cartql-app.acmecorp-stage.f5xc.app Open in urlscan Pro
72.19.3.11  Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response cartql-app.acmecorp-stage.f5xc.app/	18 KB 4 KB	668ms 434ms	Document text/html	72.19.3.11 F5
General Check archive.org Show headers Download Go to Full URL https://cartql-app.acmecorp-stage.f5xc.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 72.19.3.11 , United States, ASN35280 (F5, FR), Reverse DNS Software volt-adc / Express Resource Hash 0b8c7eecbf05da9f94f49bfc678dbe5bf545fa27077d77fff94d1a89bf55cefd Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 accept-language en-US,en;q=0.9 Response headers access-control-allow-origin * alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 7cf7644dbbf442ef-EWR content-encoding br content-type text/html date Tue, 30 May 2023 13:40:57 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9xN0mYeyzbt8Rm1Bv0UPA5tOziGn9cC4FC5J1mKtLFHh%2Fqz5b3dpc%2Bvdp3qwHGLCvgu9Sr7D3bxB6QZnuj1yqW%2B9eJSKA%2Blh0rw8a20W9MSGyUnIt3E0AD%2FhYK4wKsuUPw%3D%3D"}],"group":"cf-nel","max_age":604800} server volt-adc strict-transport-security max-age=31536000 via 1.1 vegur x-envoy-upstream-service-time 424 x-powered-by Express
GET H2	200	css fonts.googleapis.com/	15 KB 1 KB	50ms 22ms	Stylesheet text/css	2607:f8b0:4006:81c::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700|Source+Code+Pro:400,700 Requested by Host: cartql-app.acmecorp-stage.f5xc.app URL: https://cartql-app.acmecorp-stage.f5xc.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:81c::200a Flushing, United States, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash cedcafcc30f536e1bb9b4b9658572ea66f0f2715015a2438547a1b77356cd4ca Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://cartql-app.acmecorp-stage.f5xc.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Tue, 30 May 2023 13:40:57 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Tue, 30 May 2023 13:36:36 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 30 May 2023 13:40:57 GMT
GET H2	200	index.css cdn.jsdelivr.net/npm/@apollographql/graphql-playground-react@1.7.33/build/static/css/	568 B 805 B	31ms 4ms	Stylesheet text/css	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@apollographql/graphql-playground-react@1.7.33/build/static/css/index.css Requested by Host: cartql-app.acmecorp-stage.f5xc.app URL: https://cartql-app.acmecorp-stage.f5xc.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 712f55736381b7d7947f8b329115ae91e1586889cbdbdfa6c819850d26bb17f5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://cartql-app.acmecorp-stage.f5xc.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload date Tue, 30 May 2023 13:40:57 GMT x-content-type-options nosniff content-encoding br age 1836505 x-jsd-version 1.7.33 x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 341 x-served-by cache-fra-eddf8230029-FRA, cache-lga21974-LGA x-jsd-version-type version etag W/"238-kTDaN5yh+1ZUXCkN4elFCxZBDb4" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin *
GET H2	200	middleware.js Show response cdn.jsdelivr.net/npm/@apollographql/graphql-playground-react@1.7.33/build/static/js/	2 MB 578 KB	34ms 7ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@apollographql/graphql-playground-react@1.7.33/build/static/js/middleware.js Requested by Host: cartql-app.acmecorp-stage.f5xc.app URL: https://cartql-app.acmecorp-stage.f5xc.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 45486979ceb77d1a7e26dd199c40659b8e31b2a6c3c71303526711639f13682e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://cartql-app.acmecorp-stage.f5xc.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload date Tue, 30 May 2023 13:40:57 GMT x-content-type-options nosniff content-encoding br age 1229484 x-jsd-version 1.7.33 x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 591134 x-served-by cache-fra-eddf8230087-FRA, cache-lga21974-LGA x-jsd-version-type version etag W/"20eb0a-eZCM+DA2aM/y7NH85O53g3XbMb0" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin *
GET H2	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 fonts.gstatic.com/s/opensans/v35/	47 KB 48 KB	23ms 5ms	Font font/woff2	2607:f8b0:4006:820::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700|Source+Code+Pro:400,700 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://cartql-app.acmecorp-stage.f5xc.app accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Fri, 26 May 2023 17:04:05 GMT x-content-type-options nosniff age 333412 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 48412 x-xss-protection 0 last-modified Tue, 02 May 2023 15:08:53 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 25 May 2024 17:04:05 GMT
GET H2	200	HI_SiYsKILxRpg3hIP6sJ7fM7PqlPevW.woff2 fonts.gstatic.com/s/sourcecodepro/v22/	19 KB 19 KB	6ms 5ms	Font font/woff2	2607:f8b0:4006:820::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcecodepro/v22/HI_SiYsKILxRpg3hIP6sJ7fM7PqlPevW.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700|Source+Code+Pro:400,700 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1c2e64053b56afdcc933af75555920cf89c08b8ca04961f4815abdbd0bdcdbc3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://cartql-app.acmecorp-stage.f5xc.app accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Sat, 27 May 2023 17:05:12 GMT x-content-type-options nosniff age 246945 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 19680 x-xss-protection 0 last-modified Tue, 23 Aug 2022 18:25:36 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sun, 26 May 2024 17:05:12 GMT
POST H2	403	/ Show response cartql-app.acmecorp-stage.f5xc.app/	309 B 407 B	322ms 9ms	Fetch text/html	72.19.3.11 F5
General Check archive.org Show headers Download Go to Full URL https://cartql-app.acmecorp-stage.f5xc.app/ Requested by Host: cdn.jsdelivr.net URL: https://cdn.jsdelivr.net/npm/@apollographql/graphql-playground-react@1.7.33/build/static/js/middleware.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 72.19.3.11 , United States, ASN35280 (F5, FR), Reverse DNS Software volt-adc / Resource Hash 11cd1c688ac396b5ff0893d78e31ae1e3b009ff6f3af6b2c9a01d09c24f16e61 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept */* Referer https://cartql-app.acmecorp-stage.f5xc.app/ Apollo-Query-Plan-Experimental 1 X-Apollo-Tracing 1 accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 content-type application/json Response headers strict-transport-security max-age=31536000 date Tue, 30 May 2023 13:40:58 GMT server volt-adc content-length 309 content-type text/html; charset=UTF-8
POST H2	403	/ Show response cartql-app.acmecorp-stage.f5xc.app/	309 B 361 B	9ms 8ms	Fetch text/html	72.19.3.11 F5
General Check archive.org Show headers Download Go to Full URL https://cartql-app.acmecorp-stage.f5xc.app/ Requested by Host: cdn.jsdelivr.net URL: https://cdn.jsdelivr.net/npm/@apollographql/graphql-playground-react@1.7.33/build/static/js/middleware.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 72.19.3.11 , United States, ASN35280 (F5, FR), Reverse DNS Software volt-adc / Resource Hash 9c2ae54c85f9c50a5f0201c898d895716474b504ffb3fe938abcf30f4970d0f3 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept */* Referer https://cartql-app.acmecorp-stage.f5xc.app/ Apollo-Query-Plan-Experimental 1 X-Apollo-Tracing 1 accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 content-type application/json Response headers strict-transport-security max-age=31536000 date Tue, 30 May 2023 13:41:03 GMT server volt-adc content-length 309 content-type text/html; charset=UTF-8
POST H2	403	/ cartql-app.acmecorp-stage.f5xc.app/	309 B 361 B	7ms 5ms	Fetch text/html	72.19.3.11 F5
General Check archive.org Show headers Download Go to Full URL https://cartql-app.acmecorp-stage.f5xc.app/ Requested by Host: cdn.jsdelivr.net URL: https://cdn.jsdelivr.net/npm/@apollographql/graphql-playground-react@1.7.33/build/static/js/middleware.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 72.19.3.11 , United States, ASN35280 (F5, FR), Reverse DNS Software volt-adc / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept */* Referer https://cartql-app.acmecorp-stage.f5xc.app/ Apollo-Query-Plan-Experimental 1 X-Apollo-Tracing 1 accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 content-type application/json Response headers strict-transport-security max-age=31536000 date Tue, 30 May 2023 13:41:04 GMT server volt-adc content-length 309 content-type text/html; charset=UTF-8

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| _ object| schemaFetcher object| scCGSHMRCache object| s function| session object| GraphQLPlayground object| m object| p string| version object| d object| editor object| g

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://cartql-app.acmecorp-stage.f5xc.app/ Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://cartql-app.acmecorp-stage.f5xc.app/ Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://cartql-app.acmecorp-stage.f5xc.app/ Message: Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cartql-app.acmecorp-stage.f5xc.app
cdn.jsdelivr.net
fonts.googleapis.com
fonts.gstatic.com
2607:f8b0:4006:81c::200a
2607:f8b0:4006:820::2003
2a04:4e42:600::485
72.19.3.11
0b8c7eecbf05da9f94f49bfc678dbe5bf545fa27077d77fff94d1a89bf55cefd
11cd1c688ac396b5ff0893d78e31ae1e3b009ff6f3af6b2c9a01d09c24f16e61
1c2e64053b56afdcc933af75555920cf89c08b8ca04961f4815abdbd0bdcdbc3
45486979ceb77d1a7e26dd199c40659b8e31b2a6c3c71303526711639f13682e
712f55736381b7d7947f8b329115ae91e1586889cbdbdfa6c819850d26bb17f5
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
9c2ae54c85f9c50a5f0201c898d895716474b504ffb3fe938abcf30f4970d0f3
cedcafcc30f536e1bb9b4b9658572ea66f0f2715015a2438547a1b77356cd4ca