b5billing.b5dev.ca Open in urlscan Pro
2600:1f11:e0e:5f01:2a1e:3b24:62f0:dee0 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://b5billing.b5dev.ca/
Submission: On February 11 via automatic, source certstream-suspicious (February 11th 2021, 3:35:05 pm UTC)

Summary HTTP 16 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 16 HTTP transactions. The main IP is 2600:1f11:e0e:5f01:2a1e:3b24:62f0:dee0, located in Montreal, Canada and belongs to AMAZON-02, US. The main domain is b5billing.b5dev.ca.
TLS certificate: Issued by Amazon on September 3rd 2020. Valid for: a year.

This is the only time b5billing.b5dev.ca was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: 1Password (Online)

Domain & IP information

	IP Address	AS Autonomous System
3	2600:1f11:e0e... 2600:1f11:e0e:5f01:2a1e:3b24:62f0:dee0	16509 (AMAZON-02) (AMAZON-02)
9	2600:9000:21c... 2600:9000:21c7:7e00:11:d315:8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2600:1f18:26c... 2600:1f18:26cf:7400:a9:dfa4:48b:4496	14618 (AMAZON-AES) (AMAZON-AES)
2	2a05:d014:26a... 2a05:d014:26a:4801:11b1:a899:d66a:bab6	16509 (AMAZON-02) (AMAZON-02)
16	4

3 2600:1f11:e0e:5f01:2a1e:3b24:62f0:dee0 (Montreal, Canada)

ASN16509 (AMAZON-02, US)

b5billing.b5dev.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
accounts.b5dev.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2600:9000:21c7:7e00:11:d315:8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

app.b5dev.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1f18:26cf:7400:a9:dfa4:48b:4496 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

accounts.b5dev.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:d014:26a:4801:11b1:a899:d66a:bab6 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

accounts.b5dev.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	b5dev.ca b5billing.b5dev.ca app.b5dev.ca accounts.b5dev.ca	1 MB
2	b5dev.eu accounts.b5dev.eu	1 KB
2	b5dev.com accounts.b5dev.com	1 KB
16	3

	Domain	Requested by
9	app.b5dev.ca	b5billing.b5dev.ca
2	accounts.b5dev.ca	app.b5dev.ca
2	accounts.b5dev.eu	app.b5dev.ca
2	accounts.b5dev.com	app.b5dev.ca
1	b5billing.b5dev.ca
16	5

This site contains links to these domains. Also see Links.

Domain
support.1password.com
my.b5dev.ca
start.b5dev.ca
app-updates.agilebits.com
1password.com

Subject Issuer	Validity	Valid
*.b5dev.ca Amazon	`2020-09-03` - `2021-10-03`	a year	crt.sh
app.b5dev.ca Amazon	`2020-06-14` - `2021-07-14`	a year	crt.sh
*.b5dev.com Amazon	`2020-09-03` - `2021-10-05`	a year	crt.sh
*.b5dev.eu Amazon	`2020-09-03` - `2021-10-03`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://b5billing.b5dev.ca/
Frame ID: 5E27C67AE5049D78D050655EB6604DD4
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

16
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

5
Subdomains

4
IPs

3
Countries

1095 kB
Transfer

4920 kB
Size

0
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://support.1password.com/secret-key
Title: Find your Secret Key

Search URL Search Domain Scan URL

URL: https://my.b5dev.ca/signin?a=new
Title: Sign in to another account

Search URL Search Domain Scan URL

URL: https://start.b5dev.ca/sign-up/plan
Title: Create a new account

Search URL Search Domain Scan URL

URL: https://app-updates.agilebits.com/product_history/B5
Title: Version 965.281.gc03f168

Search URL Search Domain Scan URL

URL: https://1password.com/
Title: 1Password

Search URL Search Domain Scan URL

URL: https://support.1password.com/1password-com-trouble/
Title: Learn how to resolve the issue.

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
b5billing.b5dev.ca/ 6 KB
3 KB 283ms
93ms Document
text/html 2600:1f11:e0e:5f01:2a1e:3b24:62f0:dee0
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://b5billing.b5dev.ca/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f11:e0e:5f01:2a1e:3b24:62f0:dee0 Montreal, Canada, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

92fa78f442d02b80fda7252b8f9582d6c8315a41edfbbb6fb2dd8ccc12e2c0e8

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; form-action 'none'; report-uri https://my.b5dev.ca/csp_violation; script-src https://app.b5dev.ca 'sha256-mi9+p4beQcu6E0oooTjb9KQmCt4uIRSLYnxxNnUTggc='; style-src https://app.b5dev.ca 'sha256-bNMmNittYu69PLivLpkG5sNBPZLv8TnaGoi17prMiAI='; img-src data: blob: https://c.1password.com https://app.b5dev.ca https://a.b5dev.ca/ https://a.b5dev.com https://a.b5dev.eu https://avatars.slack-edge.com; child-src 'self' https://.duosecurity.com https://.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; frame-src 'self' https://.duosecurity.com https://.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; connect-src 'self' https://watchtower.1password.com https://api.pwnedpasswords.com https://app.b5dev.ca wss://b5n.b5dev.ca https://f.b5dev.ca/ .b5dev.ca https://.b5dev.com https://*.b5dev.eu https://a.b5dev.ca/ https://contact.1passwordservices.dev https://flow.1passwordservices.dev
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: b5billing.b5dev.ca
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 11 Feb 2021 15:34:47 GMT
content-type: text/html; charset=utf-8
cache-control: max-age=60, no-cache, no-store
content-encoding: gzip
content-security-policy: default-src 'none'; form-action 'none'; report-uri https://my.b5dev.ca/csp_violation; script-src https://app.b5dev.ca 'sha256-mi9+p4beQcu6E0oooTjb9KQmCt4uIRSLYnxxNnUTggc='; style-src https://app.b5dev.ca 'sha256-bNMmNittYu69PLivLpkG5sNBPZLv8TnaGoi17prMiAI='; img-src data: blob: https://c.1password.com https://app.b5dev.ca https://a.b5dev.ca/ https://a.b5dev.com https://a.b5dev.eu https://avatars.slack-edge.com; child-src 'self' https://*.duosecurity.com https://*.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; frame-src 'self' https://*.duosecurity.com https://*.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; connect-src 'self' https://watchtower.1password.com https://api.pwnedpasswords.com https://app.b5dev.ca wss://b5n.b5dev.ca https://f.b5dev.ca/ *.b5dev.ca https://*.b5dev.com https://*.b5dev.eu https://a.b5dev.ca/ https://contact.1passwordservices.dev https://flow.1passwordservices.dev
expect-ct: max-age=0, report-uri="https://my.b5dev.ca/expect_ct_violation"
referrer-policy: no-referrer
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block

GET
H2 200 dJtQfiy1NCcw6Hjh_iqj-Au6Yuw.css
app.b5dev.ca/css/ 823 KB
120 KB 821ms
775ms Stylesheet
text/css 2600:9000:21c7:7e00:11:d315:8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://app.b5dev.ca/css/dJtQfiy1NCcw6Hjh_iqj-Au6Yuw.css

Requested by

Host: b5billing.b5dev.ca
URL: https://b5billing.b5dev.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21c7:7e00:11:d315:8c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

89c980ab7544d5b3f941b044713ef3849384859dfc564f2f4d3606394f6602ad

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 11 Feb 2021 15:34:48 GMT
content-encoding: gzip
last-modified: Sat, 30 Jan 2021 17:33:47 GMT
server: AmazonS3
x-amz-cf-pop: AMS54-C1
etag: W/"58a1a2ea4a06cbe232914af5ab361b78"
vary: Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method,Origin
x-cache: Miss from cloudfront
x-amz-version-id: aLrOPzGWvuV3FXVNwTPsA6R_KbmesAWQ
via: 1.1 4b3bed207ec72204ebc89ae818e573ef.cloudfront.net (CloudFront)
cache-control: max-age=31536000, public
content-security-policy: default-src 'none';
content-type: text/css
x-amz-cf-id: FHZhpkK8dej8LUQle9Plkf5Tvlrs1e6QOluBTbt-i4LAShoo9ve4lQ==
expires: Thu, 30 Jan 2031 17:33:45 GMT

GET
H2 200 manifest-cc17ab2c35d9220d149d.min.js Show response
app.b5dev.ca/js/ 5 KB
3 KB 803ms
759ms Script
application/javascript 2600:9000:21c7:7e00:11:d315:8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://app.b5dev.ca/js/manifest-cc17ab2c35d9220d149d.min.js

Requested by

Host: b5billing.b5dev.ca
URL: https://b5billing.b5dev.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21c7:7e00:11:d315:8c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

d7c35f642dc65238f9ec2146bbc074f973fd3626565edea6df6de637220fe70d

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';

Request headers

Origin: https://b5billing.b5dev.ca
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 11 Feb 2021 15:34:48 GMT
content-encoding: gzip
vary: Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method,Origin
x-amz-cf-pop: AMS54-C1
x-cache: Miss from cloudfront
access-control-allow-origin: *
last-modified: Sat, 30 Jan 2021 17:33:49 GMT
server: AmazonS3
etag: W/"e7ae52e69305790a3b1092f9d534cbd2"
access-control-max-age: 3600
access-control-allow-methods: GET, HEAD
x-amz-version-id: o9OuF3LzrlQ5hfh3mt_0LILAkspKY5X9
via: 1.1 3af85c3075e12aff72b9e148b99d6623.cloudfront.net (CloudFront)
access-control-expose-headers: Date
cache-control: max-age=31536000, public
content-security-policy: default-src 'none';
content-type: application/javascript
x-amz-cf-id: 7quUWJVeFkBYPIGxLP-l_mrYiqnPOi4B3lutOGpiWO-02xJ4EPIsEQ==
expires: Thu, 30 Jan 2031 17:33:45 GMT

GET
H2 200 vendor-d77267b86b588d9d4ad1.min.js Show response
app.b5dev.ca/js/ 979 KB
313 KB 796ms
752ms Script
application/javascript 2600:9000:21c7:7e00:11:d315:8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://app.b5dev.ca/js/vendor-d77267b86b588d9d4ad1.min.js

Requested by

Host: b5billing.b5dev.ca
URL: https://b5billing.b5dev.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21c7:7e00:11:d315:8c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

70f0ce9e45f51802e1125ea95e5fcd6982a492f79a9345717a6a7586900d40bc

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';

Request headers

Origin: https://b5billing.b5dev.ca
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 11 Feb 2021 15:34:48 GMT
content-encoding: gzip
vary: Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method,Origin
x-amz-cf-pop: AMS54-C1
x-cache: Miss from cloudfront
access-control-allow-origin: *
last-modified: Sat, 30 Jan 2021 17:33:49 GMT
server: AmazonS3
etag: W/"e75e73e103ad9a23c50440d466ec3204"
access-control-max-age: 3600
access-control-allow-methods: GET, HEAD
x-amz-version-id: b1j6e9BggyhB5lH6RO06YpS9kFPx5FW2
via: 1.1 3af85c3075e12aff72b9e148b99d6623.cloudfront.net (CloudFront)
access-control-expose-headers: Date
cache-control: max-age=31536000, public
content-security-policy: default-src 'none';
content-type: application/javascript
x-amz-cf-id: F4bu3gCx_0KtOjbKbPfL9FM9363sqNbulul0iaYHo9bzIheXLpzVNQ==
expires: Thu, 30 Jan 2031 17:33:45 GMT

GET
H2 200 b5-b633b136f90d3227ad06.min.js Show response
app.b5dev.ca/js/ 725 KB
132 KB 786ms
742ms Script
application/javascript 2600:9000:21c7:7e00:11:d315:8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://app.b5dev.ca/js/b5-b633b136f90d3227ad06.min.js

Requested by

Host: b5billing.b5dev.ca
URL: https://b5billing.b5dev.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21c7:7e00:11:d315:8c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

96b2d4a41db15ce575aeff4e190618deab3006c084bddee3bd9e4974d700eb17

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';

Request headers

Origin: https://b5billing.b5dev.ca
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 11 Feb 2021 15:34:48 GMT
content-encoding: gzip
vary: Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method,Origin
x-amz-cf-pop: AMS54-C1
x-cache: Miss from cloudfront
access-control-allow-origin: *
last-modified: Sat, 30 Jan 2021 17:33:48 GMT
server: AmazonS3
etag: W/"7817765c90e5d1555ccdc424ce840a2e"
access-control-max-age: 3600
access-control-allow-methods: GET, HEAD
x-amz-version-id: MWhC5fLF1QsceTxvbVlOAk0cVbguB2Ox
via: 1.1 3af85c3075e12aff72b9e148b99d6623.cloudfront.net (CloudFront)
access-control-expose-headers: Date
cache-control: max-age=31536000, public
content-security-policy: default-src 'none';
content-type: application/javascript
x-amz-cf-id: aWUcPB8sUjt3v_2bXJAkz_hHKUWpikd3s3cqFvru1UNrEBCusbrO3Q==
expires: Thu, 30 Jan 2031 17:33:45 GMT

GET
H2 200 app-a5bcc1a4def21349bbf5.min.js Show response
app.b5dev.ca/js/ 2 MB
512 KB 801ms
757ms Script
application/javascript 2600:9000:21c7:7e00:11:d315:8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://app.b5dev.ca/js/app-a5bcc1a4def21349bbf5.min.js

Requested by

Host: b5billing.b5dev.ca
URL: https://b5billing.b5dev.ca/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21c7:7e00:11:d315:8c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

8344c8ac51360f307a0cca6e3634f1b56f33bd989ba7afe4ea5df825d205b52e

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';

Request headers

Origin: https://b5billing.b5dev.ca
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 11 Feb 2021 15:34:48 GMT
content-encoding: gzip
vary: Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method,Origin
x-amz-cf-pop: AMS54-C1
x-cache: Miss from cloudfront
access-control-allow-origin: *
last-modified: Fri, 29 Jan 2021 23:09:15 GMT
server: AmazonS3
etag: W/"e0949f70ffc501df6cfb17a778fe06ef"
access-control-max-age: 3600
access-control-allow-methods: GET, HEAD
x-amz-version-id: kHOkhlJChEXfDzm7o04Ms9oQeNG2clvl
via: 1.1 3af85c3075e12aff72b9e148b99d6623.cloudfront.net (CloudFront)
access-control-expose-headers: Date
cache-control: max-age=31536000, public
content-security-policy: default-src 'none';
content-type: application/javascript
x-amz-cf-id: 5l7dhE4H7bE7xgepyCrP1b4j1iKclyXm9OHfyGjGghHktQUnqDt7Uw==
expires: Wed, 29 Jan 2031 23:09:12 GMT

OPTIONS
H2 204 accountcookies
accounts.b5dev.com/api/v1/ 0
0 305ms
97ms Other 2600:1f18:26cf:7400:a9:dfa4:48b:4496
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.b5dev.com/api/v1/accountcookies

Protocol

Server

2600:1f18:26cf:7400:a9:dfa4:48b:4496 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; form-action 'none'; report-uri https://agilebitsdev.report-uri.com/r/d/csp/enforce; script-src https://app.b5dev.com 'sha256-mi9+p4beQcu6E0oooTjb9KQmCt4uIRSLYnxxNnUTggc='; style-src https://app.b5dev.com 'sha256-bNMmNittYu69PLivLpkG5sNBPZLv8TnaGoi17prMiAI='; img-src data: blob: https://c.1password.com https://app.b5dev.com https://a.b5dev.com/ https://a.b5dev.ca https://a.b5dev.eu https://avatars.slack-edge.com; child-src 'self' https://.duosecurity.com https://.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; frame-src 'self' https://.duosecurity.com https://.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; connect-src 'self' https://watchtower.1password.com https://api.pwnedpasswords.com https://app.b5dev.com wss://b5n.b5dev.com https://f.b5dev.com/ .b5dev.com https://.b5dev.ca https://*.b5dev.eu https://a.b5dev.com/ https://contact.1passwordservices.dev https://flow.1passwordservices.dev
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: cache-control
Origin: https://b5billing.b5dev.ca
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Thu, 11 Feb 2021 15:34:48 GMT
access-control-allow-credentials: true
access-control-allow-headers: X-AgileBits-Client, X-AgileBits-MAC, Cache-Control, X-AgileBits-Session-ID, Content-Type
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE
access-control-allow-origin: https://b5billing.b5dev.ca
cache-control: max-age=60, no-cache, no-store
content-encoding: gzip
content-security-policy: default-src 'none'; form-action 'none'; report-uri https://agilebitsdev.report-uri.com/r/d/csp/enforce; script-src https://app.b5dev.com 'sha256-mi9+p4beQcu6E0oooTjb9KQmCt4uIRSLYnxxNnUTggc='; style-src https://app.b5dev.com 'sha256-bNMmNittYu69PLivLpkG5sNBPZLv8TnaGoi17prMiAI='; img-src data: blob: https://c.1password.com https://app.b5dev.com https://a.b5dev.com/ https://a.b5dev.ca https://a.b5dev.eu https://avatars.slack-edge.com; child-src 'self' https://*.duosecurity.com https://*.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; frame-src 'self' https://*.duosecurity.com https://*.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; connect-src 'self' https://watchtower.1password.com https://api.pwnedpasswords.com https://app.b5dev.com wss://b5n.b5dev.com https://f.b5dev.com/ *.b5dev.com https://*.b5dev.ca https://*.b5dev.eu https://a.b5dev.com/ https://contact.1passwordservices.dev https://flow.1passwordservices.dev
expect-ct: max-age=86400, enforce, report-uri=\"https://agilebitsdev.report-uri.com/r/d/ct/enforce\"
referrer-policy: no-referrer
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block

GET
H2 200 accountcookies Show response
accounts.b5dev.com/api/v1/ 2 B
1 KB 276ms
100ms XHR
application/json 2600:1f18:26cf:7400:a9:dfa4:48b:4496
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.b5dev.com/api/v1/accountcookies

Requested by

Host: app.b5dev.ca
URL: https://app.b5dev.ca/js/vendor-d77267b86b588d9d4ad1.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:26cf:7400:a9:dfa4:48b:4496 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; form-action 'none'; report-uri https://agilebitsdev.report-uri.com/r/d/csp/enforce; script-src https://app.b5dev.com 'sha256-mi9+p4beQcu6E0oooTjb9KQmCt4uIRSLYnxxNnUTggc='; style-src https://app.b5dev.com 'sha256-bNMmNittYu69PLivLpkG5sNBPZLv8TnaGoi17prMiAI='; img-src data: blob: https://c.1password.com https://app.b5dev.com https://a.b5dev.com/ https://a.b5dev.ca https://a.b5dev.eu https://avatars.slack-edge.com; child-src 'self' https://.duosecurity.com https://.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; frame-src 'self' https://.duosecurity.com https://.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; connect-src 'self' https://watchtower.1password.com https://api.pwnedpasswords.com https://app.b5dev.com wss://b5n.b5dev.com https://f.b5dev.com/ .b5dev.com https://.b5dev.ca https://*.b5dev.eu https://a.b5dev.com/ https://contact.1passwordservices.dev https://flow.1passwordservices.dev
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json; q=1.0, text/*; q=0.8, */*; q=0.1
Cache-Control: no-cache
Referer
Accept-Language: en
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 11 Feb 2021 15:34:49 GMT
content-encoding: gzip
referrer-policy: no-referrer
expect-ct: max-age=86400, enforce, report-uri=\"https://agilebitsdev.report-uri.com/r/d/ct/enforce\"
x-frame-options: DENY
content-type: application/json
access-control-allow-origin: https://b5billing.b5dev.ca
cache-control: max-age=60, no-cache, no-store
access-control-allow-credentials: true
x-content-type-options: nosniff
content-security-policy: default-src 'none'; form-action 'none'; report-uri https://agilebitsdev.report-uri.com/r/d/csp/enforce; script-src https://app.b5dev.com 'sha256-mi9+p4beQcu6E0oooTjb9KQmCt4uIRSLYnxxNnUTggc='; style-src https://app.b5dev.com 'sha256-bNMmNittYu69PLivLpkG5sNBPZLv8TnaGoi17prMiAI='; img-src data: blob: https://c.1password.com https://app.b5dev.com https://a.b5dev.com/ https://a.b5dev.ca https://a.b5dev.eu https://avatars.slack-edge.com; child-src 'self' https://*.duosecurity.com https://*.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; frame-src 'self' https://*.duosecurity.com https://*.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; connect-src 'self' https://watchtower.1password.com https://api.pwnedpasswords.com https://app.b5dev.com wss://b5n.b5dev.com https://f.b5dev.com/ *.b5dev.com https://*.b5dev.ca https://*.b5dev.eu https://a.b5dev.com/ https://contact.1passwordservices.dev https://flow.1passwordservices.dev
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 26
x-xss-protection: 1; mode=block

GET
H2 200 accountcookies Show response
accounts.b5dev.eu/api/v1/ 2 B
1 KB 25ms
12ms XHR
application/json 2a05:d014:26a:4801:11b1:a899:d66a:bab6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.b5dev.eu/api/v1/accountcookies

Requested by

Host: app.b5dev.ca
URL: https://app.b5dev.ca/js/vendor-d77267b86b588d9d4ad1.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d014:26a:4801:11b1:a899:d66a:bab6 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; form-action 'none'; report-uri https://my.b5dev.eu/csp_violation; script-src https://app.b5dev.eu 'sha256-mi9+p4beQcu6E0oooTjb9KQmCt4uIRSLYnxxNnUTggc='; style-src https://app.b5dev.eu 'sha256-bNMmNittYu69PLivLpkG5sNBPZLv8TnaGoi17prMiAI='; img-src data: blob: https://c.1password.com https://app.b5dev.eu https://a.b5dev.eu/ https://a.b5dev.ca https://a.b5dev.com https://avatars.slack-edge.com; child-src 'self' https://.duosecurity.com https://.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; frame-src 'self' https://.duosecurity.com https://.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; connect-src 'self' https://watchtower.1password.com https://api.pwnedpasswords.com https://app.b5dev.eu wss://b5n.b5dev.eu https://f.b5dev.eu/ .b5dev.eu https://.b5dev.ca https://*.b5dev.com https://a.b5dev.eu/ https://contact.1passwordservices.dev https://flow.1passwordservices.dev
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json; q=1.0, text/*; q=0.8, */*; q=0.1
Cache-Control: no-cache
Referer
Accept-Language: en
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 11 Feb 2021 15:34:48 GMT
content-encoding: gzip
referrer-policy: no-referrer
expect-ct: max-age=0, report-uri="https://my.b5dev.eu/expect_ct_violation"
x-frame-options: DENY
content-type: application/json
access-control-allow-origin: https://b5billing.b5dev.ca
cache-control: max-age=60, no-cache, no-store
access-control-allow-credentials: true
x-content-type-options: nosniff
content-security-policy: default-src 'none'; form-action 'none'; report-uri https://my.b5dev.eu/csp_violation; script-src https://app.b5dev.eu 'sha256-mi9+p4beQcu6E0oooTjb9KQmCt4uIRSLYnxxNnUTggc='; style-src https://app.b5dev.eu 'sha256-bNMmNittYu69PLivLpkG5sNBPZLv8TnaGoi17prMiAI='; img-src data: blob: https://c.1password.com https://app.b5dev.eu https://a.b5dev.eu/ https://a.b5dev.ca https://a.b5dev.com https://avatars.slack-edge.com; child-src 'self' https://*.duosecurity.com https://*.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; frame-src 'self' https://*.duosecurity.com https://*.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; connect-src 'self' https://watchtower.1password.com https://api.pwnedpasswords.com https://app.b5dev.eu wss://b5n.b5dev.eu https://f.b5dev.eu/ *.b5dev.eu https://*.b5dev.ca https://*.b5dev.com https://a.b5dev.eu/ https://contact.1passwordservices.dev https://flow.1passwordservices.dev
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 26
x-xss-protection: 1; mode=block

OPTIONS
H2 204 accountcookies
accounts.b5dev.eu/api/v1/ 0
0 65ms
14ms Other 2a05:d014:26a:4801:11b1:a899:d66a:bab6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.b5dev.eu/api/v1/accountcookies

Protocol

Server

2a05:d014:26a:4801:11b1:a899:d66a:bab6 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; form-action 'none'; report-uri https://my.b5dev.eu/csp_violation; script-src https://app.b5dev.eu 'sha256-mi9+p4beQcu6E0oooTjb9KQmCt4uIRSLYnxxNnUTggc='; style-src https://app.b5dev.eu 'sha256-bNMmNittYu69PLivLpkG5sNBPZLv8TnaGoi17prMiAI='; img-src data: blob: https://c.1password.com https://app.b5dev.eu https://a.b5dev.eu/ https://a.b5dev.ca https://a.b5dev.com https://avatars.slack-edge.com; child-src 'self' https://.duosecurity.com https://.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; frame-src 'self' https://.duosecurity.com https://.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; connect-src 'self' https://watchtower.1password.com https://api.pwnedpasswords.com https://app.b5dev.eu wss://b5n.b5dev.eu https://f.b5dev.eu/ .b5dev.eu https://.b5dev.ca https://*.b5dev.com https://a.b5dev.eu/ https://contact.1passwordservices.dev https://flow.1passwordservices.dev
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: cache-control
Origin: https://b5billing.b5dev.ca
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Thu, 11 Feb 2021 15:34:48 GMT
access-control-allow-credentials: true
access-control-allow-headers: X-AgileBits-Client, X-AgileBits-MAC, Cache-Control, X-AgileBits-Session-ID, Content-Type
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE
access-control-allow-origin: https://b5billing.b5dev.ca
cache-control: max-age=60, no-cache, no-store
content-encoding: gzip
content-security-policy: default-src 'none'; form-action 'none'; report-uri https://my.b5dev.eu/csp_violation; script-src https://app.b5dev.eu 'sha256-mi9+p4beQcu6E0oooTjb9KQmCt4uIRSLYnxxNnUTggc='; style-src https://app.b5dev.eu 'sha256-bNMmNittYu69PLivLpkG5sNBPZLv8TnaGoi17prMiAI='; img-src data: blob: https://c.1password.com https://app.b5dev.eu https://a.b5dev.eu/ https://a.b5dev.ca https://a.b5dev.com https://avatars.slack-edge.com; child-src 'self' https://*.duosecurity.com https://*.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; frame-src 'self' https://*.duosecurity.com https://*.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; connect-src 'self' https://watchtower.1password.com https://api.pwnedpasswords.com https://app.b5dev.eu wss://b5n.b5dev.eu https://f.b5dev.eu/ *.b5dev.eu https://*.b5dev.ca https://*.b5dev.com https://a.b5dev.eu/ https://contact.1passwordservices.dev https://flow.1passwordservices.dev
expect-ct: max-age=0, report-uri="https://my.b5dev.eu/expect_ct_violation"
referrer-policy: no-referrer
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block

OPTIONS
H2 204 accountcookies
accounts.b5dev.ca/api/v1/ 0
0 286ms
93ms Other 2600:1f11:e0e:5f01:2a1e:3b24:62f0:dee0
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.b5dev.ca/api/v1/accountcookies

Protocol

Server

2600:1f11:e0e:5f01:2a1e:3b24:62f0:dee0 Montreal, Canada, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; form-action 'none'; report-uri https://my.b5dev.ca/csp_violation; script-src https://app.b5dev.ca 'sha256-mi9+p4beQcu6E0oooTjb9KQmCt4uIRSLYnxxNnUTggc='; style-src https://app.b5dev.ca 'sha256-bNMmNittYu69PLivLpkG5sNBPZLv8TnaGoi17prMiAI='; img-src data: blob: https://c.1password.com https://app.b5dev.ca https://a.b5dev.ca/ https://a.b5dev.com https://a.b5dev.eu https://avatars.slack-edge.com; child-src 'self' https://.duosecurity.com https://.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; frame-src 'self' https://.duosecurity.com https://.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; connect-src 'self' https://watchtower.1password.com https://api.pwnedpasswords.com https://app.b5dev.ca wss://b5n.b5dev.ca https://f.b5dev.ca/ .b5dev.ca https://.b5dev.com https://*.b5dev.eu https://a.b5dev.ca/ https://contact.1passwordservices.dev https://flow.1passwordservices.dev
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: cache-control
Origin: https://b5billing.b5dev.ca
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Thu, 11 Feb 2021 15:34:48 GMT
access-control-allow-credentials: true
access-control-allow-headers: X-AgileBits-Client, X-AgileBits-MAC, Cache-Control, X-AgileBits-Session-ID, Content-Type
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE
access-control-allow-origin: https://b5billing.b5dev.ca
cache-control: max-age=60, no-cache, no-store
content-encoding: gzip
content-security-policy: default-src 'none'; form-action 'none'; report-uri https://my.b5dev.ca/csp_violation; script-src https://app.b5dev.ca 'sha256-mi9+p4beQcu6E0oooTjb9KQmCt4uIRSLYnxxNnUTggc='; style-src https://app.b5dev.ca 'sha256-bNMmNittYu69PLivLpkG5sNBPZLv8TnaGoi17prMiAI='; img-src data: blob: https://c.1password.com https://app.b5dev.ca https://a.b5dev.ca/ https://a.b5dev.com https://a.b5dev.eu https://avatars.slack-edge.com; child-src 'self' https://*.duosecurity.com https://*.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; frame-src 'self' https://*.duosecurity.com https://*.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; connect-src 'self' https://watchtower.1password.com https://api.pwnedpasswords.com https://app.b5dev.ca wss://b5n.b5dev.ca https://f.b5dev.ca/ *.b5dev.ca https://*.b5dev.com https://*.b5dev.eu https://a.b5dev.ca/ https://contact.1passwordservices.dev https://flow.1passwordservices.dev
expect-ct: max-age=0, report-uri="https://my.b5dev.ca/expect_ct_violation"
referrer-policy: no-referrer
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block

GET
H2 200 accountcookies Show response
accounts.b5dev.ca/api/v1/ 2 B
1 KB 92ms
92ms XHR
application/json 2600:1f11:e0e:5f01:2a1e:3b24:62f0:dee0
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.b5dev.ca/api/v1/accountcookies

Requested by

Host: app.b5dev.ca
URL: https://app.b5dev.ca/js/vendor-d77267b86b588d9d4ad1.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f11:e0e:5f01:2a1e:3b24:62f0:dee0 Montreal, Canada, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; form-action 'none'; report-uri https://my.b5dev.ca/csp_violation; script-src https://app.b5dev.ca 'sha256-mi9+p4beQcu6E0oooTjb9KQmCt4uIRSLYnxxNnUTggc='; style-src https://app.b5dev.ca 'sha256-bNMmNittYu69PLivLpkG5sNBPZLv8TnaGoi17prMiAI='; img-src data: blob: https://c.1password.com https://app.b5dev.ca https://a.b5dev.ca/ https://a.b5dev.com https://a.b5dev.eu https://avatars.slack-edge.com; child-src 'self' https://.duosecurity.com https://.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; frame-src 'self' https://.duosecurity.com https://.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; connect-src 'self' https://watchtower.1password.com https://api.pwnedpasswords.com https://app.b5dev.ca wss://b5n.b5dev.ca https://f.b5dev.ca/ .b5dev.ca https://.b5dev.com https://*.b5dev.eu https://a.b5dev.ca/ https://contact.1passwordservices.dev https://flow.1passwordservices.dev
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json; q=1.0, text/*; q=0.8, */*; q=0.1
Cache-Control: no-cache
Referer
Accept-Language: en
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 11 Feb 2021 15:34:48 GMT
content-encoding: gzip
referrer-policy: no-referrer
expect-ct: max-age=0, report-uri="https://my.b5dev.ca/expect_ct_violation"
x-frame-options: DENY
content-type: application/json
access-control-allow-origin: https://b5billing.b5dev.ca
cache-control: max-age=60, no-cache, no-store
access-control-allow-credentials: true
x-content-type-options: nosniff
content-security-policy: default-src 'none'; form-action 'none'; report-uri https://my.b5dev.ca/csp_violation; script-src https://app.b5dev.ca 'sha256-mi9+p4beQcu6E0oooTjb9KQmCt4uIRSLYnxxNnUTggc='; style-src https://app.b5dev.ca 'sha256-bNMmNittYu69PLivLpkG5sNBPZLv8TnaGoi17prMiAI='; img-src data: blob: https://c.1password.com https://app.b5dev.ca https://a.b5dev.ca/ https://a.b5dev.com https://a.b5dev.eu https://avatars.slack-edge.com; child-src 'self' https://*.duosecurity.com https://*.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; frame-src 'self' https://*.duosecurity.com https://*.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; connect-src 'self' https://watchtower.1password.com https://api.pwnedpasswords.com https://app.b5dev.ca wss://b5n.b5dev.ca https://f.b5dev.ca/ *.b5dev.ca https://*.b5dev.com https://*.b5dev.eu https://a.b5dev.ca/ https://contact.1passwordservices.dev https://flow.1passwordservices.dev
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 26
x-xss-protection: 1; mode=block

GET
H2 200 1password-lock-ring-gradient-74d7b183ee12f50c65c2ecd66b73a768.svg
app.b5dev.ca/images/ 333 B
844 B 455ms
454ms Image
image/svg+xml 2600:9000:21c7:7e00:11:d315:8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://app.b5dev.ca/images/1password-lock-ring-gradient-74d7b183ee12f50c65c2ecd66b73a768.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21c7:7e00:11:d315:8c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

204ae24d0b9c95793fd4a50dcd57431232686f301d2a3fe3cd90dc85fc7228f6

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 11 Feb 2021 15:34:49 GMT
via: 1.1 4b3bed207ec72204ebc89ae818e573ef.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
x-cache: Miss from cloudfront
content-length: 333
last-modified: Mon, 01 Feb 2021 20:31:58 GMT
server: AmazonS3
etag: "74d7b183ee12f50c65c2ecd66b73a768"
vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
x-amz-version-id: OqRTHPCZ.8DxBvN4qepwJ9FjsOH4V88A
cache-control: max-age=31536000, public
content-security-policy: default-src 'none';
accept-ranges: bytes
content-type: image/svg+xml
x-amz-cf-id: fBzenyuKTzDVColMFszvBQawxj4b7v4qeFb7DcsC-ZFmS4Ju308o2g==
expires: Sat, 01 Feb 2031 20:31:50 GMT

GET
H2 200 1password-faceplate-02d32dfc81244b1cbf7a92af26e84878.svg
app.b5dev.ca/images/ 5 KB
2 KB 477ms
476ms Image
image/svg+xml 2600:9000:21c7:7e00:11:d315:8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://app.b5dev.ca/images/1password-faceplate-02d32dfc81244b1cbf7a92af26e84878.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21c7:7e00:11:d315:8c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

a7527e1b5dc4e8da48186a4c49bdc8f0562fd2a58ad5fce6ddab316aa4d75eb2

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 11 Feb 2021 15:34:49 GMT
content-encoding: gzip
last-modified: Mon, 01 Feb 2021 20:31:58 GMT
server: AmazonS3
x-amz-cf-pop: AMS54-C1
etag: W/"02d32dfc81244b1cbf7a92af26e84878"
vary: Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method,Origin
x-cache: Miss from cloudfront
x-amz-version-id: NmkW44d4PV8FxuIr4LgO9Rq6lroIbnl_
via: 1.1 4b3bed207ec72204ebc89ae818e573ef.cloudfront.net (CloudFront)
cache-control: max-age=31536000, public
content-security-policy: default-src 'none';
content-type: image/svg+xml
x-amz-cf-id: GVEltLDf1KhLQtDZ2b5B9vvFWyZzbUpYU4rZov49yIfzzZ-8JdA-Bw==
expires: Sat, 01 Feb 2031 20:31:50 GMT

GET
H2 200 1password-keyhole.png
app.b5dev.ca/images/ 3 KB
3 KB 455ms
455ms Image
image/png 2600:9000:21c7:7e00:11:d315:8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://app.b5dev.ca/images/1password-keyhole.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21c7:7e00:11:d315:8c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

59c9e16c52a50c59a22b8a3aef3a98ff5744ef6e60576ec307e788fb5905596e

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 11 Feb 2021 15:34:49 GMT
via: 1.1 4b3bed207ec72204ebc89ae818e573ef.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS54-C1
x-cache: Miss from cloudfront
content-length: 2882
last-modified: Mon, 01 Feb 2021 20:31:58 GMT
server: AmazonS3
etag: "da2531c7aaf5cbf56bc6fb576820db5e"
vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
x-amz-version-id: PIqfI6.gsfXzfTTqZjM8jBk7unvqL8CY
cache-control: max-age=31536000, public
content-security-policy: default-src 'none';
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: YKgmECY_UeGVi0QrdOCllUg4-vvwn5aKUYfH-wyi9ChrjJpZNJSmjg==
expires: Sat, 01 Feb 2031 20:31:50 GMT

GET
H2 200 spinner-black.svg
app.b5dev.ca/images/ 2 KB
1 KB 465ms
465ms Image
image/svg+xml 2600:9000:21c7:7e00:11:d315:8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://app.b5dev.ca/images/spinner-black.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21c7:7e00:11:d315:8c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

2d6dedba87f0cc5900b49d4c186f59aea8d954ba2d42f1e1c3a55c0ae4d35bb0

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 11 Feb 2021 15:34:49 GMT
content-encoding: gzip
last-modified: Mon, 01 Feb 2021 20:32:03 GMT
server: AmazonS3
x-amz-cf-pop: AMS54-C1
etag: W/"5adf5ec3d5ebc7f178b9439020cc1869"
vary: Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method,Origin
x-cache: Miss from cloudfront
x-amz-version-id: n63JeZLmJvx7w1rDwBjjmwmxcB0jcgRM
via: 1.1 4b3bed207ec72204ebc89ae818e573ef.cloudfront.net (CloudFront)
cache-control: max-age=31536000, public
content-security-policy: default-src 'none';
content-type: image/svg+xml
x-amz-cf-id: oYeqBsWRnQByB1xt41rqGqIICSeWxGkErbNccG-IXUV2jyquZxj6ew==
expires: Sat, 01 Feb 2031 20:31:50 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: 1Password (Online)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

11 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	Message: %cStop! font-family: Helvetica; font-size: 20px; color: #666; font-size: 50px; font-weight: bold; font-style: italic; color: #0083F6;
console-api	log	Message: %cThis feature is for use by web developers. Copying and pasting text here that came from someone else could give them access to your 1Password data. font-family: Helvetica; font-size: 20px; color: #666;
console-api	debug	URL: https://app.b5dev.ca/js/b5-b633b136f90d3227ad06.min.js(Line 1) Message: crypto tests: 36.041015625 ms
console-api	log	URL: https://app.b5dev.ca/js/b5-b633b136f90d3227ad06.min.js(Line 1) Message: Crypto init and tests are complete jwkImport: true rsaOaep256: true nativeAesGcm: true nativePbes2: true nativeEcdsa: true
console-api	log	URL: https://app.b5dev.ca/js/app-a5bcc1a4def21349bbf5.min.js(Line 1) Message: Last sign out message is not available.
console-api	log	URL: https://app.b5dev.ca/js/b5-b633b136f90d3227ad06.min.js(Line 1) Message: ⬆️ GET https://accounts.b5dev.com/api/v1/accountcookies Session: [none] Request: he7wvn4rzxdyo
console-api	log	URL: https://app.b5dev.ca/js/b5-b633b136f90d3227ad06.min.js(Line 1) Message: ⬆️ GET https://accounts.b5dev.eu/api/v1/accountcookies Session: [none] Request: l27efu2c3xijw
console-api	log	URL: https://app.b5dev.ca/js/b5-b633b136f90d3227ad06.min.js(Line 1) Message: ⬆️ GET https://accounts.b5dev.ca/api/v1/accountcookies Session: [none] Request: hajzxm3bfg24u
console-api	log	URL: https://app.b5dev.ca/js/b5-b633b136f90d3227ad06.min.js(Line 1) Message: ✅ GET https://accounts.b5dev.eu/api/v1/accountcookies Session: [none] Request: l27efu2c3xijw Time: 94 ms
console-api	log	URL: https://app.b5dev.ca/js/b5-b633b136f90d3227ad06.min.js(Line 1) Message: ✅ GET https://accounts.b5dev.ca/api/v1/accountcookies Session: [none] Request: hajzxm3bfg24u Time: 382 ms
console-api	log	URL: https://app.b5dev.ca/js/b5-b633b136f90d3227ad06.min.js(Line 1) Message: ✅ GET https://accounts.b5dev.com/api/v1/accountcookies Session: [none] Request: he7wvn4rzxdyo Time: 586 ms

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'none'; form-action 'none'; report-uri https://my.b5dev.ca/csp_violation; script-src https://app.b5dev.ca 'sha256-mi9+p4beQcu6E0oooTjb9KQmCt4uIRSLYnxxNnUTggc='; style-src https://app.b5dev.ca 'sha256-bNMmNittYu69PLivLpkG5sNBPZLv8TnaGoi17prMiAI='; img-src data: blob: https://c.1password.com https://app.b5dev.ca https://a.b5dev.ca/ https://a.b5dev.com https://a.b5dev.eu https://avatars.slack-edge.com; child-src 'self' https://.duosecurity.com https://.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; frame-src 'self' https://.duosecurity.com https://.duofederal.com https://map.1passwordservices.dev https://billing.1passwordservices.dev https://duo.1passwordservices.dev; connect-src 'self' https://watchtower.1password.com https://api.pwnedpasswords.com https://app.b5dev.ca wss://b5n.b5dev.ca https://f.b5dev.ca/ .b5dev.ca https://.b5dev.com https://*.b5dev.eu https://a.b5dev.ca/ https://contact.1passwordservices.dev https://flow.1passwordservices.dev
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.b5dev.ca
accounts.b5dev.com
accounts.b5dev.eu
app.b5dev.ca
b5billing.b5dev.ca
2600:1f11:e0e:5f01:2a1e:3b24:62f0:dee0
2600:1f18:26cf:7400:a9:dfa4:48b:4496
2600:9000:21c7:7e00:11:d315:8c0:93a1
2a05:d014:26a:4801:11b1:a899:d66a:bab6
204ae24d0b9c95793fd4a50dcd57431232686f301d2a3fe3cd90dc85fc7228f6
2d6dedba87f0cc5900b49d4c186f59aea8d954ba2d42f1e1c3a55c0ae4d35bb0
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
59c9e16c52a50c59a22b8a3aef3a98ff5744ef6e60576ec307e788fb5905596e
70f0ce9e45f51802e1125ea95e5fcd6982a492f79a9345717a6a7586900d40bc
8344c8ac51360f307a0cca6e3634f1b56f33bd989ba7afe4ea5df825d205b52e
89c980ab7544d5b3f941b044713ef3849384859dfc564f2f4d3606394f6602ad
92fa78f442d02b80fda7252b8f9582d6c8315a41edfbbb6fb2dd8ccc12e2c0e8
96b2d4a41db15ce575aeff4e190618deab3006c084bddee3bd9e4974d700eb17
a7527e1b5dc4e8da48186a4c49bdc8f0562fd2a58ad5fce6ddab316aa4d75eb2
d7c35f642dc65238f9ec2146bbc074f973fd3626565edea6df6de637220fe70d

b5billing.b5dev.ca Open in urlscan Pro 2600:1f11:e0e:5f01:2a1e:3b24:62f0:dee0 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

16 Requests

100 %HTTPS

100 %IPv6

3 Domains

5 Subdomains

4 IPs

3 Countries

1095 kBTransfer

4920 kBSize

0 Cookies

6 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

18 JavaScript Global Variables

0 Cookies

11 Console Messages

Security Headers

Indicators

b5billing.b5dev.ca Open in urlscan Pro
2600:1f11:e0e:5f01:2a1e:3b24:62f0:dee0 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

5
Subdomains

4
IPs

3
Countries

1095 kB
Transfer

4920 kB
Size

0
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!