fedauth.colorado.edu
Open in
urlscan Pro
128.138.129.198
Malicious Activity!
Public Scan
Effective URL: https://fedauth.colorado.edu/idp/profile/SAML2/Redirect/SSO;jsessionid=422B29873F2F5D818000F89991A365D1?execution=e1s1
Submission: On October 21 via automatic, source certstream-suspicious — Scanned from DE
Summary
TLS certificate: Issued by Sectigo RSA Organization Validation S... on May 30th 2020. Valid for: 2 years.
This is the only time fedauth.colorado.edu was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Orange (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 128.138.183.37 128.138.183.37 | 104 (COLORADO-AS) (COLORADO-AS) | |
2 2 | 18.205.218.45 18.205.218.45 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 5 | 128.138.129.198 128.138.129.198 | 104 (COLORADO-AS) (COLORADO-AS) | |
1 | 142.250.184.234 142.250.184.234 | 15169 (GOOGLE) (GOOGLE) | |
2 | 172.217.16.131 172.217.16.131 | 15169 (GOOGLE) (GOOGLE) | |
7 | 3 |
ASN104 (COLORADO-AS, US)
PTR: osr-misc01.colorado.edu
desktopsupport.colorado.edu |
ASN14618 (AMAZON-AES, US)
PTR: ec2-18-205-218-45.compute-1.amazonaws.com
oit.colorado.edu |
ASN104 (COLORADO-AS, US)
PTR: fedauth-comp.colorado.edu
fedauth.colorado.edu |
ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f10.1e100.net
fonts.googleapis.com |
ASN15169 (GOOGLE, US)
PTR: zrh04s06-in-f131.1e100.net
fonts.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
colorado.edu
4 redirects
desktopsupport.colorado.edu oit.colorado.edu fedauth.colorado.edu |
33 KB |
2 |
gstatic.com
fonts.gstatic.com |
32 KB |
1 |
googleapis.com
fonts.googleapis.com |
1 KB |
7 | 3 |
Domain | Requested by | |
---|---|---|
5 | fedauth.colorado.edu |
1 redirects
fedauth.colorado.edu
|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | oit.colorado.edu | 2 redirects |
1 | fonts.googleapis.com |
fedauth.colorado.edu
|
1 | desktopsupport.colorado.edu | 1 redirects |
7 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.colorado.edu |
oit.colorado.edu |
Subject Issuer | Validity | Valid | |
---|---|---|---|
fedauth.colorado.edu Sectigo RSA Organization Validation Secure Server CA |
2020-05-30 - 2022-05-30 |
2 years | crt.sh |
upload.video.google.com GTS CA 1C3 |
2021-10-04 - 2021-12-27 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2021-09-13 - 2021-11-20 |
2 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://fedauth.colorado.edu/idp/profile/SAML2/Redirect/SSO;jsessionid=422B29873F2F5D818000F89991A365D1?execution=e1s1
Frame ID: CA213D7A295075C46D9302E58E2F38DD
Requests: 7 HTTP requests in this frame
Screenshot
Page Title
Federated Identity Service | University of Colorado BoulderPage URL History Show full URLs
-
https://desktopsupport.colorado.edu/
HTTP 301
https://oit.colorado.edu/user/login?destination=node/16699/ HTTP 302
https://oit.colorado.edu/saml_login?destination=node/16699/ HTTP 302
https://fedauth.colorado.edu/idp/profile/SAML2/Redirect/SSO?SAMLRequest=fVLBbuIwEP2VyPdgCFClFiCxRatFYltE2... HTTP 302
https://fedauth.colorado.edu/idp/profile/SAML2/Redirect/SSO;jsessionid=422B29873F2F5D818000F89991A365D1?e... Page URL
Detected technologies
Google Font API (Font Scripts) ExpandDetected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Need help logging in?
Search URL Search Domain Scan URL
Title: Office of Information Technology
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Legal & Trademarks
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://desktopsupport.colorado.edu/
HTTP 301
https://oit.colorado.edu/user/login?destination=node/16699/ HTTP 302
https://oit.colorado.edu/saml_login?destination=node/16699/ HTTP 302
https://fedauth.colorado.edu/idp/profile/SAML2/Redirect/SSO?SAMLRequest=fVLBbuIwEP2VyPdgCFClFiCxRatFYltE2B56qRx7slhy7NQz3rZ%2FXye02nLhZPt53ps3z16gbG0n1pFO7gAvEZCyt9Y6FMPFksXghJdoUDjZAgpSolr%2F3oliNBZd8OSVt%2Bwb5TpDIkIg4x3Ltpsle76VjWrKZjav6%2Bm0kLpUBaimmZZlrWF2o8q6rmW%2Fm7HsEQIm5pIloURHjLB1SNJRgsbFJJ%2BM82JyHJdiMhdF%2BcSyTZrGOEkD60TUoeC8AS3TtKPk2wep%2FQh05EZ3PE3TGAu8N1vwA2gTQBGvqgeWrb9833mHsYVQQfhnFPw57P4re0OXqmjazkKfCm%2B9jhZG3anjwxnPa5FLhQOq4nPto9UQWLb%2FzPWHcdq4v9cjrc9FKH4dj%2Ft8%2F1Ad2WrRa4shorBKthb8O7A4v%2Fl9ktpu9t4a9Z799KGVdL1TjxidN0OpoCAdGnCU0rHWv94FkARLRiEC46tzy8uftfoA&RelayState=https%3A%2F%2Foit.colorado.edu%2Fsaml_login%3Fdestination%3Dnode%252F16699%252F&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=HTW4vLq2Um%2FtqI2MWCoRNiP%2FN5GQu%2BbNBQ%2BKxALIC9rGzrnX07%2FjYqPdkzhq25a4%2FIOaUNk1fCeANuVhW3ROlwRM%2FyWXNqehQbJSDuMzpD43byj2LHcfDsIzaORPX0M%2FGI5MkEjkZPsO6PLrB7UVUHEybfJ%2BO41LUL1TnPxCA%2FxJsOR8ZMe9nCz0na3yXRegCPbJ%2FvjSriIuJ5wfFQ%2BY4yn3ZiKbjzAvGOR7mUgQBlQ6GfrhHlCEkxazQaGHsteM6o8P1A9teylgkUCWigNDZeAVhDmxnWU9SFgHXOpAdr4sDevJR%2BEoq4rkJxFvXI3oaV2OjoyU9LRt1l8qlKqECooXAiwIMQciUGH3wm4QoKxOJnOla4eFwzeesTmfLtVGBW5kvfzozEk3lH8KL4YHNRiad8PGiLhg1wOvsTPplZfdF6Yosd73a6nZzXGXNpszG4wPoTIO7P5mD2ZvUGwKdvPgP99SskBhbYGomD0nWjD%2BIQy9LO6%2BrH1t8dIuXtRO HTTP 302
https://fedauth.colorado.edu/idp/profile/SAML2/Redirect/SSO;jsessionid=422B29873F2F5D818000F89991A365D1?execution=e1s1 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
SSO;jsessionid=422B29873F2F5D818000F89991A365D1
fedauth.colorado.edu/idp/profile/SAML2/Redirect/ Redirect Chain
|
6 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
6 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.css
fedauth.colorado.edu/idp/css/ |
7 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cu-boulder-logo-text-black.svg
fedauth.colorado.edu/idp//images/ |
15 KB 15 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
be-boulder-white.svg
fedauth.colorado.edu/idp/images/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Orange (Telecommunication)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster function| toggle function| toggleDos2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
fedauth.colorado.edu/idp/ | Name: JSESSIONID Value: 422B29873F2F5D818000F89991A365D1 |
|
oit.colorado.edu/ | Name: SimpleSAMLSessionID Value: 2585928cdb49b71374cd72bc5c47d8d6 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
desktopsupport.colorado.edu
fedauth.colorado.edu
fonts.googleapis.com
fonts.gstatic.com
oit.colorado.edu
128.138.129.198
128.138.183.37
142.250.184.234
172.217.16.131
18.205.218.45
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
27c373012970f2fc1608c8e62140c05c4961a3845221f503d5ea9242c9001fa0
94582966f3a08046e4f6b05276fe17cf7d9babc30fb844e85f5f7a37edd23c8f
afca10ddc92e394aab92a7ebd073102024edcbe2fa71ac8110d83bc60352419b
c3121377252e9afb656b5e8d23c619a1cead4545e31ed1fde80e9ad778391cbf
c9e31f9893030e21aa09eefaceacdd1775f6a789fea8c2245ba8ac57dad845c5
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca