![](/screenshots/1e03fd2a-f595-4b53-b01b-b9182d9cd6fa.png)
safe.thomson.com
Open in
urlscan Pro
163.231.5.34
Public Scan
Effective URL: https://safe.thomson.com/auth/router?action=Login&ProtectionLevel=SAFE5&TYPE=33554433&REALMOID=06-b5029185-75c8-4f56-8a36...
Submission: On October 09 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by COMODO RSA Organization Validation Se... on September 11th 2020. Valid for: a year.
This is the only time safe.thomson.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 3 | 159.220.48.12 159.220.48.12 | 32067 (AS32067) (AS32067) | |
1 17 | 163.231.5.34 163.231.5.34 | 4583 (WESTPUB-A) (WESTPUB-A) | |
1 | 2a00:1450:400... 2a00:1450:4001:825::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:801::2008 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:81f::2008 | 15169 (GOOGLE) (GOOGLE) | |
19 | 4 |
ASN15169 (GOOGLE, US)
ssl.google-analytics.com |
ASN15169 (GOOGLE, US)
ssl.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
thomson.com
1 redirects
safe.thomson.com |
97 KB |
3 |
thomsonreuters.com
3 redirects
passwordmanager.thomsonreuters.com |
920 B |
2 |
google-analytics.com
ssl.google-analytics.com |
17 KB |
1 |
googleapis.com
ajax.googleapis.com |
31 KB |
19 | 4 |
Domain | Requested by | |
---|---|---|
17 | safe.thomson.com |
1 redirects
safe.thomson.com
ajax.googleapis.com |
3 | passwordmanager.thomsonreuters.com | 3 redirects |
2 | ssl.google-analytics.com |
safe.thomson.com
|
1 | ajax.googleapis.com |
safe.thomson.com
|
19 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.thomson.com COMODO RSA Organization Validation Secure Server CA |
2020-09-11 - 2021-09-11 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-09-22 - 2020-12-15 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1O1 |
2020-09-03 - 2020-11-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://safe.thomson.com/auth/router?action=Login&ProtectionLevel=SAFE5&TYPE=33554433&REALMOID=06-b5029185-75c8-4f56-8a36-4f624b040bfd&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$n2qz3amlrh%2fv1pvbHhSJQCz8zdlUtA0AaNNsYaIJHj76AJMQIG2Pit4IO61zEklf&TARGET=$SM$HTTPS%3a%2f%2fpasswordmanager%2ethomsonreuters%2ecom%2fhipm_tr%2fpsf%2eexe
Frame ID: CD63340165A28DA89D50F5C225B94462
Requests: 19 HTTP requests in this frame
Screenshot
![](/screenshots/1e03fd2a-f595-4b53-b01b-b9182d9cd6fa.png)
Page URL History Show full URLs
-
https://passwordmanager.thomsonreuters.com/
HTTP 302
https://passwordmanager.thomsonreuters.com/hipm_tr/psf.exe HTTP 302
https://safe.thomson.com/siteminderagent/SmMakeCookie.ccc?SMSESSION=QUERY&PERSIST=0&TARGET=$SM$https%... HTTP 302
https://passwordmanager.thomsonreuters.com/hipm_tr/psf.exe?SMSESSION=NO HTTP 302
https://safe.thomson.com/auth/router?action=Login&ProtectionLevel=SAFE5&TYPE=33554433&REALMOID=06-b50... Page URL
Detected technologies
![](/vendor/wappa/icons/WindowsServer.png)
Detected patterns
- headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
![](/vendor/wappa/icons/IIS.png)
Detected patterns
- headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://passwordmanager.thomsonreuters.com/
HTTP 302
https://passwordmanager.thomsonreuters.com/hipm_tr/psf.exe HTTP 302
https://safe.thomson.com/siteminderagent/SmMakeCookie.ccc?SMSESSION=QUERY&PERSIST=0&TARGET=$SM$https%3a%2f%2fpasswordmanager%2ethomsonreuters%2ecom%2fhipm_tr%2fpsf%2eexe HTTP 302
https://passwordmanager.thomsonreuters.com/hipm_tr/psf.exe?SMSESSION=NO HTTP 302
https://safe.thomson.com/auth/router?action=Login&ProtectionLevel=SAFE5&TYPE=33554433&REALMOID=06-b5029185-75c8-4f56-8a36-4f624b040bfd&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$n2qz3amlrh%2fv1pvbHhSJQCz8zdlUtA0AaNNsYaIJHj76AJMQIG2Pit4IO61zEklf&TARGET=$SM$HTTPS%3a%2f%2fpasswordmanager%2ethomsonreuters%2ecom%2fhipm_tr%2fpsf%2eexe Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
![]() safe.thomson.com/auth/ Redirect Chain
|
25 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style_min.css
safe.thomson.com/safe-ui/css/ |
19 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
respond.min.js
safe.thomson.com/safe-ui/js/ |
3 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
DwrMethodController.js
safe.thomson.com/auth/dwr/interface/ |
2 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
engine.js
safe.thomson.com/auth/dwr/ |
77 KB 25 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
util.js
safe.thomson.com/auth/dwr/ |
47 KB 15 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
captcha
safe.thomson.com/auth/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.6.1/ |
89 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
__System.pageLoaded.dwr
safe.thomson.com/auth/dwr/call/plaincall/ |
200 B 861 B |
XHR
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wrap-bg.png
safe.thomson.com/safe-ui/img/ |
952 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sprite.gif
safe.thomson.com/safe-ui/img/ |
10 KB 10 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
thomsonreuters_transparent.gif
safe.thomson.com/safe-ui/img/ |
5 KB 5 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
header-bg.gif
safe.thomson.com/safe-ui/img/ |
842 B 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-lock.png
safe.thomson.com/safe-ui/img/ |
543 B 804 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
input-bg.png
safe.thomson.com/safe-ui/img/ |
119 B 380 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga.js
ssl.google-analytics.com/ |
45 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
script.min.js
safe.thomson.com/safe-ui/js/ |
7 KB 3 KB |
XHR
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
__utm.gif
ssl.google-analytics.com/r/ |
35 B 386 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
plugins.min.js
safe.thomson.com/safe-ui/js/ |
24 KB 8 KB |
XHR
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
44 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| getQueryVariable object| respond string| jsSafeEnvironment string| envSuffix string| jsRoot string| cssRoot string| imageRoot string| docRoot string| dwrRoot string| dwrRoot2 undefined| SAFELogo object| dwr object| DwrMethodController string| httpMethod function| $ function| jQuery object| _gaq function| getCaptchaResults function| createSpan function| getCaptchaButtonText object| isMobile function| buildHTML object| jQuery16101389368531659878 object| _gat object| gaGlobal object| entityToCode object| charToEntity string| entityName function| UnescapeEntities function| EscapeEntities boolean| bInvalid string| completeHREF string| baseurl function| fireClickEvent function| getBaseUrl function| isDefined function| createMessageSpan function| invalidFrmInputs string| paramString function| log9 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.safe.thomson.com/ | Name: __utmb Value: 232658333.1.10.1602230720 |
|
.safe.thomson.com/ | Name: __utmt Value: 1 |
|
.safe.thomson.com/ | Name: __utmz Value: 232658333.1602230720.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none) |
|
.safe.thomson.com/ | Name: __utmc Value: 232658333 |
|
safe.thomson.com/auth | Name: safe2.protectionlevel Value: SAFE5 |
|
.safe.thomson.com/ | Name: __utma Value: 232658333.485629663.1602230720.1602230720.1602230720.1 |
|
safe.thomson.com/ | Name: JSESSIONID Value: 0000W3kmpN-74_F0NBurLkjvTcu:-1 |
|
safe.thomson.com/ | Name: BIGipServerSAFE-443 Value: 576251811.47873.0000 |
|
safe.thomson.com/auth | Name: safe2.target Value: HTTPS://passwordmanager.thomsonreuters.com/hipm_tr/psf.exe |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
passwordmanager.thomsonreuters.com
safe.thomson.com
ssl.google-analytics.com
159.220.48.12
163.231.5.34
2a00:1450:4001:801::2008
2a00:1450:4001:81f::2008
2a00:1450:4001:825::200a
02cf1424531a5cd6441fa74fb2cf625e2363c3df8e25aeccb77cb847769bf33a
0b077275b97f382827dd8c70f4ee8d7eccd1be9b9fab33a0800de5fdea82e79a
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
1628d9552e67d29d36791070b49c58c24462a8fb1e4386ad35c84ca529569c01
1740653fa0a0fd0aafd54ca0b8d375421d58e65b5836c12b9b33b2bd63557815
3d55f11a265e107bdbe4945dddaf4197a29d0bf050dce3ba5355cc2de2e2fc8c
4b198aa18aee57dac3edc7c450837c5c1c0e1ad81cd1cadb0d25aca72a8ab5f1
5f270b4dada904a5b43cbb16e3b1bf8201e60f4dccf96e158b62d15dd3baf58e
712bd07564cb32b21c51129e5b9fcaee8c79182473e16cdaacfe6ffadbd7a5eb
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
9f2d0ef5fe02cd3366e31fe7695d3b4f6b2844d30ca3d671dd1c726014d6067e
be135e2279b56f4dc64c4b104ac2aa151bb6ad95b31b9d7581f48f5f1aad6fd3
c531168567600088d6bc7f6663ba22c4d16883069b3a61f3c6a1bc539cf7ea90
c784376960f3163dc760bc019e72e5fed78203745a5510c69992a39d1d8fe776
c9b87a12835f4faa9901181d23a83eccd52804829f46c4551df0fa1a7385a238
d3f1c02cda72c02f23c27dbbb6604c3887d053c8e74203ea2ecd7df721f8e080
d407d69bd83898e45f38abe172695de9fdd5d045ec1ca6fffa7b583858efabb2
e54dc140bf29aa03bccecdd6ffc6c4c0b9c6320fcbf86c614b0b9cc7e9f4595c
f63903515e837208b0de93a9725b15ae86427d969574301b7d01e9d900e99872