auth.bath.ac.uk Open in urlscan Pro
138.38.0.116 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://testauth-php.matt.bath.ac.uk/
Effective URL:
https://auth.bath.ac.uk/login?service=https://testauth-php.matt.bath.ac.uk/
Submission: On January 18 via automatic, source certstream-suspicious (January 18th 2024, 12:29:56 pm UTC) — Scanned from GB

Summary HTTP 8 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 8 HTTP transactions. The main IP is 138.38.0.116, located in Radstock, United Kingdom and belongs to JANET Jisc Services Limited, GB. The main domain is auth.bath.ac.uk.
TLS certificate: Issued by GEANT OV RSA CA 4 on October 19th 2023. Valid for: a year.

This is the only time auth.bath.ac.uk was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	138.38.44.10 138.38.44.10	786 (JANET Jis...) (JANET Jisc Services Limited)
5	138.38.0.116 138.38.0.116	786 (JANET Jis...) (JANET Jisc Services Limited)
1	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
8	3

1 138.38.44.10 (Bristol, United Kingdom) 1 redirects

ASN786 (JANET Jisc Services Limited, GB)
PTR: matt.bath.ac.uk

testauth-php.matt.bath.ac.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 138.38.0.116 (Radstock, United Kingdom)

ASN786 (JANET Jisc Services Limited, GB)
PTR: auth.bath.ac.uk

auth.bath.ac.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	bath.ac.uk 1 redirects testauth-php.matt.bath.ac.uk auth.bath.ac.uk	196 KB
2	gstatic.com fonts.gstatic.com	81 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 28	2 KB
8	3

	Domain	Requested by
5	auth.bath.ac.uk	auth.bath.ac.uk
2	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	auth.bath.ac.uk
1	testauth-php.matt.bath.ac.uk	1 redirects
8	4

This site contains links to these domains. Also see Links.

Domain
www.bath.ac.uk

Subject Issuer	Validity	Valid
auth.bath.ac.uk GEANT OV RSA CA 4	`2023-10-19` - `2024-10-18`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-12-11` - `2024-03-04`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-12-11` - `2024-03-04`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://auth.bath.ac.uk/login?service=https://testauth-php.matt.bath.ac.uk/
Frame ID: DD99FFE73CBE039745C8A5FF7752337B
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

University of Bath Single Sign-on

Page URL History Show full URLs

https://testauth-php.matt.bath.ac.uk/ HTTP 302
https://auth.bath.ac.uk/login?service=https://testauth-php.matt.bath.ac.uk/ Page URL

Detected technologies

ZURB Foundation (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<div [^>]*class="[^"]*(?:small|medium|large)-\d{1,2} columns

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

8
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

278 kB
Transfer

295 kB
Size

1
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: http://www.bath.ac.uk/

Search URL Search Domain Scan URL

URL: https://www.bath.ac.uk/guides/change-or-reset-your-university-password/
Title: reset your password

Search URL Search Domain Scan URL

URL: http://www.bath.ac.uk/locations/it-service-desk/
Title: Report any issues on this page

Search URL Search Domain Scan URL

URL: http://www.bath.ac.uk/corporate-information/copyright/
Title: © University of Bath 2024

Search URL Search Domain Scan URL

URL: http://www.bath.ac.uk/corporate-information/disclaimer/
Title: Disclaimer

Search URL Search Domain Scan URL

URL: http://www.bath.ac.uk/foi/
Title: Freedom of information

Search URL Search Domain Scan URL

URL: http://www.bath.ac.uk/corporate-information/privacy-and-cookie-policy/
Title: Privacy and cookie policy

Search URL Search Domain Scan URL

URL: http://www.bath.ac.uk/index
Title: A–Z

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://testauth-php.matt.bath.ac.uk/ HTTP 302
https://auth.bath.ac.uk/login?service=https://testauth-php.matt.bath.ac.uk/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200

Primary Request login Show response
auth.bath.ac.uk/
Redirect Chain

https://testauth-php.matt.bath.ac.uk/
https://auth.bath.ac.uk/login?service=https://testauth-php.matt.bath.ac.uk/

10 KB
10 KB

290ms
54ms

Document
text/html

138.38.0.116
JANET Jisc Servic...

General

Check archive.org

Show headers Download Go to

Full URL: https://auth.bath.ac.uk/login?service=https://testauth-php.matt.bath.ac.uk/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 138.38.0.116 Radstock, United Kingdom, ASN786 (JANET Jisc Services Limited, GB),
Reverse DNS: auth.bath.ac.uk
Software: /
Resource Hash: 8505068f5f357ca15b44ca16c1b933d1a36ff938530decb365cb9f562810a7de

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

Cache-Control: no-store
Connection: keep-alive
Content-Language: en
Content-Type: text/html;charset=UTF-8
Date: Thu, 18 Jan 2024 12:29:52 GMT
Keep-Alive: timeout=60
Transfer-Encoding: chunked

Redirect headers

content-length: 0
date: Thu, 18 Jan 2024 12:29:51 GMT
location: https://auth.bath.ac.uk/login?service=https://testauth-php.matt.bath.ac.uk/
server: lighttpd/1.4.69

GET
H2 200 css
fonts.googleapis.com/ 21 KB
2 KB 176ms
63ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Noto+Sans:400,400i,700,700i|Noto+Serif:400,400i,700,700i&subset=cyrillic,latin-ext

Requested by

Host: auth.bath.ac.uk
URL: https://auth.bath.ac.uk/login?service=https://testauth-php.matt.bath.ac.uk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fd4e2459baefa4f7a5aa7beeeb81dac592702a55169a445b28ecc6477eb06fa3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://auth.bath.ac.uk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 18 Jan 2024 12:29:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 18 Jan 2024 12:29:52 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 18 Jan 2024 12:29:52 GMT

GET
H/1.1 200 sso.css
auth.bath.ac.uk/css/ 135 KB
135 KB 51ms
51ms Stylesheet
text/css 138.38.0.116
JANET Jisc Servic...

General

Check archive.org

Show headers Download Go to

Full URL: https://auth.bath.ac.uk/css/sso.css
Requested by: Host: auth.bath.ac.uk
URL: https://auth.bath.ac.uk/login?service=https://testauth-php.matt.bath.ac.uk/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 138.38.0.116 Radstock, United Kingdom, ASN786 (JANET Jisc Services Limited, GB),
Reverse DNS: auth.bath.ac.uk
Software: /
Resource Hash: 158087d46d2d7dfc2d5375874b314a4d0208d60e4085574c6742efd1c8cd373a

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://auth.bath.ac.uk/login?service=https://testauth-php.matt.bath.ac.uk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Thu, 18 Jan 2024 12:29:52 GMT
Last-Modified: Thu, 14 Jul 2022 22:19:26 GMT
ETag: W/"138395-1657837166000"
Content-Type: text/css;charset=UTF-8
Cache-Control: private
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=60
Content-Length: 138395

GET
H/1.1 200 uob-logo-inverse.svg
auth.bath.ac.uk/images/ 38 KB
39 KB 205ms
101ms Image
image/svg+xml 138.38.0.116
JANET Jisc Servic...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth.bath.ac.uk/images/uob-logo-inverse.svg
Requested by: Host: auth.bath.ac.uk
URL: https://auth.bath.ac.uk/login?service=https://testauth-php.matt.bath.ac.uk/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 138.38.0.116 Radstock, United Kingdom, ASN786 (JANET Jisc Services Limited, GB),
Reverse DNS: auth.bath.ac.uk
Software: /
Resource Hash: 3fb22c1cbde828ac058e94132891ae5b69dbbedd32a2ee3f851a4a7e193d8322

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://auth.bath.ac.uk/login?service=https://testauth-php.matt.bath.ac.uk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Thu, 18 Jan 2024 12:29:52 GMT
Last-Modified: Thu, 14 Jul 2022 22:19:26 GMT
ETag: W/"39417-1657837166000"
Content-Type: image/svg+xml;charset=UTF-8
Cache-Control: private
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=60
Content-Length: 39417

GET
H/1.1 200 webapp.png
auth.bath.ac.uk/images/ 10 KB
10 KB 156ms
53ms Image
image/png 138.38.0.116
JANET Jisc Servic...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth.bath.ac.uk/images/webapp.png
Requested by: Host: auth.bath.ac.uk
URL: https://auth.bath.ac.uk/login?service=https://testauth-php.matt.bath.ac.uk/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 138.38.0.116 Radstock, United Kingdom, ASN786 (JANET Jisc Services Limited, GB),
Reverse DNS: auth.bath.ac.uk
Software: /
Resource Hash: 8914a6f5b1291a5f2c2491ce80bb3e991f128400121c5f6fdb17cd943e970c57

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://auth.bath.ac.uk/login?service=https://testauth-php.matt.bath.ac.uk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Thu, 18 Jan 2024 12:29:52 GMT
Last-Modified: Wed, 28 Sep 2016 11:11:30 GMT
ETag: W/"10166-1475061090000"
Content-Type: image/png;charset=UTF-8
Cache-Control: private
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=60
Content-Length: 10166

GET
H/1.1 200 warning.png
auth.bath.ac.uk/images/ 602 B
885 B 154ms
51ms Image
image/png 138.38.0.116
JANET Jisc Servic...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth.bath.ac.uk/images/warning.png
Requested by: Host: auth.bath.ac.uk
URL: https://auth.bath.ac.uk/login?service=https://testauth-php.matt.bath.ac.uk/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 138.38.0.116 Radstock, United Kingdom, ASN786 (JANET Jisc Services Limited, GB),
Reverse DNS: auth.bath.ac.uk
Software: /
Resource Hash: b674d1a684594ed6baacc296940e411a4d0a3ca75a354b8e49c6e1baf5931904

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://auth.bath.ac.uk/login?service=https://testauth-php.matt.bath.ac.uk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Thu, 18 Jan 2024 12:29:52 GMT
Last-Modified: Wed, 28 Sep 2016 11:11:30 GMT
ETag: W/"602-1475061090000"
Content-Type: image/png;charset=UTF-8
Cache-Control: private
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=60
Content-Length: 602

GET
H2 200 ga6daw1J5X9T9RW6j9bNVls-hfgvz8JcMofYTYf6D30.woff2
fonts.gstatic.com/s/notoserif/v23/ 42 KB
43 KB 164ms
53ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/notoserif/v23/ga6daw1J5X9T9RW6j9bNVls-hfgvz8JcMofYTYf6D30.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Noto+Sans:400,400i,700,700i|Noto+Serif:400,400i,700,700i&subset=cyrillic,latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9d3959df4ebd84904a1622b6d7c9728f487e0c4d372f9bc2f59d0c480702f9c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://auth.bath.ac.uk
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 17 Jan 2024 02:07:40 GMT
x-content-type-options: nosniff
age: 123732
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43212
x-xss-protection: 0
last-modified: Tue, 24 Oct 2023 00:59:26 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 16 Jan 2025 02:07:40 GMT

GET
H2 200 o-0bIpQlx3QUlC5A4PNB6Ryti20_6n1iPHjc5a7duw.woff2
fonts.gstatic.com/s/notosans/v35/ 39 KB
39 KB 224ms
114ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/notosans/v35/o-0bIpQlx3QUlC5A4PNB6Ryti20_6n1iPHjc5a7duw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Noto+Sans:400,400i,700,700i|Noto+Serif:400,400i,700,700i&subset=cyrillic,latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7ce617e28c528cae254492f317057575634a707c324c4bcaa253f6a576cd8926

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://auth.bath.ac.uk
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 18:09:58 GMT
x-content-type-options: nosniff
age: 152394
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39552
x-xss-protection: 0
last-modified: Wed, 29 Nov 2023 20:09:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 15 Jan 2025 18:09:58 GMT

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			auth.bath.ac.uk/	1969-12-31 23:59:59	Name: JSESSIONID Value: EAC9F7B690882399231E5258A5F3CF6D

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

auth.bath.ac.uk
fonts.googleapis.com
fonts.gstatic.com
testauth-php.matt.bath.ac.uk
138.38.0.116
138.38.44.10
2a00:1450:4001:813::2003
2a00:1450:4001:830::200a
158087d46d2d7dfc2d5375874b314a4d0208d60e4085574c6742efd1c8cd373a
3fb22c1cbde828ac058e94132891ae5b69dbbedd32a2ee3f851a4a7e193d8322
7ce617e28c528cae254492f317057575634a707c324c4bcaa253f6a576cd8926
8505068f5f357ca15b44ca16c1b933d1a36ff938530decb365cb9f562810a7de
8914a6f5b1291a5f2c2491ce80bb3e991f128400121c5f6fdb17cd943e970c57
9d3959df4ebd84904a1622b6d7c9728f487e0c4d372f9bc2f59d0c480702f9c5
b674d1a684594ed6baacc296940e411a4d0a3ca75a354b8e49c6e1baf5931904
fd4e2459baefa4f7a5aa7beeeb81dac592702a55169a445b28ecc6477eb06fa3

auth.bath.ac.uk Open in urlscan Pro 138.38.0.116 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

50 %IPv6

3 Domains

4 Subdomains

3 IPs

2 Countries

278 kBTransfer

295 kBSize

1 Cookies

8 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

1 Cookies

Indicators

auth.bath.ac.uk Open in urlscan Pro
138.38.0.116 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

278 kB
Transfer

295 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions