urlscan.io logo urlscan.io
SecurityTrails logo

gtam.login.duosecurity.com Open in urlscan Pro
75.2.30.150  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://secure.gtm.goldentree.com/
Effective URL: https://gtam.login.duosecurity.com/email_first?authkey=ASGWRLQ9PJFQQNOK69C7&aid=1b3ea640d6cd428691735e731af84c74
Submission: On July 21 via automatic, source certstream-suspicious — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 75.2.30.150, located in United States and belongs to AMAZON-02, US. The main domain is gtam.login.duosecurity.com.
TLS certificate: Issued by Amazon on May 25th 2022. Valid for: a year.
This is the only time gtam.login.duosecurity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2 64.238.144.210 62 (CONE)
1 6 75.2.30.150 16509 (AMAZON-02)
6 2
Apex Domain
Subdomains		 Transfer
6 duosecurity.com
sso-07f32f30.sso.duosecurity.com
gtam.login.duosecurity.com
367 KB
2 goldentree.com
secure.gtm.goldentree.com
2 KB
6 2
Domain Requested by
5 gtam.login.duosecurity.com gtam.login.duosecurity.com
2 secure.gtm.goldentree.com 1 redirects
1 sso-07f32f30.sso.duosecurity.com 1 redirects
6 3

This site contains no links.

Subject Issuer Validity Valid
secure.goldentree.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-07-31 -
2022-08-03		 a year crt.sh
*.login.duosecurity.com
Amazon		 2022-05-25 -
2023-06-23		 a year crt.sh

This page contains 1 frames:

Primary Page: https://gtam.login.duosecurity.com/email_first?authkey=ASGWRLQ9PJFQQNOK69C7&aid=1b3ea640d6cd428691735e731af84c74
Frame ID: F4E38FBBA265BD12F1B67311A472731A
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Login

Page URL History Show full URLs

  1. https://secure.gtm.goldentree.com/ HTTP 302
    https://secure.gtm.goldentree.com/my.policy Page URL
  2. https://sso-07f32f30.sso.duosecurity.com/saml2/sp/DIYUBYVWQ5XBSG7CJRKC/sso HTTP 302
    https://gtam.login.duosecurity.com/email_first?authkey=ASGWRLQ9PJFQQNOK69C7&aid=1b3ea640d6cd428691735e731af84c74 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

2
IPs

1
Countries

368 kB
Transfer

1144 kB
Size

7
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://secure.gtm.goldentree.com/ HTTP 302
    https://secure.gtm.goldentree.com/my.policy Page URL
  2. https://sso-07f32f30.sso.duosecurity.com/saml2/sp/DIYUBYVWQ5XBSG7CJRKC/sso HTTP 302
    https://gtam.login.duosecurity.com/email_first?authkey=ASGWRLQ9PJFQQNOK69C7&aid=1b3ea640d6cd428691735e731af84c74 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://secure.gtm.goldentree.com/ HTTP 302
  • https://secure.gtm.goldentree.com/my.policy

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
my.policy
secure.gtm.goldentree.com/
Redirect Chain
  • https://secure.gtm.goldentree.com/
  • https://secure.gtm.goldentree.com/my.policy
1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://secure.gtm.goldentree.com/my.policy
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
64.238.144.210 Queens, United States, ASN62 (CONE, US),
Reverse DNS
64-238-144-210.cyrusone.com
Software
BigIP /
Resource Hash
6eaccc9b4516418afcd0cf9fc6dd28b05a0b228d3b13aa1a985039c341fd6142
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains
X-Frame-Options DENY

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store
Connection
close
Content-Length
1492
Content-Type
text/html; charset=ISO-8859-1
Date
Thu, 21 Jul 2022 15:34:46 GMT
Server
BigIP
Strict-Transport-Security
max-age=16070400; includeSubDomains
X-Frame-Options
DENY

Redirect headers

Connection
close
Content-Length
0
Location
/my.policy
Server
BigIP
Strict-Transport-Security
max-age=16070400; includeSubDomains
Primary Request email_first
gtam.login.duosecurity.com/
Redirect Chain
  • https://sso-07f32f30.sso.duosecurity.com/saml2/sp/DIYUBYVWQ5XBSG7CJRKC/sso
  • https://gtam.login.duosecurity.com/email_first?authkey=ASGWRLQ9PJFQQNOK69C7&aid=1b3ea640d6cd428691735e731af84c74
2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gtam.login.duosecurity.com/email_first?authkey=ASGWRLQ9PJFQQNOK69C7&aid=1b3ea640d6cd428691735e731af84c74
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
75.2.30.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb043b6cb0f8a076.awsglobalaccelerator.com
Software
Duo/1.0 /
Resource Hash
6559b83a9653d7b6cdcc9bc1b7ea5995a8b5c41834b9646769512b4c42492526
Security Headers
Name Value
Content-Security-Policy default-src 'none'; style-src 'self' https://uw2.pwl.login.duosecurity.com; script-src 'self' https://uw2.pwl.login.duosecurity.com; font-src 'self'; frame-src 'self' com-duosecurity-devicehealth://*; frame-ancestors 'none'; img-src 'self' https://uw2.pwl.login.duosecurity.com; connect-src 'self' https://uw2.pwl.login.duosecurity.com https://127.0.0.1:53100 https://127.0.0.1:53101 https://127.0.0.1:53102 https://127.0.0.1:53103 https://127.0.0.1:53104 https://127.0.0.1:53105 https://127.0.0.1:63100 https://127.0.0.1:63101 http://127.0.0.1:53106 http://127.0.0.1:53107 http://127.0.0.1:53108 http://127.0.0.1:53109 http://127.0.0.1:53110 http://127.0.0.1:53111 https://localhost:53100 https://localhost:53101 https://localhost:53102 https://localhost:53103 https://localhost:53104 https://localhost:53105 https://localhost:63100 https://localhost:63101
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://secure.gtm.goldentree.com
Referer
https://secure.gtm.goldentree.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-security-policy
default-src 'none'; style-src 'self' https://uw2.pwl.login.duosecurity.com; script-src 'self' https://uw2.pwl.login.duosecurity.com; font-src 'self'; frame-src 'self' com-duosecurity-devicehealth://*; frame-ancestors 'none'; img-src 'self' https://uw2.pwl.login.duosecurity.com; connect-src 'self' https://uw2.pwl.login.duosecurity.com https://127.0.0.1:53100 https://127.0.0.1:53101 https://127.0.0.1:53102 https://127.0.0.1:53103 https://127.0.0.1:53104 https://127.0.0.1:53105 https://127.0.0.1:63100 https://127.0.0.1:63101 http://127.0.0.1:53106 http://127.0.0.1:53107 http://127.0.0.1:53108 http://127.0.0.1:53109 http://127.0.0.1:53110 http://127.0.0.1:53111 https://localhost:53100 https://localhost:53101 https://localhost:53102 https://localhost:53103 https://localhost:53104 https://localhost:53105 https://localhost:63100 https://localhost:63101
content-type
text/html; charset=UTF-8
date
Thu, 21 Jul 2022 15:34:47 GMT
etag
W/"5b3f2e1adbc5bc2660b91ee6d8452c7e3c564142"
server
Duo/1.0
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
x-duo-endpoint-health-appserver-url
https://127.0.0.1:53100 https://127.0.0.1:53101 https://127.0.0.1:53102 https://127.0.0.1:53103 https://127.0.0.1:53104 https://127.0.0.1:53105 https://127.0.0.1:63100 https://127.0.0.1:63101 http://127.0.0.1:53106 http://127.0.0.1:53107 http://127.0.0.1:53108 http://127.0.0.1:53109 http://127.0.0.1:53110 http://127.0.0.1:53111 https://localhost:53100 https://localhost:53101 https://localhost:53102 https://localhost:53103 https://localhost:53104 https://localhost:53105 https://localhost:63100 https://localhost:63101
x-duo-endpoint-health-uri
com-duosecurity-devicehealth://*
x-frame-options
DENY
x-robots-tag
noindex, nofollow
x-xss-protection
1; mode=block

Redirect headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
content-security-policy
default-src 'none'; style-src 'self' https://uw2.pwl.login.duosecurity.com; script-src 'self' https://uw2.pwl.login.duosecurity.com; font-src 'self'; frame-src 'self' ; frame-ancestors 'none'; img-src 'self' https://uw2.pwl.login.duosecurity.com; connect-src 'self' https://uw2.pwl.login.duosecurity.com
content-type
text/html; charset=UTF-8
date
Thu, 21 Jul 2022 15:34:47 GMT
expires
0
location
https://gtam.login.duosecurity.com/email_first?authkey=ASGWRLQ9PJFQQNOK69C7&aid=1b3ea640d6cd428691735e731af84c74
pragma
no-cache
server
Duo/1.0
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
x-frame-options
DENY
x-robots-tag
noindex, nofollow
x-xss-protection
1; mode=block
email-first.css
gtam.login.duosecurity.com/static/css/page/ 		62 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://gtam.login.duosecurity.com/static/css/page/email-first.css?v=74ac7
Requested by
Host: gtam.login.duosecurity.com
URL: https://gtam.login.duosecurity.com/email_first?authkey=ASGWRLQ9PJFQQNOK69C7&aid=1b3ea640d6cd428691735e731af84c74
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
75.2.30.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb043b6cb0f8a076.awsglobalaccelerator.com
Software
Duo/1.0 /
Resource Hash
74ac79c5eb135775ab4863d23d1b4e05efb97ba5249b3ef1e8b97064b9647ec6
Security Headers
Name Value
Content-Security-Policy default-src 'none'; style-src 'self' https://uw2.pwl.login.duosecurity.com; script-src 'self' https://uw2.pwl.login.duosecurity.com; font-src 'self'; frame-src 'self' ; frame-ancestors 'none'; img-src 'self' https://uw2.pwl.login.duosecurity.com; connect-src 'self' https://uw2.pwl.login.duosecurity.com
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://gtam.login.duosecurity.com/email_first?authkey=ASGWRLQ9PJFQQNOK69C7&aid=1b3ea640d6cd428691735e731af84c74
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 21 Jul 2022 15:34:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 15 Jul 2022 19:33:30 GMT
server
Duo/1.0
etag
W/"62d1c10a-f772"
x-frame-options
DENY
content-type
text/css
cache-control
max-age=315360000
content-security-policy
default-src 'none'; style-src 'self' https://uw2.pwl.login.duosecurity.com; script-src 'self' https://uw2.pwl.login.duosecurity.com; font-src 'self'; frame-src 'self' ; frame-ancestors 'none'; img-src 'self' https://uw2.pwl.login.duosecurity.com; connect-src 'self' https://uw2.pwl.login.duosecurity.com
strict-transport-security
max-age=31536000
x-robots-tag
noindex, nofollow
x-xss-protection
1; mode=block
expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery.min.js
gtam.login.duosecurity.com/static/shared/lib/jquery/ 		87 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gtam.login.duosecurity.com/static/shared/lib/jquery/jquery.min.js?v=ff152
Requested by
Host: gtam.login.duosecurity.com
URL: https://gtam.login.duosecurity.com/email_first?authkey=ASGWRLQ9PJFQQNOK69C7&aid=1b3ea640d6cd428691735e731af84c74
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
75.2.30.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb043b6cb0f8a076.awsglobalaccelerator.com
Software
Duo/1.0 /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
Security Headers
Name Value
Content-Security-Policy default-src 'none'; style-src 'self' https://uw2.pwl.login.duosecurity.com; script-src 'self' https://uw2.pwl.login.duosecurity.com; font-src 'self'; frame-src 'self' ; frame-ancestors 'none'; img-src 'self' https://uw2.pwl.login.duosecurity.com; connect-src 'self' https://uw2.pwl.login.duosecurity.com
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://gtam.login.duosecurity.com/email_first?authkey=ASGWRLQ9PJFQQNOK69C7&aid=1b3ea640d6cd428691735e731af84c74
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 21 Jul 2022 15:34:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 15 Jul 2022 19:33:30 GMT
server
Duo/1.0
etag
W/"62d1c10a-15d9d"
x-frame-options
DENY
content-type
application/javascript
cache-control
max-age=315360000
content-security-policy
default-src 'none'; style-src 'self' https://uw2.pwl.login.duosecurity.com; script-src 'self' https://uw2.pwl.login.duosecurity.com; font-src 'self'; frame-src 'self' ; frame-ancestors 'none'; img-src 'self' https://uw2.pwl.login.duosecurity.com; connect-src 'self' https://uw2.pwl.login.duosecurity.com
strict-transport-security
max-age=31536000
x-robots-tag
noindex, nofollow
x-xss-protection
1; mode=block
expires
Thu, 31 Dec 2037 23:55:55 GMT
email-first.js
gtam.login.duosecurity.com/static/js/page/ 		966 KB
289 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gtam.login.duosecurity.com/static/js/page/email-first.js?v=7709f
Requested by
Host: gtam.login.duosecurity.com
URL: https://gtam.login.duosecurity.com/email_first?authkey=ASGWRLQ9PJFQQNOK69C7&aid=1b3ea640d6cd428691735e731af84c74
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
75.2.30.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb043b6cb0f8a076.awsglobalaccelerator.com
Software
Duo/1.0 /
Resource Hash
7709f96c8cc96d7017779931133de6090602eb89ad7b46221248aad100a9b3eb
Security Headers
Name Value
Content-Security-Policy default-src 'none'; style-src 'self' https://uw2.pwl.login.duosecurity.com; script-src 'self' https://uw2.pwl.login.duosecurity.com; font-src 'self'; frame-src 'self' ; frame-ancestors 'none'; img-src 'self' https://uw2.pwl.login.duosecurity.com; connect-src 'self' https://uw2.pwl.login.duosecurity.com
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://gtam.login.duosecurity.com/email_first?authkey=ASGWRLQ9PJFQQNOK69C7&aid=1b3ea640d6cd428691735e731af84c74
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 21 Jul 2022 15:34:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 15 Jul 2022 19:33:30 GMT
server
Duo/1.0
etag
W/"62d1c10a-f1811"
x-frame-options
DENY
content-type
application/javascript
cache-control
max-age=315360000
content-security-policy
default-src 'none'; style-src 'self' https://uw2.pwl.login.duosecurity.com; script-src 'self' https://uw2.pwl.login.duosecurity.com; font-src 'self'; frame-src 'self' ; frame-ancestors 'none'; img-src 'self' https://uw2.pwl.login.duosecurity.com; connect-src 'self' https://uw2.pwl.login.duosecurity.com
strict-transport-security
max-age=31536000
x-robots-tag
noindex, nofollow
x-xss-protection
1; mode=block
expires
Thu, 31 Dec 2037 23:55:55 GMT
logo
gtam.login.duosecurity.com/ 		26 KB
26 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://gtam.login.duosecurity.com/logo
Requested by
Host: gtam.login.duosecurity.com
URL: https://gtam.login.duosecurity.com/email_first?authkey=ASGWRLQ9PJFQQNOK69C7&aid=1b3ea640d6cd428691735e731af84c74
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
75.2.30.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb043b6cb0f8a076.awsglobalaccelerator.com
Software
Duo/1.0 /
Resource Hash
0b103362f76afcfe6e2f1df52932900c2450560fdd9e32f5537fd4a4aebfdadb
Security Headers
Name Value
Content-Security-Policy default-src 'none'; style-src 'self' https://uw2.pwl.login.duosecurity.com; script-src 'self' https://uw2.pwl.login.duosecurity.com; font-src 'self'; frame-src 'self' ; frame-ancestors 'none'; img-src 'self' https://uw2.pwl.login.duosecurity.com; connect-src 'self' https://uw2.pwl.login.duosecurity.com
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://gtam.login.duosecurity.com/email_first?authkey=ASGWRLQ9PJFQQNOK69C7&aid=1b3ea640d6cd428691735e731af84c74
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 21 Jul 2022 15:34:48 GMT
x-content-type-options
nosniff
server
Duo/1.0
etag
"ee428339e29e96904997788fd0ca60ba564168af"
x-frame-options
DENY
content-type
image/png
content-security-policy
default-src 'none'; style-src 'self' https://uw2.pwl.login.duosecurity.com; script-src 'self' https://uw2.pwl.login.duosecurity.com; font-src 'self'; frame-src 'self' ; frame-ancestors 'none'; img-src 'self' https://uw2.pwl.login.duosecurity.com; connect-src 'self' https://uw2.pwl.login.duosecurity.com
strict-transport-security
max-age=31536000
x-robots-tag
noindex, nofollow
content-length
26405
x-xss-protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery function| _ object| regeneratorRuntime object| _fallbackJedInstance object| _jedInstance

7 Cookies

Domain/Path Name / Value
secure.gtm.goldentree.com/ Name: LastMRH_Session
Value: dc27eef4
secure.gtm.goldentree.com/ Name: MRHSession
Value: b93adcdddbe2ef7d35044b17dc27eef4
sso-07f32f30.sso.duosecurity.com/ Name: sid
Value: "MzEzYWMwMjM5Y2MzNDAxODg2MWI1Y2Y5YzNhZjliYmU=|84.19.175.183|1658417687|1d9ff803aa9302939e5f78af042ce879e292cd4d"
sso-07f32f30.sso.duosecurity.com/ Name: sid-init-e9ae339bbfd545f185cf0a96f06795c9
Value: "MzEzYWMwMjM5Y2MzNDAxODg2MWI1Y2Y5YzNhZjliYmU=|84.19.175.183|1658417687|ea98b6074f29e45004888203c709479653d0a2bb"
gtam.login.duosecurity.com/ Name: sid
Value: "YTk1NWQ3MDg5NmU2NDMzNTgxNmEwZWIwOGZkZjFiOTU=|84.19.175.183|1658417687|edb48c28e717684c4712fd938a5e47197eb39e6a"
gtam.login.duosecurity.com/ Name: sid-init-73f9539043954db2b85c60455fe8dc53
Value: "YTk1NWQ3MDg5NmU2NDMzNTgxNmEwZWIwOGZkZjFiOTU=|84.19.175.183|1658417687|4993803fccceef5b04e7d6cc95e48ca3ddbf1063"
gtam.login.duosecurity.com/ Name: _xsrf
Value: "ZWM4NjVmYjQ2NzYyNGQ0MThhMjA2MTE2YzZiMTYxMDM=|84.19.175.183|1658417687|4afaf78bb2978cd1178032a17258ceb3e7f53d48"

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=16070400; includeSubDomains
X-Frame-Options DENY