signonuat.allmerica.com Open in urlscan Pro
192.147.224.76 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://apexuat.allmerica.com/AgencyPortalSP/AddMultipleForms
Effective URL:
https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC
Submission: On August 13 via manual (August 13th 2020, 9:55:19 am UTC) from IL

Summary HTTP 14 Redirects Links 2 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 14 HTTP transactions. The main IP is 192.147.224.76, located in United States and belongs to HANOVER, US. The main domain is signonuat.allmerica.com.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on March 2nd 2020. Valid for: 2 years.

This is the only time signonuat.allmerica.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
2 2	192.147.224.40 192.147.224.40		12236 (HANOVER) (HANOVER)
14	192.147.224.76 192.147.224.76		12236 (HANOVER) (HANOVER)
14	1

2 192.147.224.40 (United States) 2 redirects

ASN12236 (HANOVER, US)
PTR: ipaddr19214722440.hanover.com

apexuat.allmerica.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 192.147.224.76 (United States)

ASN12236 (HANOVER, US)
PTR: devssoauthvip.allmerica.com

signonuat.allmerica.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	allmerica.com 2 redirects apexuat.allmerica.com signonuat.allmerica.com	36 KB
14	1

	Domain	Requested by
14	signonuat.allmerica.com	signonuat.allmerica.com
2	apexuat.allmerica.com	2 redirects
14	2

This site contains links to these domains. Also see Links.

Domain
secauthuat.allmerica.com

Subject Issuer	Validity	Valid
*.allmerica.com DigiCert SHA2 High Assurance Server CA	`2020-03-02` - `2022-06-05`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC
Frame ID: C4EAEA0229CAFFC1C721DFA1B871FEED
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://apexuat.allmerica.com/AgencyPortalSP/AddMultipleForms HTTP 302
https://apexuat.allmerica.com/AgencyPortalSP/AddMultipleForms HTTP 302
https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC Page URL

Detected technologies

Java (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_jk(?:\/([\d\.]+))?/i

Red Hat (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Red Hat/i

mod_jk (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_jk(?:\/([\d\.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
headers server /mod_jk(?:\/([\d\.]+))?/i

Apache Tomcat (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_jk(?:\/([\d\.]+))?/i

Page Statistics

14
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

1
IPs

1
Countries

35 kB
Transfer

28 kB
Size

2
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: http://secauthuat.allmerica.com/SecAuth/portalchangepassword
Title: Change Password

Search URL Search Domain Scan URL

URL: http://secauthuat.allmerica.com/SecAuth/portalforgotpassword
Title: Forgot your Password?

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://apexuat.allmerica.com/AgencyPortalSP/AddMultipleForms HTTP 302
https://apexuat.allmerica.com/AgencyPortalSP/AddMultipleForms HTTP 302
https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set afc_login_controller.jsp Show response signonuat.allmerica.com/ciss/ Redirect Chain http://apexuat.allmerica.com/AgencyPortalSP/AddMultipleForms https://apexuat.allmerica.com/AgencyPortalSP/AddMultipleForms https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC	5 KB 5 KB	443ms 101ms	Document text/html	192.147.224.76 HANOVER
General Check archive.org Show headers Download Go to Full URL https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.147.224.76 , United States, ASN12236 (HANOVER, US), Reverse DNS devssoauthvip.allmerica.com Software Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 / Resource Hash `e6b40d846c845cb8e6ad7d1470cd0a450ed1adf3d7272045783428d3bede5700` Request headers Host signonuat.allmerica.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Cookie ACTSESSION=aHR0cDovL2FwZXh1YXQuYWxsbWVyaWNhLmNvbTo4MC9BZ2VuY3lQb3J0YWxTUC9BZGRNdWx0aXBsZUZvcm1z Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 13 Aug 2020 09:55:03 GMT Server Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 WWW-Authenticate Basic realm="CT" Basic realm="CT" Content-Type text/html;charset=ISO-8859-1 Cache-Control proxy-revalidate Set-Cookie JSESSIONID=B0FC21E2520397F491ABE228B80FCD3B.SecurityA2; Path=/ciss/; HttpOnly BIGipServerpo_tomcatut80=2442114721.20480.0000; expires=Thu, 13-Aug-2020 17:55:03 GMT; path=/; Httponly X-Cnection close Transfer-Encoding chunked Redirect headers Date Thu, 13 Aug 2020 09:55:03 GMT Server Apache WWW-Authenticate Basic realm="CT" Set-Cookie ACTSESSION=aHR0cDovL2FwZXh1YXQuYWxsbWVyaWNhLmNvbTo4MC9BZ2VuY3lQb3J0YWxTUC9BZGRNdWx0aXBsZUZvcm1z; domain=.allmerica.com; path=/ Location https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC Content-Length 280 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=iso-8859-1 Vary Accept-Encoding
GET H/1.1	200 OK	login.css signonuat.allmerica.com/ciss/RiskSkins/Default/login/css/	2 KB 3 KB	116ms 115ms	Stylesheet text/css	192.147.224.76 HANOVER
General Check archive.org Show headers Download Go to Full URL https://signonuat.allmerica.com/ciss/RiskSkins/Default/login/css/login.css Requested by Host: signonuat.allmerica.com URL: https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.147.224.76 , United States, ASN12236 (HANOVER, US), Reverse DNS devssoauthvip.allmerica.com Software Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 / Resource Hash `0d6f4e37431b0aaa3253e54c11967e4551b934e94c66cea717f8a920ab719d34` Request headers Referer https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 13 Aug 2020 09:55:03 GMT WWW-Authenticate Basic realm="CT", Basic realm="CT" Last-Modified Wed, 27 May 2020 19:37:22 GMT Server Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 Cache-Control proxy-revalidate ETag W/"2115-1590608242000" Content-Type text/css X-Cnection close Accept-Ranges bytes Content-Length 2115
GET H/1.1	200 OK	login_01.gif signonuat.allmerica.com/ciss/RiskSkins/Default/login/images/	293 B 796 B	227ms 111ms	Image image/gif	192.147.224.76 HANOVER
General Check archive.org Show headers Download Go to Show image Full URL https://signonuat.allmerica.com/ciss/RiskSkins/Default/login/images/login_01.gif Requested by Host: signonuat.allmerica.com URL: https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.147.224.76 , United States, ASN12236 (HANOVER, US), Reverse DNS devssoauthvip.allmerica.com Software Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 / Resource Hash `2bcad6253b4f7d7cc143489a66e23b5c1e2a61edc778d714a4926004fff3b4cf` Request headers Referer https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 13 Aug 2020 09:55:03 GMT WWW-Authenticate Basic realm="CT", Basic realm="CT" Last-Modified Wed, 27 May 2020 19:37:22 GMT Server Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 Cache-Control proxy-revalidate ETag W/"293-1590608242000" Content-Type image/gif X-Cnection close Accept-Ranges bytes Content-Length 293
GET H/1.1	200 OK	login_02.gif signonuat.allmerica.com/ciss/RiskSkins/Default/login/images/	2 KB 2 KB	397ms 106ms	Image image/gif	192.147.224.76 HANOVER
General Check archive.org Show headers Download Go to Show image Full URL https://signonuat.allmerica.com/ciss/RiskSkins/Default/login/images/login_02.gif Requested by Host: signonuat.allmerica.com URL: https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.147.224.76 , United States, ASN12236 (HANOVER, US), Reverse DNS devssoauthvip.allmerica.com Software Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 / Resource Hash `3ca577e3951128ee4a387549e3ab42677ad5a4f7e365fc3401433652841eaf03` Request headers Referer https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 13 Aug 2020 09:55:04 GMT WWW-Authenticate Basic realm="CT", Basic realm="CT" Last-Modified Wed, 27 May 2020 19:37:22 GMT Server Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 Cache-Control proxy-revalidate ETag W/"1714-1590608242000" Content-Type image/gif X-Cnection close Accept-Ranges bytes Content-Length 1714
GET H/1.1	200 OK	login_03.gif signonuat.allmerica.com/ciss/RiskSkins/Default/login/images/	292 B 795 B	395ms 104ms	Image image/gif	192.147.224.76 HANOVER
General Check archive.org Show headers Download Go to Show image Full URL https://signonuat.allmerica.com/ciss/RiskSkins/Default/login/images/login_03.gif Requested by Host: signonuat.allmerica.com URL: https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.147.224.76 , United States, ASN12236 (HANOVER, US), Reverse DNS devssoauthvip.allmerica.com Software Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 / Resource Hash `5bbe788fee24036cf6744c023e39b12d7b59f2f49ce917c16c61d6ba6a4c439e` Request headers Referer https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 13 Aug 2020 09:55:04 GMT WWW-Authenticate Basic realm="CT", Basic realm="CT" Last-Modified Wed, 27 May 2020 19:37:22 GMT Server Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 Cache-Control proxy-revalidate ETag W/"292-1590608242000" Content-Type image/gif X-Cnection close Accept-Ranges bytes Content-Length 292
GET H/1.1	200 OK	login_04.gif signonuat.allmerica.com/ciss/RiskSkins/Default/login/images/	1 KB 2 KB	397ms 102ms	Image image/gif	192.147.224.76 HANOVER
General Check archive.org Show headers Download Go to Show image Full URL https://signonuat.allmerica.com/ciss/RiskSkins/Default/login/images/login_04.gif Requested by Host: signonuat.allmerica.com URL: https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.147.224.76 , United States, ASN12236 (HANOVER, US), Reverse DNS devssoauthvip.allmerica.com Software Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 / Resource Hash `b6297d5bd54edfc2ae2ff3bda8c789a6b0cd784704a4459c0aa42b97e08cb82f` Request headers Referer https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 13 Aug 2020 09:55:04 GMT WWW-Authenticate Basic realm="CT", Basic realm="CT" Last-Modified Wed, 27 May 2020 19:37:22 GMT Server Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 Cache-Control proxy-revalidate ETag W/"1375-1590608242000" Content-Type image/gif X-Cnection close Accept-Ranges bytes Content-Length 1375
GET H/1.1	200 OK	login_05.gif signonuat.allmerica.com/ciss/RiskSkins/Default/login/images/	14 KB 14 KB	396ms 99ms	Image image/gif	192.147.224.76 HANOVER
General Check archive.org Show headers Download Go to Show image Full URL https://signonuat.allmerica.com/ciss/RiskSkins/Default/login/images/login_05.gif Requested by Host: signonuat.allmerica.com URL: https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.147.224.76 , United States, ASN12236 (HANOVER, US), Reverse DNS devssoauthvip.allmerica.com Software Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 / Resource Hash `ef663e9e68e43f3de19aa9ebd06942f769abebd22a4ad9a189ba751d633704fe` Request headers Referer https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 13 Aug 2020 09:55:04 GMT WWW-Authenticate Basic realm="CT", Basic realm="CT" Last-Modified Wed, 27 May 2020 19:37:22 GMT Server Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 Cache-Control proxy-revalidate ETag W/"14164-1590608242000" Content-Type image/gif X-Cnection close Accept-Ranges bytes Content-Length 14164
GET H/1.1	200 OK	login_06.gif signonuat.allmerica.com/ciss/RiskSkins/Default/login/images/	836 B 1 KB	296ms 111ms	Image image/gif	192.147.224.76 HANOVER
General Check archive.org Show headers Download Go to Show image Full URL https://signonuat.allmerica.com/ciss/RiskSkins/Default/login/images/login_06.gif Requested by Host: signonuat.allmerica.com URL: https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.147.224.76 , United States, ASN12236 (HANOVER, US), Reverse DNS devssoauthvip.allmerica.com Software Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 / Resource Hash `0f439da6ffb978d1a79e59bfa052646bb419c5a7f74ec37e6ad885fe12566a83` Request headers Referer https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 13 Aug 2020 09:55:04 GMT WWW-Authenticate Basic realm="CT", Basic realm="CT" Last-Modified Wed, 27 May 2020 19:37:22 GMT Server Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 Cache-Control proxy-revalidate ETag W/"836-1590608242000" Content-Type image/gif X-Cnection close Accept-Ranges bytes Content-Length 836
GET H/1.1	200 OK	login_07.gif signonuat.allmerica.com/ciss/RiskSkins/Default/login/images/	834 B 1 KB	132ms 104ms	Image image/gif	192.147.224.76 HANOVER
General Check archive.org Show headers Download Go to Show image Full URL https://signonuat.allmerica.com/ciss/RiskSkins/Default/login/images/login_07.gif Requested by Host: signonuat.allmerica.com URL: https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.147.224.76 , United States, ASN12236 (HANOVER, US), Reverse DNS devssoauthvip.allmerica.com Software Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 / Resource Hash `15ee925cb9bd5583a3165d53af8a9f346c783ae71a6ac7ef344245e0085f7c2e` Request headers Referer https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 13 Aug 2020 09:55:04 GMT WWW-Authenticate Basic realm="CT", Basic realm="CT" Last-Modified Wed, 27 May 2020 19:37:22 GMT Server Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 Cache-Control proxy-revalidate ETag W/"834-1590608242000" Content-Type image/gif X-Cnection close Accept-Ranges bytes Content-Length 834
GET H/1.1	200 OK	login_09.gif signonuat.allmerica.com/ciss/RiskSkins/Default/login/images/	829 B 1 KB	137ms 100ms	Image image/gif	192.147.224.76 HANOVER
General Check archive.org Show headers Download Go to Show image Full URL https://signonuat.allmerica.com/ciss/RiskSkins/Default/login/images/login_09.gif Requested by Host: signonuat.allmerica.com URL: https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.147.224.76 , United States, ASN12236 (HANOVER, US), Reverse DNS devssoauthvip.allmerica.com Software Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 / Resource Hash `849773a854cebda5c7b4f7514a3623d2b0bede4a0f8227c46e858d8bc211bbfe` Request headers Referer https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 13 Aug 2020 09:55:04 GMT WWW-Authenticate Basic realm="CT", Basic realm="CT" Last-Modified Wed, 27 May 2020 19:37:22 GMT Server Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 Cache-Control proxy-revalidate ETag W/"829-1590608242000" Content-Type image/gif X-Cnection close Accept-Ranges bytes Content-Length 829
GET H/1.1	200 OK	login_10.gif signonuat.allmerica.com/ciss/RiskSkins/Default/login/images/	351 B 854 B	140ms 108ms	Image image/gif	192.147.224.76 HANOVER
General Check archive.org Show headers Download Go to Show image Full URL https://signonuat.allmerica.com/ciss/RiskSkins/Default/login/images/login_10.gif Requested by Host: signonuat.allmerica.com URL: https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.147.224.76 , United States, ASN12236 (HANOVER, US), Reverse DNS devssoauthvip.allmerica.com Software Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 / Resource Hash `4f83d72c16ba22a04d7e167b8fcd31b458d933d6e16e60c9ee5eff668de032d2` Request headers Referer https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 13 Aug 2020 09:55:04 GMT WWW-Authenticate Basic realm="CT", Basic realm="CT" Last-Modified Wed, 27 May 2020 19:37:22 GMT Server Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 Cache-Control proxy-revalidate ETag W/"351-1590608242000" Content-Type image/gif X-Cnection close Accept-Ranges bytes Content-Length 351
GET H/1.1	200 OK	login_11.gif signonuat.allmerica.com/ciss/RiskSkins/Default/login/images/	392 B 895 B	143ms 111ms	Image image/gif	192.147.224.76 HANOVER
General Check archive.org Show headers Download Go to Show image Full URL https://signonuat.allmerica.com/ciss/RiskSkins/Default/login/images/login_11.gif Requested by Host: signonuat.allmerica.com URL: https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.147.224.76 , United States, ASN12236 (HANOVER, US), Reverse DNS devssoauthvip.allmerica.com Software Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 / Resource Hash `30a59e3a2a433b02ad8c848276350e8a4d50b92928cc3e2d445e2cc72364618a` Request headers Referer https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 13 Aug 2020 09:55:04 GMT WWW-Authenticate Basic realm="CT", Basic realm="CT" Last-Modified Wed, 27 May 2020 19:37:22 GMT Server Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 Cache-Control proxy-revalidate ETag W/"392-1590608242000" Content-Type image/gif X-Cnection close Accept-Ranges bytes Content-Length 392
GET H/1.1	200 OK	login_12.gif signonuat.allmerica.com/ciss/RiskSkins/Default/login/images/	347 B 850 B	171ms 101ms	Image image/gif	192.147.224.76 HANOVER
General Check archive.org Show headers Download Go to Show image Full URL https://signonuat.allmerica.com/ciss/RiskSkins/Default/login/images/login_12.gif Requested by Host: signonuat.allmerica.com URL: https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.147.224.76 , United States, ASN12236 (HANOVER, US), Reverse DNS devssoauthvip.allmerica.com Software Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 / Resource Hash `6a8d83117823c890bb198779634f187b1f67370089bf7e8c970468ab3063bb40` Request headers Referer https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 13 Aug 2020 09:55:04 GMT WWW-Authenticate Basic realm="CT", Basic realm="CT" Last-Modified Wed, 27 May 2020 19:37:22 GMT Server Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 Cache-Control proxy-revalidate ETag W/"347-1590608242000" Content-Type image/gif X-Cnection close Accept-Ranges bytes Content-Length 347
GET H/1.1	200 OK	BGi4.gif signonuat.allmerica.com/ciss/RiskSkins/Default/login/css/	97 B 598 B	132ms 102ms	Image image/gif	192.147.224.76 HANOVER
General Check archive.org Show headers Download Go to Show image Full URL https://signonuat.allmerica.com/ciss/RiskSkins/Default/login/css/BGi4.gif Requested by Host: signonuat.allmerica.com URL: https://signonuat.allmerica.com/ciss/afc_login_controller.jsp?CTAuthMode=BASIC Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.147.224.76 , United States, ASN12236 (HANOVER, US), Reverse DNS devssoauthvip.allmerica.com Software Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 / Resource Hash `ac0c756a93e08d3b47a3098936f4e04063bae5ae043884cffd4ddd2db3176fbd` Request headers Referer https://signonuat.allmerica.com/ciss/RiskSkins/Default/login/css/login.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 13 Aug 2020 09:55:04 GMT WWW-Authenticate Basic realm="CT", Basic realm="CT" Last-Modified Wed, 27 May 2020 19:37:22 GMT Server Apache/2.4.6 (Red Hat Enterprise Linux) mod_jk/1.2.40 Cache-Control proxy-revalidate ETag W/"97-1590608242000" Content-Type image/gif X-Cnection close Accept-Ranges bytes Content-Length 97

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| theBody function| handleKeyPress

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			signonuat.allmerica.com/	1970-01-19 11:42:21	Name: BIGipServerpo_tomcatut80 Value: 2442114721.20480.0000
			signonuat.allmerica.com/ciss/	1969-12-31 23:59:59	Name: JSESSIONID Value: B0FC21E2520397F491ABE228B80FCD3B.SecurityA2

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

apexuat.allmerica.com
signonuat.allmerica.com
192.147.224.40
192.147.224.76
0d6f4e37431b0aaa3253e54c11967e4551b934e94c66cea717f8a920ab719d34
0f439da6ffb978d1a79e59bfa052646bb419c5a7f74ec37e6ad885fe12566a83
15ee925cb9bd5583a3165d53af8a9f346c783ae71a6ac7ef344245e0085f7c2e
2bcad6253b4f7d7cc143489a66e23b5c1e2a61edc778d714a4926004fff3b4cf
30a59e3a2a433b02ad8c848276350e8a4d50b92928cc3e2d445e2cc72364618a
3ca577e3951128ee4a387549e3ab42677ad5a4f7e365fc3401433652841eaf03
4f83d72c16ba22a04d7e167b8fcd31b458d933d6e16e60c9ee5eff668de032d2
5bbe788fee24036cf6744c023e39b12d7b59f2f49ce917c16c61d6ba6a4c439e
6a8d83117823c890bb198779634f187b1f67370089bf7e8c970468ab3063bb40
849773a854cebda5c7b4f7514a3623d2b0bede4a0f8227c46e858d8bc211bbfe
ac0c756a93e08d3b47a3098936f4e04063bae5ae043884cffd4ddd2db3176fbd
b6297d5bd54edfc2ae2ff3bda8c789a6b0cd784704a4459c0aa42b97e08cb82f
e6b40d846c845cb8e6ad7d1470cd0a450ed1adf3d7272045783428d3bede5700
ef663e9e68e43f3de19aa9ebd06942f769abebd22a4ad9a189ba751d633704fe