auth.ocf.berkeley.edu
Open in
urlscan Pro
2607:f140:8801::1:79
Public Scan
Effective URL: https://auth.ocf.berkeley.edu/auth/realms/ocf/login-actions/authenticate?session_code=YilhmefYAmj4bwFprN4bWJMZy-fRje8g7D1jpu8T...
Submission Tags: phishingrod
Submission: On April 27 via api from DE — Scanned from DE
Summary
TLS certificate: Issued by R3 on February 28th 2023. Valid for: 3 months.
This is the only time auth.ocf.berkeley.edu was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 9 | 2607:f140:880... 2607:f140:8801::1:79 | 25 (UCB) (UCB) | |
1 | 2a00:1450:400... 2a00:1450:4001:801::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:806::2003 | 15169 (GOOGLE) (GOOGLE) | |
8 | 3 |
ASN25 (UCB, US)
discord.ocf.io | |
discord.ocf.berkeley.edu | |
auth.ocf.berkeley.edu |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
berkeley.edu
2 redirects
discord.ocf.berkeley.edu auth.ocf.berkeley.edu |
165 KB |
1 |
gstatic.com
fonts.gstatic.com |
17 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 119 |
854 B |
1 |
ocf.io
1 redirects
discord.ocf.io |
111 B |
8 | 4 |
Domain | Requested by | |
---|---|---|
6 | auth.ocf.berkeley.edu |
auth.ocf.berkeley.edu
|
2 | discord.ocf.berkeley.edu | 2 redirects |
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
auth.ocf.berkeley.edu
|
1 | discord.ocf.io | 1 redirects |
8 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.positrondream.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
lb.ocf.berkeley.edu R3 |
2023-02-28 - 2023-05-29 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-04-03 - 2023-06-26 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-04-03 - 2023-06-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://auth.ocf.berkeley.edu/auth/realms/ocf/login-actions/authenticate?session_code=YilhmefYAmj4bwFprN4bWJMZy-fRje8g7D1jpu8Truk&execution=ae27d7f3-b1e8-4b40-9b18-212daea56062&client_id=id6&tab_id=T6cEOsRkYwE
Frame ID: 3B67410D0D3C5B9A03D8DBAF497E4BDE
Requests: 8 HTTP requests in this frame
Screenshot
Page Title
Sign in to OCFPage URL History Show full URLs
-
https://discord.ocf.io/
HTTP 302
https://discord.ocf.berkeley.edu/ HTTP 307
https://discord.ocf.berkeley.edu/oauth/authorize?state=8f059bd1-b578-44c1-8e7c-4aad49ba63c7 HTTP 307
https://auth.ocf.berkeley.edu/auth/realms/ocf/protocol/openid-connect/auth?client_id=id6&redirect_uri=http... Page URL
- https://auth.ocf.berkeley.edu/auth/realms/ocf/login-actions/authenticate?session_code=YilhmefYAmj4bwFprN4b... Page URL
Detected technologies
Google Font API (Font Scripts) ExpandDetected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Madison Porter
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://discord.ocf.io/
HTTP 302
https://discord.ocf.berkeley.edu/ HTTP 307
https://discord.ocf.berkeley.edu/oauth/authorize?state=8f059bd1-b578-44c1-8e7c-4aad49ba63c7 HTTP 307
https://auth.ocf.berkeley.edu/auth/realms/ocf/protocol/openid-connect/auth?client_id=id6&redirect_uri=https%3A%2F%2Fdiscord.ocf.berkeley.edu%2Foauth%2Fcallback&response_type=code&scope=openid+email+profile&state=8f059bd1-b578-44c1-8e7c-4aad49ba63c7 Page URL
- https://auth.ocf.berkeley.edu/auth/realms/ocf/login-actions/authenticate?session_code=YilhmefYAmj4bwFprN4bWJMZy-fRje8g7D1jpu8Truk&execution=ae27d7f3-b1e8-4b40-9b18-212daea56062&client_id=id6&tab_id=T6cEOsRkYwE Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://discord.ocf.io/ HTTP 302
- https://discord.ocf.berkeley.edu/ HTTP 307
- https://discord.ocf.berkeley.edu/oauth/authorize?state=8f059bd1-b578-44c1-8e7c-4aad49ba63c7 HTTP 307
- https://auth.ocf.berkeley.edu/auth/realms/ocf/protocol/openid-connect/auth?client_id=id6&redirect_uri=https%3A%2F%2Fdiscord.ocf.berkeley.edu%2Foauth%2Fcallback&response_type=code&scope=openid+email+profile&state=8f059bd1-b578-44c1-8e7c-4aad49ba63c7
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
auth
auth.ocf.berkeley.edu/auth/realms/ocf/protocol/openid-connect/ Redirect Chain
|
599 B 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
Primary Request
authenticate
auth.ocf.berkeley.edu/auth/realms/ocf/login-actions/ |
3 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.css
auth.ocf.berkeley.edu/auth/resources/7ctlt/login/ocf-theme/css/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
1 KB 854 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ocf-logo.svg
auth.ocf.berkeley.edu/auth/resources/7ctlt/login/ocf-theme/img/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
eye-off.png
auth.ocf.berkeley.edu/auth/resources/7ctlt/login/ocf-theme/img/ |
580 B 874 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jealousy.png
auth.ocf.berkeley.edu/auth/resources/7ctlt/login/ocf-theme/img/ |
155 KB 155 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
7Aulp_0qiz-aVz7u3PJLcUMYOFnOkEk30eg.woff2
fonts.gstatic.com/s/muli/v28/ |
17 KB 17 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| togglePassword5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
auth.ocf.berkeley.edu/auth/realms/ocf/ | Name: AUTH_SESSION_ID Value: 62447aa8-9aed-40fa-890f-51da44599d26.deployment-6878d947f4-zrk9n |
|
auth.ocf.berkeley.edu/auth/realms/ocf/ | Name: AUTH_SESSION_ID_LEGACY Value: 62447aa8-9aed-40fa-890f-51da44599d26.deployment-6878d947f4-zrk9n |
|
auth.ocf.berkeley.edu/auth/realms/ocf/ | Name: KC_RESTART Value: eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI0ZTQ1OGViOC00M2I1LTRlM2QtOGQwYy01YWE0M2QyMmNmNGYifQ.eyJjaWQiOiJpZDYiLCJwdHkiOiJvcGVuaWQtY29ubmVjdCIsInJ1cmkiOiJodHRwczovL2Rpc2NvcmQub2NmLmJlcmtlbGV5LmVkdS9vYXV0aC9jYWxsYmFjayIsImFjdCI6IkFVVEhFTlRJQ0FURSIsIm5vdGVzIjp7InNjb3BlIjoib3BlbmlkIGVtYWlsIHByb2ZpbGUiLCJpc3MiOiJodHRwczovL2F1dGgub2NmLmJlcmtlbGV5LmVkdS9hdXRoL3JlYWxtcy9vY2YiLCJyZXNwb25zZV90eXBlIjoiY29kZSIsInJlZGlyZWN0X3VyaSI6Imh0dHBzOi8vZGlzY29yZC5vY2YuYmVya2VsZXkuZWR1L29hdXRoL2NhbGxiYWNrIiwic3RhdGUiOiI4ZjA1OWJkMS1iNTc4LTQ0YzEtOGU3Yy00YWFkNDliYTYzYzcifX0.zcyncZrtl8fUz_Jp_BMTfA6nIwIrMxhnchHvGCC8C9k |
|
.discord.ocf.berkeley.edu/ | Name: request_uri Value: Lw== |
|
.discord.ocf.berkeley.edu/ | Name: OAuth_Token_Request_State Value: 8f059bd1-b578-44c1-8e7c-4aad49ba63c7 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | frame-src 'self'; frame-ancestors 'self'; object-src 'none'; |
Strict-Transport-Security | max-age=31536000; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
auth.ocf.berkeley.edu
discord.ocf.berkeley.edu
discord.ocf.io
fonts.googleapis.com
fonts.gstatic.com
2607:f140:8801::1:79
2a00:1450:4001:801::200a
2a00:1450:4001:806::2003
07b236245d9662406b93d322b0451bbc4ee8a7ebb5cd6a87e90f4eddbadda6c3
15559265c43e023322fbb97f910244594c12c7c9b60afcfe7bd3529155f560ae
17c3cea4fa1fbf239246b9211945f5b29ea246267c488cf5ea010a76209602d1
3f7ffa4e5df557c0e8f515c294de825f002345bc992e29879dea9ab6af7738c3
4163248df303e40081dd80e7b839384715738d6f151eb83c763c34a15b5741c6
a929197a7bef9db35a4664f35f9a6925f070c9f733c1dec911e26b4067e5f285
c716ee1397b41946c62c1725f99a0f5eaf126dfc9039438bc7a339c1216ebbe1
eed2945d00bccd54152ecd1e7cd74b18f6b4fac136ed16d65e9570c4c8c90c7f