spclient

Requested by

Host: accounts.scdn.co
URL: https://accounts.scdn.co/sso/js/indexReact.c42685c9d238dfb950c0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:1:7c5:: , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

envoy /

Resource Hash

ba693c29cbb459fc1fc2b410d929bef612ef5f67ab56c2c6f3ef61e5c7ae606c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://accounts.spotify.com/

Response headers

strict-transport-security: max-age=31536000
cache-control: no-cache
content-encoding: gzip
x-content-type-options: nosniff
via: HTTP/2 edgeproxy, 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 107
date: Thu, 07 Nov 2024 15:32:09 GMT
content-type: application/json; charset=utf-8
server: envoy

GET
H/1.1 200
OK new-google-icon.72fd940a229bc94cf9484a3320b3dccb.svg
accounts.scdn.co/sso/images/ 1 KB
1 KB 46ms
20ms Image
image/svg+xml 2a04:4e42:4f::760
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://accounts.scdn.co/sso/images/new-google-icon.72fd940a229bc94cf9484a3320b3dccb.svg
Requested by: Host: accounts.spotify.com
URL: https://accounts.spotify.com/login?continue=https%3A%2F%2Fwww.spotify.com%2Fca-en%2Faccount%2Forder-history%2F
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4f::760 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 2998e21de5d77c5c325adb584f547923566040bb1425e20391a6a5002ec82ad3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://accounts.spotify.com/

Response headers

x-goog-metageneration: 1
Content-Encoding: gzip
x-amz-meta-goog-reserved-file-mtime: 1729665599
ETag: "72fd940a229bc94cf9484a3320b3dccb"
Age: 1313249
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1292
X-Cache: HIT, HIT
Date: Thu, 07 Nov 2024 15:32:09 GMT
Last-Modified: Wed, 23 Oct 2024 06:43:32 GMT
Content-Type: image/svg+xml
X-Served-By: cache-chi-kigq8000100-CHI, cache-yul1970070-YUL
X-Cache-Hits: 1840, 1131
Cache-Control: public, max-age=31536000, no-transform
Connection: keep-alive
x-amz-checksum-crc32c: vmMyPw==
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
x-goog-generation: 1729665812667936
Content-Length: 594

GET
H/1.1 200
OK new-facebook-icon.eae8e1b6256f7ccf01cf81913254e70b.svg
accounts.scdn.co/sso/images/ 536 B
1 KB 69ms
23ms Image
image/svg+xml 2a04:4e42:4f::760
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://accounts.scdn.co/sso/images/new-facebook-icon.eae8e1b6256f7ccf01cf81913254e70b.svg
Requested by: Host: accounts.spotify.com
URL: https://accounts.spotify.com/login?continue=https%3A%2F%2Fwww.spotify.com%2Fca-en%2Faccount%2Forder-history%2F
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4f::760 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: a315bf64477d20afda420228d40f906275b0c2d5d8539833fa19dbc5489fac9d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://accounts.spotify.com/

Response headers

x-goog-metageneration: 1
Content-Encoding: gzip
x-amz-meta-goog-reserved-file-mtime: 1729602187
ETag: "eae8e1b6256f7ccf01cf81913254e70b"
Age: 1331463
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 536
X-Cache: HIT, HIT
Date: Thu, 07 Nov 2024 15:32:09 GMT
Last-Modified: Tue, 22 Oct 2024 13:04:37 GMT
Content-Type: image/svg+xml
X-Served-By: cache-chi-klot8100072-CHI, cache-yul1970046-YUL
X-Cache-Hits: 6686, 1171
Cache-Control: public, max-age=31536000, no-transform
Connection: keep-alive
x-amz-checksum-crc32c: yO0Fxg==
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
x-goog-generation: 1729602277341325
Content-Length: 350

GET
H/1.1 200
OK new-apple-icon.e356139ea90852da2e60f1ff738f3cbb.svg
accounts.scdn.co/sso/images/ 913 B
1 KB 68ms
22ms Image
image/svg+xml 2a04:4e42:4f::760
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://accounts.scdn.co/sso/images/new-apple-icon.e356139ea90852da2e60f1ff738f3cbb.svg
Requested by: Host: accounts.spotify.com
URL: https://accounts.spotify.com/login?continue=https%3A%2F%2Fwww.spotify.com%2Fca-en%2Faccount%2Forder-history%2F
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4f::760 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: fa173bbfc674f749b4c6275d1e270993407180b619e8c85da1b25dc4280819cb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://accounts.spotify.com/

Response headers

x-goog-metageneration: 1
Content-Encoding: gzip
x-amz-meta-goog-reserved-file-mtime: 1726235346
ETag: "e356139ea90852da2e60f1ff738f3cbb"
Age: 4466351
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 913
X-Cache: HIT, HIT
Date: Thu, 07 Nov 2024 15:32:09 GMT
Last-Modified: Fri, 13 Sep 2024 13:53:18 GMT
Content-Type: image/svg+xml
X-Served-By: cache-chi-klot8100104-CHI, cache-yul1970030-YUL
X-Cache-Hits: 18456, 1111
Cache-Control: public, max-age=31536000, no-transform
Connection: keep-alive
x-amz-checksum-crc32c: sCLZQw==
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
x-goog-generation: 1726235598219544
Content-Length: 513

GET
H3 200 enterprise.js Show response
www.google.com/recaptcha/ 2 KB
1 KB 267ms
49ms Script
text/javascript 142.251.40.228
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise.js?render=6LfCVLAUAAAAALFwwRnnCJ12DalriUGbj8FW_J39

Requested by

Host: accounts.scdn.co
URL: https://accounts.scdn.co/sso/js/indexReact.c42685c9d238dfb950c0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.228 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f4.1e100.net

Software

ESF /

Resource Hash

09fdc9f1d7a9cb27584d33642b98cd319f9396ab4be107e289a0ac3bac49fa9f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://accounts.spotify.com/

Response headers

cache-control: private, max-age=300
content-encoding: gzip
cross-origin-resource-policy: cross-origin
report-to: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
x-content-type-options: nosniff
expires: Thu, 07 Nov 2024 15:32:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
date: Thu, 07 Nov 2024 15:32:09 GMT
x-xss-protection: 0
content-type: text/javascript; charset=utf-8
server: ESF
x-frame-options: SAMEORIGIN

GET
H3 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/ 546 KB
215 KB 349ms
26ms Script
text/javascript 142.251.40.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise.js?render=6LfCVLAUAAAAALFwwRnnCJ12DalriUGbj8FW_J39

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.227 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f3.1e100.net

Software

sffe /

Resource Hash

f8e5f5ce9ff44073cff24bcd3d2b8aa4e67b67891b14ff929fe4743880fdf82e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://accounts.spotify.com
Referer: https://accounts.spotify.com/

Response headers

content-encoding: gzip
age: 33568
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
x-content-type-options: nosniff
expires: Fri, 07 Nov 2025 06:12:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 07 Nov 2024 06:12:41 GMT
last-modified: Tue, 22 Oct 2024 00:01:33 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
accept-ranges: bytes
access-control-allow-origin: *
content-length: 220347
x-xss-protection: 0
server: sffe

OPTIONS
H2 200 configuration
guc3-spclient.spotify.com/remote-config-resolver/v3/unauth/ Frame 0
0 135ms
61ms Preflight 2600:1901:1:6ac::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://guc3-spclient.spotify.com/remote-config-resolver/v3/unauth/configuration
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:1:6ac:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://accounts.spotify.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Origin,Content-Type,Spotify-App-Version,App-Platform,X-Spotify-Connection-Id,X-Client-Id,X-Spotify-Quicksilver-Uri,client-token,content-access-token,x-cloud-trace-context
access-control-allow-methods: DELETE,GET,PATCH,POST,PUT,OPTIONS
access-control-allow-origin: https://accounts.spotify.com
access-control-max-age: 604800
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 07 Nov 2024 15:32:09 GMT
server: envoy
vary: Accept-Encoding
via: HTTP/2 edgeproxy, 1.1 google

POST
H2 200 configuration Show response
guc3-spclient.spotify.com/remote-config-resolver/v3/unauth/ 170 B
648 B 57ms
54ms XHR
application/json 2600:1901:1:6ac::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://guc3-spclient.spotify.com/remote-config-resolver/v3/unauth/configuration

Requested by

Host: accounts.scdn.co
URL: https://accounts.scdn.co/sso/js/indexReact.c42685c9d238dfb950c0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:1:6ac:: , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

deccd49cd11e08263fb15512d17fe0d224462765cb5b4c65e07cf4eb65f1bac4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
content-type: application/json
Referer: https://accounts.spotify.com/

Response headers

strict-transport-security: max-age=31536000
access-control-max-age: 604800
cache-control: private, max-age=0
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, HEAD, DELETE, PATCH
x-content-type-options: nosniff
via: HTTP/2 edgeproxy, 1.1 google
access-control-allow-origin: https://accounts.spotify.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 165
date: Thu, 07 Nov 2024 15:32:09 GMT
content-type: application/json
server: envoy
access-control-allow-headers: Accept, App-Platform, Authorization, client-token, content-access-token, Content-Type, Origin, Retry-After, SPA-Preferred-Publisher, Spotify-App, Spotify-App-Version, spotify-org-uri, X-ClientAttribute-Version, X-Client-Id, x-cloud-trace-context, X-Cloud-Trace-Context, X-Geo-Country, X-Installation-Id, x-permission-grant-token, X-Spotify-Additional-Idp, X-Spotify-Connection-Id, X-Spotify-Quicksilver-Uri, x-twitch-jwt

POST
H2 200 events Show response
guc3-spclient.spotify.com/gabo-receiver-service/public/v3/ 13 B
104 B 84ms
82ms XHR
application/json 2600:1901:1:6ac::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://guc3-spclient.spotify.com/gabo-receiver-service/public/v3/events

Requested by

Host: accounts.scdn.co
URL: https://accounts.scdn.co/sso/js/indexReact.c42685c9d238dfb950c0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:1:6ac:: , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
content-type: application/json
Referer: https://accounts.spotify.com/

Response headers

strict-transport-security: max-age=31536000
cache-control: no-cache
content-encoding: gzip
access-control-allow-credentials: true
x-content-type-options: nosniff
via: HTTP/2 edgeproxy, 1.1 google
access-control-allow-origin: https://accounts.spotify.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39
date: Thu, 07 Nov 2024 15:32:09 GMT
content-type: application/json
server: envoy

POST
H2 200 events Show response
guc3-spclient.spotify.com/gabo-receiver-service/public/v3/ 13 B
94 B 90ms
84ms XHR
application/json 2600:1901:1:6ac::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://guc3-spclient.spotify.com/gabo-receiver-service/public/v3/events

Requested by

Host: accounts.scdn.co
URL: https://accounts.scdn.co/sso/js/indexReact.c42685c9d238dfb950c0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:1:6ac:: , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
content-type: application/json
Referer: https://accounts.spotify.com/

Response headers

strict-transport-security: max-age=31536000
cache-control: no-cache
content-encoding: gzip
access-control-allow-credentials: true
x-content-type-options: nosniff
via: HTTP/2 edgeproxy, 1.1 google
access-control-allow-origin: https://accounts.spotify.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39
date: Thu, 07 Nov 2024 15:32:09 GMT
content-type: application/json
server: envoy

OPTIONS
H2 200 events
guc3-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame 0
0 136ms
63ms Preflight 2600:1901:1:6ac::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://guc3-spclient.spotify.com/gabo-receiver-service/public/v3/events
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:1:6ac:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://accounts.spotify.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Origin,Content-Type,Spotify-App-Version,App-Platform,X-Spotify-Connection-Id,X-Client-Id,X-Spotify-Quicksilver-Uri,client-token,content-access-token,x-cloud-trace-context
access-control-allow-methods: DELETE,GET,PATCH,POST,PUT,OPTIONS
access-control-allow-origin: https://accounts.spotify.com
access-control-max-age: 604800
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 07 Nov 2024 15:32:09 GMT
server: envoy
vary: Accept-Encoding
via: HTTP/2 edgeproxy, 1.1 google

OPTIONS
H2 200 events
guc3-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame 0
0 132ms
60ms Preflight 2600:1901:1:6ac::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://guc3-spclient.spotify.com/gabo-receiver-service/public/v3/events
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:1:6ac:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://accounts.spotify.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Authorization,Origin,Content-Type,Spotify-App-Version,App-Platform,X-Spotify-Connection-Id,X-Client-Id,X-Spotify-Quicksilver-Uri,client-token,content-access-token,x-cloud-trace-context
access-control-allow-methods: DELETE,GET,PATCH,POST,PUT,OPTIONS
access-control-allow-origin: https://accounts.spotify.com
access-control-max-age: 604800
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 07 Nov 2024 15:32:09 GMT
server: envoy
vary: Accept-Encoding
via: HTTP/2 edgeproxy, 1.1 google

GET
H3 200 anchor
www.google.com/recaptcha/enterprise/ Frame D072 0
0 352ms
63ms Document
text/html 142.251.40.228
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6LfCVLAUAAAAALFwwRnnCJ12DalriUGbj8FW_J39&co=aHR0cHM6Ly9hY2NvdW50cy5zcG90aWZ5LmNvbTo0NDM.&hl=en&v=-ZG7BC9TxCVEbzIO2m429usb&size=invisible&cb=89de3h9255xw

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/-ZG7BC9TxCVEbzIO2m429usb/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.228 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f4.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-avd5-RakwviMyU0DON9RJA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://accounts.spotify.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-avd5-RakwviMyU0DON9RJA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Thu, 07 Nov 2024 15:32:10 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK favicon.ace4d8543bbb017893402a1e9d1ac1fa.ico
accounts.scdn.co/sso/images/ 5 KB
1 KB 24ms
23ms Other
image/vnd.microsoft.icon 2a04:4e42:4f::760
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://accounts.scdn.co/sso/images/favicon.ace4d8543bbb017893402a1e9d1ac1fa.ico
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:4f::760 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: d2534e9fb333a6e277f1edf9b9843564e094027fb79979081e41fd778c339ae5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://accounts.spotify.com/

Response headers

x-goog-metageneration: 1
Content-Encoding: gzip
x-amz-meta-goog-reserved-file-mtime: 1729523870
ETag: "ace4d8543bbb017893402a1e9d1ac1fa"
Age: 1445815
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 5430
X-Cache: HIT, HIT
Date: Thu, 07 Nov 2024 15:32:11 GMT
Last-Modified: Mon, 21 Oct 2024 15:19:55 GMT
Content-Type: image/vnd.microsoft.icon
X-Served-By: cache-chi-kigq8000168-CHI, cache-yul1970030-YUL
X-Cache-Hits: 149, 977
Cache-Control: public, max-age=31536000, no-transform
Connection: keep-alive
x-amz-checksum-crc32c: gUdNpg==
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
x-goog-generation: 1729523995775645
Content-Length: 706

POST
H3 200 events Show response
guc3-spclient.spotify.com/gabo-receiver-service/public/v3/ 13 B
58 B 171ms
167ms XHR
application/json 35.186.224.31
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://guc3-spclient.spotify.com/gabo-receiver-service/public/v3/events

Requested by

Host: accounts.scdn.co
URL: https://accounts.scdn.co/sso/js/indexReact.c42685c9d238dfb950c0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

35.186.224.31 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

31.224.186.35.bc.googleusercontent.com

Software

envoy /

Resource Hash

debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
content-type: application/json
Referer: https://accounts.spotify.com/

Response headers

strict-transport-security: max-age=31536000
cache-control: no-cache
content-encoding: gzip
access-control-allow-credentials: true
x-content-type-options: nosniff
via: HTTP/2 edgeproxy, 1.1 google
access-control-allow-origin: https://accounts.spotify.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39
date: Thu, 07 Nov 2024 15:32:13 GMT
content-type: application/json
server: envoy

POST
H3 200 events Show response
guc3-spclient.spotify.com/gabo-receiver-service/public/v3/ 13 B
58 B 75ms
72ms XHR
application/json 35.186.224.31
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://guc3-spclient.spotify.com/gabo-receiver-service/public/v3/events

Requested by

Host: accounts.scdn.co
URL: https://accounts.scdn.co/sso/js/indexReact.c42685c9d238dfb950c0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

35.186.224.31 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

31.224.186.35.bc.googleusercontent.com

Software

envoy /

Resource Hash

debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
content-type: application/json
Referer: https://accounts.spotify.com/

Response headers

strict-transport-security: max-age=31536000
cache-control: no-cache
content-encoding: gzip
access-control-allow-credentials: true
x-content-type-options: nosniff
via: HTTP/2 edgeproxy, 1.1 google
access-control-allow-origin: https://accounts.spotify.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39
date: Thu, 07 Nov 2024 15:32:13 GMT
content-type: application/json
server: envoy

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.google.com/recaptcha	1970-01-21 05:09:05	Name: _GRECAPTCHA Value: 09ANOXeZxE-_l_ebwNNaYfAxsd0UKMpV_qJ6KgFiWEE_SOxLjRdHn4Wz9eiBYECnwQiKnBe3C5yhm4wZ0rn7irBOA
.spotify.com/	1970-01-21 10:25:53	Name: sp_m Value: ca-en
www.spotify.com/	1970-01-21 00:49:57	Name: __Host-sp_csrf_sid Value: 0925806eec9fe22addcf0928a52e08e445860e51d2ddb1cf33fb93f142047282
.spotify.com/	1970-01-21 09:35:29	Name: sp_t Value: 41770670-cd5c-4731-bb86-81ec35e98870
.spotify.com/	1970-01-21 00:51:19	Name: sp_new Value: 1
.spotify.com/	1970-01-21 00:51:19	Name: sp_landing Value: https%3A%2F%2Fwww.spotify.com%2Fca-en%2Faccount%2Forder-history%2F
accounts.spotify.com/	1970-01-21 10:25:53	Name: __Host-device_id Value: AQAgX9CIkaC2R_E8IXAAYPJmLMy7ZZintwF7LCjeU1ys8R226-mnchWMR-yX-HmMkffMHz_3uOoIeFuaLdcXBPVU1q1R6_O8-gI
.accounts.spotify.com/	1969-12-31 23:59:59	Name: __Secure-TPASESSION Value: AQDsxph7NARLXIBqgbebxo+cLqBHXB3vm+RgLzFKH9YUI+qxUMotqnKxOAN8Nea2d4sRByPpelAyNIZ4XdDzIkAOcujWeXVpAvU=
.accounts.spotify.com/	1969-12-31 23:59:59	Name: sp_sso_csrf_token Value: 013acda719b821f5be378ae5e3271a7e616a3f020231373330393933353238353132
.accounts.spotify.com/	1969-12-31 23:59:59	Name: sp_tr Value: false
accounts.spotify.com/	1970-01-21 00:49:57	Name: __Host-sp_csrf_sid Value: fa6e45241fce056671578da1ae6c3bd372a5c220376b63a2fa8a09fdf1cf70f5

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://accounts.spotify.com/login?continue=https%3A%2F%2Fwww.spotify.com%2Fca-en%2Faccount%2Forder-history%2F Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://www.google-analytics.com https://ssl.google-analytics.com https://www.google.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ https://cdn.cookielaw.org/scripttemplates/ https://.onetrust.com https://.googletagmanager.com 'sha256-DdOTSPXUa4upGVO8zYWD1wUUqxjFKJFyE/4ha4Fe9XE=' https://accounts.scdn.co; img-src 'self' https://i.imgur.com https://d2mv8tnci56s9d.cloudfront.net https://profile-images.scdn.co https://.scdn.co https://graph.facebook.com https://fbcdn-profile-a.akamaihd.net https://.fbcdn.net https://platform-lookaside.fbsbx.com https://www.google.com https://www.google-analytics.com https://stats.g.doubleclick.net https://.googletagmanager.com data: https://accounts.scdn.co; font-src 'self' data: https://sp-bootstrap.global.ssl.fastly.net https://fonts.gstatic.com https://.scdn.co; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/css2; frame-src 'self' https://www.spotify.com https://www.google.com https://app.adjust.com https://itunes.apple.com itms-apps: https://www.google.com/recaptcha/; connect-src 'self' https://.spotify.com https://.google-analytics.com https://.ingest.sentry.io/ https://.googletagmanager.com;
Strict-Transport-Security	max-age=31536000
X-Content-Security-Policy	default-src 'self'; script-src 'self' https://www.google-analytics.com https://ssl.google-analytics.com https://www.google.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ https://cdn.cookielaw.org/scripttemplates/ https://.onetrust.com https://.googletagmanager.com 'sha256-DdOTSPXUa4upGVO8zYWD1wUUqxjFKJFyE/4ha4Fe9XE=' https://accounts.scdn.co; img-src 'self' https://i.imgur.com https://d2mv8tnci56s9d.cloudfront.net https://profile-images.scdn.co https://.scdn.co https://graph.facebook.com https://fbcdn-profile-a.akamaihd.net https://.fbcdn.net https://platform-lookaside.fbsbx.com https://www.google.com https://www.google-analytics.com https://stats.g.doubleclick.net https://.googletagmanager.com data: https://accounts.scdn.co; font-src 'self' data: https://sp-bootstrap.global.ssl.fastly.net https://fonts.gstatic.com https://.scdn.co; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/css2; frame-src 'self' https://www.spotify.com https://www.google.com https://app.adjust.com https://itunes.apple.com itms-apps: https://www.google.com/recaptcha/; connect-src 'self' https://.spotify.com https://.google-analytics.com https://.ingest.sentry.io/ https://.googletagmanager.com;
X-Content-Type-Options	nosniff
X-Frame-Options	deny

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.scdn.co
accounts.spotify.com
apresolve.spotify.com
encore.scdn.co
guc3-spclient.spotify.com
www.google.com
www.gstatic.com
www.spotify.com
142.251.40.227
142.251.40.228
2600:141b:1c00:10::172c:c9a9
2600:1901:1:6ac::
2600:1901:1:7c5::
2a04:4e42:4f::760
35.186.224.24
35.186.224.31
09fdc9f1d7a9cb27584d33642b98cd319f9396ab4be107e289a0ac3bac49fa9f
2998e21de5d77c5c325adb584f547923566040bb1425e20391a6a5002ec82ad3
406312aa9e36de68c1c1975221e22ccd619a390f5fe9665ce64eff29ae32ba4c
4252606cf3c6b177ae87bf37e83c73db1895a99d44b9c6965309cd343124c9ba
6549a7238a69d08fd60bce0a4363915942fe4b0c4304d68edb51d0e325f572ab
85564946a706be50f09f4602bb41d3c21aaa57bd492603a269b2d30657ddf668
89484220600d480887cda10a47f73e626943548bd07b0b249d59f85731427b93
91623228bbcef3805f91d3df656132fcf95b5572bf345039eedc91a136b7ed09
9164e08c61e16f0dfb8390517c3c0730252208aebf0e1c8b924b67bf47d368db
a315bf64477d20afda420228d40f906275b0c2d5d8539833fa19dbc5489fac9d
ba693c29cbb459fc1fc2b410d929bef612ef5f67ab56c2c6f3ef61e5c7ae606c
d2534e9fb333a6e277f1edf9b9843564e094027fb79979081e41fd778c339ae5
debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8
deccd49cd11e08263fb15512d17fe0d224462765cb5b4c65e07cf4eb65f1bac4
f8e5f5ce9ff44073cff24bcd3d2b8aa4e67b67891b14ff929fe4743880fdf82e
fa173bbfc674f749b4c6275d1e270993407180b619e8c85da1b25dc4280819cb

accounts.spotify.com Open in urlscan Pro 2600:1901:1:7c5:: Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

24 Requests

100 %HTTPS

50 %IPv6

4 Domains

8 Subdomains

7 IPs

1 Countries

1127 kBTransfer

2625 kBSize

11 Cookies

2 Outgoing links

Page URL History

Redirected requests

24 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

11 Cookies

1 Console Messages

Security Headers

Indicators

accounts.spotify.com Open in urlscan Pro
2600:1901:1:7c5:: Public Scan

Screenshot
Live screenshot

Full Image

24
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

8
Subdomains

7
IPs

1
Countries

1127 kB
Transfer

2625 kB
Size

11
Cookies

24 HTTP transactions
0 data transactions