urlscan.io logo urlscan.io
SecurityTrails logo

apps.intuit.com Open in urlscan Pro
54.213.197.138  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://apps.com/
Effective URL: https://apps.intuit.com/app/apps/home
Submission: On November 08 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 15 HTTP transactions. The main IP is 54.213.197.138, located in Boardman, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is apps.intuit.com.
TLS certificate: Issued by Amazon on July 9th 2018. Valid for: a year.
This is the only time apps.intuit.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 173.240.173.236 11641 (INTUIT-LA...)
1 1 173.240.173.151 11641 (INTUIT-LA...)
1 2 54.213.197.138 16509 (AMAZON-02)
13 23.8.12.123 20940 (AKAMAI-ASN1)
1 34.216.208.110 16509 (AMAZON-02)
15 3
1    173.240.173.236 (Mountain View, United States)

ASN11641 (INTUIT-LAS-DC - Intuit Inc., US)
PTR: lasf01.appexidg.intuit.com
apps.com
1    173.240.173.151 (Mountain View, United States)

ASN11641 (INTUIT-LAS-DC - Intuit Inc., US)
PTR: pprdidg-lvdcf.apps.com
www.apps.com
2    54.213.197.138 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-213-197-138.us-west-2.compute.amazonaws.com
apps.intuit.com
13    23.8.12.123 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-8-12-123.deploy.static.akamaitechnologies.com
plugin.intuitcdn.net
assets.intuitcdn.net
1    34.216.208.110 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-216-208-110.us-west-2.compute.amazonaws.com
zion.qbo.intuit.com
Apex Domain
Subdomains		 Transfer
13 intuitcdn.net
plugin.intuitcdn.net
assets.intuitcdn.net
543 KB
3 intuit.com
apps.intuit.com
zion.qbo.intuit.com
11 KB
2 apps.com
apps.com
www.apps.com
313 B
15 3
Domain Requested by
12 plugin.intuitcdn.net apps.intuit.com
plugin.intuitcdn.net
2 apps.intuit.com 1 redirects
1 assets.intuitcdn.net plugin.intuitcdn.net
1 zion.qbo.intuit.com apps.intuit.com
1 www.apps.com 1 redirects
1 apps.com 1 redirects
15 6

This site contains no links.

Subject Issuer Validity Valid
*.prd-sbg-idg-appsproxy.a.intuit.com
Amazon		 2018-07-09 -
2019-08-09		 a year crt.sh
*.intuitcdn.net
DigiCert SHA2 Secure Server CA		 2018-03-12 -
2019-03-12		 a year crt.sh
*.sbgnode.a.intuit.com
DigiCert SHA2 Secure Server CA		 2018-05-12 -
2019-05-13		 a year crt.sh

This page contains 1 frames:

Primary Page: https://apps.intuit.com/app/apps/home
Frame ID: E0419713A58479B22C96A3763073D155
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://apps.com/ HTTP 302
    https://www.apps.com/ HTTP 301
    https://apps.intuit.com/ HTTP 302
    https://apps.intuit.com/app/apps/home Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • env /^dojo$/i

Page Statistics

15
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

6
Subdomains

3
IPs

2
Countries

554 kB
Transfer

2197 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://apps.com/ HTTP 302
    https://www.apps.com/ HTTP 301
    https://apps.intuit.com/ HTTP 302
    https://apps.intuit.com/app/apps/home Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request home
apps.intuit.com/app/apps/
Redirect Chain
  • http://apps.com/
  • https://www.apps.com/
  • https://apps.intuit.com/
  • https://apps.intuit.com/app/apps/home
22 KB
11 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://apps.intuit.com/app/apps/home
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.213.197.138 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-213-197-138.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
e838bec09a6c79c4cdfae199d3556232de31ebdbe805d862ca4073fd80718d37
Security Headers
Name Value
Content-Security-Policy default-src https://*.qbo.intuit.com 'self' https://*.intuit.com https://*.intuitcdn.net:*; script-src 'unsafe-eval' 'unsafe-inline' https://js.stripe.com https://www.glancecdn.net/cobrowse/ https://s3.amazonaws.com/glancecdn/cobrowse/js/ https://js-agent.newrelic.com https://cdn.appdynamics.com https://cdn.mxpnl.com https://paybycoin.disqus.com/count.js https://bam.nr-data.net https://cdnssl.clicktale.net https://cdn.walkme.com https://playerserver.walkme.com https://maps.googleapis.com https://*.zopim.com https://d2yyd1h5u9mauk.cloudfront.net https://widget.uservoice.com https://by2.uservoice.com https://assets.uvcdn.com https://siteintercept.qualtrics.com https://www.paypal.com https://s3-us-west-2.amazonaws.com/idg-pi/sitecatalyst/js/idgtrack.js https://prod-app.bdc-cdn.com/js/utility/commonUtils.js https://app.fundbox.com/static/ https://checkout.razorpay.com/v1/razorpay.js 'report-sample' 'self' https://*.intuit.com https://*.intuitcdn.net:* https://display.ugc.bazaarvoice.com/static/Intuitappcenter/ http://display.ugc.bazaarvoice.com/static/Intuitappcenter/ https://display.ugc.bazaarvoice.com/common/ https://apps.nexus.bazaarvoice.com https://analytics-static.ugc.bazaarvoice.com https://api.bazaarvoice.com/data/ http://api.bazaarvoice.com/data/ https://s3.amazonaws.com/bvscout/ https://network.bazaarvoice.com https://www.google.com/recaptcha/ https://www.google-analytics.com/analytics.js https://www.google.com/m8/feeds/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/iframe_api https://www.googleapis.com/youtube/ https://s.ytimg.com/yts/jsbin/ https://lpcdn.lpsnmedia.net https://lptag.liveperson.net https://accdn.lpsnmedia.net/api/account/ https://va.v.liveperson.net/api/js/ https://sales.liveperson.net https://mpsnare.iesnare.com/ https://ssl.kaptcha.com:*; connect-src https://api.segment.io https://bam.nr-data.net https://col.eum-appdynamics.com https://api.mixpanel.com https://cdn.segment.io https://ing-district.clicktale.net https://conductor.clicktale.net https://ec.walkme.com https://www.glancecdn.net https://*.glance.net wss://*.glance.net https://qbo.wagepoint.com https://siteintercept.qualtrics.com https://web.delighted.com wss://ws.pusherapp.com wss://*.zopim.com wss://*.identity-plus.a.intuit.com wss://*.intuit.com https://s3.us-west-2.amazonaws.com/ips-logos-prod/ https://consent.intuit.apps.com 'self' https://*.intuit.com https://*.intuitcdn.net:* wss://plugin-localhost.intuitcdn.net:* wss://plugin.intuitcdn.net:* https://network.bazaarvoice.com https://www.youtube.com https://vimeo.com https://app.apintego.com wss://va.msg.liveperson.net/ws_api/account/ https://*.tsheets.com https://app.intuit.launchdarkly.com https://stream.intuit.launchdarkly.com https://events.intuit.launchdarkly.com https://api.razorpay.com https://lumberjack.razorpay.com https://razorpaygateway.api.intuit.com; style-src 'unsafe-inline' 'unsafe-eval' blob: https://www.glancecdn.net https://s3.amazonaws.com/glancecdn/cobrowse/ https://fonts.googleapis.com/css 'self' https://*.intuitcdn.net:* https://*.intuit.com https://display.ugc.bazaarvoice.com; frame-src https://js.stripe.com intuitnative: https://widget.uservoice.com https://fls.doubleclick.net https://1996823.fls.doubleclick.net https://tableau.intuit.net https://app.fundbox.com https://www1.royalbank.com https://app.bill.com https://www.bill.com https://prod-static.bdc-cdn.com https://app-qbo-vip.cashview.com https://qbo.wagepoint.com https://www.referquickbooks.com https://refer.quickbooks.ca https://www.avataxforqbo.com https://qbo.paysuite.co.uk https://qbo.paybooks.in https://www.citruspay.com https://*.yourpayroll.com.au https://www.paypal.com https://*.s3.amazonaws.com https://*.intuittrainingplatform.com https://intuitsocial.az1.qualtrics.com https://siteintercept.qualtrics.com https://*.intuitstatic.com blob: data: https://quickbooks.intuit.fr https://*.intuitcdn.net https://*.intuit.com https://api.bazaarvoice.com https://display.ugc.bazaarvoice.com https://www.google.com/recaptcha/ https://www.youtube.com https://*.youtube.com https://player.vimeo.com https://app.apintego.com https://lpcdn.lpsnmedia.net https://*.liveperson.net https://*.tsheets.com https://secure.paymentech.com https://ssl.kaptcha.com https://securevar.paymentech.com https://tst.kaptcha.com; img-src https://col.eum-appdynamics.com https://bam.nr-data.net https://intuitctoiuxqa.112.2o7.net https://ec.walkme.com https://www.glancecdn.net https://s3.amazonaws.com/glancecdn/cobrowse/ https://app.bill.com https://www.bill.com https://pixel.everesttech.net https://cdn.jsdelivr.net/emojione/assets/ https://v2.zopim.com https://siteintercept.qualtrics.com https://az1.qualtrics.com data: https://www.paypalobjects.com https://www.pos-depot.com/wp-content/ https://*.s3.amazonaws.com blob: https://app.fundbox.com/img/ https://q.stripe.com https://maps.gstatic.com/mapfiles/ https://maps.googleapis.com/maps/ https://raw.githubusercontent.com/googlemaps/v3-utility-library/master/markerclustererplus/images/ https://images-na.ssl-images-amazon.com 'self' https://*.intuit.com https://*.intuitcdn.net:* https://network.bazaarvoice.com https://display.ugc.bazaarvoice.com https://www.google-analytics.com https://i.ytimg.com https://img.youtube.com https://i.vimeocdn.com https://lpcdn.lpsnmedia.net https://sales.liveperson.net https://*.tsheets.com https://opfcaptcha-prod.s3.amazonaws.com https://secure.paymentech.com https://ssl.kaptcha.com https://securevar.paymentech.com https://tst.kaptcha.com; child-src 'self' blob:; font-src https://*.qbo.intuit.com https://www.glancecdn.net https://s3.amazonaws.com/glancecdn/cobrowse/ https://v2.zopim.com https://www.paypalobjects.com https://prod-static.bdc-cdn.com data: 'self' https://*.intuit.com https://*.intuitcdn.net:*; object-src blob: 'self' https://*.intuitcdn.net https://*.intuit.com https://mpsnare.iesnare.com/stmgwb2.swf; worker-src 'self' blob:; media-src https://lpcdn.lpsnmedia.net/le_unified_window/; report-uri https://zion.qbo.intuit.com/api/v1/cspReport; base-uri 'none';
Strict-Transport-Security max-age=15552000; includeSubDomains max-age=15768000
X-Content-Type-Options nosniff nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block 1; mode=block

Request headers

:method
GET
:authority
apps.intuit.com
:scheme
https
:path
/app/apps/home
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Thu, 08 Nov 2018 22:03:36 GMT
content-type
text/html; charset=utf-8
server
nginx
x-dns-prefetch-control
off
strict-transport-security
max-age=15552000; includeSubDomains max-age=15768000
x-download-options
noopen
x-content-type-options
nosniff nosniff
x-xss-protection
1; mode=block 1; mode=block
cache-control
private,no-cache,no-store,pre-check=0,post-check=0,must-revalidate
expires
-1
pragma
no-cache
set-cookie
hosted-shell=%7B%22clientId%22%3A%22f1c13a21-a59f-4990-8fc1-64ac3c65520b%22%7D; Expires=Sun, 05 Nov 2028 22:03:36 GMT; Secure qbo.clientType=web; Path=/
content-security-policy
default-src https://*.qbo.intuit.com 'self' https://*.intuit.com https://*.intuitcdn.net:*; script-src 'unsafe-eval' 'unsafe-inline' https://js.stripe.com https://www.glancecdn.net/cobrowse/ https://s3.amazonaws.com/glancecdn/cobrowse/js/ https://js-agent.newrelic.com https://cdn.appdynamics.com https://cdn.mxpnl.com https://paybycoin.disqus.com/count.js https://bam.nr-data.net https://cdnssl.clicktale.net https://cdn.walkme.com https://playerserver.walkme.com https://maps.googleapis.com https://*.zopim.com https://d2yyd1h5u9mauk.cloudfront.net https://widget.uservoice.com https://by2.uservoice.com https://assets.uvcdn.com https://siteintercept.qualtrics.com https://www.paypal.com https://s3-us-west-2.amazonaws.com/idg-pi/sitecatalyst/js/idgtrack.js https://prod-app.bdc-cdn.com/js/utility/commonUtils.js https://app.fundbox.com/static/ https://checkout.razorpay.com/v1/razorpay.js 'report-sample' 'self' https://*.intuit.com https://*.intuitcdn.net:* https://display.ugc.bazaarvoice.com/static/Intuitappcenter/ http://display.ugc.bazaarvoice.com/static/Intuitappcenter/ https://display.ugc.bazaarvoice.com/common/ https://apps.nexus.bazaarvoice.com https://analytics-static.ugc.bazaarvoice.com https://api.bazaarvoice.com/data/ http://api.bazaarvoice.com/data/ https://s3.amazonaws.com/bvscout/ https://network.bazaarvoice.com https://www.google.com/recaptcha/ https://www.google-analytics.com/analytics.js https://www.google.com/m8/feeds/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/iframe_api https://www.googleapis.com/youtube/ https://s.ytimg.com/yts/jsbin/ https://lpcdn.lpsnmedia.net https://lptag.liveperson.net https://accdn.lpsnmedia.net/api/account/ https://va.v.liveperson.net/api/js/ https://sales.liveperson.net https://mpsnare.iesnare.com/ https://ssl.kaptcha.com:*; connect-src https://api.segment.io https://bam.nr-data.net https://col.eum-appdynamics.com https://api.mixpanel.com https://cdn.segment.io https://ing-district.clicktale.net https://conductor.clicktale.net https://ec.walkme.com https://www.glancecdn.net https://*.glance.net wss://*.glance.net https://qbo.wagepoint.com https://siteintercept.qualtrics.com https://web.delighted.com wss://ws.pusherapp.com wss://*.zopim.com wss://*.identity-plus.a.intuit.com wss://*.intuit.com https://s3.us-west-2.amazonaws.com/ips-logos-prod/ https://consent.intuit.apps.com 'self' https://*.intuit.com https://*.intuitcdn.net:* wss://plugin-localhost.intuitcdn.net:* wss://plugin.intuitcdn.net:* https://network.bazaarvoice.com https://www.youtube.com https://vimeo.com https://app.apintego.com wss://va.msg.liveperson.net/ws_api/account/ https://*.tsheets.com https://app.intuit.launchdarkly.com https://stream.intuit.launchdarkly.com https://events.intuit.launchdarkly.com https://api.razorpay.com https://lumberjack.razorpay.com https://razorpaygateway.api.intuit.com; style-src 'unsafe-inline' 'unsafe-eval' blob: https://www.glancecdn.net https://s3.amazonaws.com/glancecdn/cobrowse/ https://fonts.googleapis.com/css 'self' https://*.intuitcdn.net:* https://*.intuit.com https://display.ugc.bazaarvoice.com; frame-src https://js.stripe.com intuitnative: https://widget.uservoice.com https://fls.doubleclick.net https://1996823.fls.doubleclick.net https://tableau.intuit.net https://app.fundbox.com https://www1.royalbank.com https://app.bill.com https://www.bill.com https://prod-static.bdc-cdn.com https://app-qbo-vip.cashview.com https://qbo.wagepoint.com https://www.referquickbooks.com https://refer.quickbooks.ca https://www.avataxforqbo.com https://qbo.paysuite.co.uk https://qbo.paybooks.in https://www.citruspay.com https://*.yourpayroll.com.au https://www.paypal.com https://*.s3.amazonaws.com https://*.intuittrainingplatform.com https://intuitsocial.az1.qualtrics.com https://siteintercept.qualtrics.com https://*.intuitstatic.com blob: data: https://quickbooks.intuit.fr https://*.intuitcdn.net https://*.intuit.com https://api.bazaarvoice.com https://display.ugc.bazaarvoice.com https://www.google.com/recaptcha/ https://www.youtube.com https://*.youtube.com https://player.vimeo.com https://app.apintego.com https://lpcdn.lpsnmedia.net https://*.liveperson.net https://*.tsheets.com https://secure.paymentech.com https://ssl.kaptcha.com https://securevar.paymentech.com https://tst.kaptcha.com; img-src https://col.eum-appdynamics.com https://bam.nr-data.net https://intuitctoiuxqa.112.2o7.net https://ec.walkme.com https://www.glancecdn.net https://s3.amazonaws.com/glancecdn/cobrowse/ https://app.bill.com https://www.bill.com https://pixel.everesttech.net https://cdn.jsdelivr.net/emojione/assets/ https://v2.zopim.com https://siteintercept.qualtrics.com https://az1.qualtrics.com data: https://www.paypalobjects.com https://www.pos-depot.com/wp-content/ https://*.s3.amazonaws.com blob: https://app.fundbox.com/img/ https://q.stripe.com https://maps.gstatic.com/mapfiles/ https://maps.googleapis.com/maps/ https://raw.githubusercontent.com/googlemaps/v3-utility-library/master/markerclustererplus/images/ https://images-na.ssl-images-amazon.com 'self' https://*.intuit.com https://*.intuitcdn.net:* https://network.bazaarvoice.com https://display.ugc.bazaarvoice.com https://www.google-analytics.com https://i.ytimg.com https://img.youtube.com https://i.vimeocdn.com https://lpcdn.lpsnmedia.net https://sales.liveperson.net https://*.tsheets.com https://opfcaptcha-prod.s3.amazonaws.com https://secure.paymentech.com https://ssl.kaptcha.com https://securevar.paymentech.com https://tst.kaptcha.com; child-src 'self' blob:; font-src https://*.qbo.intuit.com https://www.glancecdn.net https://s3.amazonaws.com/glancecdn/cobrowse/ https://v2.zopim.com https://www.paypalobjects.com https://prod-static.bdc-cdn.com data: 'self' https://*.intuit.com https://*.intuitcdn.net:*; object-src blob: 'self' https://*.intuitcdn.net https://*.intuit.com https://mpsnare.iesnare.com/stmgwb2.swf; worker-src 'self' blob:; media-src https://lpcdn.lpsnmedia.net/le_unified_window/; report-uri https://zion.qbo.intuit.com/api/v1/cspReport; base-uri 'none';
content-security-policy-report-only
script-src * 'unsafe-eval' 'unsafe-inline' 'report-sample' 'nonce-wwI2VmQuwfKZuCeH58Zo2w=='; worker-src 'self' blob:; report-uri https://zion.qbo.intuit.com/api/v1/cspReport; base-uri 'none';
vary
Accept-Encoding
content-encoding
gzip
x-frame-options
SAMEORIGIN

Redirect headers

status
302
date
Thu, 08 Nov 2018 22:03:36 GMT
content-type
text/html
content-length
154
location
https://apps.intuit.com/app/apps/home
server
nginx
cache-control
no-store, no-cache, must-revalidate
document-register-element.js
plugin.intuitcdn.net/sbg-web-shell-ui/10.0.0/bower_components/document-register-element/build/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://plugin.intuitcdn.net/sbg-web-shell-ui/10.0.0/bower_components/document-register-element/build/document-register-element.js
Requested by
Host: apps.intuit.com
URL: https://apps.intuit.com/app/apps/home
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.8.12.123 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-8-12-123.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
f09c09d80e5bd57b08805166bcffed9f89df94bc52602007eda5719aa0624168

Request headers

Referer
https://apps.intuit.com/app/apps/home
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 08 Nov 2018 22:03:36 GMT
content-encoding
gzip
vary
Accept-Encoding
x-amz-request-id
337C9D606D7D7086
status
200
content-length
4834
x-amz-id-2
vpK5eoNRy3/4TDY/L5P98SkSDKYl9V6BHlUHItymek3JxlIDLyQUBPKGmNTqnl2RTnw4TmSJ6ks=
last-modified
Tue, 30 Oct 2018 22:09:27 GMT
server
AmazonS3
etag
"3928657172b1ae34a0a1df24558093c2"
access-control-max-age
86400
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31556926, immutable
access-control-allow-credentials
false
accept-ranges
bytes
timing-allow-origin
*
dojo.js
plugin.intuitcdn.net/sbg-web-shell-ui/10.0.0/dojo/ 		94 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://plugin.intuitcdn.net/sbg-web-shell-ui/10.0.0/dojo/dojo.js
Requested by
Host: apps.intuit.com
URL: https://apps.intuit.com/app/apps/home
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.8.12.123 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-8-12-123.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
c9963888d5e558ca2440b002bf3f0ebead7ebce345f440ade6b6fe06c89df1a6

Request headers

Referer
https://apps.intuit.com/app/apps/home
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 08 Nov 2018 22:03:36 GMT
content-encoding
gzip
vary
Accept-Encoding
x-amz-request-id
F2247521817CA2E8
status
200
content-length
32115
x-amz-id-2
QiE9g0ir1gKueS0ej0ZUwJaYXyefgih9CFQiOD0Vn8cBa3GElGsLL7RMywOtsKEqS/4wnMo7DcU=
last-modified
Tue, 30 Oct 2018 22:09:40 GMT
server
AmazonS3
etag
"73e3cd954a02e1cfd734be1c00dccf3e"
access-control-max-age
86400
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31556926, immutable
access-control-allow-credentials
false
accept-ranges
bytes
timing-allow-origin
*
boot.js
plugin.intuitcdn.net/sbg-web-shell-ui/10.0.0/shell/ 		948 KB
255 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://plugin.intuitcdn.net/sbg-web-shell-ui/10.0.0/shell/boot.js
Requested by
Host: apps.intuit.com
URL: https://apps.intuit.com/app/apps/home
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.8.12.123 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-8-12-123.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
18d4d8faf3a237d6141ece1ff05ef251b0457c7b201e02756d1d1b3a55272132

Request headers

Referer
https://apps.intuit.com/app/apps/home
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 08 Nov 2018 22:03:36 GMT
content-encoding
gzip
vary
Accept-Encoding
x-amz-request-id
D6CA82D6F74B568E
status
200
x-amz-id-2
QX2JdWU7OUj94wQS8IWQOqeW4wWFuWMXhpRyLCFs4dq3UUOBACY2+y5BKIOtog0yA9sn6g037C0=
last-modified
Tue, 30 Oct 2018 22:10:32 GMT
server
AmazonS3
etag
"b3cc7e73fdc74136ea27c9f5205b20d9"
access-control-max-age
86400
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31556926, immutable
access-control-allow-credentials
false
accept-ranges
bytes
timing-allow-origin
*
qbo-polyfill.min.js
plugin.intuitcdn.net/qbo-polyfill/2.7.5/release/ 		38 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://plugin.intuitcdn.net/qbo-polyfill/2.7.5/release/qbo-polyfill.min.js
Requested by
Host: apps.intuit.com
URL: https://apps.intuit.com/app/apps/home
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.8.12.123 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-8-12-123.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
45a20f4be79b21036be436f12fb5644b1bf784e5ae573d73858bc15705764346

Request headers

Referer
https://apps.intuit.com/app/apps/home
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 08 Nov 2018 22:03:36 GMT
content-encoding
gzip
vary
Accept-Encoding
x-amz-request-id
717D7D4495C4CA8D
status
200
content-length
13358
x-amz-id-2
UaSlXXCdMy1Ej2jf4pLc9yO4DiwQvtsk+9CXRdU1si00QFQlWa/gd5O8XKBMm7u+Mt+Jvcqu/gw=
last-modified
Wed, 23 May 2018 17:28:26 GMT
server
AmazonS3
etag
"f871babb47ec7b22578c4f343d90fc23"
access-control-max-age
86400
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31556926, immutable
access-control-allow-credentials
false
accept-ranges
bytes
timing-allow-origin
*
blank.gif
plugin.intuitcdn.net/sbg-web-shell-ui/10.0.0/dojo/resources/ 		43 B
413 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://plugin.intuitcdn.net/sbg-web-shell-ui/10.0.0/dojo/resources/blank.gif
Requested by
Host: apps.intuit.com
URL: https://apps.intuit.com/app/apps/home
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.8.12.123 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-8-12-123.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer
https://apps.intuit.com/app/apps/home
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 08 Nov 2018 22:03:36 GMT
x-amz-request-id
66FA6D68D652FDBE
status
200
content-length
43
x-amz-id-2
xKIGRgO9P2L50ZcmaZr1V8Zy/B9Xr4XZPVtiK30IaXwJd7NzhOt+w9f+jVVLMd23/0mTbErFdS0=
last-modified
Tue, 30 Oct 2018 22:09:41 GMT
server
AmazonS3
etag
"6d22e4f2d2057c6e8d6fab098e76e80f"
access-control-max-age
86400
access-control-allow-methods
GET
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=31556926, immutable
access-control-allow-credentials
false
accept-ranges
bytes
timing-allow-origin
*
react-dom.production.min.js
plugin.intuitcdn.net/react-dom/16.4.2/umd/ 		94 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://plugin.intuitcdn.net/react-dom/16.4.2/umd/react-dom.production.min.js
Requested by
Host: apps.intuit.com
URL: https://apps.intuit.com/app/apps/home
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.8.12.123 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-8-12-123.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
dcd354ff2a04d11ed5c716a92a2c3f864810cdc48ccedc9c95be51a5e56557b6

Request headers

Referer
https://apps.intuit.com/app/apps/home
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 08 Nov 2018 22:03:36 GMT
content-encoding
gzip
vary
Accept-Encoding
x-amz-request-id
826E88AFB51FAA1B
status
200
content-length
31327
x-amz-id-2
FNrgCafRb2SSE8d6l6pxFZnvrTdVKaNDtBna3SaUXVmEeGYBuH/OP7vQyME7Frr+a+nWYBHJ1z8=
last-modified
Wed, 01 Aug 2018 20:42:04 GMT
server
AmazonS3
etag
"7fee5629ef167c147de453b2c01ae41c"
access-control-max-age
86400
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31556926, immutable
access-control-allow-credentials
false
accept-ranges
bytes
timing-allow-origin
*
react.production.min.js
plugin.intuitcdn.net/react/16.4.2/umd/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://plugin.intuitcdn.net/react/16.4.2/umd/react.production.min.js
Requested by
Host: apps.intuit.com
URL: https://apps.intuit.com/app/apps/home
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.8.12.123 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-8-12-123.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d84431e49d6ec77b2380f2ed0debe5a38e3d5cd5dfbc4a65711616205eae8bcc

Request headers

Referer
https://apps.intuit.com/app/apps/home
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 08 Nov 2018 22:03:36 GMT
content-encoding
gzip
vary
Accept-Encoding
x-amz-request-id
6B7262A77E8526C9
status
200
content-length
3050
x-amz-id-2
4rLBI5ALfm+yikctt7jHgzhrK1EmVGqN8PjjQNV/flRRbqWVXVynp7P++AFcnsrmkvj3Or0cIQQ=
last-modified
Wed, 01 Aug 2018 20:42:02 GMT
server
AmazonS3
etag
"c485b1a84875e690cb252ffbab97809b"
access-control-max-age
86400
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31556926, immutable
access-control-allow-credentials
false
accept-ranges
bytes
timing-allow-origin
*
ua-parser.min.js
plugin.intuitcdn.net/ua-parser-js/0.7.19/dist/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://plugin.intuitcdn.net/ua-parser-js/0.7.19/dist/ua-parser.min.js
Requested by
Host: apps.intuit.com
URL: https://apps.intuit.com/app/apps/home
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.8.12.123 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-8-12-123.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ab3dab7735a2d68a52ba971cdd61cfb1ef69815a08099efd34e79594fa39ad5c

Request headers

Referer
https://apps.intuit.com/app/apps/home
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 08 Nov 2018 22:03:36 GMT
content-encoding
gzip
vary
Accept-Encoding
x-amz-request-id
9B50B86182877197
status
200
content-length
6315
x-amz-id-2
5R2f/OfkqoFJw4gWkcKC7caY0INv6ziDNdBJ1V79oU+Ou9NMPBYq4osvDU51y5LCQJcuccH8iCo=
last-modified
Thu, 25 Oct 2018 19:36:58 GMT
server
AmazonS3
etag
"33fd310b1d1bf0bbe5f270994bc18ee8"
access-control-max-age
86400
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31556926, immutable
access-control-allow-credentials
false
accept-ranges
bytes
timing-allow-origin
*, *, *
cspReport
zion.qbo.intuit.com/api/v1/ 		0
339 B 		Other
General
Check archive.org
Download Go to
Full URL
https://zion.qbo.intuit.com/api/v1/cspReport
Requested by
Host: apps.intuit.com
URL: https://apps.intuit.com/app/apps/home
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.216.208.110 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-34-216-208-110.us-west-2.compute.amazonaws.com
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/api/v1/cspReport
pragma
no-cache
origin
https://apps.intuit.com
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
content-type
application/csp-report
accept
*/*
cache-control
no-cache
:authority
zion.qbo.intuit.com
referer
https://apps.intuit.com/app/apps/home
:scheme
https
content-length
558
:method
POST
Referer
https://apps.intuit.com/app/apps/home
Origin
https://apps.intuit.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/csp-report

Response headers

date
Thu, 08 Nov 2018 22:03:37 GMT
status
200
x-powered-by
Express
access-control-max-age
1728000
access-control-allow-methods
GET, POST, OPTIONS, PUT, DELETE
access-control-allow-origin
https://apps.intuit.com
access-control-allow-credentials
true
access-control-allow-headers
X-Requested-With, accept, csrftoken, origin, Cookie, Content-Type, intuit_tid, intuit_requestid, X-Range, authorization
content-length
0
x-xss-protection
1; mode=block
main.css
assets.intuitcdn.net/ui-components-web-react/10.3.1/ 		86 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://assets.intuitcdn.net/ui-components-web-react/10.3.1/main.css
Requested by
Host: plugin.intuitcdn.net
URL: https://plugin.intuitcdn.net/sbg-web-shell-ui/10.0.0/dojo/dojo.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.8.12.123 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-8-12-123.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
6d611e385777e232d3c0bd87ab5421cac96a7e25639f65142a5b2bcff47c0cee

Request headers

Referer
https://apps.intuit.com/app/apps/home
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 08 Nov 2018 22:03:36 GMT
content-encoding
gzip
vary
Accept-Encoding
x-amz-request-id
BB4B0D122B2D4115
status
200
content-length
8640
x-amz-id-2
nyl/szFSVWCgvzVML5IBvYc7dDhXYwPpz4iYG7J2oBxFfh8JnsaSL1G5dpokccUaoSbiGaOR0hU=
last-modified
Tue, 23 Oct 2018 20:38:57 GMT
server
AmazonS3
etag
"c17ec644bf72edcd0be112aa2d34b6a4"
access-control-max-age
86400
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=15552000
access-control-allow-credentials
false
accept-ranges
bytes
expires
Tue, 07 May 2019 22:03:36 GMT
hui.min.css
plugin.intuitcdn.net/harmony-ui-components/27.2.4/dist/css/ 		497 KB
84 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://plugin.intuitcdn.net/harmony-ui-components/27.2.4/dist/css/hui.min.css
Requested by
Host: plugin.intuitcdn.net
URL: https://plugin.intuitcdn.net/sbg-web-shell-ui/10.0.0/dojo/dojo.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.8.12.123 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-8-12-123.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
8df876e04dcc8e694931ea33d6857862d35f63abd93d21ab69a0706fadd7c308

Request headers

Referer
https://apps.intuit.com/app/apps/home
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 08 Nov 2018 22:03:36 GMT
content-encoding
gzip
vary
Accept-Encoding
x-amz-request-id
056262D460ADB9F6
status
200
x-amz-id-2
FgnPwUSeXli49rJnAAVGOZlh22shQFZjHU31Plri3n36n48bPIbkryjkQe4lDIdXcQapsA6lcnc=
last-modified
Fri, 05 Oct 2018 22:27:34 GMT
server
AmazonS3
etag
"aceafb8d2eb436d3692d72cadc7e633c"
access-control-max-age
86400
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31556926, immutable
access-control-allow-credentials
false
accept-ranges
bytes
timing-allow-origin
*, *
main.css
plugin.intuitcdn.net/sbg-web-shell-ui/10.0.0/shell/harmony/ecosystem-app/ 		225 KB
74 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://plugin.intuitcdn.net/sbg-web-shell-ui/10.0.0/shell/harmony/ecosystem-app/main.css
Requested by
Host: plugin.intuitcdn.net
URL: https://plugin.intuitcdn.net/sbg-web-shell-ui/10.0.0/dojo/dojo.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.8.12.123 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-8-12-123.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
a031a79ed87d9215a64d7673f054c2be739bfaf835cfbad90261b35624c68d5c

Request headers

Referer
https://apps.intuit.com/app/apps/home
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 08 Nov 2018 22:03:36 GMT
content-encoding
gzip
vary
Accept-Encoding
x-amz-request-id
779DF26750223BAE
status
200
x-amz-id-2
3ymjZ8SexrU40xqPs87WQP2xKsL+HijHqv5aPMVGasgd04WiGRd8G2rzsi9jwlZ7ou1+TbJBD3A=
last-modified
Tue, 30 Oct 2018 22:10:37 GMT
server
AmazonS3
etag
"86a6da38e9115489763d925d2f46b37b"
access-control-max-age
86400
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31556926, immutable
access-control-allow-credentials
false
accept-ranges
bytes
timing-allow-origin
*, *, *
harmony-common.css
plugin.intuitcdn.net/sbg-web-shell-ui/10.0.0/shell/harmony/ 		155 KB
29 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://plugin.intuitcdn.net/sbg-web-shell-ui/10.0.0/shell/harmony/harmony-common.css
Requested by
Host: plugin.intuitcdn.net
URL: https://plugin.intuitcdn.net/sbg-web-shell-ui/10.0.0/dojo/dojo.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.8.12.123 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-8-12-123.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
4093cb7f11cc7bc7e68d77b55336f7669bfe22297891365f0ae6194354bead7c

Request headers

Referer
https://apps.intuit.com/app/apps/home
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 08 Nov 2018 22:03:36 GMT
content-encoding
gzip
vary
Accept-Encoding
x-amz-request-id
73F961453F77B686
status
200
content-length
28877
x-amz-id-2
NaxvvC5EJqy4vAUJjBdq/m+LgAtO5WEl2t4dGzvor6WhVoRV3W3aZHX3CcNlrak/AQjg9AzU9Vo=
last-modified
Tue, 30 Oct 2018 22:10:38 GMT
server
AmazonS3
etag
"c44ff84fd224a5c12d85beb8b12c7959"
access-control-max-age
86400
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31556926, immutable
access-control-allow-credentials
false
accept-ranges
bytes
timing-allow-origin
*, *, *
prop-types.min.js
plugin.intuitcdn.net/prop-types/15.6.2/dist/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://plugin.intuitcdn.net/prop-types/15.6.2/dist/prop-types.min.js
Requested by
Host: plugin.intuitcdn.net
URL: https://plugin.intuitcdn.net/sbg-web-shell-ui/10.0.0/dojo/dojo.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.8.12.123 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-8-12-123.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
366983720beb5de29b3b05416e994d1655f8763ef6501c0c4ce07d54ff5da6d5

Request headers

Referer
https://apps.intuit.com/app/apps/home
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 08 Nov 2018 22:03:36 GMT
content-encoding
gzip
vary
Accept-Encoding
x-amz-request-id
BF6E9879129E1590
status
200
content-length
797
x-amz-id-2
3SBz30hjZgaCUJ1lVGa0Pb/MVDyKojMUMUcrBceKNe4XtqgXBbA2b76LvKJr7/ZRLKmpVY0zUMc=
last-modified
Thu, 21 Jun 2018 19:32:14 GMT
server
AmazonS3
etag
"379c8c0eaaafcda0ccce638c1a4d9aed"
access-control-max-age
86400
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31556926, immutable
access-control-allow-credentials
false
accept-ranges
bytes
timing-allow-origin
*, *, *, *, *

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| dojoConfig object| appContext object| neoContext function| define function| require object| dojo object| dijit object| dojox object| qbo object| core object| __core-js_shared__

2 Cookies

Domain/Path Name / Value
apps.intuit.com/ Name: qbo.clientType
Value: web
apps.intuit.com/app/apps Name: hosted-shell
Value: %7B%22clientId%22%3A%22f1c13a21-a59f-4990-8fc1-64ac3c65520b%22%7D

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src https://*.qbo.intuit.com 'self' https://*.intuit.com https://*.intuitcdn.net:*; script-src 'unsafe-eval' 'unsafe-inline' https://js.stripe.com https://www.glancecdn.net/cobrowse/ https://s3.amazonaws.com/glancecdn/cobrowse/js/ https://js-agent.newrelic.com https://cdn.appdynamics.com https://cdn.mxpnl.com https://paybycoin.disqus.com/count.js https://bam.nr-data.net https://cdnssl.clicktale.net https://cdn.walkme.com https://playerserver.walkme.com https://maps.googleapis.com https://*.zopim.com https://d2yyd1h5u9mauk.cloudfront.net https://widget.uservoice.com https://by2.uservoice.com https://assets.uvcdn.com https://siteintercept.qualtrics.com https://www.paypal.com https://s3-us-west-2.amazonaws.com/idg-pi/sitecatalyst/js/idgtrack.js https://prod-app.bdc-cdn.com/js/utility/commonUtils.js https://app.fundbox.com/static/ https://checkout.razorpay.com/v1/razorpay.js 'report-sample' 'self' https://*.intuit.com https://*.intuitcdn.net:* https://display.ugc.bazaarvoice.com/static/Intuitappcenter/ http://display.ugc.bazaarvoice.com/static/Intuitappcenter/ https://display.ugc.bazaarvoice.com/common/ https://apps.nexus.bazaarvoice.com https://analytics-static.ugc.bazaarvoice.com https://api.bazaarvoice.com/data/ http://api.bazaarvoice.com/data/ https://s3.amazonaws.com/bvscout/ https://network.bazaarvoice.com https://www.google.com/recaptcha/ https://www.google-analytics.com/analytics.js https://www.google.com/m8/feeds/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/iframe_api https://www.googleapis.com/youtube/ https://s.ytimg.com/yts/jsbin/ https://lpcdn.lpsnmedia.net https://lptag.liveperson.net https://accdn.lpsnmedia.net/api/account/ https://va.v.liveperson.net/api/js/ https://sales.liveperson.net https://mpsnare.iesnare.com/ https://ssl.kaptcha.com:*; connect-src https://api.segment.io https://bam.nr-data.net https://col.eum-appdynamics.com https://api.mixpanel.com https://cdn.segment.io https://ing-district.clicktale.net https://conductor.clicktale.net https://ec.walkme.com https://www.glancecdn.net https://*.glance.net wss://*.glance.net https://qbo.wagepoint.com https://siteintercept.qualtrics.com https://web.delighted.com wss://ws.pusherapp.com wss://*.zopim.com wss://*.identity-plus.a.intuit.com wss://*.intuit.com https://s3.us-west-2.amazonaws.com/ips-logos-prod/ https://consent.intuit.apps.com 'self' https://*.intuit.com https://*.intuitcdn.net:* wss://plugin-localhost.intuitcdn.net:* wss://plugin.intuitcdn.net:* https://network.bazaarvoice.com https://www.youtube.com https://vimeo.com https://app.apintego.com wss://va.msg.liveperson.net/ws_api/account/ https://*.tsheets.com https://app.intuit.launchdarkly.com https://stream.intuit.launchdarkly.com https://events.intuit.launchdarkly.com https://api.razorpay.com https://lumberjack.razorpay.com https://razorpaygateway.api.intuit.com; style-src 'unsafe-inline' 'unsafe-eval' blob: https://www.glancecdn.net https://s3.amazonaws.com/glancecdn/cobrowse/ https://fonts.googleapis.com/css 'self' https://*.intuitcdn.net:* https://*.intuit.com https://display.ugc.bazaarvoice.com; frame-src https://js.stripe.com intuitnative: https://widget.uservoice.com https://fls.doubleclick.net https://1996823.fls.doubleclick.net https://tableau.intuit.net https://app.fundbox.com https://www1.royalbank.com https://app.bill.com https://www.bill.com https://prod-static.bdc-cdn.com https://app-qbo-vip.cashview.com https://qbo.wagepoint.com https://www.referquickbooks.com https://refer.quickbooks.ca https://www.avataxforqbo.com https://qbo.paysuite.co.uk https://qbo.paybooks.in https://www.citruspay.com https://*.yourpayroll.com.au https://www.paypal.com https://*.s3.amazonaws.com https://*.intuittrainingplatform.com https://intuitsocial.az1.qualtrics.com https://siteintercept.qualtrics.com https://*.intuitstatic.com blob: data: https://quickbooks.intuit.fr https://*.intuitcdn.net https://*.intuit.com https://api.bazaarvoice.com https://display.ugc.bazaarvoice.com https://www.google.com/recaptcha/ https://www.youtube.com https://*.youtube.com https://player.vimeo.com https://app.apintego.com https://lpcdn.lpsnmedia.net https://*.liveperson.net https://*.tsheets.com https://secure.paymentech.com https://ssl.kaptcha.com https://securevar.paymentech.com https://tst.kaptcha.com; img-src https://col.eum-appdynamics.com https://bam.nr-data.net https://intuitctoiuxqa.112.2o7.net https://ec.walkme.com https://www.glancecdn.net https://s3.amazonaws.com/glancecdn/cobrowse/ https://app.bill.com https://www.bill.com https://pixel.everesttech.net https://cdn.jsdelivr.net/emojione/assets/ https://v2.zopim.com https://siteintercept.qualtrics.com https://az1.qualtrics.com data: https://www.paypalobjects.com https://www.pos-depot.com/wp-content/ https://*.s3.amazonaws.com blob: https://app.fundbox.com/img/ https://q.stripe.com https://maps.gstatic.com/mapfiles/ https://maps.googleapis.com/maps/ https://raw.githubusercontent.com/googlemaps/v3-utility-library/master/markerclustererplus/images/ https://images-na.ssl-images-amazon.com 'self' https://*.intuit.com https://*.intuitcdn.net:* https://network.bazaarvoice.com https://display.ugc.bazaarvoice.com https://www.google-analytics.com https://i.ytimg.com https://img.youtube.com https://i.vimeocdn.com https://lpcdn.lpsnmedia.net https://sales.liveperson.net https://*.tsheets.com https://opfcaptcha-prod.s3.amazonaws.com https://secure.paymentech.com https://ssl.kaptcha.com https://securevar.paymentech.com https://tst.kaptcha.com; child-src 'self' blob:; font-src https://*.qbo.intuit.com https://www.glancecdn.net https://s3.amazonaws.com/glancecdn/cobrowse/ https://v2.zopim.com https://www.paypalobjects.com https://prod-static.bdc-cdn.com data: 'self' https://*.intuit.com https://*.intuitcdn.net:*; object-src blob: 'self' https://*.intuitcdn.net https://*.intuit.com https://mpsnare.iesnare.com/stmgwb2.swf; worker-src 'self' blob:; media-src https://lpcdn.lpsnmedia.net/le_unified_window/; report-uri https://zion.qbo.intuit.com/api/v1/cspReport; base-uri 'none';
Strict-Transport-Security max-age=15552000; includeSubDomains max-age=15768000
X-Content-Type-Options nosniff nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block 1; mode=block