stitchfix.onelogin.com
Open in
urlscan Pro
18.216.23.70
Public Scan
Effective URL: https://stitchfix.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmkiOiJodHRwczovL3N0aXRjaGZpeC5vbmVsb2dp...
Submission: On July 18 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on May 5th 2020. Valid for: a year.
This is the only time stitchfix.onelogin.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 52.22.52.234 52.22.52.234 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 1 | 52.203.26.4 52.203.26.4 | 14618 (AMAZON-AES) (AMAZON-AES) | |
2 7 | 18.216.23.70 18.216.23.70 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:4001:81e::200a | 15169 (GOOGLE) (GOOGLE) | |
3 | 13.224.194.3 13.224.194.3 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 2600:9000:20e... 2600:9000:20eb:c600:18:b15c:ee80:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 52.34.255.199 52.34.255.199 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:4001:818::2003 | 15169 (GOOGLE) (GOOGLE) | |
14 | 7 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-22-52-234.compute-1.amazonaws.com
financial-transaction-service.staging.stitchfix.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-203-26-4.compute-1.amazonaws.com
admin-auth-service.staging.stitchfix.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-216-23-70.us-east-2.compute.amazonaws.com
stitchfix.onelogin.com |
ASN16509 (AMAZON-02, US)
PTR: server-13-224-194-3.fra2.r.cloudfront.net
cdn.onelogin.com |
ASN16509 (AMAZON-02, US)
web-login-v2-cdn.onelogin.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-34-255-199.us-west-2.compute.amazonaws.com
desktop-us.onelogin.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
onelogin.com
2 redirects
stitchfix.onelogin.com cdn.onelogin.com web-login-v2-cdn.onelogin.com desktop-us.onelogin.com |
1 MB |
2 |
stitchfix.com
2 redirects
financial-transaction-service.staging.stitchfix.com admin-auth-service.staging.stitchfix.com |
2 KB |
1 |
gstatic.com
fonts.gstatic.com |
11 KB |
1 |
googleapis.com
fonts.googleapis.com |
761 B |
14 | 4 |
Domain | Requested by | |
---|---|---|
7 | stitchfix.onelogin.com |
2 redirects
web-login-v2-cdn.onelogin.com
cdn.onelogin.com |
3 | web-login-v2-cdn.onelogin.com |
stitchfix.onelogin.com
|
3 | cdn.onelogin.com |
stitchfix.onelogin.com
web-login-v2-cdn.onelogin.com |
1 | fonts.gstatic.com |
web-login-v2-cdn.onelogin.com
|
1 | desktop-us.onelogin.com |
web-login-v2-cdn.onelogin.com
|
1 | fonts.googleapis.com |
stitchfix.onelogin.com
|
1 | admin-auth-service.staging.stitchfix.com | 1 redirects |
1 | financial-transaction-service.staging.stitchfix.com | 1 redirects |
14 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.onelogin.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.onelogin.com DigiCert SHA2 Secure Server CA |
2020-05-05 - 2021-05-10 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-06-30 - 2020-09-22 |
3 months | crt.sh |
cdn.onelogin.com Amazon |
2020-05-31 - 2021-06-30 |
a year | crt.sh |
*.gstatic.com GTS CA 1O1 |
2020-06-30 - 2020-09-22 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://stitchfix.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmkiOiJodHRwczovL3N0aXRjaGZpeC5vbmVsb2dpbi5jb20vdHJ1c3Qvc2FtbDIvaHR0cC1yZWRpcmVjdC9zc28vNjQ4NTMzP3NhbWxfcmVxdWVzdF9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA0Mi5lNGMwYjc2ZWM5OGM3NjMzNmIwM2U5MWJlOGZkZjA0YjFkNmJjNTlmLk9EQlotLWxteUU5alVHY3g1alYtS1p3UUE4M09DaHl2MllTcWtwWUx3TjQlM0QiLCJub3RpZmljYXRpb24iOnsibWVzc2FnZSI6IkNvbm5lY3RpbmcgdG8gQXBwbGljYXRpb24iLCJpY29uIjoiY29ubmVjdGlvbiIsInR5cGUiOiJpbmZvIn0sImlzcyI6Ik1PTk9SQUlMIiwiYXVkIjoiQUNDRVNTIiwiZXhwIjoxNTk1MDM1NTY2LCJwYXJhbXMiOnt9LCJtZXRob2QiOiJnZXQifQ.18VZmRjhOeX7qT9LcNLEjoaAMHnzOdb8zmnNP9H4Md0
Frame ID: 2F102CCB317524F0F18AEAA5056ACAF4
Requests: 14 HTTP requests in this frame
Frame:
https://desktop-us.onelogin.com/
Frame ID: 42918609F02981A7AF2349ACF33B1092
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://financial-transaction-service.staging.stitchfix.com/
HTTP 302
https://admin-auth-service.staging.stitchfix.com/login/saml/onelogin?app_description=&app_name=FinancialTransactionService&ca... HTTP 302
https://stitchfix.onelogin.com/trust/saml2/http-redirect/sso/648533?RelayState=eyJvcmlnaW4iOiJodHRwczovL2Zp... HTTP 302
https://stitchfix.onelogin.com/login HTTP 302
https://stitchfix.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmkiOiJodHRwczovL3N0... Page URL
Detected technologies
Amazon Web Services (PaaS) ExpandDetected patterns
- headers server /^AmazonS3$/i
Amazon S3 (Miscellaneous) Expand
Detected patterns
- headers server /^AmazonS3$/i
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: Powered by OneLogin
Search URL Search Domain Scan URL
Title: Terms
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://financial-transaction-service.staging.stitchfix.com/
HTTP 302
https://admin-auth-service.staging.stitchfix.com/login/saml/onelogin?app_description=&app_name=FinancialTransactionService&callback_prefix=&origin=https%3A%2F%2Ffinancial-transaction-service.staging.stitchfix.com%2F&scanner=false&show_sso_login=false&use_role_bit_set=true HTTP 302
https://stitchfix.onelogin.com/trust/saml2/http-redirect/sso/648533?RelayState=eyJvcmlnaW4iOiJodHRwczovL2ZpbmFuY2lhbC10cmFuc2FjdGlvbi1zZXJ2aWNlLnN0YWdpbmcuc3RpdGNoZml4LmNvbS8iLCJjYWxsYmFja19wcmVmaXgiOiIiLCJpbmNsdWRlX2V4dGVuZGVkX3JvbGVzIjpmYWxzZSwidXNlX3JvbGVfYml0X3NldCI6dHJ1ZSwiYXVkaWVuY2UiOiJmaW5hbmNpYWwtdHJhbnNhY3Rpb24tc2VydmljZS5zdGFnaW5nLnN0aXRjaGZpeC5jb20ifQ%3D%3D&SAMLRequest=nFJNb9NAEP0rq73b6zptiVa1pZAUsBRaKzEcuKDFniYjeWfNzhjaf4%2FstGq5RILrznv7PmZu2Pl%2BsKtRjrSDnyOwqEffE9tpUOgxkg2OkS05D2yltfvV563N08w6ZoiCgfQbynCeM8QgoQ29VtWm0LvbfX27br5v7z9Wd1p9hcgYqNB5mmlVMY9QEYsjKXSe5VmSvUsulk12YfOFza7S68vlN602wILkZGYeRQa2xrCgtMcHfEwDQR8OSGkbvJE4spjJZ24maBKhwwitGOZgri%2BXV4uFVquXYOtAPHqIe4i%2FsIUvu%2B2rgus8UuJGOSZ8Gqcs7oB0SF%2FFJ80JAiTYOoFZ2rxY0qp%2BruM9Uod0ON%2FdjxOI7aemqZP6ft%2Foct6fnauK6kOI3sn5T6YX7JKHGWonX%2FKky38ONefwIK5z4m7MGxfl80ndOQ%2FVpg49tk%2F%2F4UyiI0Yg0WrV9%2BH3OoITKLTEEbQpT5J%2FH275JwAA%2F%2F8%3D HTTP 302
https://stitchfix.onelogin.com/login HTTP 302
https://stitchfix.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmkiOiJodHRwczovL3N0aXRjaGZpeC5vbmVsb2dpbi5jb20vdHJ1c3Qvc2FtbDIvaHR0cC1yZWRpcmVjdC9zc28vNjQ4NTMzP3NhbWxfcmVxdWVzdF9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA0Mi5lNGMwYjc2ZWM5OGM3NjMzNmIwM2U5MWJlOGZkZjA0YjFkNmJjNTlmLk9EQlotLWxteUU5alVHY3g1alYtS1p3UUE4M09DaHl2MllTcWtwWUx3TjQlM0QiLCJub3RpZmljYXRpb24iOnsibWVzc2FnZSI6IkNvbm5lY3RpbmcgdG8gQXBwbGljYXRpb24iLCJpY29uIjoiY29ubmVjdGlvbiIsInR5cGUiOiJpbmZvIn0sImlzcyI6Ik1PTk9SQUlMIiwiYXVkIjoiQUNDRVNTIiwiZXhwIjoxNTk1MDM1NTY2LCJwYXJhbXMiOnt9LCJtZXRob2QiOiJnZXQifQ.18VZmRjhOeX7qT9LcNLEjoaAMHnzOdb8zmnNP9H4Md0 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
/
stitchfix.onelogin.com/login2/ Redirect Chain
|
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
5 KB 761 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
onelogin-vigilance.min.js
cdn.onelogin.com/ |
361 KB 362 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendord096c1782733d573e6dbe05e6b79012fba240c0b.js
web-login-v2-cdn.onelogin.com/login2/ |
177 KB 56 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
intld096c1782733d573e6dbe05e6b79012fba240c0b.js
web-login-v2-cdn.onelogin.com/login2/ |
44 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
appd096c1782733d573e6dbe05e6b79012fba240c0b.js
web-login-v2-cdn.onelogin.com/login2/ |
2 MB 544 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
auth
stitchfix.onelogin.com/access/ |
2 KB 3 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
branding.json
stitchfix.onelogin.com/api/v1/ |
2 KB 3 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
nonce
stitchfix.onelogin.com/access/ |
128 B 658 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
Cookie set
/
desktop-us.onelogin.com/ Frame 4291 |
1 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ce40301a5f445dc88b332a3d2675df755658ec3e.jpg
cdn.onelogin.com/images/brands/backgrounds/login/ |
136 KB 136 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
31350bca15afdae2d010b304a3a9f3d051c7ae68.png
cdn.onelogin.com/images/brands/logos/login/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
nonce_verify
stitchfix.onelogin.com/access/ |
63 B 694 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| thisdata function| webpackJsonp object| IntlPolyfill object| core object| __core-js_shared__ object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.onelogin.com/ | Name: ol_login_rules_canary_0 Value: false |
|
stitchfix.onelogin.com/ | Name: sub_session_onelogin.com Value: BAh7CCIfYnJvd3Nlcl92ZXJpZmljYXRpb25fdG9rZW4iRTNhNWZlNmUxNTUxZmVmN2YxYTkzMmRmYTI1MTM5MWIyZTNhODVmNzgxZjc3NDdmNjRiZDZkNTYxNmJkYzNkYzY6DnJldHVybl90byIBwGh0dHBzOi8vc3RpdGNoZml4Lm9uZWxvZ2luLmNvbS90cnVzdC9zYW1sMi9odHRwLXJlZGlyZWN0L3Nzby82NDg1MzM%2Fc2FtbF9yZXF1ZXN0X3BhcmFtc190b2tlbj1mOTdmYjY4MDQyLmU0YzBiNzZlYzk4Yzc2MzM2YjAzZTkxYmU4ZmRmMDRiMWQ2YmM1OWYuT0RCWi0tbG15RTlqVUdjeDVqVi1LWndRQTgzT0NoeXYyWVNxa3BZTHdONCUzRDoPc2Vzc2lvbl9pZCIpMWQyMTg2YmMtZGQyMy00OWExLWFlZmItYWI3Y2UwN2JmOTVk--0595137e808470e27770dedaa934477ae5c54aab |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
admin-auth-service.staging.stitchfix.com
cdn.onelogin.com
desktop-us.onelogin.com
financial-transaction-service.staging.stitchfix.com
fonts.googleapis.com
fonts.gstatic.com
stitchfix.onelogin.com
web-login-v2-cdn.onelogin.com
13.224.194.3
18.216.23.70
2600:9000:20eb:c600:18:b15c:ee80:93a1
2a00:1450:4001:818::2003
2a00:1450:4001:81e::200a
52.203.26.4
52.22.52.234
52.34.255.199
072cfad7c9566c180d5840017914756732c6bfc461c870af0f91601190c02fff
201b9f664da369ea42d21b73fe9a035813e902dece2dd8dac056bb093b8413ad
2b5ef628b0372e608ccff13d79961f463c9368cb3966df0f8d048c7740529119
430b1cb260c43ca62cb0f4206556a023f24c68821daf23fe92288f1099002ff6
57c67289c2201efef75d7ca5947f483f49c02304ce5ba3f3572fd87a4d212a5a
5cebf1a07eb6b4beddcb61ce0398559e3de2710aa53a80302f2d52b46263d5e0
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
8f210ae2e7a86aa66f6b9ae9542c61f0decafb78eb6d3c49bf5daefff051055e
c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc
d709bb755b4ef254b7c9d4dead27057e282131d81ef4bdf17487dddb32b4dccd
e2e33adc4b4b1fd09f4385641a21d78dfca6b96629827f0e6a30829587815cde
e353a85db1817d37c7b72d3c661b4c3ff2107a7ddd15263b77ac2c14fead0525
edfa51b27606267a7e0f672c82e68e22f9ae42ac09d4e11d88155d7b4cee05cb
eef376d9ba561b179c4d943f37c824d7453c6dd2d415ef98543234d2fedd3f37
fcfe87b25c780693378d1b7a068afd7ee1d5b2cf65c150be6477dc261bdc7ce5