urlscan.io logo urlscan.io
SecurityTrails logo

hcarewards.lifeatworkportal.com Open in urlscan Pro
65.197.229.12  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://hcarewards.ehr.com/default.ashx?classname=saml&target=portal-edassist
Effective URL: https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
Submission: On March 12 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 5 HTTP transactions. The main IP is 65.197.229.12, located in United States and belongs to AS16983, US. The main domain is hcarewards.lifeatworkportal.com.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on November 18th 2019. Valid for: a year.
This is the only time hcarewards.lifeatworkportal.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 5 158.82.145.48 40196 (WILLISNOR...)
4 6 65.197.229.12 16983 (AS16983)
5 2
Apex Domain
Subdomains		 Transfer
6 lifeatworkportal.com
hcarewards.lifeatworkportal.com
3 KB
5 ehr.com
hcarewards.ehr.com
12 KB
5 2
Domain Requested by
6 hcarewards.lifeatworkportal.com 4 redirects hcarewards.ehr.com
5 hcarewards.ehr.com 2 redirects hcarewards.ehr.com
5 2

This site contains no links.

Subject Issuer Validity Valid
hcarewards.ehr.com
GlobalSign RSA OV SSL CA 2018		 2019-10-15 -
2021-10-15		 2 years crt.sh
hcarewards.lifeatworkportal.com
Sectigo RSA Organization Validation Secure Server CA		 2019-11-18 -
2020-11-17		 a year crt.sh

This page contains 2 frames:

Primary Page: https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
Frame ID: 8BA9208ED7FC58C853A98E9CC40218C8
Requests: 4 HTTP requests in this frame

Frame: https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
Frame ID: 34AD3A7DC5F8B9334666B20D03C913AC
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://hcarewards.ehr.com/default.ashx?classname=saml&target=portal-edassist HTTP 302
    https://hcarewards.ehr.com/default.ashx?classname=saml&target=portal-edassist HTTP 302
    https://hcarewards.ehr.com/default.ashx?CLASSNAME=LOGIN Page URL
  2. https://hcarewards.lifeatworkportal.com/logoff/oplogoff.jsp?url=/Benefits/ HTTP 302
    https://hcarewards.lifeatworkportal.com/opglobal/pub/logout.jsp?logofftype=null HTTP 302
    https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

10 kB
Transfer

10 kB
Size

7
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://hcarewards.ehr.com/default.ashx?classname=saml&target=portal-edassist HTTP 302
    https://hcarewards.ehr.com/default.ashx?classname=saml&target=portal-edassist HTTP 302
    https://hcarewards.ehr.com/default.ashx?CLASSNAME=LOGIN Page URL
  2. https://hcarewards.lifeatworkportal.com/logoff/oplogoff.jsp?url=/Benefits/ HTTP 302
    https://hcarewards.lifeatworkportal.com/opglobal/pub/logout.jsp?logofftype=null HTTP 302
    https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://hcarewards.ehr.com/default.ashx?classname=saml&target=portal-edassist HTTP 302
  • https://hcarewards.ehr.com/default.ashx?classname=saml&target=portal-edassist HTTP 302
  • https://hcarewards.ehr.com/default.ashx?CLASSNAME=LOGIN
Request Chain 3
  • https://hcarewards.lifeatworkportal.com/logoff/oplogoff.jsp?url=/Benefits/ HTTP 302
  • https://hcarewards.lifeatworkportal.com/opglobal/pub/logout.jsp?logofftype=null HTTP 302
  • https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
default.ashx
hcarewards.ehr.com/
Redirect Chain
  • http://hcarewards.ehr.com/default.ashx?classname=saml&target=portal-edassist
  • https://hcarewards.ehr.com/default.ashx?classname=saml&target=portal-edassist
  • https://hcarewards.ehr.com/default.ashx?CLASSNAME=LOGIN
1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://hcarewards.ehr.com/default.ashx?CLASSNAME=LOGIN
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.82.145.48 , United States, ASN40196 (WILLISNORTHAMERICA, US),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
196d75141ee2d8a74ef3aa6fbb5084ced62dcecbc156e03ad7cfc8b0b66cc586

Request headers

Host
hcarewards.ehr.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
%be%baB%0f%0a%8f%3a%aa%c4%01%84%b2%f3(%b1S%c7%3d%d9%9b%b9%12%d3)%94%be%06%14%d8D8%3d%25%5c%1d%bb%bb%98%a4%1cx3%05c%94%cad%8eApp=%fe%23%9d%ec%fbs%8e%94%7b%f2%8d%fc%db%89%11%87%0dW%16%dcc%a4%60%3c%bdA0j%8c%9a%26%04x%8c%d0%7ds%b3%ffNE%de%ae%e5%09%bfm%e7; %be%baB%0f%0a%8f%3a%aa%c4%01%84%b2%f3(%b1S%c7%3d%d9%9b%b9%12%d3)%94%be%06%14%d8D8%3d%25%5c%1d%bb%bb%98%a4%1cx3%05c%94%cad%8eSessionHistory_Insert=False; %be%baB%0f%0a%8f%3a%aa%c4%01%84%b2%f3(%b1S%c7%3d%d9%9b%b9%12%d3)%94%be%06%14%d8D8%3d%25%5c%1d%bb%bb%98%a4%1cx3%05c%94%cad%8eSessionHistory_Key=07b5ea13-b485-4f49-b32a-af96778f9b90; %be%baB%0f%0a%8f%3a%aa%c4%01%84%b2%f3(%b1S%c7%3d%d9%9b%b9%12%d3)%94%be%06%14%d8D8%3d%25%5c%1d%bb%bb%98%a4%1cx3%05c%94%cad%8eSessionHistory_Id=45158012; f5-cookie=2531704074.0.0000
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Cache-Control
no-cache
Pragma
no-cache
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Expires
-1
Vary
Accept-Encoding
Server
Microsoft-IIS/7.5
SPRequestGuid
8d8fadde-072b-47d8-8b79-6dcc8b8d29ab
X-SharePointHealthScore
0
X-AspNet-Version
2.0.50727
X-Powered-By
ASP.NET
MicrosoftSharePointTeamServices
14.0.0.7230
X-MS-InvokeApp
1; RequireReadOnly
SPServer
1
Date
Thu, 12 Mar 2020 08:48:19 GMT
Content-Length
941

Redirect headers

Cache-Control
private
Content-Type
text/html; charset=utf-8
Expires
Wed, 11 Mar 2020 16:08:19 GMT
Location
/default.ashx?CLASSNAME=LOGIN
Server
Microsoft-IIS/7.5
SPRequestGuid
2e2988f5-2a09-4140-a7ce-8462f52bfbbc
X-SharePointHealthScore
0
X-AspNet-Version
2.0.50727
Set-Cookie
%be%baB%0f%0a%8f%3a%aa%c4%01%84%b2%f3(%b1S%c7%3d%d9%9b%b9%12%d3)%94%be%06%14%d8D8%3d%25%5c%1d%bb%bb%98%a4%1cx3%05c%94%cad%8eApp=%fe%23%9d%ec%fbs%8e%94%7b%f2%8d%fc%db%89%11%87%0dW%16%dcc%a4%60%3c%bdA0j%8c%9a%26%04x%8c%d0%7ds%b3%ffNE%de%ae%e5%09%bfm%e7; path=/; secure; HttpOnly %be%baB%0f%0a%8f%3a%aa%c4%01%84%b2%f3(%b1S%c7%3d%d9%9b%b9%12%d3)%94%be%06%14%d8D8%3d%25%5c%1d%bb%bb%98%a4%1cx3%05c%94%cad%8eSessionHistory_Insert=False; path=/; secure; HttpOnly %be%baB%0f%0a%8f%3a%aa%c4%01%84%b2%f3(%b1S%c7%3d%d9%9b%b9%12%d3)%94%be%06%14%d8D8%3d%25%5c%1d%bb%bb%98%a4%1cx3%05c%94%cad%8eSessionHistory_Key=07b5ea13-b485-4f49-b32a-af96778f9b90; path=/; secure; HttpOnly %be%baB%0f%0a%8f%3a%aa%c4%01%84%b2%f3(%b1S%c7%3d%d9%9b%b9%12%d3)%94%be%06%14%d8D8%3d%25%5c%1d%bb%bb%98%a4%1cx3%05c%94%cad%8eSessionHistory_Id=45158012; path=/; secure; HttpOnly f5-cookie=2531704074.0.0000; path=/; Httponly; Secure
X-Powered-By
ASP.NET
MicrosoftSharePointTeamServices
14.0.0.7230
X-MS-InvokeApp
1; RequireReadOnly
SPServer
1
Date
Thu, 12 Mar 2020 08:48:19 GMT
Content-Length
152
default.ashx
hcarewards.ehr.com/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://hcarewards.ehr.com/default.ashx?CLASSNAME=RESOURCEHANDLER&ID=%25fb%255e%25ae%25cb%25e7r%2510%2586%25e9%257bZ%2599%25f1T%25bcl
Requested by
Host: hcarewards.ehr.com
URL: https://hcarewards.ehr.com/default.ashx?CLASSNAME=LOGIN
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.82.145.48 , United States, ASN40196 (WILLISNORTHAMERICA, US),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
bd263caf9c3ca3d45b10052b2e715e2b0291f1a9c88b1ebf5178e3a2473acf97

Request headers

Referer
https://hcarewards.ehr.com/default.ashx?CLASSNAME=LOGIN
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

Date
Thu, 12 Mar 2020 08:48:19 GMT
Content-Encoding
gzip
SPServer
1
X-AspNet-Version
2.0.50727
X-Powered-By
ASP.NET
Transfer-Encoding
chunked
X-SharePointHealthScore
0
Content-Disposition
attachment; filename=login.css
MicrosoftSharePointTeamServices
14.0.0.7230
X-MS-InvokeApp
1; RequireReadOnly
Last-Modified
Tue, 05 Nov 2019 02:08:04 GMT
Server
Microsoft-IIS/7.5
SPRequestGuid
1a3ed104-f9f9-4559-99bf-8877ee6a5ff4
ETag
G7fsPW3jqIGf1X1dbth3dM8D76g=
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public
Expires
Wed, 11 Mar 2020 16:08:19 GMT
default.ashx
hcarewards.ehr.com/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://hcarewards.ehr.com/default.ashx?CLASSNAME=RESOURCEHANDLER&ID=%251d%25b2%25fc)%259c%2b%2511dU%25e7t%2585%25f4%25f6%25f6%25bc
Requested by
Host: hcarewards.ehr.com
URL: https://hcarewards.ehr.com/default.ashx?CLASSNAME=LOGIN
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.82.145.48 , United States, ASN40196 (WILLISNORTHAMERICA, US),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
38ca7c48de33fb31ae7dfe8b2963024ab33be876a88453781e369ebb02e55b06

Request headers

Referer
https://hcarewards.ehr.com/default.ashx?CLASSNAME=LOGIN
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Thu, 12 Mar 2020 08:48:19 GMT
SPServer
1
X-AspNet-Version
2.0.50727
X-Powered-By
ASP.NET
X-SharePointHealthScore
0
Content-Disposition
attachment; filename=HCA_Logo.png
Content-Length
6825
MicrosoftSharePointTeamServices
14.0.0.7230
X-MS-InvokeApp
1; RequireReadOnly
Last-Modified
Tue, 05 Nov 2019 02:08:04 GMT
Server
Microsoft-IIS/7.5
SPRequestGuid
2e2d805d-37a4-430b-afb9-24aa0c282053
ETag
OHXhmKnTRVH1IUkj/JuKjtTnQ8Q=
Content-Type
image/png
Cache-Control
public
Expires
Wed, 11 Mar 2020 16:08:19 GMT
azerror.jsp
hcarewards.lifeatworkportal.com/opglobal/pub/ Frame 34AD
Redirect Chain
  • https://hcarewards.lifeatworkportal.com/logoff/oplogoff.jsp?url=/Benefits/
  • https://hcarewards.lifeatworkportal.com/opglobal/pub/logout.jsp?logofftype=null
  • https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
Requested by
Host: hcarewards.ehr.com
URL: https://hcarewards.ehr.com/default.ashx?CLASSNAME=LOGIN
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
65.197.229.12 , United States, ASN16983 (AS16983, US),
Reverse DNS
celanese.benefitcenter.com
Software
/
Resource Hash

Request headers

Host
hcarewards.lifeatworkportal.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Referer
https://hcarewards.ehr.com/default.ashx?CLASSNAME=LOGIN
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
X-Mapping-clhgdopm=55BC790EBEEF1918BA3300D84B79F506; SMSESSION=LOGGEDOFF; X-Mapping-edphjpip=50101A29C4AFA45E17B22BCF4F267B45; JSESSIONID=f_vN7iLt_VbsdAiMHnEhRnQJhMWk7ei12Rvj6OKAbZgQ75zgPhq5!-288164837; PSESSIONID=g3DN7iNq9bkRh5ec5UgLcshOVJ0vBnSlxxp3YnmEwxKLg0k_XbfX!-288164837; LB=83.143.245.67:48004 Berlin-Berlin-Germany HCA-SPS--HCACLO
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://hcarewards.ehr.com/default.ashx?CLASSNAME=LOGIN

Response headers

Cache-Control
no-store
Content-Type
text/html; charset=ISO-8859-1
Date
Thu, 12 Mar 2020 08:48:20 GMT
Keep-Alive
timeout=5, max=98
Via
HTTP/1.1 hcarewards.lifeatworkportal.com:80
Connection
Keep-Alive
Content-Length
152

Redirect headers

Cache-Control
no-store
Content-Type
text/html; charset=ISO-8859-1
Date
Thu, 12 Mar 2020 08:48:20 GMT
Location
https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
Keep-Alive
timeout=5, max=99
Transfer-Encoding
chunked
Via
HTTP/1.1 hcarewards.lifeatworkportal.com:80
Connection
Keep-Alive
Set-Cookie
PSESSIONID=g3DN7iNq9bkRh5ec5UgLcshOVJ0vBnSlxxp3YnmEwxKLg0k_XbfX!-288164837;Path=/;HttpOnly; secure LB=83.143.245.67:48004 Berlin-Berlin-Germany HCA-SPS--HCACLO;Path=/;Secure;HttpOnly; secure
Primary Request azerror.jsp
hcarewards.lifeatworkportal.com/opglobal/pub/
Redirect Chain
  • https://hcarewards.lifeatworkportal.com/logoff/oplogoff.jsp?url=/Benefits/
  • https://hcarewards.lifeatworkportal.com/opglobal/pub/logout.jsp?logofftype=null
  • https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
185 B
437 B 		Document
General
Check archive.org
Download Go to
Full URL
https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
65.197.229.12 , United States, ASN16983 (AS16983, US),
Reverse DNS
celanese.benefitcenter.com
Software
/
Resource Hash
3d434a50b1fed419df57ab32511579051a7cee7cb0398988285f5ebc6a96b271

Request headers

Host
hcarewards.lifeatworkportal.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Referer
https://hcarewards.ehr.com/default.ashx?CLASSNAME=LOGIN
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
origURL=hcarewards.lifeatworkportal.com; X-Mapping-clhgdopm=993CDF2A725F0491E286ADC56C5A21E7; X-Mapping-edphjpip=50101A29C4AFA45E17B22BCF4F267B45; PSESSIONID=BHfN7iRkhJgGNaQmyAdUiYKuAhT8qi8AdB4dOXHCVeLV0X3NCTLX!-288164837; SMSESSION=LOGGEDOFF; JSESSIONID=mKvN7iThFoaJo2lF1HhtN-zLesClsKWyBJ4zXjs8yHKvjfLRdtN1!-288164837; LB=83.143.245.67:48004 Berlin-Berlin-Germany HCA-SPS--HCACLO
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document
Referer
https://hcarewards.ehr.com/default.ashx?CLASSNAME=LOGIN

Response headers

Cache-Control
no-store
Content-Type
text/html; charset=ISO-8859-1
Date
Thu, 12 Mar 2020 08:48:21 GMT
Keep-Alive
timeout=5, max=97
Via
HTTP/1.1 hcarewards.lifeatworkportal.com:80
Connection
Keep-Alive
Content-Length
185

Redirect headers

Cache-Control
no-store
Content-Type
text/html; charset=ISO-8859-1
Date
Thu, 12 Mar 2020 08:48:21 GMT
Location
https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
Keep-Alive
timeout=5, max=98
Transfer-Encoding
chunked
Via
HTTP/1.1 hcarewards.lifeatworkportal.com:80
Connection
Keep-Alive

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

7 Cookies

Domain/Path Name / Value
hcarewards.lifeatworkportal.com/ Name: LB
Value: 83.143.245.67:48004 Berlin-Berlin-Germany HCA-SPS--HCACLO
hcarewards.lifeatworkportal.com/ Name: JSESSIONID
Value: mKvN7iThFoaJo2lF1HhtN-zLesClsKWyBJ4zXjs8yHKvjfLRdtN1!-288164837
hcarewards.lifeatworkportal.com/ Name: PSESSIONID
Value: BHfN7iRkhJgGNaQmyAdUiYKuAhT8qi8AdB4dOXHCVeLV0X3NCTLX!-288164837
.hcarewards.lifeatworkportal.com/ Name: SMSESSION
Value: LOGGEDOFF
hcarewards.lifeatworkportal.com/ Name: X-Mapping-edphjpip
Value: 50101A29C4AFA45E17B22BCF4F267B45
hcarewards.lifeatworkportal.com/ Name: X-Mapping-clhgdopm
Value: 993CDF2A725F0491E286ADC56C5A21E7
hcarewards.lifeatworkportal.com/ Name: origURL
Value: hcarewards.lifeatworkportal.com