fed.xlgroup.com Open in urlscan Pro
199.26.159.141 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://my.xlcatlin.com/personal/soundar_vanangamudi_contractor_xlgroup_com/Documents/Desktop/desktop/output
Effective URL:
https://fed.xlgroup.com/adfs/ls/?client-request-id=222d94a0-80bf-d000-cf76-56700b0c464f&username=&wa=wsignin1.0&wtrealm=...
Submission: On February 08 via manual (February 8th 2023, 10:49:51 am UTC) from PH — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 9 HTTP transactions. The main IP is 199.26.159.141, located in United States and belongs to XL-CAPITAL, US. The main domain is fed.xlgroup.com.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on May 12th 2022. Valid for: a year.

This is the only time fed.xlgroup.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3 3	2620:1ec:8fb::10 2620:1ec:8fb::10	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 3	20.190.160.15 20.190.160.15	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
7	199.26.159.141 199.26.159.141	22848 (XL-CAPITAL) (XL-CAPITAL)
9	2

3 2620:1ec:8fb::10 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

my.xlcatlin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 20.190.160.15 (Amsterdam, Netherlands) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

login.microsoftonline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 199.26.159.141 (United States)

ASN22848 (XL-CAPITAL, US)

fed.xlgroup.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	xlgroup.com fed.xlgroup.com	205 KB
3	microsoftonline.com 1 redirects login.microsoftonline.com — Cisco Umbrella Rank: 20	59 KB
3	xlcatlin.com 3 redirects my.xlcatlin.com	4 KB
9	3

	Domain	Requested by
7	fed.xlgroup.com	login.microsoftonline.com fed.xlgroup.com
3	login.microsoftonline.com	1 redirects login.microsoftonline.com
3	my.xlcatlin.com	3 redirects
9	3

This site contains no links.

Subject Issuer	Validity	Valid
stamp2.login.microsoftonline.com DigiCert SHA2 Secure Server CA	`2022-11-23` - `2023-11-23`	a year	crt.sh
fed.xlgroup.com DigiCert TLS RSA SHA256 2020 CA1	`2022-05-12` - `2023-05-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://fed.xlgroup.com/adfs/ls/?client-request-id=222d94a0-80bf-d000-cf76-56700b0c464f&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAAlZHNaxNBGMZ3umnMVzX0JJ6k5KRMdmZndmcm4GF3sqtUIRakahHKfiUNJtl1s4mpJ_HksYIXexItCPEmFEovisdeDB77F4ggiKceNXrx2D6HH-_D8x5enveKiuu4UUP_ROCcELXbGAbRfPpP6XKp-volXPn4VJl9Ga8n5Yrb2gXlSa-TxqOkHsT9Kbi6lWXJsKFp_e36pBd4Wa87mCfaZjtO-0MtjNreqJfVvWEyOQBgBsA3AKYLjzCTQthSYoaYLS0k7aZjMl0QnQjqMGrb3GTUNIghHINzCR0XESGaGBGEHJ0brtO0BDY40x1LSmn9tQ4Tpk64oJRyR0gsmW4j0xXCtY8XLrSsUbalzxGn3SfRr4Xi_MbNJB5mu2qu1USPp-qpivmg1gzis8ALGMTUjyA1Qwr9iBLY1r1Q6JSGAuEjNR8n0aAbznLge66C1EahUKoqF5XLykkOvFn8U-_eNL4U7M1W97--Kj_YoOBoURt3mEwtju7daq5d792376y7gtzdWN0WIbY7a2NvmCVa8jDs34yvsQbeyYOdfP4wXyyoVWVFlbfxzzx4fk45LJ7lNbMyOK7gUjGI_dQbhN1wuYaxH3LECeQsQpBi34C-zzhEfkBJwD0ece_Z0qnWPi0pJ-ffvd9_8fbg848bvwE1&pullStatus=0
Frame ID: 21E0D0990548A21B3296F94CE183EA6E
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Anmelden

Page URL History Show full URLs

https://my.xlcatlin.com/personal/soundar_vanangamudi_contractor_xlgroup_com/Documents/Desktop/deskto... HTTP 302
https://my.xlcatlin.com/personal/soundar_vanangamudi_contractor_xlgroup_com/_layouts/15/Authenticate... HTTP 302
https://my.xlcatlin.com/_forms/default.aspx?ReturnUrl=%2fpersonal%2fsoundar_vanangamudi_contractor_x... HTTP 302
https://login.microsoftonline.com/53b7cac7-14be-46d4-be43-f2ad9244d901/oauth2/authorize?client%5Fid=00000003%2... Page URL
https://login.microsoftonline.com/53b7cac7-14be-46d4-be43-f2ad9244d901/oauth2/authorize?client%5Fid=00000003%2... HTTP 302
https://fed.xlgroup.com/adfs/ls/?client-request-id=222d94a0-80bf-d000-cf76-56700b0c464f&username=&wa... Page URL
https://fed.xlgroup.com/adfs/ls/?client-request-id=222d94a0-80bf-d000-cf76-56700b0c464f&username=&wa... Page URL

Page Statistics

9
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

261 kB
Transfer

353 kB
Size

10
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://my.xlcatlin.com/personal/soundar_vanangamudi_contractor_xlgroup_com/Documents/Desktop/desktop/output HTTP 302
https://my.xlcatlin.com/personal/soundar_vanangamudi_contractor_xlgroup_com/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Fsoundar%5Fvanangamudi%5Fcontractor%5Fxlgroup%5Fcom%2FDocuments%2FDesktop%2Fdesktop%2Foutput HTTP 302
https://my.xlcatlin.com/_forms/default.aspx?ReturnUrl=%2fpersonal%2fsoundar_vanangamudi_contractor_xlgroup_com%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Fsoundar%255Fvanangamudi%255Fcontractor%255Fxlgroup%255Fcom%252FDocuments%252FDesktop%252Fdesktop%252Foutput&Source=cookie HTTP 302
https://login.microsoftonline.com/53b7cac7-14be-46d4-be43-f2ad9244d901/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=17C99BCC1707BCA0CBDE672932394E74BB867465359E588C%2DEF0399D10300E285FEDA915872EACCCAEDA91E79623894448E9C1C72B06F99FB&redirect%5Furi=https%3A%2F%2Fmy%2Exlcatlin%2Ecom%2F%5Fforms%2Fdefault%2Easpx&domain%5Fhint=xlgroup%2Ecom&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=222d94a0%2D80bf%2Dd000%2Dcf76%2D56700b0c464f Page URL
https://login.microsoftonline.com/53b7cac7-14be-46d4-be43-f2ad9244d901/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=17C99BCC1707BCA0CBDE672932394E74BB867465359E588C%2DEF0399D10300E285FEDA915872EACCCAEDA91E79623894448E9C1C72B06F99FB&redirect%5Furi=https%3A%2F%2Fmy%2Exlcatlin%2Ecom%2F%5Fforms%2Fdefault%2Easpx&domain%5Fhint=xlgroup%2Ecom&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=222d94a0%2D80bf%2Dd000%2Dcf76%2D56700b0c464f&sso_reload=true HTTP 302
https://fed.xlgroup.com/adfs/ls/?client-request-id=222d94a0-80bf-d000-cf76-56700b0c464f&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAAlZHNaxNBGMZ3umnMVzX0JJ6k5KRMdmZndmcm4GF3sqtUIRakahHKfiUNJtl1s4mpJ_HksYIXexItCPEmFEovisdeDB77F4ggiKceNXrx2D6HH-_D8x5enveKiuu4UUP_ROCcELXbGAbRfPpP6XKp-volXPn4VJl9Ga8n5Yrb2gXlSa-TxqOkHsT9Kbi6lWXJsKFp_e36pBd4Wa87mCfaZjtO-0MtjNreqJfVvWEyOQBgBsA3AKYLjzCTQthSYoaYLS0k7aZjMl0QnQjqMGrb3GTUNIghHINzCR0XESGaGBGEHJ0brtO0BDY40x1LSmn9tQ4Tpk64oJRyR0gsmW4j0xXCtY8XLrSsUbalzxGn3SfRr4Xi_MbNJB5mu2qu1USPp-qpivmg1gzis8ALGMTUjyA1Qwr9iBLY1r1Q6JSGAuEjNR8n0aAbznLge66C1EahUKoqF5XLykkOvFn8U-_eNL4U7M1W97--Kj_YoOBoURt3mEwtju7daq5d792376y7gtzdWN0WIbY7a2NvmCVa8jDs34yvsQbeyYOdfP4wXyyoVWVFlbfxzzx4fk45LJ7lNbMyOK7gUjGI_dQbhN1wuYaxH3LECeQsQpBi34C-zzhEfkBJwD0ece_Z0qnWPi0pJ-ffvd9_8fbg848bvwE1 Page URL
https://fed.xlgroup.com/adfs/ls/?client-request-id=222d94a0-80bf-d000-cf76-56700b0c464f&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAAlZHNaxNBGMZ3umnMVzX0JJ6k5KRMdmZndmcm4GF3sqtUIRakahHKfiUNJtl1s4mpJ_HksYIXexItCPEmFEovisdeDB77F4ggiKceNXrx2D6HH-_D8x5enveKiuu4UUP_ROCcELXbGAbRfPpP6XKp-volXPn4VJl9Ga8n5Yrb2gXlSa-TxqOkHsT9Kbi6lWXJsKFp_e36pBd4Wa87mCfaZjtO-0MtjNreqJfVvWEyOQBgBsA3AKYLjzCTQthSYoaYLS0k7aZjMl0QnQjqMGrb3GTUNIghHINzCR0XESGaGBGEHJ0brtO0BDY40x1LSmn9tQ4Tpk64oJRyR0gsmW4j0xXCtY8XLrSsUbalzxGn3SfRr4Xi_MbNJB5mu2qu1USPp-qpivmg1gzis8ALGMTUjyA1Qwr9iBLY1r1Q6JSGAuEjNR8n0aAbznLge66C1EahUKoqF5XLykkOvFn8U-_eNL4U7M1W97--Kj_YoOBoURt3mEwtju7daq5d792376y7gtzdWN0WIbY7a2NvmCVa8jDs34yvsQbeyYOdfP4wXyyoVWVFlbfxzzx4fk45LJ7lNbMyOK7gUjGI_dQbhN1wuYaxH3LECeQsQpBi34C-zzhEfkBJwD0ece_Z0qnWPi0pJ-ffvd9_8fbg848bvwE1&pullStatus=0 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://my.xlcatlin.com/personal/soundar_vanangamudi_contractor_xlgroup_com/Documents/Desktop/desktop/output HTTP 302
https://my.xlcatlin.com/personal/soundar_vanangamudi_contractor_xlgroup_com/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Fsoundar%5Fvanangamudi%5Fcontractor%5Fxlgroup%5Fcom%2FDocuments%2FDesktop%2Fdesktop%2Foutput HTTP 302
https://my.xlcatlin.com/_forms/default.aspx?ReturnUrl=%2fpersonal%2fsoundar_vanangamudi_contractor_xlgroup_com%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Fsoundar%255Fvanangamudi%255Fcontractor%255Fxlgroup%255Fcom%252FDocuments%252FDesktop%252Fdesktop%252Foutput&Source=cookie HTTP 302
https://login.microsoftonline.com/53b7cac7-14be-46d4-be43-f2ad9244d901/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=17C99BCC1707BCA0CBDE672932394E74BB867465359E588C%2DEF0399D10300E285FEDA915872EACCCAEDA91E79623894448E9C1C72B06F99FB&redirect%5Furi=https%3A%2F%2Fmy%2Exlcatlin%2Ecom%2F%5Fforms%2Fdefault%2Easpx&domain%5Fhint=xlgroup%2Ecom&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=222d94a0%2D80bf%2Dd000%2Dcf76%2D56700b0c464f

Request Chain 2

https://login.microsoftonline.com/53b7cac7-14be-46d4-be43-f2ad9244d901/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=17C99BCC1707BCA0CBDE672932394E74BB867465359E588C%2DEF0399D10300E285FEDA915872EACCCAEDA91E79623894448E9C1C72B06F99FB&redirect%5Furi=https%3A%2F%2Fmy%2Exlcatlin%2Ecom%2F%5Fforms%2Fdefault%2Easpx&domain%5Fhint=xlgroup%2Ecom&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=222d94a0%2D80bf%2Dd000%2Dcf76%2D56700b0c464f&sso_reload=true HTTP 302
https://fed.xlgroup.com/adfs/ls/?client-request-id=222d94a0-80bf-d000-cf76-56700b0c464f&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAAlZHNaxNBGMZ3umnMVzX0JJ6k5KRMdmZndmcm4GF3sqtUIRakahHKfiUNJtl1s4mpJ_HksYIXexItCPEmFEovisdeDB77F4ggiKceNXrx2D6HH-_D8x5enveKiuu4UUP_ROCcELXbGAbRfPpP6XKp-volXPn4VJl9Ga8n5Yrb2gXlSa-TxqOkHsT9Kbi6lWXJsKFp_e36pBd4Wa87mCfaZjtO-0MtjNreqJfVvWEyOQBgBsA3AKYLjzCTQthSYoaYLS0k7aZjMl0QnQjqMGrb3GTUNIghHINzCR0XESGaGBGEHJ0brtO0BDY40x1LSmn9tQ4Tpk64oJRyR0gsmW4j0xXCtY8XLrSsUbalzxGn3SfRr4Xi_MbNJB5mu2qu1USPp-qpivmg1gzis8ALGMTUjyA1Qwr9iBLY1r1Q6JSGAuEjNR8n0aAbznLge66C1EahUKoqF5XLykkOvFn8U-_eNL4U7M1W97--Kj_YoOBoURt3mEwtju7daq5d792376y7gtzdWN0WIbY7a2NvmCVa8jDs34yvsQbeyYOdfP4wXyyoVWVFlbfxzzx4fk45LJ7lNbMyOK7gUjGI_dQbhN1wuYaxH3LECeQsQpBi34C-zzhEfkBJwD0ece_Z0qnWPi0pJ-ffvd9_8fbg848bvwE1

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

authorize Show response
login.microsoftonline.com/53b7cac7-14be-46d4-be43-f2ad9244d901/oauth2/
Redirect Chain

https://my.xlcatlin.com/personal/soundar_vanangamudi_contractor_xlgroup_com/Documents/Desktop/desktop/output
https://my.xlcatlin.com/personal/soundar_vanangamudi_contractor_xlgroup_com/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Fsoundar%5Fvanangamudi%5Fcontractor%5Fxlgroup%5Fcom%2FDocuments%2FDeskt...
https://my.xlcatlin.com/_forms/default.aspx?ReturnUrl=%2fpersonal%2fsoundar_vanangamudi_contractor_xlgroup_com%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Fsoundar%255Fvanangamu...
https://login.microsoftonline.com/53b7cac7-14be-46d4-be43-f2ad9244d901/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20i...

152 KB
55 KB

219ms
124ms

Document
text/html

20.190.160.15
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.microsoftonline.com/53b7cac7-14be-46d4-be43-f2ad9244d901/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=17C99BCC1707BCA0CBDE672932394E74BB867465359E588C%2DEF0399D10300E285FEDA915872EACCCAEDA91E79623894448E9C1C72B06F99FB&redirect%5Furi=https%3A%2F%2Fmy%2Exlcatlin%2Ecom%2F%5Fforms%2Fdefault%2Easpx&domain%5Fhint=xlgroup%2Ecom&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=222d94a0%2D80bf%2Dd000%2Dcf76%2D56700b0c464f

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

20.190.160.15 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

eb917c9721328a89bb5541d8c3a59330e59a3f76584e9c9ffeee82ef9d239d69

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache
Content-Encoding: gzip
Content-Length: 55147
Content-Type: text/html; charset=utf-8
Date: Wed, 08 Feb 2023 10:49:46 GMT
Expires: -1
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams1"}]}
x-ms-ests-server: 2.1.14526.6 - EUS ProdSlices
x-ms-request-id: 783f077f-1947-4f23-982b-f5ad55d50700

Redirect headers

cache-control: no-cache, no-store
content-length: 903
content-type: text/html; charset=utf-8
date: Wed, 08 Feb 2023 10:49:46 GMT
expires: -1
include-referred-token-binding-id: true
location: https://login.microsoftonline.com:443/53b7cac7-14be-46d4-be43-f2ad9244d901/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=17C99BCC1707BCA0CBDE672932394E74BB867465359E588C%2DEF0399D10300E285FEDA915872EACCCAEDA91E79623894448E9C1C72B06F99FB&redirect%5Furi=https%3A%2F%2Fmy%2Exlcatlin%2Ecom%2F%5Fforms%2Fdefault%2Easpx&domain%5Fhint=xlgroup%2Ecom&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=222d94a0%2D80bf%2Dd000%2Dcf76%2D56700b0c464f
microsoftsharepointteamservices: 16.0.0.23325
ms-cv: oJQtIr+AANDPdlZwCwxGTw.0
nel: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0}
p3p: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
pragma: no-cache
report-to: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=53b7cac7-14be-46d4-be43-f2ad9244d901&destinationEndpoint=Edge-Prod-LON21r5b&frontEnd=AFD"}]}
request-id: 222d94a0-80bf-d000-cf76-56700b0c464f
spiislatency: 1
sprequestduration: 64
sprequestguid: 222d94a0-80bf-d000-cf76-56700b0c464f
strict-transport-security: max-age=31536000
x-1dscollectorurl: https://mobile.events.data.microsoft.com/OneCollector/1.0/
x-ariacollectorurl: https://browser.pipe.aria.microsoft.com/Collector/3.0/
x-aspnet-version: 4.0.30319
x-cache: CONFIG_NOCACHE
x-content-type-options: nosniff
x-databoundary: NONE
x-ms-invokeapp: 1; RequireReadOnly
x-msedge-ref: Ref A: 5032B9DD3EE84905B90616AA115043A0 Ref B: LON21EDGE0518 Ref C: 2023-02-08T10:49:46Z
x-networkstatistics: 0,525568,0,232,395938,0,142481
x-powered-by: ASP.NET
x-sharepointhealthscore: 3

POST
H/1.1 200
OK reportbssotelemetry
login.microsoftonline.com/common/instrumentation/ 264 B
1 KB 44ms
44ms Ping
application/json 20.190.160.15
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.microsoftonline.com/common/instrumentation/reportbssotelemetry?hpgid=6&hpgact=1800&client-request-id=222d94a0-80bf-d000-cf76-56700b0c464f&hpgrequestid=783f077f-1947-4f23-982b-f5ad55d50700

Requested by

Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/53b7cac7-14be-46d4-be43-f2ad9244d901/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=17C99BCC1707BCA0CBDE672932394E74BB867465359E588C%2DEF0399D10300E285FEDA915872EACCCAEDA91E79623894448E9C1C72B06F99FB&redirect%5Furi=https%3A%2F%2Fmy%2Exlcatlin%2Ecom%2F%5Fforms%2Fdefault%2Easpx&domain%5Fhint=xlgroup%2Ecom&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=222d94a0%2D80bf%2Dd000%2Dcf76%2D56700b0c464f

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

20.190.160.15 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://login.microsoftonline.com/53b7cac7-14be-46d4-be43-f2ad9244d901/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=17C99BCC1707BCA0CBDE672932394E74BB867465359E588C%2DEF0399D10300E285FEDA915872EACCCAEDA91E79623894448E9C1C72B06F99FB&redirect%5Furi=https%3A%2F%2Fmy%2Exlcatlin%2Ecom%2F%5Fforms%2Fdefault%2Easpx&domain%5Fhint=xlgroup%2Ecom&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=222d94a0%2D80bf%2Dd000%2Dcf76%2D56700b0c464f
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Wed, 08 Feb 2023 10:49:46 GMT
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams1"}]}
Content-Type: application/json; charset=utf-8
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
x-ms-request-id: cd0392e9-eeac-4210-971b-f1225fd37400
Cache-Control: no-store, no-cache
Content-Length: 264
x-ms-ests-server: 2.1.14526.6 - NEULR2 ProdSlices
X-XSS-Protection: 0
Expires: -1

GET
H/1.1

200
OK

/ Show response
fed.xlgroup.com/adfs/ls/
Redirect Chain

https://login.microsoftonline.com/53b7cac7-14be-46d4-be43-f2ad9244d901/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20i...
https://fed.xlgroup.com/adfs/ls/?client-request-id=222d94a0-80bf-d000-cf76-56700b0c464f&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQI...

30 KB
31 KB

1179ms
315ms

Document
text/html

199.26.159.141
XL-CAPITAL

General

Check archive.org

Show headers Download Go to

Full URL

https://fed.xlgroup.com/adfs/ls/?client-request-id=222d94a0-80bf-d000-cf76-56700b0c464f&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAAlZHNaxNBGMZ3umnMVzX0JJ6k5KRMdmZndmcm4GF3sqtUIRakahHKfiUNJtl1s4mpJ_HksYIXexItCPEmFEovisdeDB77F4ggiKceNXrx2D6HH-_D8x5enveKiuu4UUP_ROCcELXbGAbRfPpP6XKp-volXPn4VJl9Ga8n5Yrb2gXlSa-TxqOkHsT9Kbi6lWXJsKFp_e36pBd4Wa87mCfaZjtO-0MtjNreqJfVvWEyOQBgBsA3AKYLjzCTQthSYoaYLS0k7aZjMl0QnQjqMGrb3GTUNIghHINzCR0XESGaGBGEHJ0brtO0BDY40x1LSmn9tQ4Tpk64oJRyR0gsmW4j0xXCtY8XLrSsUbalzxGn3SfRr4Xi_MbNJB5mu2qu1USPp-qpivmg1gzis8ALGMTUjyA1Qwr9iBLY1r1Q6JSGAuEjNR8n0aAbznLge66C1EahUKoqF5XLykkOvFn8U-_eNL4U7M1W97--Kj_YoOBoURt3mEwtju7daq5d792376y7gtzdWN0WIbY7a2NvmCVa8jDs34yvsQbeyYOdfP4wXyyoVWVFlbfxzzx4fk45LJ7lNbMyOK7gUjGI_dQbhN1wuYaxH3LECeQsQpBi34C-zzhEfkBJwD0ece_Z0qnWPi0pJ-ffvd9_8fbg848bvwE1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

199.26.159.141 , United States, ASN22848 (XL-CAPITAL, US),

Reverse DNS

Software

Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

1fb76db7194df611ad101689bb3744b4f568f1c6315927851342064bfe1590c1

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;
Strict-Transport-Security	max-age = 31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://login.microsoftonline.com/53b7cac7-14be-46d4-be43-f2ad9244d901/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=17C99BCC1707BCA0CBDE672932394E74BB867465359E588C%2DEF0399D10300E285FEDA915872EACCCAEDA91E79623894448E9C1C72B06F99FB&redirect%5Furi=https%3A%2F%2Fmy%2Exlcatlin%2Ecom%2F%5Fforms%2Fdefault%2Easpx&domain%5Fhint=xlgroup%2Ecom&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=222d94a0%2D80bf%2Dd000%2Dcf76%2D56700b0c464f
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache,no-store
Content-Length: 31002
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;
Content-Type: text/html; charset=utf-8
Date: Wed, 08 Feb 2023 10:49:35 GMT
Expires: -1
Pragma: no-cache
Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
Strict-Transport-Security: max-age = 31536000
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block

Redirect headers

Cache-Control: no-store, no-cache
Content-Encoding: gzip
Content-Length: 805
Content-Type: text/html; charset=utf-8
Date: Wed, 08 Feb 2023 10:49:47 GMT
Expires: -1
Location: https://fed.xlgroup.com/adfs/ls/?client-request-id=222d94a0-80bf-d000-cf76-56700b0c464f&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAAlZHNaxNBGMZ3umnMVzX0JJ6k5KRMdmZndmcm4GF3sqtUIRakahHKfiUNJtl1s4mpJ_HksYIXexItCPEmFEovisdeDB77F4ggiKceNXrx2D6HH-_D8x5enveKiuu4UUP_ROCcELXbGAbRfPpP6XKp-volXPn4VJl9Ga8n5Yrb2gXlSa-TxqOkHsT9Kbi6lWXJsKFp_e36pBd4Wa87mCfaZjtO-0MtjNreqJfVvWEyOQBgBsA3AKYLjzCTQthSYoaYLS0k7aZjMl0QnQjqMGrb3GTUNIghHINzCR0XESGaGBGEHJ0brtO0BDY40x1LSmn9tQ4Tpk64oJRyR0gsmW4j0xXCtY8XLrSsUbalzxGn3SfRr4Xi_MbNJB5mu2qu1USPp-qpivmg1gzis8ALGMTUjyA1Qwr9iBLY1r1Q6JSGAuEjNR8n0aAbznLge66C1EahUKoqF5XLykkOvFn8U-_eNL4U7M1W97--Kj_YoOBoURt3mEwtju7daq5d792376y7gtzdWN0WIbY7a2NvmCVa8jDs34yvsQbeyYOdfP4wXyyoVWVFlbfxzzx4fk45LJ7lNbMyOK7gUjGI_dQbhN1wuYaxH3LECeQsQpBi34C-zzhEfkBJwD0ece_Z0qnWPi0pJ-ffvd9_8fbg848bvwE1#
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams1"}]}
x-ms-ests-server: 2.1.14526.6 - WUS2 ProdSlices
x-ms-request-id: 1a6faaa4-a463-4ad0-b5d2-990b5c5a3401

GET
H/1.1 200
OK style.css
fed.xlgroup.com/adfs/portal/css/ 10 KB
11 KB 189ms
105ms Stylesheet
text/css 199.26.159.141
XL-CAPITAL

General

Check archive.org

Show headers Download Go to

Full URL

https://fed.xlgroup.com/adfs/portal/css/style.css?id=3B1A0C704CDAE8ECD48AA8F0D50409D981CEF21D7AE6DC85B0797D270101B151

Requested by

Host: fed.xlgroup.com
URL: https://fed.xlgroup.com/adfs/ls/?client-request-id=222d94a0-80bf-d000-cf76-56700b0c464f&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAAlZHNaxNBGMZ3umnMVzX0JJ6k5KRMdmZndmcm4GF3sqtUIRakahHKfiUNJtl1s4mpJ_HksYIXexItCPEmFEovisdeDB77F4ggiKceNXrx2D6HH-_D8x5enveKiuu4UUP_ROCcELXbGAbRfPpP6XKp-volXPn4VJl9Ga8n5Yrb2gXlSa-TxqOkHsT9Kbi6lWXJsKFp_e36pBd4Wa87mCfaZjtO-0MtjNreqJfVvWEyOQBgBsA3AKYLjzCTQthSYoaYLS0k7aZjMl0QnQjqMGrb3GTUNIghHINzCR0XESGaGBGEHJ0brtO0BDY40x1LSmn9tQ4Tpk64oJRyR0gsmW4j0xXCtY8XLrSsUbalzxGn3SfRr4Xi_MbNJB5mu2qu1USPp-qpivmg1gzis8ALGMTUjyA1Qwr9iBLY1r1Q6JSGAuEjNR8n0aAbznLge66C1EahUKoqF5XLykkOvFn8U-_eNL4U7M1W97--Kj_YoOBoURt3mEwtju7daq5d792376y7gtzdWN0WIbY7a2NvmCVa8jDs34yvsQbeyYOdfP4wXyyoVWVFlbfxzzx4fk45LJ7lNbMyOK7gUjGI_dQbhN1wuYaxH3LECeQsQpBi34C-zzhEfkBJwD0ece_Z0qnWPi0pJ-ffvd9_8fbg848bvwE1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

199.26.159.141 , United States, ASN22848 (XL-CAPITAL, US),

Reverse DNS

Software

Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

3b1a0c704cdae8ecd48aa8f0d50409d981cef21d7ae6dc85b0797d270101b151

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;
Strict-Transport-Security	max-age = 31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fed.xlgroup.com/adfs/ls/?client-request-id=222d94a0-80bf-d000-cf76-56700b0c464f&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAAlZHNaxNBGMZ3umnMVzX0JJ6k5KRMdmZndmcm4GF3sqtUIRakahHKfiUNJtl1s4mpJ_HksYIXexItCPEmFEovisdeDB77F4ggiKceNXrx2D6HH-_D8x5enveKiuu4UUP_ROCcELXbGAbRfPpP6XKp-volXPn4VJl9Ga8n5Yrb2gXlSa-TxqOkHsT9Kbi6lWXJsKFp_e36pBd4Wa87mCfaZjtO-0MtjNreqJfVvWEyOQBgBsA3AKYLjzCTQthSYoaYLS0k7aZjMl0QnQjqMGrb3GTUNIghHINzCR0XESGaGBGEHJ0brtO0BDY40x1LSmn9tQ4Tpk64oJRyR0gsmW4j0xXCtY8XLrSsUbalzxGn3SfRr4Xi_MbNJB5mu2qu1USPp-qpivmg1gzis8ALGMTUjyA1Qwr9iBLY1r1Q6JSGAuEjNR8n0aAbznLge66C1EahUKoqF5XLykkOvFn8U-_eNL4U7M1W97--Kj_YoOBoURt3mEwtju7daq5d792376y7gtzdWN0WIbY7a2NvmCVa8jDs34yvsQbeyYOdfP4wXyyoVWVFlbfxzzx4fk45LJ7lNbMyOK7gUjGI_dQbhN1wuYaxH3LECeQsQpBi34C-zzhEfkBJwD0ece_Z0qnWPi0pJ-ffvd9_8fbg848bvwE1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Strict-Transport-Security: max-age = 31536000
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;
X-Content-Type-Options: nosniff
Date: Wed, 08 Feb 2023 10:49:35 GMT
Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
ETag: 3B1A0C704CDAE8ECD48AA8F0D50409D981CEF21D7AE6DC85B0797D270101B151
Content-Type: text/css
Content-Length: 10462
X-XSS-Protection: 1; mode=block
Expires: Fri, 10 Mar 2023 10:49:35 GMT

GET
H/1.1 200
OK logo.png
fed.xlgroup.com/adfs/portal/logo/ 6 KB
6 KB 295ms
105ms Image
image/png 199.26.159.141
XL-CAPITAL

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fed.xlgroup.com/adfs/portal/logo/logo.png?id=16B98B12CD0ECF05E2985C1AEE73DB3878E5181A1217A79ED4D6658CB1D713F5

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

199.26.159.141 , United States, ASN22848 (XL-CAPITAL, US),

Reverse DNS

Software

Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;
Strict-Transport-Security	max-age = 31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fed.xlgroup.com/adfs/ls/?client-request-id=222d94a0-80bf-d000-cf76-56700b0c464f&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAAlZHNaxNBGMZ3umnMVzX0JJ6k5KRMdmZndmcm4GF3sqtUIRakahHKfiUNJtl1s4mpJ_HksYIXexItCPEmFEovisdeDB77F4ggiKceNXrx2D6HH-_D8x5enveKiuu4UUP_ROCcELXbGAbRfPpP6XKp-volXPn4VJl9Ga8n5Yrb2gXlSa-TxqOkHsT9Kbi6lWXJsKFp_e36pBd4Wa87mCfaZjtO-0MtjNreqJfVvWEyOQBgBsA3AKYLjzCTQthSYoaYLS0k7aZjMl0QnQjqMGrb3GTUNIghHINzCR0XESGaGBGEHJ0brtO0BDY40x1LSmn9tQ4Tpk64oJRyR0gsmW4j0xXCtY8XLrSsUbalzxGn3SfRr4Xi_MbNJB5mu2qu1USPp-qpivmg1gzis8ALGMTUjyA1Qwr9iBLY1r1Q6JSGAuEjNR8n0aAbznLge66C1EahUKoqF5XLykkOvFn8U-_eNL4U7M1W97--Kj_YoOBoURt3mEwtju7daq5d792376y7gtzdWN0WIbY7a2NvmCVa8jDs34yvsQbeyYOdfP4wXyyoVWVFlbfxzzx4fk45LJ7lNbMyOK7gUjGI_dQbhN1wuYaxH3LECeQsQpBi34C-zzhEfkBJwD0ece_Z0qnWPi0pJ-ffvd9_8fbg848bvwE1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Strict-Transport-Security: max-age = 31536000
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;
X-Content-Type-Options: nosniff
Date: Wed, 08 Feb 2023 10:49:35 GMT
Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
ETag: 16B98B12CD0ECF05E2985C1AEE73DB3878E5181A1217A79ED4D6658CB1D713F5
Content-Type: image/png
Content-Length: 5980
X-XSS-Protection: 1; mode=block
Expires: Fri, 10 Mar 2023 10:49:35 GMT

GET
H/1.1 200
OK Primary Request / Show response
fed.xlgroup.com/adfs/ls/ 25 KB
25 KB 434ms
433ms Document
text/html 199.26.159.141
XL-CAPITAL

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

199.26.159.141 , United States, ASN22848 (XL-CAPITAL, US),

Reverse DNS

Software

Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

0e4d49122ada9f4d2f6891b50a54722854c952142f6303c850c0aa64eb239ca3

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;
Strict-Transport-Security	max-age = 31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://fed.xlgroup.com/adfs/ls/?client-request-id=222d94a0-80bf-d000-cf76-56700b0c464f&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAAlZHNaxNBGMZ3umnMVzX0JJ6k5KRMdmZndmcm4GF3sqtUIRakahHKfiUNJtl1s4mpJ_HksYIXexItCPEmFEovisdeDB77F4ggiKceNXrx2D6HH-_D8x5enveKiuu4UUP_ROCcELXbGAbRfPpP6XKp-volXPn4VJl9Ga8n5Yrb2gXlSa-TxqOkHsT9Kbi6lWXJsKFp_e36pBd4Wa87mCfaZjtO-0MtjNreqJfVvWEyOQBgBsA3AKYLjzCTQthSYoaYLS0k7aZjMl0QnQjqMGrb3GTUNIghHINzCR0XESGaGBGEHJ0brtO0BDY40x1LSmn9tQ4Tpk64oJRyR0gsmW4j0xXCtY8XLrSsUbalzxGn3SfRr4Xi_MbNJB5mu2qu1USPp-qpivmg1gzis8ALGMTUjyA1Qwr9iBLY1r1Q6JSGAuEjNR8n0aAbznLge66C1EahUKoqF5XLykkOvFn8U-_eNL4U7M1W97--Kj_YoOBoURt3mEwtju7daq5d792376y7gtzdWN0WIbY7a2NvmCVa8jDs34yvsQbeyYOdfP4wXyyoVWVFlbfxzzx4fk45LJ7lNbMyOK7gUjGI_dQbhN1wuYaxH3LECeQsQpBi34C-zzhEfkBJwD0ece_Z0qnWPi0pJ-ffvd9_8fbg848bvwE1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache,no-store
Content-Length: 25619
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;
Content-Type: text/html; charset=utf-8
Date: Wed, 08 Feb 2023 10:49:35 GMT
Expires: -1
Pragma: no-cache
Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
Strict-Transport-Security: max-age = 31536000
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK style.css
fed.xlgroup.com/adfs/portal/css/ 10 KB
11 KB 106ms
106ms Stylesheet
text/css 199.26.159.141
XL-CAPITAL

General

Check archive.org

Show headers Download Go to

Full URL

https://fed.xlgroup.com/adfs/portal/css/style.css?id=3B1A0C704CDAE8ECD48AA8F0D50409D981CEF21D7AE6DC85B0797D270101B151

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

199.26.159.141 , United States, ASN22848 (XL-CAPITAL, US),

Reverse DNS

Software

Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

3b1a0c704cdae8ecd48aa8f0d50409d981cef21d7ae6dc85b0797d270101b151

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;
Strict-Transport-Security	max-age = 31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fed.xlgroup.com/adfs/ls/?client-request-id=222d94a0-80bf-d000-cf76-56700b0c464f&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAAlZHNaxNBGMZ3umnMVzX0JJ6k5KRMdmZndmcm4GF3sqtUIRakahHKfiUNJtl1s4mpJ_HksYIXexItCPEmFEovisdeDB77F4ggiKceNXrx2D6HH-_D8x5enveKiuu4UUP_ROCcELXbGAbRfPpP6XKp-volXPn4VJl9Ga8n5Yrb2gXlSa-TxqOkHsT9Kbi6lWXJsKFp_e36pBd4Wa87mCfaZjtO-0MtjNreqJfVvWEyOQBgBsA3AKYLjzCTQthSYoaYLS0k7aZjMl0QnQjqMGrb3GTUNIghHINzCR0XESGaGBGEHJ0brtO0BDY40x1LSmn9tQ4Tpk64oJRyR0gsmW4j0xXCtY8XLrSsUbalzxGn3SfRr4Xi_MbNJB5mu2qu1USPp-qpivmg1gzis8ALGMTUjyA1Qwr9iBLY1r1Q6JSGAuEjNR8n0aAbznLge66C1EahUKoqF5XLykkOvFn8U-_eNL4U7M1W97--Kj_YoOBoURt3mEwtju7daq5d792376y7gtzdWN0WIbY7a2NvmCVa8jDs34yvsQbeyYOdfP4wXyyoVWVFlbfxzzx4fk45LJ7lNbMyOK7gUjGI_dQbhN1wuYaxH3LECeQsQpBi34C-zzhEfkBJwD0ece_Z0qnWPi0pJ-ffvd9_8fbg848bvwE1&pullStatus=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Strict-Transport-Security: max-age = 31536000
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;
X-Content-Type-Options: nosniff
Date: Wed, 08 Feb 2023 10:49:35 GMT
Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
ETag: 3B1A0C704CDAE8ECD48AA8F0D50409D981CEF21D7AE6DC85B0797D270101B151
Content-Type: text/css
Content-Length: 10462
X-XSS-Protection: 1; mode=block
Expires: Fri, 10 Mar 2023 10:49:35 GMT

GET
H/1.1 200
OK logo.png
fed.xlgroup.com/adfs/portal/logo/ 6 KB
6 KB 107ms
106ms Image
image/png 199.26.159.141
XL-CAPITAL

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fed.xlgroup.com/adfs/portal/logo/logo.png?id=16B98B12CD0ECF05E2985C1AEE73DB3878E5181A1217A79ED4D6658CB1D713F5

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

199.26.159.141 , United States, ASN22848 (XL-CAPITAL, US),

Reverse DNS

Software

Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

16b98b12cd0ecf05e2985c1aee73db3878e5181a1217a79ed4d6658cb1d713f5

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;
Strict-Transport-Security	max-age = 31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fed.xlgroup.com/adfs/ls/?client-request-id=222d94a0-80bf-d000-cf76-56700b0c464f&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAAlZHNaxNBGMZ3umnMVzX0JJ6k5KRMdmZndmcm4GF3sqtUIRakahHKfiUNJtl1s4mpJ_HksYIXexItCPEmFEovisdeDB77F4ggiKceNXrx2D6HH-_D8x5enveKiuu4UUP_ROCcELXbGAbRfPpP6XKp-volXPn4VJl9Ga8n5Yrb2gXlSa-TxqOkHsT9Kbi6lWXJsKFp_e36pBd4Wa87mCfaZjtO-0MtjNreqJfVvWEyOQBgBsA3AKYLjzCTQthSYoaYLS0k7aZjMl0QnQjqMGrb3GTUNIghHINzCR0XESGaGBGEHJ0brtO0BDY40x1LSmn9tQ4Tpk64oJRyR0gsmW4j0xXCtY8XLrSsUbalzxGn3SfRr4Xi_MbNJB5mu2qu1USPp-qpivmg1gzis8ALGMTUjyA1Qwr9iBLY1r1Q6JSGAuEjNR8n0aAbznLge66C1EahUKoqF5XLykkOvFn8U-_eNL4U7M1W97--Kj_YoOBoURt3mEwtju7daq5d792376y7gtzdWN0WIbY7a2NvmCVa8jDs34yvsQbeyYOdfP4wXyyoVWVFlbfxzzx4fk45LJ7lNbMyOK7gUjGI_dQbhN1wuYaxH3LECeQsQpBi34C-zzhEfkBJwD0ece_Z0qnWPi0pJ-ffvd9_8fbg848bvwE1&pullStatus=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Strict-Transport-Security: max-age = 31536000
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;
X-Content-Type-Options: nosniff
Date: Wed, 08 Feb 2023 10:49:35 GMT
Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
ETag: 16B98B12CD0ECF05E2985C1AEE73DB3878E5181A1217A79ED4D6658CB1D713F5
Content-Type: image/png
Content-Length: 5980
X-XSS-Protection: 1; mode=block
Expires: Fri, 10 Mar 2023 10:49:35 GMT

GET
H/1.1 200
OK illustration.png
fed.xlgroup.com/adfs/portal/illustration/ 114 KB
114 KB 106ms
105ms Image
image/png 199.26.159.141
XL-CAPITAL

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fed.xlgroup.com/adfs/portal/illustration/illustration.png?id=183128A3C941EDE3D9199FA37D6AA90E0A7DFE101B37D10B4FEDA0CF35E11AFD

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

199.26.159.141 , United States, ASN22848 (XL-CAPITAL, US),

Reverse DNS

Software

Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

183128a3c941ede3d9199fa37d6aa90e0a7dfe101b37d10b4feda0cf35e11afd

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;
Strict-Transport-Security	max-age = 31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fed.xlgroup.com/adfs/ls/?client-request-id=222d94a0-80bf-d000-cf76-56700b0c464f&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAAlZHNaxNBGMZ3umnMVzX0JJ6k5KRMdmZndmcm4GF3sqtUIRakahHKfiUNJtl1s4mpJ_HksYIXexItCPEmFEovisdeDB77F4ggiKceNXrx2D6HH-_D8x5enveKiuu4UUP_ROCcELXbGAbRfPpP6XKp-volXPn4VJl9Ga8n5Yrb2gXlSa-TxqOkHsT9Kbi6lWXJsKFp_e36pBd4Wa87mCfaZjtO-0MtjNreqJfVvWEyOQBgBsA3AKYLjzCTQthSYoaYLS0k7aZjMl0QnQjqMGrb3GTUNIghHINzCR0XESGaGBGEHJ0brtO0BDY40x1LSmn9tQ4Tpk64oJRyR0gsmW4j0xXCtY8XLrSsUbalzxGn3SfRr4Xi_MbNJB5mu2qu1USPp-qpivmg1gzis8ALGMTUjyA1Qwr9iBLY1r1Q6JSGAuEjNR8n0aAbznLge66C1EahUKoqF5XLykkOvFn8U-_eNL4U7M1W97--Kj_YoOBoURt3mEwtju7daq5d792376y7gtzdWN0WIbY7a2NvmCVa8jDs34yvsQbeyYOdfP4wXyyoVWVFlbfxzzx4fk45LJ7lNbMyOK7gUjGI_dQbhN1wuYaxH3LECeQsQpBi34C-zzhEfkBJwD0ece_Z0qnWPi0pJ-ffvd9_8fbg848bvwE1&pullStatus=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Strict-Transport-Security: max-age = 31536000
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;
X-Content-Type-Options: nosniff
Date: Wed, 08 Feb 2023 10:49:35 GMT
Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
ETag: 183128A3C941EDE3D9199FA37D6AA90E0A7DFE101B37D10B4FEDA0CF35E11AFD
Content-Type: image/png
Content-Length: 116699
X-XSS-Protection: 1; mode=block
Expires: Fri, 10 Mar 2023 10:49:35 GMT

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
my.xlcatlin.com/	1970-01-20 09:30:53	Name: nSGt-17C99BCC1707BCA0CBDE672932394E74BB867465359E588C Value: gYEwQkVDNkM3MTIwMDJGMDM4Rjk3NDRGNTYwMjlCQzg2QUZDNUY1RDBBN0M4QjQ0MzVEMDE3Qzk5QkNDMTcwN0JDQTBDQkRFNjcyOTMyMzk0RTc0QkI4Njc0NjUzNTlFNTg4QxIxMzMyMDMyNzU4Njc3NjIyNjkPbXkueGxjYXRsaW4uY29tHjYgRrweSHfmRWvtloNq8sXq/DXDaFpH3jCjwEDUJjbc6RhJQTT0s7dYsSh7DXjhqLyPFTCSQZJ9WGiNOQrr9HWcLJmTl5XB46KRNe6dMCdnifAq1FYyRLIH6KJ9F8SA59m9XyaVqFAnpiAav11bbqr5T6THwzaKlQQmZCPbO1rHk6z86EoPly3Eyntvscgq/2M0IVBqmCRyb1yQ0vwCC8kXl88VUrLc4aFPa5fyBEIOhfP9rQ8qeYJ3S/7ls1ZTEhghRUiV7YI0pwtZY04cogpnzBAqWMpeanGXEhn4Mgk7b9wo/ohkhQXgCidDsMlr3ibne2s90LJFhGBMeksKtYcAAAA=
my.xlcatlin.com/	1970-01-20 09:30:53	Name: RpsContextCookie Value: U291cmNlPSUyRnBlcnNvbmFsJTJGc291bmRhciU1RnZhbmFuZ2FtdWRpJTVGY29udHJhY3RvciU1RnhsZ3JvdXAlNUZjb20lMkZEb2N1bWVudHMlMkZEZXNrdG9wJTJGZGVza3RvcCUyRm91dHB1dCZQcmV2aW91c1JlcXVlc3RDb3JyZWxhdGlvbklkPTIyMmQ5NGEwJTJEODBiZiUyRGQwMDAlMkRjZjc2JTJENTY3MDBiMGM0NjRmJlJldHVyblVybD0lMkZwZXJzb25hbCUyRnNvdW5kYXIlNUZ2YW5hbmdhbXVkaSU1RmNvbnRyYWN0b3IlNUZ4bGdyb3VwJTVGY29tJTJGJTVGbGF5b3V0cyUyRjE1JTJGQXV0aGVudGljYXRlJTJFYXNweCUzRlNvdXJjZSUzRCUyNTJGcGVyc29uYWwlMjUyRnNvdW5kYXIlMjU1RnZhbmFuZ2FtdWRpJTI1NUZjb250cmFjdG9yJTI1NUZ4bGdyb3VwJTI1NUZjb20lMjUyRkRvY3VtZW50cyUyNTJGRGVza3RvcCUyNTJGZGVza3RvcCUyNTJGb3V0cHV0
login.microsoftonline.com/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
login.microsoftonline.com/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: AADSSO Value: NA\|NoExtension
login.microsoftonline.com/	1970-01-20 09:30:53	Name: SSOCOOKIEPULLED Value: 1
login.microsoftonline.com/	1970-01-20 10:14:05	Name: buid Value: 0.AQMAx8q3U74U1Ea-Q_KtkkTZAQMAAAAAAPEPzgAAAAAAAAADAAA.AQABAAEAAAD--DLA3VO7QrddgJg7WevrKmtj9U9vP0yT7B0HD3z41fdcLqkwQ3jsD41q8fG5T7YI4vK3oZXMilxjJwefFWAVc1O9tK3dtK_wpPDJRCa20ThIUWMbQq_bF9WRJpfbADIgAA
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: ESTSWCTXFLOWTOKEN Value: AQABAAEAAAD--DLA3VO7QrddgJg7Wevryko-d0d13_r4WtEWgV65CgNvjwU-Acj5dMDS2fBXEwIi3ba_63HdCFt8pz8H97rnAmw1Wp4ffs5UciSw-oyQOthtI-qHqV9JCJl337pWJjohLYTn52hVYDuMqTIpQa-CtgplNG74NLneddIaKKU_m-HZYn1hToN4zpgGBr3tlt9XgJLnA6dmkksvnptyxKQ57QPIT1fgiEVaQBJ6KT33QToxyKtwXTB-5dEClnGV1zdA1PqaLEMLWa6Nh-xHwXczy_Ni2Wuz2goyN51wDWohjmtPEJ7-jJn4W_nbcKR0awZxXc0oq9g3Ha_N3dUBun2iqBFMdj-VgO-e7ZYOhqtK_7EeZkQZulniYXha0Puk5r8HJmG5TA5PAGvegCCUxDdqIDjD1UZ2B8LorufwldgVgmZBgy7RbWA9lATD4Nt4MeS6s6ElPNLsvFU0rEo-QHTDNPBnlnBVvRC_RfMH67m9QR202h5K5WaC5AvXysfv4JEjiUQLiYwhzoMpeVKj87-_sxJCh38M-O6ev08oaXaJJ0QFvQjk2JKc1tlwidiwAJmliEuZkot2b62v86ZWU0JoIAA
login.microsoftonline.com/	1970-01-20 10:14:05	Name: fpc Value: AqNVgvdu9NFHrtZ9S9VB_5s3obWfAQAAAEl1ddsOAAAA
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: esctx Value: PAQABAAEAAAD--DLA3VO7QrddgJg7WevrLYS6_7xVOFwlqELA5zo892n6r4tCH85PdZKmtq4boH_oxXuzmeDfRJPuq9T9ozLnJVfEga7ZSAMIE5yUANvl-BtfzvKWV9INe0H6FuXTHIOAZBLXnbMeMFqJAyZv5q5fNVFckt5XsSEV42tM8NM3vPwrmyKcA5U56spX9VgIkNggAA

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fed.xlgroup.com
login.microsoftonline.com
my.xlcatlin.com
199.26.159.141
20.190.160.15
2620:1ec:8fb::10
0e4d49122ada9f4d2f6891b50a54722854c952142f6303c850c0aa64eb239ca3
16b98b12cd0ecf05e2985c1aee73db3878e5181a1217a79ed4d6658cb1d713f5
183128a3c941ede3d9199fa37d6aa90e0a7dfe101b37d10b4feda0cf35e11afd
1fb76db7194df611ad101689bb3744b4f568f1c6315927851342064bfe1590c1
3b1a0c704cdae8ecd48aa8f0d50409d981cef21d7ae6dc85b0797d270101b151
eb917c9721328a89bb5541d8c3a59330e59a3f76584e9c9ffeee82ef9d239d69

fed.xlgroup.com Open in urlscan Pro 199.26.159.141 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

9 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

261 kBTransfer

353 kBSize

10 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

10 Cookies

Security Headers

Indicators

fed.xlgroup.com Open in urlscan Pro
199.26.159.141 Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

261 kB
Transfer

353 kB
Size

10
Cookies

9 HTTP transactions
0 data transactions