kndctr_E264EA7B5444D3850A4C98A1_AdobeOrg_cluster

__privaci_cookie_consents

affinity

rxVisitor

dtSa

_gid

rxvt

__privaci_latest_published_version

__privaci_cookie_consent_uuid

__privaci_cookie_consent_generated

dtPC

dtCookie

_ga_7342E137HT

_ga_XNQEBXVC3J

adobeConsent

AMCV_E264EA7B5444D3850A4C98A1%40AdobeOrg

adobeState

kndctr_E264EA7B5444D3850A4C98A1_AdobeOrg_identity

You're looking at domain 'wellcare.superiorhealthplan.com' on the commercial generic top-level domain (.com) with subdomain 'wellcare'. The second-level label 'superiorhealthplan' is 18 characters long with seven vowels and 11 consonants. Word splitting yields three words: superior, health, plan. The median word length lands at six characters. No strong language cues emerged from the frequency lists.

html/06/c0/06c04d12-e915-426b-84b9-3c05e26aaf9c.html.gz

img-src * data:; default-src * data: 'unsafe-eval' 'unsafe-inline' blob:; object-src 'none';

require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers

attachment; filename="Logo_Wellcare-color-sm.png"; filename*=UTF-8''Logo_Wellcare-color-sm.png

attachment; filename="Logo_combo_WC_WellcareBySuperiorHP.png"; filename*=UTF-8''Logo_combo_WC_WellcareBySuperiorHP.png

default-src 'none'; img-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; object-src 'none'

script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0

script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:197:0

script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:165:0

script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:207:0

attachment; filename="favicon_wellcare_medicare_3cl_icon.ico"; filename*=UTF-8''favicon_wellcare_medicare_3cl_icon.ico

default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline';

Learn more about the incident.
external link

format-detection

3J0i36QheEdRdzO0O1q5XbUbLw64i9U_RI8icPW0faokO7v4tW30Xbknx7jsx28TRnWDfE35YALU6rpepP4a3lE3P0x20SDwIE-T3qlAT3rQGEAtTsl_1kWSkEjvX6I--AvnlboG1tMrxhHpnS3ImKRHieozAELd_k7r--BS0ioksRuulf3VYyQ-PX5vhXCM0wqlJQdILb2lTTDSCnvLow

content-page-ref

keywords

description

viewport

Medicare TX - wellcare.superiorhealthplan.com

author

title

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

CSC Corporate Domains, Inc.

SUPERIORHEALTHPLAN.COM

Amazon Web Services, LLC

Amazon

Amazon.com, Inc.

Amazon Web Services

Amazon Webservices EC2

AMAZO-CF


		// New Adobe Analytics implementation
		let pageLanguage = "en_us";
		let covertedPageLanguage;
		switch (pageLanguage) {
		case 'en_us':
			covertedPageLanguage = 'english';
			break;
		case 'es':
			covertedPageLanguage = 'spanish';
			break;
		case 'es_us':
			covertedPageLanguage = 'spanish';
			break;
		default:
			covertedPageLanguage = 'unknown';
		}

		let siteDomain = window.location.hostname;
		let siteDomainParts = siteDomain.split('.');
		let siteName = siteDomainParts.length === 3 ? siteDomainParts[1] : siteDomainParts[0];
		let brandKey = "";
		let brandSiteType = "";
		switch (siteName) {
			case 'wellcare':
				brandKey = 'wellcare';
				brandSiteType = 'public:wellcare';
				break;
			case 'fideliscare':
				brandKey = 'fidelis';
				brandSiteType = 'public:fidelis';
				break;
			default:
				brandKey = 'public';
				brandSiteType = 'public';
		}

		var stateParse = "Texas:TX";
		var productParse = "medicare:medicare";
		var stateSplit = stateParse.split(':');
		var productSplit = productParse.split(':');

		window.centeneAnalyticsQueue = window.centeneAnalyticsQueue || [];
		centeneAnalyticsQueue.push({
			event: {
				type: "page view",
				time: Number(new Date()),
				url: window.location.href
			},
			environment: {
				language: covertedPageLanguage,
				siteType: "public",
				product: productSplit[0],
				planname: "n/a"
			},
			user: {
				state: stateSplit[1]
			}
		});
	


	var googleanalytics = true;
	var adobeanalytics = false;
	var cncleavingalert = true;



(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
})(window,document,'script','dataLayer','GTM-TBVQT7V');



    $(".sh-toggle").click(function () {
        $($(".fullDisclaimer")).toggleClass("notShowing");
        $($(".excerpt")).toggleClass("notShowing");
    });




if (!Object.prototype.hasOwnProperty.call(window, 'CenteneAnalytics')) {
Object.defineProperty(window, "CenteneAnalytics", {
    value: {
        trackdata: function(eventpayload) {
            var eventType = (eventpayload && eventpayload.event && eventpayload.event.type) ? eventpayload.event.type : "";

            // check if _common payload object exists
            var commonPayload = (eventpayload && eventpayload.data && eventpayload.data._common) ? eventpayload.data._common : false;

            // merge eventpayload.data._common payload properties into eventpayload.data object if they don't already exist
            if (typeof commonPayload === 'object' && commonPayload !== null && !Array.isArray(commonPayload)){
                CenteneAnalytics.mergeObjects(eventpayload.data, eventpayload.data._common, false);
            }

            switch (eventType) {
				case "page view":
					CenteneAnalytics.DL = CenteneAnalytics.mapvalidator(eventpayload);
					if(eventpayload && eventpayload.data && eventpayload.data.allocation === "search") {
						CenteneAnalytics.isinit = true;
						return;
					}
					_satellite.track("Adobe Global Init");
					CenteneAnalytics.isinit = true;
					break;
				case "custom":
					CenteneAnalytics.DL = CenteneAnalytics.DL || {};
					CenteneAnalytics.DL.custom = CenteneAnalytics.mapvalidator(eventpayload);
					_satellite.track("Event: Custom Matrix");
					break;
				case "link click":
					CenteneAnalytics.DL = CenteneAnalytics.mapvalidator(eventpayload);
					_satellite.track("link_click");
					break;
				case "site search":
					CenteneAnalytics.DL = CenteneAnalytics.mapvalidator(eventpayload);
					_satellite.track("site_search");
					break;
				case "file download":
					CenteneAnalytics.DL = CenteneAnalytics.mapvalidator(eventpayload);
					_satellite.track("file_download");
					break;
				case "AEP Link Click":
					CenteneAnalytics.DL = CenteneAnalytics.mapvalidator(eventpayload);
					_satellite.track("AEP Link Click");
					break;
				case "error":
					break;
            }
        },
        DL: {}
    },
    writable: false
});
}  
  
CenteneAnalytics.mapvalidator = function(eventpayload) {
    var eventType = (eventpayload && eventpayload.event && eventpayload.event.type) ? eventpayload.event.type : "";
    var eventName = (eventpayload && eventpayload.event && eventpayload.event.name) ? eventpayload.event.name : "";
    var datalayer = (typeof eventpayload == "object") ? eventpayload : {};
    switch (eventType) {
        case "page view":
            // :::: flag
            break;
        case "custom":
            datalayer.error = datalayer.error || {};
            if (!eventName) {
                datalayer.error.schema = {
                    "call_type": "custom",
                    "message": "will not go out because call is missing a name identifier"
                }
            }
            break;
    }
    return datalayer;
}

CenteneAnalytics.mergeObjects = function(target, source, removeSourceProps) {
    if (typeof target !== 'object' || target === null) {
        _satellite.logger.error('[CenteneAnalytics.mergeObjects] Target must be a non-null object');
        return;
    }

    if (typeof source !== 'object' || source === null) {
        _satellite.logger.error('[CenteneAnalytics.mergeObjects] Source must be a non-null object');
        return target;
    }

    const deletePropsFromSourceObj = (typeof removeSourceProps !== 'boolean' || removeSourceProps === true) ? true : false;

    Object.keys(source).forEach(function(key) {
        if (key === '_common') {
            return; // Skip _common keys
        }

        const sourceVal = source[key];
        const targetVal = target[key];

        const shouldOverwrite = (
            // zero-length string
            (typeof targetVal === 'string' && targetVal === '') || 
            // zero-length array
            (Array.isArray(targetVal) && targetVal.length === 0) || 
            // array with single zero-length string
            (Array.isArray(targetVal) && targetVal.length === 1 && typeof targetVal[0] === 'string' && targetVal[0] === '') || 
            // undefined var
            (typeof targetVal === 'undefined')
        );

        if (!(key in target) || shouldOverwrite) {
            target[key] = sourceVal;

            if (deletePropsFromSourceObj){
                delete source[key];
            }
        } else if (
            typeof targetVal === 'object' &&
            targetVal !== null &&
            typeof sourceVal === 'object' &&
            sourceVal !== null &&
            !Array.isArray(targetVal) &&
            !Array.isArray(sourceVal)
        ) {
            CenteneAnalytics.mergeObjects(targetVal, sourceVal, deletePropsFromSourceObj);
        }
        // Otherwise, do not overwrite
    });

    return target;
}

CenteneAnalytics.getCleanVal = function(dataObjProp, isObjExpected, isLower) {
    /*returns string and numaric values unless <isObjExpected> = true*/
    var value = "";
    var isL = (isLower === false) ? 0 : 1;
    try {
        value = eval(dataObjProp);
        if ((typeof value === "object" || typeof value === "boolean") && isObjExpected && (value || value === false)) {
            return value;
        }
        if ((!value) || (typeof value === "object") || (typeof value != "number" && typeof value != "string")) {
            return "";
        }
    } catch (e) {
        /*value could not be found*/ }
    if (typeof value === "string" && isL) {
        value = value.toLowerCase();
    }
    return value;
}

CenteneAnalytics.decodeCleanText = function(val) {
    var r = "";

    if (typeof val === "string") {

        var htmlt = document.createElement('p');
        htmlt.innerHTML = val;
        r = (htmlt.textContent || htmlt.innerText) + "";
        htmlt = null;

        r = decodeURIComponent(r).replace(/[^\w|\d|\s|\-]/gi, '').replace(/\s\s+/g, ' ');
    }

    return r;
}

// begin token backup
;(function () {
  var findAuthState = function (substring) {
    var stores = [sessionStorage, localStorage];
    for (var s = 0; s < stores.length; s++) {
      for (var i = 0; i < stores[s].length; i++) {
        var key = stores[s].key(i);
        if (key.indexOf(substring) !== -1) {
          try {
            var parsed = JSON.parse(stores[s].getItem(key));
            if (parsed && typeof parsed === 'object') return parsed;
          } catch (e) {}
        }
      }
    }
    return null;
  };

  var decodeJwtPayload = function (token) {
    try {
      var base64Url = token.split('.')[1];
      var base64 = base64Url.replace(/-/g, '+').replace(/_/g, '/');
      var jsonPayload = decodeURIComponent(
        window.atob(base64).split('').map(function (c) {
          return '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2);
        }).join('')
      );
      return JSON.parse(jsonPayload);
    } catch (e) {
      return null;
    }
  };

  var encodeJwtPayload = function (claims) {
    try {
      var json = JSON.stringify(claims);
      var binary = encodeURIComponent(json).replace(/%([0-9A-F]{2})/g, function (match, p1) {
        return String.fromCharCode(parseInt(p1, 16));
      });
      var base64 = window.btoa(binary);
      return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
    } catch (e) {
      return null;
    }
  };

  var resolveToken = function (user) {
    var token = user.accessToken;
    if (typeof token !== 'string' || token === '') return null;

    var parts = token.split('.');
    var claims = decodeJwtPayload(token);

    // 1. JWT already has _state — return token as-is
    if (claims && typeof claims._state === 'string' && claims._state !== '') {
      return { token: token, state: claims._state.toLowerCase() };
    }

    // 2. JWT missing _state — check tokenType on parent object
    if (typeof user.tokenType !== 'string' || user.tokenType === '') {
      return null; // no way to classify this token
    }

    var state = user.tokenType.toLowerCase();

    // 3. Inject _state into JWT payload and re-encode
    if (claims && parts.length === 3) {
      claims._state = state;
      var newPayload = encodeJwtPayload(claims);
      if (newPayload) {
        return { token: parts[0] + '.' + newPayload + '.' + parts[2], state: state };
      }
    }

    // 4. Re-encode failed — return original token with resolved state
    return { token: token, state: state };
  };

  var data = findAuthState('centene-entrykey-auth-state');
  if (!data) return;

  var users = data.state && data.state.users;
  if (!Array.isArray(users) || !users.length) return;

  var identityToken, profileToken;

  for (var i = 0; i < users.length; i++) {
    var user = users[i];
    if (!user || typeof user !== 'object') continue;

    var resolved = resolveToken(user);
    if (!resolved) continue;

    if (!identityToken && resolved.state.indexOf('identity') !== -1) {
      identityToken = resolved.token;
    } else if (!profileToken && resolved.state.indexOf('profile') !== -1) {
      profileToken = resolved.token;
    }

    if (identityToken && profileToken) break;
  }

  _satellite.setVar('identityToken', identityToken);
  _satellite.setVar('profileToken', profileToken);
})();
// end token backup

window.centeneAnalyticsQueue = window.centeneAnalyticsQueue || [];

for (let i = 0; i < centeneAnalyticsQueue.length; i++) {
  if (!centeneAnalyticsQueue[i].isProcessed) {
    try {
      let e = centeneAnalyticsQueue[i];

      if (e && typeof e === 'object' && typeof e.event === 'object') {

        let fallbackToken = e?.data?._common?.user?.accesstoken || _satellite.getVar('profileToken') || _satellite.getVar('identityToken') || undefined;

        if (typeof e.data === 'object' && e.data !== null) {
          if (e.data.user && typeof e.data.user === 'object') {
            if (!e.data.user.accesstoken && typeof fallbackToken !== 'undefined') {
              e.data.user.accesstoken = fallbackToken;
            }
          } else if (!e.data.user && typeof fallbackToken !== 'undefined') {
            e.data.user = { accesstoken: fallbackToken };
          }
        } else if (typeof e.data === 'undefined' && typeof fallbackToken !== 'undefined') {
          e.data = { user: { accesstoken: fallbackToken } };
        }
      }
    } catch (err) {
      _satellite.logger.error('[UTILITY TOKEN RECOVERY ERROR]', err);
    }

    CenteneAnalytics.trackdata(centeneAnalyticsQueue[i]);
    centeneAnalyticsQueue[i].isProcessed = true;
  }
}

window.centeneAnalyticsQueue.push = function(e) {
    if (typeof CenteneAnalytics !== "undefined" && typeof CenteneAnalytics.trackdata !== "undefined") {

        if (e && typeof e === 'object' && typeof e.event === 'object') {
            try {
              var fallbackToken = e?.data?._common?.user?.accesstoken || _satellite.getVar('profileToken') || _satellite.getVar('identityToken') || undefined;

              if (typeof e.data === 'object' && e.data !== null) {
                if (e.data.user && typeof e.data.user === 'object') {
                  if (!e.data.user.accesstoken && typeof fallbackToken !== 'undefined') {
                    e.data.user.accesstoken = fallbackToken;
                  }
                } else if (!e.data.user && typeof fallbackToken !== 'undefined') {
                  e.data.user = { accesstoken: fallbackToken };
                }
              } else if (typeof e.data === 'undefined' && typeof fallbackToken !== 'undefined') {
                e.data = { user: { accesstoken: fallbackToken } };
              }
            } catch (err) {
                _satellite.logger.error('[UTILITY TOKEN RECOVERY ERROR]', err);
            }

            if (e.event.type === "custom") {
                e.event.pagename = _satellite.getVar("Page Name");
              
                try {
                   if (e?.data?.environment) {
                        const env = e.data.environment;

                        if (e.data.allocation === undefined && env.allocation !== undefined) {
                            e.data.allocation = env.allocation;
                        }

                        if (e.data.location === undefined && env.location !== undefined) {
                            e.data.location = env.location;
                        }
                    }
                }catch(err){}
            }
        }
      
        CenteneAnalytics.trackdata(e);
        e.isProcessed = true;

        return Array.prototype.push.apply(this, arguments);
    }
}

/******** Turn off documentUnloading in non-prod enviroments or via sessionStroage value ********/
CenteneAnalytics.setDocUnload = function (toggle) {
	try {
		if (toggle) {
			sessionStorage.setItem('disableAdobeBeacons',toggle.toString());
		}
	} catch(e) { }
}

CenteneAnalytics.docUnload = function() {
	try {
		var turnOffdocumentUnloading = false;
        var dlEnv = CenteneAnalytics?.DL?.data?.environment?.env || '';
		if (typeof dlEnv === 'string' && dlEnv !== '' && dlEnv.toLowerCase().indexOf('prod') === -1) {
			turnOffdocumentUnloading = true;
		} else if (sessionStorage.getItem('disableAdobeBeacons') === 'true') {
			turnOffdocumentUnloading = true;
		} else if (localStorage.getItem('com.adobe.reactor.debug') === 'true') {
			turnOffdocumentUnloading = true;
		} else if (_satellite.getVar('Launch Environment') != undefined && _satellite.getVar('Launch Environment').toLowerCase() != 'production') {
			turnOffdocumentUnloading = true;
		} else {
			var hostArr = window.location.hostname.split('.')
			if (hostArr[0].includes('stage') || hostArr[0].includes('dev') || hostArr[0].includes('test') || hostArr[0].includes('localhost')) {
				turnOffdocumentUnloading = true;
			}
		}

		if (turnOffdocumentUnloading) {
			var rules = _satellite?._container?.rules;
            if (Array.isArray(rules) && rules.length >= 1){
              for (var i=0; i<rules.length; i++) {
                  var actions = rules[i].actions;
                  for (var j=0; j<actions.length;j++) {
                      if (actions[j]?.settings?.documentUnloading == true) {
                          actions[j].settings.documentUnloading = false;
                      }
                  }
              }
            }
		}
	} catch(e) {
		_satellite.logger.info('error in turnOffdocumentUnloading',e)
	}
}
CenteneAnalytics.docUnload();

/******** handle persisted page views ********/
window.addEventListener('pageshow', (event)=> {
	_satellite.logger.info('pageshow',event)
	if (event.persisted && typeof window.CQ != 'undefined'){
		_satellite.logger.info('centeneAnalyticsQueue',centeneAnalyticsQueue)
		var index = centeneAnalyticsQueue.findLastIndex(
		  e => e.event?.type === 'page view'
		);
		if (index == -1) { return false }

		var eventToResend = JSON.parse(JSON.stringify(centeneAnalyticsQueue[index]));
		eventToResend.isProcessed = false;
		eventToResend.fired = '';
		eventToResend.data = eventToResend.data || {};
		eventToResend.data.isprerendered = true
		_satellite.logger.info('eventToResend',eventToResend)

		centeneAnalyticsQueue.push(eventToResend)
	}
});


_satellite["_runScript1"](function(event, target, Promise) {
 return alloy("getIdentity")
   .then(function(result) {
     _satellite.setVar("ECID", result.identity.ECID);
   });

});

_satellite["_runScript2"](function(event, target, Promise) {
var xidToken=_satellite.getVar("XID Token");"string"==typeof xidToken&&""!==xidToken?_satellite.setVar("pvIncludedXID","true"):_satellite.setVar("pvIncludedXID","false");
});

X-UA-Compatible

JQuery

Google-Analytics

What You Need to Know About Flu Shot

Tracking domain: smetrics.superiorhealthplan.com

smetrics.superiorhealthplan.com

Tracking domain: www.google-analytics.com

www.google-analytics.com

app.securiti.ai

www.google.com

Tracking domain: www.googletagmanager.com

www.googletagmanager.com

stats.g.doubleclick.net

adobedc.demdex.net

Tracking domain: region1.analytics.google.com

region1.analytics.google.com

View security analysis for https://wellcare.superiorhealthplan.com/member-resources/member-rights/health-and-wellness/wellness-connection/what-you-need-to-know-about-flu-shot.html

Requests	IP Address	Location	AS Autonomous System
14	52.222.236.83Cloudfront · CDN	United States	AS16509Amazon.com, Inc.
10	52.222.236.13Cloudfront · CDN	United States	AS16509Amazon.com, Inc.
10	142.251.127.95Google · CDN	United States	AS15169Google LLC
10	23.52.181.12	Frankfurt am Main, Hesse, Germany	AS16625Akamai Technologies, Inc.
10	142.251.153.119Google · CDN	United States	AS15169Google LLC
10	65.9.130.128Cloudfront · CDN	United States	AS16509Amazon.com, Inc.
10	142.251.110.95Google · CDN	United States	AS15169Google LLC
74	7	-	-

Security Scan Report: wellcare.superiorhealthplan.com

Summary

AI Security Verdict

Safe Website

Safety Factors

Details

Screenshot

Page Load Overview

Domain & IP Information

Detected Technologies3

Scan History