urlscan.io logo urlscan.io
SecurityTrails logo

pmw.empire.ca Open in urlscan Pro
207.61.86.116  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://pmw.empire.ca/pmwweb/dynamicReport.do?win=popup&type=claimDetails&claimId=EDID07052021-458
Effective URL: https://pmw.empire.ca/pmwweb/login.jsp
Submission: On May 17 via manual from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 9 IPs in 3 countries across 8 domains to perform 23 HTTP transactions. The main IP is 207.61.86.116, located in Kingston, Canada and belongs to AS-EMPIRELIFE, CA. The main domain is pmw.empire.ca.
TLS certificate: Issued by Entrust Certification Authority - L1K on November 25th 2020. Valid for: a year.
This is the only time pmw.empire.ca was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 8 207.61.86.116 53564 (AS-EMPIRE...)
3 2606:4700::68... 13335 (CLOUDFLAR...)
1 52.216.77.172 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
4 52.216.108.173 16509 (AMAZON-02)
1 2 142.250.184.230 15169 (GOOGLE)
4 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
23 9
8    207.61.86.116 (Kingston, Canada)

ASN53564 (AS-EMPIRELIFE, CA)
pmw.empire.ca
3    2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)
maxcdn.bootstrapcdn.com
1    52.216.77.172 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com
pmw-notices.s3.amazonaws.com
1    2a00:1450:4001:808::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
4    52.216.108.173 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com
s3.amazonaws.com
2    142.250.184.230 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f6.1e100.net
5290522.fls.doubleclick.net
4    2606:4700::6813:9308 (United States)

ASN13335 (CLOUDFLARENET, US)
script.crazyegg.com
1    2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.com
1    2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.de
Domain Requested by
8 pmw.empire.ca 1 redirects pmw.empire.ca
4 script.crazyegg.com www.googletagmanager.com
script.crazyegg.com
4 s3.amazonaws.com pmw.empire.ca
3 maxcdn.bootstrapcdn.com pmw.empire.ca
2 5290522.fls.doubleclick.net 1 redirects www.googletagmanager.com
1 adservice.google.de adservice.google.com
1 adservice.google.com 5290522.fls.doubleclick.net
1 www.googletagmanager.com pmw.empire.ca
1 pmw-notices.s3.amazonaws.com pmw.empire.ca
23 9

This site contains links to these domains. Also see Links.

Domain
youtu.be
www.empire.ca
Subject Issuer Validity Valid
*.empire.ca
Entrust Certification Authority - L1K		 2020-11-25 -
2021-12-24		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-03-01 -
2022-02-28		 a year crt.sh
*.s3.amazonaws.com
DigiCert Baltimore CA-2 G2		 2021-01-11 -
2022-02-11		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-04-13 -
2021-07-06		 3 months crt.sh
s3.amazonaws.com
DigiCert Baltimore CA-2 G2		 2020-08-04 -
2021-08-09		 a year crt.sh
*.doubleclick.net
GTS CA 1C3		 2021-04-13 -
2021-07-06		 3 months crt.sh
*.google.com
GTS CA 1O1		 2021-04-13 -
2021-07-06		 3 months crt.sh

This page contains 4 frames:

Primary Page: https://pmw.empire.ca/pmwweb/login.jsp
Frame ID: 5183AF2B90F476193618E5E4BCC7274C
Requests: 20 HTTP requests in this frame

Frame: https://5290522.fls.doubleclick.net/activityi;dc_pre=COre8bTe0PACFZcK4Aoda-4LCA;src=5290522;type=consu0;cat=consu018;ord=5075009796385;gtm=2wg5c1;auiddc=1286985515.1621255239;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp
Frame ID: E851310E1DD75D97A96FB9573B0D8E14
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=COre8bTe0PACFZcK4Aoda-4LCA;src=5290522;type=consu0;cat=consu018;ord=5075009796385;gtm=2wg5c1;auiddc=1286985515.1621255239;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp
Frame ID: D709BD4FDBF68B2CDD293E38FBF8FC8C
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.de/ddm/fls/i/dc_pre=COre8bTe0PACFZcK4Aoda-4LCA;src=5290522;type=consu0;cat=consu018;ord=5075009796385;gtm=2wg5c1;auiddc=1286985515.1621255239;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp
Frame ID: B766552A6CEFF932C170CE3D4906E6E1
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://pmw.empire.ca/pmwweb/dynamicReport.do?win=popup&type=claimDetails&claimId=EDID07052021-458 HTTP 302
    https://pmw.empire.ca/pmwweb/login.jsp Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
  • script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /script\.crazyegg\.com\/pages\/scripts\/\d+\/\d+\.js/i
Overall confidence: 100%
Detected patterns
  • html /googletagmanager\.com\/ns\.html[^>]+><\/iframe>/i
  • html /<!-- (?:End )?Google Tag Manager -->/i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

23
Requests

100 %
HTTPS

56 %
IPv6

8
Domains

9
Subdomains

9
IPs

3
Countries

281 kB
Transfer

677 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://pmw.empire.ca/pmwweb/dynamicReport.do?win=popup&type=claimDetails&claimId=EDID07052021-458 HTTP 302
    https://pmw.empire.ca/pmwweb/login.jsp Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 15
  • https://5290522.fls.doubleclick.net/activityi;src=5290522;type=consu0;cat=consu018;ord=5075009796385;gtm=2wg5c1;auiddc=1286985515.1621255239;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp HTTP 302
  • https://5290522.fls.doubleclick.net/activityi;dc_pre=COre8bTe0PACFZcK4Aoda-4LCA;src=5290522;type=consu0;cat=consu018;ord=5075009796385;gtm=2wg5c1;auiddc=1286985515.1621255239;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp

23 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set login.jsp
pmw.empire.ca/pmwweb/
Redirect Chain
  • https://pmw.empire.ca/pmwweb/dynamicReport.do?win=popup&type=claimDetails&claimId=EDID07052021-458
  • https://pmw.empire.ca/pmwweb/login.jsp
16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pmw.empire.ca/pmwweb/login.jsp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.61.86.116 Kingston, Canada, ASN53564 (AS-EMPIRELIFE, CA),
Reverse DNS
Software
Apache /
Resource Hash
a8a93a2acf2036084a5aa06a4be5d5e23b6345d2271b460153ad5d53accf4d0d

Request headers

Host
pmw.empire.ca
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
WASReqURL=https:///pmwweb/dynamicReport.do?win=popup&type=claimDetails&claimId=EDID07052021-458; SERVERID=pmwa
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 17 May 2021 12:40:37 GMT
Server
Apache
Expires
Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control
no-cache="set-cookie, set-cookie2"
Content-Type
text/html;charset=ISO-8859-1
Content-Language
en-US
Set-Cookie
JSESSIONID=0000HT2QgKd98EcUI2ebA5dI3q6:-1; Path=/; HttpOnly user_lang=en_CA; Expires=Tue, 18-May-21 12:40:37 GMT
Connection
close
Transfer-Encoding
chunked
Content-Encoding
gzip

Redirect headers

Date
Mon, 17 May 2021 12:40:37 GMT
Server
Apache
Location
https://pmw.empire.ca/pmwweb/login.jsp
Content-Length
0
Expires
Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control
no-cache="set-cookie, set-cookie2"
Content-Type
text/plain
Content-Language
en-US
Set-Cookie
WASReqURL=https:///pmwweb/dynamicReport.do?win=popup&type=claimDetails&claimId=EDID07052021-458; Path=/; HttpOnly SERVERID=pmwa; path=/
Connection
close
common.js
pmw.empire.ca/pmwweb/js/ 		8 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pmw.empire.ca/pmwweb/js/common.js?v=1
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/login.jsp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.61.86.116 Kingston, Canada, ASN53564 (AS-EMPIRELIFE, CA),
Reverse DNS
Software
Apache /
Resource Hash
43c2f58515288f5d6772c245a4ff3264fe8a12b4a8361af1751c0dc49254eb10

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
pmw.empire.ca
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://pmw.empire.ca/pmwweb/login.jsp
Cookie
user_lang=en_CA; WASReqURL=https:///pmwweb/dynamicReport.do?win=popup&type=claimDetails&claimId=EDID07052021-458; SERVERID=pmwa; JSESSIONID=0000HT2QgKd98EcUI2ebA5dI3q6:-1
Connection
keep-alive
Referer
https://pmw.empire.ca/pmwweb/login.jsp
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 17 May 2021 12:40:38 GMT
Content-Encoding
gzip
Last-Modified
Thu, 29 Apr 2021 14:10:06 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Language
en-US
Connection
close
Content-Type
application/javascript
login.js
pmw.empire.ca/pmwweb/js/ 		1 KB
779 B 		Script
General
Check archive.org
Download Go to
Full URL
https://pmw.empire.ca/pmwweb/js/login.js
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/login.jsp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.61.86.116 Kingston, Canada, ASN53564 (AS-EMPIRELIFE, CA),
Reverse DNS
Software
Apache /
Resource Hash
ebaf85d1a8b4dc8f1a2687f462547a734cdb823c71fa9528850d3d92f94c69a9

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
pmw.empire.ca
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://pmw.empire.ca/pmwweb/login.jsp
Cookie
user_lang=en_CA; WASReqURL=https:///pmwweb/dynamicReport.do?win=popup&type=claimDetails&claimId=EDID07052021-458; SERVERID=pmwa; JSESSIONID=0000HT2QgKd98EcUI2ebA5dI3q6:-1
Connection
keep-alive
Referer
https://pmw.empire.ca/pmwweb/login.jsp
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 17 May 2021 12:40:38 GMT
Content-Encoding
gzip
Last-Modified
Thu, 29 Apr 2021 14:10:06 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Language
en-US
Connection
close
Content-Type
application/javascript
popup.js
pmw.empire.ca/pmwweb/js/ 		10 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pmw.empire.ca/pmwweb/js/popup.js
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/login.jsp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.61.86.116 Kingston, Canada, ASN53564 (AS-EMPIRELIFE, CA),
Reverse DNS
Software
Apache /
Resource Hash
7c6a95d2e26541425b18ceaaf84268342dc8c561f84da2becc456e4aebe13ae3

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
pmw.empire.ca
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://pmw.empire.ca/pmwweb/login.jsp
Cookie
user_lang=en_CA; WASReqURL=https:///pmwweb/dynamicReport.do?win=popup&type=claimDetails&claimId=EDID07052021-458; SERVERID=pmwa; JSESSIONID=0000HT2QgKd98EcUI2ebA5dI3q6:-1
Connection
keep-alive
Referer
https://pmw.empire.ca/pmwweb/login.jsp
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 17 May 2021 12:40:38 GMT
Content-Encoding
gzip
Last-Modified
Thu, 29 Apr 2021 14:10:06 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Language
en-US
Connection
close
Content-Type
application/javascript
jquery-3.1.0.min.js
pmw.empire.ca/pmwweb/js/ 		84 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pmw.empire.ca/pmwweb/js/jquery-3.1.0.min.js
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/login.jsp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.61.86.116 Kingston, Canada, ASN53564 (AS-EMPIRELIFE, CA),
Reverse DNS
Software
Apache /
Resource Hash
702b9e051e82b32038ffdb33a4f7eb5f7b38f4cf6f514e4182d8898f4eb0b7fb

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
pmw.empire.ca
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
*/*
Cache-Control
no-cache
Sec-Fetch-Dest
script
Referer
https://pmw.empire.ca/pmwweb/login.jsp
Cookie
user_lang=en_CA; WASReqURL=https:///pmwweb/dynamicReport.do?win=popup&type=claimDetails&claimId=EDID07052021-458; SERVERID=pmwa; JSESSIONID=0000HT2QgKd98EcUI2ebA5dI3q6:-1
Connection
keep-alive
Referer
https://pmw.empire.ca/pmwweb/login.jsp
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 17 May 2021 12:40:38 GMT
Content-Encoding
gzip
Last-Modified
Thu, 29 Apr 2021 14:10:06 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Language
en-US
Connection
close
Content-Type
application/javascript
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 		118 KB
18 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://pmw.empire.ca
Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 12:40:38 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
cdn-edgestorageid
632, 617, 617
access-control-allow-origin
*
cdn-cachedat
2021-05-17 12:22:31
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1bf0c9aa00004ed4adbe1000000001
timing-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:03:59 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
1f584706a58a5f244bca91bbcc33d9c6
cf-ray
650cea55dd994ed4-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
bootstrap-theme.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 		23 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap-theme.min.css
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
653e073e97423adda5bc3917a241ee8497dd38a48f14bcde0098a4e54fd0fa5e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://pmw.empire.ca
Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 12:40:38 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
cdn-edgestorageid
601, 617, 617
access-control-allow-origin
*
cdn-cachedat
2021-05-17 14:38:40
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1bf0c9aa00004ed495388000000001
timing-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:03:59 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
4410ee5cc479ab573301e56fa59a9178
cf-ray
650cea55dd9c4ed4-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ 		36 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://pmw.empire.ca
Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 12:40:38 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
cdn-edgestorageid
722, 617, 617, 617
access-control-allow-origin
*
cdn-cachedat
2021-05-17 13:44:27
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
0a1bf0c9af00004ed4e606b000000001
timing-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:00 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
7aa9a846018fcb10003f929d8c07a14d
cf-ray
650cea55dd9f4ed4-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
mstyle.css
pmw.empire.ca/pmwweb/theme/ 		8 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://pmw.empire.ca/pmwweb/theme/mstyle.css
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/login.jsp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.61.86.116 Kingston, Canada, ASN53564 (AS-EMPIRELIFE, CA),
Reverse DNS
Software
Apache /
Resource Hash
255649c5ef97fafe4e20cae821cc401e214325c26c03aabc940d7ae67fa2d6be

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
pmw.empire.ca
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
text/css,*/*;q=0.1
Cache-Control
no-cache
Sec-Fetch-Dest
style
Referer
https://pmw.empire.ca/pmwweb/login.jsp
Cookie
user_lang=en_CA; WASReqURL=https:///pmwweb/dynamicReport.do?win=popup&type=claimDetails&claimId=EDID07052021-458; SERVERID=pmwa; JSESSIONID=0000HT2QgKd98EcUI2ebA5dI3q6:-1
Connection
keep-alive
Referer
https://pmw.empire.ca/pmwweb/login.jsp
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 17 May 2021 12:40:38 GMT
Content-Encoding
gzip
Last-Modified
Thu, 29 Apr 2021 14:10:06 GMT
Server
Apache
Transfer-Encoding
chunked
Content-Language
en-US
Connection
close
Content-Type
text/css
logo.jpg
pmw.empire.ca/pmwweb/images/ 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pmw.empire.ca/pmwweb/images/logo.jpg
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/login.jsp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
207.61.86.116 Kingston, Canada, ASN53564 (AS-EMPIRELIFE, CA),
Reverse DNS
Software
Apache /
Resource Hash
ba3b1c0e6648bab1d96ece08eb97855735b1813c386d7822e4f29d2ccc72ce11

Request headers

Pragma
no-cache
Sec-Fetch-Site
same-origin
Accept-Encoding
gzip, deflate, br
Host
pmw.empire.ca
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
no-cors
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control
no-cache
Sec-Fetch-Dest
image
Referer
https://pmw.empire.ca/pmwweb/login.jsp
Cookie
user_lang=en_CA; WASReqURL=https:///pmwweb/dynamicReport.do?win=popup&type=claimDetails&claimId=EDID07052021-458; SERVERID=pmwa; JSESSIONID=0000HT2QgKd98EcUI2ebA5dI3q6:-1
Connection
keep-alive
Referer
https://pmw.empire.ca/pmwweb/login.jsp
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 17 May 2021 12:40:38 GMT
Last-Modified
Thu, 29 Apr 2021 14:10:06 GMT
Server
Apache
Connection
close
Content-Type
image/jpeg
Content-Length
9655
Content-Language
en-US
Telemedicine-PlanMemberSite-LogOn-EN.jpg
pmw-notices.s3.amazonaws.com/ 		115 KB
116 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pmw-notices.s3.amazonaws.com/Telemedicine-PlanMemberSite-LogOn-EN.jpg
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/login.jsp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.77.172 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
6a1376ae848e884e330513163738de276b3193361c7e28bd6001428ba53d3c35

Request headers

Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 17 May 2021 12:40:40 GMT
Last-Modified
Wed, 26 Aug 2020 14:46:02 GMT
Server
AmazonS3
x-amz-request-id
2TPDP00N4AA27H8H
ETag
"45f289dea7c90ed8c247a857dfe77ee9"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
117944
x-amz-id-2
MKd4KVtH3FDE5dZ/GW0pLf1Gs0ZEllX77AhKr34PojJ8/sY2bZrXpMp8K/72mvcjEuKQJ0m2b5w=
gtm.js
www.googletagmanager.com/ 		168 KB
49 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-KN2DJ87
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/login.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
ac8eb97f82fed745a919024e81455e3942846d42bc0a243180028d3d9dada0e4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 12:40:38 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
50237
x-xss-protection
0
last-modified
Mon, 17 May 2021 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 17 May 2021 12:40:38 GMT
notice-title-en.txt
s3.amazonaws.com/pmw-notices/ 		0
529 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://s3.amazonaws.com/pmw-notices/notice-title-en.txt
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/js/jquery-3.1.0.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.108.173 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*/*
Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 17 May 2021 12:40:40 GMT
Last-Modified
Thu, 04 Jun 2020 18:38:34 GMT
Server
AmazonS3
x-amz-request-id
2TPE2TQ1102JS7Q6
ETag
"d41d8cd98f00b204e9800998ecf8427e"
Vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Access-Control-Allow-Methods
GET
Content-Type
text/plain
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3000
Accept-Ranges
bytes
Content-Length
0
x-amz-id-2
ITFnn/WHEjmP70UIJUi4BPIxGyGBFiDoxDgt1OqiQ8XNG1LQacG/NUQYFH69kpGWg9AELG9vvP8=
login-notice-en.txt
s3.amazonaws.com/pmw-notices/ 		0
529 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://s3.amazonaws.com/pmw-notices/login-notice-en.txt
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/js/jquery-3.1.0.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.108.173 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*/*
Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 17 May 2021 12:40:40 GMT
Last-Modified
Fri, 07 Aug 2020 13:02:35 GMT
Server
AmazonS3
x-amz-request-id
2TP7VRJ4PQXZQ654
ETag
"d41d8cd98f00b204e9800998ecf8427e"
Vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Access-Control-Allow-Methods
GET
Content-Type
text/plain
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3000
Accept-Ranges
bytes
Content-Length
0
x-amz-id-2
8Oeup+skv92y+EJSTeRb1J7CAj6u7TcjRvEMk7xMmW09MHhWdVw8/ZWT9zlVkO/KKTWdMCOJdXU=
notice-title-fr.txt
s3.amazonaws.com/pmw-notices/ 		0
529 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://s3.amazonaws.com/pmw-notices/notice-title-fr.txt
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/js/jquery-3.1.0.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.108.173 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*/*
Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 17 May 2021 12:40:40 GMT
Last-Modified
Thu, 04 Jun 2020 18:38:34 GMT
Server
AmazonS3
x-amz-request-id
2TP56YP67J428NPM
ETag
"d41d8cd98f00b204e9800998ecf8427e"
Vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Access-Control-Allow-Methods
GET
Content-Type
text/plain
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3000
Accept-Ranges
bytes
Content-Length
0
x-amz-id-2
QxQYAMFwnX+oHQwXvwUlAyInPEwdORPR++DxDhpAZsYmPr8m9RK1baPFthkgaUeueHFF1v6Qs+o=
login-notice-fr.txt
s3.amazonaws.com/pmw-notices/ 		0
529 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://s3.amazonaws.com/pmw-notices/login-notice-fr.txt
Requested by
Host: pmw.empire.ca
URL: https://pmw.empire.ca/pmwweb/js/jquery-3.1.0.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.108.173 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*/*
Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 17 May 2021 12:40:40 GMT
Last-Modified
Fri, 07 Aug 2020 13:02:35 GMT
Server
AmazonS3
x-amz-request-id
2TP6F2GQD67899SF
ETag
"d41d8cd98f00b204e9800998ecf8427e"
Vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Access-Control-Allow-Methods
GET
Content-Type
text/plain
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3000
Accept-Ranges
bytes
Content-Length
0
x-amz-id-2
WLrgftJvD0X7jZBHHJBMUig3CYpi4kpUVtiLeewTp2N7xdmpjf2izj0Yh63RxlBLknsQDTVEVvE=
activityi;dc_pre=COre8bTe0PACFZcK4Aoda-4LCA;src=5290522;type=consu0;cat=consu018;ord=5075009796385;gtm=2wg5c1;auiddc=1286985515.1621255239;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp
5290522.fls.doubleclick.net/ Frame E851
Redirect Chain
  • https://5290522.fls.doubleclick.net/activityi;src=5290522;type=consu0;cat=consu018;ord=5075009796385;gtm=2wg5c1;auiddc=1286985515.1621255239;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp?
  • https://5290522.fls.doubleclick.net/activityi;dc_pre=COre8bTe0PACFZcK4Aoda-4LCA;src=5290522;type=consu0;cat=consu018;ord=5075009796385;gtm=2wg5c1;auiddc=1286985515.1621255239;~oref=https%3A%2F%2Fpm...
498 B
417 B 		Document
General
Check archive.org
Download Go to
Full URL
https://5290522.fls.doubleclick.net/activityi;dc_pre=COre8bTe0PACFZcK4Aoda-4LCA;src=5290522;type=consu0;cat=consu018;ord=5075009796385;gtm=2wg5c1;auiddc=1286985515.1621255239;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KN2DJ87
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.184.230 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f6.1e100.net
Software
cafe /
Resource Hash
69168c8c52ab6c8f713adc921afedc657a4cf15ae580fca643273db3d5691748
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
5290522.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=COre8bTe0PACFZcK4Aoda-4LCA;src=5290522;type=consu0;cat=consu018;ord=5075009796385;gtm=2wg5c1;auiddc=1286985515.1621255239;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://pmw.empire.ca/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
about:blank

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Mon, 17 May 2021 12:40:39 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
pragma
no-cache
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
392
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Mon, 17-May-2021 12:55:39 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Mon, 17 May 2021 12:40:39 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://5290522.fls.doubleclick.net/activityi;dc_pre=COre8bTe0PACFZcK4Aoda-4LCA;src=5290522;type=consu0;cat=consu018;ord=5075009796385;gtm=2wg5c1;auiddc=1286985515.1621255239;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
5353.js
script.crazyegg.com/pages/scripts/0018/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.crazyegg.com/pages/scripts/0018/5353.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KN2DJ87
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2d225283fa1360db3eb5df5eb0650605972c540f49f26df613f59d3d4c982df6

Request headers

Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 12:40:39 GMT
content-encoding
gzip
cf-cache-status
EXPIRED
ce-version
11.1.295
content-length
1584
cf-request-id
0a1bf0ccc400004df4aaa4f000000001
timing-allow-origin
*
last-modified
Mon, 17 May 2021 12:40:39 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
accept-ranges
bytes
cf-ray
650cea5ac9c04df4-FRA
dc_pre=COre8bTe0PACFZcK4Aoda-4LCA;src=5290522;type=consu0;cat=consu018;ord=5075009796385;gtm=2wg5c1;auiddc=1286985515.1621255239;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp
adservice.google.com/ddm/fls/i/ Frame D709 		497 B
484 B 		Document
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/ddm/fls/i/dc_pre=COre8bTe0PACFZcK4Aoda-4LCA;src=5290522;type=consu0;cat=consu018;ord=5075009796385;gtm=2wg5c1;auiddc=1286985515.1621255239;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp
Requested by
Host: 5290522.fls.doubleclick.net
URL: https://5290522.fls.doubleclick.net/activityi;dc_pre=COre8bTe0PACFZcK4Aoda-4LCA;src=5290522;type=consu0;cat=consu018;ord=5075009796385;gtm=2wg5c1;auiddc=1286985515.1621255239;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
27361c0a846ad2c181c876f7861179a4960903b0bbb7d369e4821f8c77e23a23
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
adservice.google.com
:scheme
https
:path
/ddm/fls/i/dc_pre=COre8bTe0PACFZcK4Aoda-4LCA;src=5290522;type=consu0;cat=consu018;ord=5075009796385;gtm=2wg5c1;auiddc=1286985515.1621255239;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://5290522.fls.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://5290522.fls.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Mon, 17 May 2021 12:40:39 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
content-type
text/html; charset=UTF-8
pragma
no-cache
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
391
x-xss-protection
0
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
dc_pre=COre8bTe0PACFZcK4Aoda-4LCA;src=5290522;type=consu0;cat=consu018;ord=5075009796385;gtm=2wg5c1;auiddc=1286985515.1621255239;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp
adservice.google.de/ddm/fls/i/ Frame B766 		194 B
877 B 		Document
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/ddm/fls/i/dc_pre=COre8bTe0PACFZcK4Aoda-4LCA;src=5290522;type=consu0;cat=consu018;ord=5075009796385;gtm=2wg5c1;auiddc=1286985515.1621255239;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp
Requested by
Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=COre8bTe0PACFZcK4Aoda-4LCA;src=5290522;type=consu0;cat=consu018;ord=5075009796385;gtm=2wg5c1;auiddc=1286985515.1621255239;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
adservice.google.de
:scheme
https
:path
/ddm/fls/i/dc_pre=COre8bTe0PACFZcK4Aoda-4LCA;src=5290522;type=consu0;cat=consu018;ord=5075009796385;gtm=2wg5c1;auiddc=1286985515.1621255239;~oref=https%3A%2F%2Fpmw.empire.ca%2Fpmwweb%2Flogin.jsp
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://adservice.google.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://adservice.google.com/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Mon, 17 May 2021 12:40:39 GMT
expires
Mon, 17 May 2021 12:40:39 GMT
cache-control
private, max-age=0
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
177
x-xss-protection
0
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
5353.json
script.crazyegg.com/pages/data-scripts/0018/ 		12 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://script.crazyegg.com/pages/data-scripts/0018/5353.json?t=1
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0018/5353.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
44422036312180cc22493beb97a4c52147597e2e946d634622b6e6b16b934d77

Request headers

Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 12:40:39 GMT
content-encoding
gzip
cf-cache-status
EXPIRED
ce-version
11.1.295
content-length
1170
cf-request-id
0a1bf0cebe000017824b3f9000000001
timing-allow-origin
*
last-modified
Mon, 17 May 2021 12:40:39 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
accept-ranges
bytes
cf-ray
650cea5dff3f1782-FRA
11.1.295.js
script.crazyegg.com/pages/versioned/common-scripts/ 		62 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.crazyegg.com/pages/versioned/common-scripts/11.1.295.js
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0018/5353.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
55ef5fb785dc29c2dc48ab41dde8b5daa7e3d7c09d0574ffe54330076f476ec5

Request headers

Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 12:40:39 GMT
content-encoding
gzip
cf-cache-status
HIT
age
1705
cf-ray
650cea5f0d6b4df4-FRA
content-length
21028
cf-request-id
0a1bf0cf6400004df49e330000000001
last-modified
Wed, 12 May 2021 17:41:27 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000, s-maxage=31536000
accept-ranges
bytes
timing-allow-origin
*
5353.json
script.crazyegg.com/pages/sampling-data-scripts/0018/ 		904 B
429 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://script.crazyegg.com/pages/sampling-data-scripts/0018/5353.json?t=450348
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/11.1.295.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6a57672398a283f7a1c57b481a7e3dfa3c5dcd3f90726c07f3fead8fb36d009c

Request headers

Referer
https://pmw.empire.ca/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 17 May 2021 12:40:39 GMT
content-encoding
gzip
cf-cache-status
EXPIRED
ce-version
11.1.295
content-length
339
cf-request-id
0a1bf0cf7e000017824b93a000000001
timing-allow-origin
*
last-modified
Mon, 17 May 2021 12:40:39 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
accept-ranges
bytes
cf-ray
650cea5f29841782-FRA

Verdicts & Comments Add Verdict or Comment

99 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated string| SERVLET_CONTEXT object| keyCd boolean| altKy boolean| ctlKy boolean| shiftKy object| mouseBtn object| helpWin object| detailsWin object| cardWin number| F4_KEY number| F5_KEY function| setContextRoot function| getMouseButton function| getKeyCode function| handleOnClose function| resetLocalKeyCodes function| logout function| isIE function| isNetscape5 function| highLightMenu function| restoreMenu function| highlightButton function| restoreButton function| changeBgColor function| printPage function| assureUpper function| changeLocation function| changeToDesktop function| changeToMobile function| jumpSection function| browserInnerHeight function| setContentHeight function| keepCurrentPage function| showDiv function| hideDiv function| showTr function| hideTr function| hideDatesForHistory function| getImage function| OnCancel function| loginFocus function| popUpInformation function| commonWindow function| openFAQ function| getPersonalisedForm function| remindMeLater function| getDynamicPDF function| getDynamicTaxReportPDF function| getClaimDetailsPDF function| getDetailsPDF function| getParamedicalsPDF function| getHCSAFAQPDF function| getStaticPDF function| openBooklet function| getADDBooklet function| getTCTIBooklet function| openWalletCard function| openWalletCardNew function| openPDFWindow function| openWindow function| getDefaultWaitingUrl function| baseUrl function| encodeSpecialChars function| openPopup function| closePopup function| $ function| jQuery number| MSG_LOGIN_EMPTY_USERNAME number| MSG_LOGIN_EMPTY_PASSWORD number| MSG_LOGIN_EMPTY_BOTH number| MSG_LOGIN_USERNAME_NOT_VALID number| MSG_LOGIN_PASSWORD_LENGTH number| MSG_LOGIN_PASSWORD_ONE_NUERIC number| MSG_LOGIN_PASSWORD_ONE_ALPHA object| en_CA_Login_Msg object| fr_CA_Login_Msg function| getLoginMessage function| OnSubmit function| keyhandler object| dataLayer object| google_tag_manager object| google_tag_data boolean| CE_USER_SCRIPT object| CE2 string| CE_USER_DATA_URL string| CE_USER_COMMON_SCRIPT_URL object| CE2BH

1 Cookies

Domain/Path Name / Value
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5290522.fls.doubleclick.net
adservice.google.com
adservice.google.de
maxcdn.bootstrapcdn.com
pmw-notices.s3.amazonaws.com
pmw.empire.ca
s3.amazonaws.com
script.crazyegg.com
www.googletagmanager.com
142.250.184.230
207.61.86.116
2606:4700::6812:bcf
2606:4700::6813:9308
2a00:1450:4001:808::2008
2a00:1450:4001:810::2002
2a00:1450:4001:827::2002
52.216.108.173
52.216.77.172
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
255649c5ef97fafe4e20cae821cc401e214325c26c03aabc940d7ae67fa2d6be
27361c0a846ad2c181c876f7861179a4960903b0bbb7d369e4821f8c77e23a23
2d225283fa1360db3eb5df5eb0650605972c540f49f26df613f59d3d4c982df6
43c2f58515288f5d6772c245a4ff3264fe8a12b4a8361af1751c0dc49254eb10
44422036312180cc22493beb97a4c52147597e2e946d634622b6e6b16b934d77
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
55ef5fb785dc29c2dc48ab41dde8b5daa7e3d7c09d0574ffe54330076f476ec5
653e073e97423adda5bc3917a241ee8497dd38a48f14bcde0098a4e54fd0fa5e
69168c8c52ab6c8f713adc921afedc657a4cf15ae580fca643273db3d5691748
6a1376ae848e884e330513163738de276b3193361c7e28bd6001428ba53d3c35
6a57672398a283f7a1c57b481a7e3dfa3c5dcd3f90726c07f3fead8fb36d009c
702b9e051e82b32038ffdb33a4f7eb5f7b38f4cf6f514e4182d8898f4eb0b7fb
7c6a95d2e26541425b18ceaaf84268342dc8c561f84da2becc456e4aebe13ae3
a8a93a2acf2036084a5aa06a4be5d5e23b6345d2271b460153ad5d53accf4d0d
ac8eb97f82fed745a919024e81455e3942846d42bc0a243180028d3d9dada0e4
ba3b1c0e6648bab1d96ece08eb97855735b1813c386d7822e4f29d2ccc72ce11
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ebaf85d1a8b4dc8f1a2687f462547a734cdb823c71fa9528850d3d92f94c69a9
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c