auth.ocf.berkeley.edu
Open in
urlscan Pro
2607:f140:8801::1:79
Public Scan
Effective URL: https://auth.ocf.berkeley.edu/auth/realms/ocf/login-actions/authenticate?session_code=UMVYbvpl2RrbM9ppNvv798MUb45kmrcYNGm14qw_...
Submission Tags: phishingrod
Submission: On February 28 via api from DE — Scanned from DE
Summary
TLS certificate: Issued by R3 on February 28th 2023. Valid for: 3 months.
This is the only time auth.ocf.berkeley.edu was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 9 | 2607:f140:880... 2607:f140:8801::1:79 | 25 (UCB) (UCB) | |
1 | 2a00:1450:400... 2a00:1450:4001:82a::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:80e::2003 | 15169 (GOOGLE) (GOOGLE) | |
8 | 3 |
ASN25 (UCB, US)
discord.ocf.io | |
discord.ocf.berkeley.edu | |
auth.ocf.berkeley.edu |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
berkeley.edu
2 redirects
discord.ocf.berkeley.edu auth.ocf.berkeley.edu |
166 KB |
1 |
gstatic.com
fonts.gstatic.com |
17 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 36 |
837 B |
1 |
ocf.io
1 redirects
discord.ocf.io |
111 B |
8 | 4 |
Domain | Requested by | |
---|---|---|
6 | auth.ocf.berkeley.edu |
auth.ocf.berkeley.edu
|
2 | discord.ocf.berkeley.edu | 2 redirects |
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
auth.ocf.berkeley.edu
|
1 | discord.ocf.io | 1 redirects |
8 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.positrondream.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
lb.ocf.berkeley.edu R3 |
2023-02-28 - 2023-05-29 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-02-08 - 2023-05-03 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-02-08 - 2023-05-03 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://auth.ocf.berkeley.edu/auth/realms/ocf/login-actions/authenticate?session_code=UMVYbvpl2RrbM9ppNvv798MUb45kmrcYNGm14qw_MOA&execution=ae27d7f3-b1e8-4b40-9b18-212daea56062&client_id=id6&tab_id=a_A9PWmp99Y
Frame ID: 4F2C6D6ED3F9B1E4B4348B7540F60AE5
Requests: 8 HTTP requests in this frame
Screenshot
Page Title
Sign in to OCFPage URL History Show full URLs
-
https://discord.ocf.io/
HTTP 302
https://discord.ocf.berkeley.edu/ HTTP 307
https://discord.ocf.berkeley.edu/oauth/authorize?state=78199003-7864-4f3c-b0ba-737606ae3379 HTTP 307
https://auth.ocf.berkeley.edu/auth/realms/ocf/protocol/openid-connect/auth?client_id=id6&redirect_uri=http... Page URL
- https://auth.ocf.berkeley.edu/auth/realms/ocf/login-actions/authenticate?session_code=UMVYbvpl2RrbM9ppNvv7... Page URL
Detected technologies
Google Font API (Font Scripts) ExpandDetected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Madison Porter
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://discord.ocf.io/
HTTP 302
https://discord.ocf.berkeley.edu/ HTTP 307
https://discord.ocf.berkeley.edu/oauth/authorize?state=78199003-7864-4f3c-b0ba-737606ae3379 HTTP 307
https://auth.ocf.berkeley.edu/auth/realms/ocf/protocol/openid-connect/auth?client_id=id6&redirect_uri=https%3A%2F%2Fdiscord.ocf.berkeley.edu%2Foauth%2Fcallback&response_type=code&scope=openid+email+profile&state=78199003-7864-4f3c-b0ba-737606ae3379 Page URL
- https://auth.ocf.berkeley.edu/auth/realms/ocf/login-actions/authenticate?session_code=UMVYbvpl2RrbM9ppNvv798MUb45kmrcYNGm14qw_MOA&execution=ae27d7f3-b1e8-4b40-9b18-212daea56062&client_id=id6&tab_id=a_A9PWmp99Y Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://discord.ocf.io/ HTTP 302
- https://discord.ocf.berkeley.edu/ HTTP 307
- https://discord.ocf.berkeley.edu/oauth/authorize?state=78199003-7864-4f3c-b0ba-737606ae3379 HTTP 307
- https://auth.ocf.berkeley.edu/auth/realms/ocf/protocol/openid-connect/auth?client_id=id6&redirect_uri=https%3A%2F%2Fdiscord.ocf.berkeley.edu%2Foauth%2Fcallback&response_type=code&scope=openid+email+profile&state=78199003-7864-4f3c-b0ba-737606ae3379
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
auth
auth.ocf.berkeley.edu/auth/realms/ocf/protocol/openid-connect/ Redirect Chain
|
599 B 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
Primary Request
authenticate
auth.ocf.berkeley.edu/auth/realms/ocf/login-actions/ |
3 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.css
auth.ocf.berkeley.edu/auth/resources/7ctlt/login/ocf-theme/css/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
1023 B 837 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ocf-logo.svg
auth.ocf.berkeley.edu/auth/resources/7ctlt/login/ocf-theme/img/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
eye-off.png
auth.ocf.berkeley.edu/auth/resources/7ctlt/login/ocf-theme/img/ |
580 B 874 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jealousy.png
auth.ocf.berkeley.edu/auth/resources/7ctlt/login/ocf-theme/img/ |
155 KB 155 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
7Aulp_0qiz-aVz7u3PJLcUMYOFnOkEk30eg.woff2
fonts.gstatic.com/s/muli/v28/ |
17 KB 17 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| togglePassword5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
auth.ocf.berkeley.edu/auth/realms/ocf/ | Name: AUTH_SESSION_ID Value: 758469fb-a175-492e-9292-3db85d61a73a.deployment-6878d947f4-zrk9n |
|
auth.ocf.berkeley.edu/auth/realms/ocf/ | Name: AUTH_SESSION_ID_LEGACY Value: 758469fb-a175-492e-9292-3db85d61a73a.deployment-6878d947f4-zrk9n |
|
auth.ocf.berkeley.edu/auth/realms/ocf/ | Name: KC_RESTART Value: eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI0ZTQ1OGViOC00M2I1LTRlM2QtOGQwYy01YWE0M2QyMmNmNGYifQ.eyJjaWQiOiJpZDYiLCJwdHkiOiJvcGVuaWQtY29ubmVjdCIsInJ1cmkiOiJodHRwczovL2Rpc2NvcmQub2NmLmJlcmtlbGV5LmVkdS9vYXV0aC9jYWxsYmFjayIsImFjdCI6IkFVVEhFTlRJQ0FURSIsIm5vdGVzIjp7InNjb3BlIjoib3BlbmlkIGVtYWlsIHByb2ZpbGUiLCJpc3MiOiJodHRwczovL2F1dGgub2NmLmJlcmtlbGV5LmVkdS9hdXRoL3JlYWxtcy9vY2YiLCJyZXNwb25zZV90eXBlIjoiY29kZSIsInJlZGlyZWN0X3VyaSI6Imh0dHBzOi8vZGlzY29yZC5vY2YuYmVya2VsZXkuZWR1L29hdXRoL2NhbGxiYWNrIiwic3RhdGUiOiI3ODE5OTAwMy03ODY0LTRmM2MtYjBiYS03Mzc2MDZhZTMzNzkifX0.Fl2P4qissXDKNrlSKgxWmrYVLQOEtRYOeFQ4VMoVguQ |
|
.discord.ocf.berkeley.edu/ | Name: request_uri Value: Lw== |
|
.discord.ocf.berkeley.edu/ | Name: OAuth_Token_Request_State Value: 78199003-7864-4f3c-b0ba-737606ae3379 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | frame-src 'self'; frame-ancestors 'self'; object-src 'none'; |
Strict-Transport-Security | max-age=31536000; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
auth.ocf.berkeley.edu
discord.ocf.berkeley.edu
discord.ocf.io
fonts.googleapis.com
fonts.gstatic.com
2607:f140:8801::1:79
2a00:1450:4001:80e::2003
2a00:1450:4001:82a::200a
00c017c352584c22be3a444cd8234744e7b318734744b49cea6ee1bc20f9cd32
15559265c43e023322fbb97f910244594c12c7c9b60afcfe7bd3529155f560ae
3f7ffa4e5df557c0e8f515c294de825f002345bc992e29879dea9ab6af7738c3
4163248df303e40081dd80e7b839384715738d6f151eb83c763c34a15b5741c6
afcdc7208fb910ad2c321de671d680022b1e5faeb893526dc6f390f6c5ef712b
c11b2ae7cef8d69e3316db3b0afe4d50faf2dc00ebcddbc29ea3efb67992038d
c716ee1397b41946c62c1725f99a0f5eaf126dfc9039438bc7a339c1216ebbe1
eed2945d00bccd54152ecd1e7cd74b18f6b4fac136ed16d65e9570c4c8c90c7f