login.uc.edu
Open in
urlscan Pro
129.137.3.196
Public Scan
Effective URL: https://login.uc.edu/idp/profile/SAML2/Redirect/SSO;jsessionid=fdxx5rn8bgtu1apgdjxc9so5y?execution=e1s1
Submission Tags: phishing malicious Search All
Submission: On January 24 via api from US
Summary
TLS certificate: Issued by InCommon RSA Server CA on October 9th 2019. Valid for: a year.
This is the only time login.uc.edu was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 129.137.5.111 129.137.5.111 | 20126 (UC-DOM) (UC-DOM) | |
1 1 | 40.97.128.194 40.97.128.194 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
3 3 | 2603:1026:206... 2603:1026:206:2::2 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 1 | 20.190.129.160 20.190.129.160 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 1 | 129.137.6.64 129.137.6.64 | 20126 (UC-DOM) (UC-DOM) | |
1 9 | 129.137.3.196 129.137.3.196 | 20126 (UC-DOM) (UC-DOM) | |
1 | 2a00:1450:400... 2a00:1450:4001:820::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:821::2003 | 15169 (GOOGLE) (GOOGLE) | |
10 | 3 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
www.outlook.com | |
outlook.office365.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
login.microsoftonline.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
uc.edu
4 redirects
mail.uc.edu adfs.uc.edu login.uc.edu |
1 MB |
2 |
office365.com
2 redirects
outlook.office365.com |
6 KB |
2 |
outlook.com
2 redirects
outlook.com www.outlook.com |
912 B |
1 |
gstatic.com
fonts.gstatic.com |
9 KB |
1 |
googleapis.com
fonts.googleapis.com |
686 B |
1 |
microsoftonline.com
1 redirects
login.microsoftonline.com |
2 KB |
10 | 6 |
Domain | Requested by | |
---|---|---|
9 | login.uc.edu |
1 redirects
login.uc.edu
|
2 | outlook.office365.com | 2 redirects |
2 | mail.uc.edu | 2 redirects |
1 | fonts.gstatic.com |
login.uc.edu
|
1 | fonts.googleapis.com |
login.uc.edu
|
1 | adfs.uc.edu | 1 redirects |
1 | login.microsoftonline.com | 1 redirects |
1 | www.outlook.com | 1 redirects |
1 | outlook.com | 1 redirects |
10 | 9 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.uc.edu |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.uc.edu InCommon RSA Server CA |
2019-10-09 - 2020-10-08 |
a year | crt.sh |
*.storage.googleapis.com GTS CA 1O1 |
2020-01-07 - 2020-03-31 |
3 months | crt.sh |
*.google.com GTS CA 1O1 |
2020-01-07 - 2020-03-31 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://login.uc.edu/idp/profile/SAML2/Redirect/SSO;jsessionid=fdxx5rn8bgtu1apgdjxc9so5y?execution=e1s1
Frame ID: AF6B6DE3C969A076E018726C4C5AFB37
Requests: 10 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://mail.uc.edu/
HTTP 302
https://mail.uc.edu/ HTTP 302
https://outlook.com/mail.uc.edu/ HTTP 301
https://www.outlook.com/mail.uc.edu/ HTTP 301
https://outlook.office365.com/mail.uc.edu/ HTTP 302
https://outlook.office365.com/owa/mail.uc.edu/ HTTP 302
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redir... HTTP 302
https://adfs.uc.edu/adfs/ls/?client-request-id=ae96470c-ef68-4545-b560-606ca99bd373&username=&wa... HTTP 302
https://login.uc.edu/idp/profile/SAML2/Redirect/SSO?SAMLRequest=fZFLa8MwEIT%2fitDdlq04SS0cQ0goGPo... HTTP 302
https://login.uc.edu/idp/profile/SAML2/Redirect/SSO;jsessionid=fdxx5rn8bgtu1apgdjxc9so5y?executio... Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
- script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i
Modernizr (JavaScript Libraries) Expand
Detected patterns
- script /([\d.]+)?\/modernizr(?:.([\d.]+))?.*\.js/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Title: Get My Username
Search URL Search Domain Scan URL
Title: Change My Password
Search URL Search Domain Scan URL
Title: Forgot My Password
Search URL Search Domain Scan URL
Title: IT@UC Service Desk
Search URL Search Domain Scan URL
Title: UC Information Security Policies
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://mail.uc.edu/
HTTP 302
https://mail.uc.edu/ HTTP 302
https://outlook.com/mail.uc.edu/ HTTP 301
https://www.outlook.com/mail.uc.edu/ HTTP 301
https://outlook.office365.com/mail.uc.edu/ HTTP 302
https://outlook.office365.com/owa/mail.uc.edu/ HTTP 302
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=ae96470c-ef68-4545-b560-606ca99bd373&protectedtoken=true&domain_hint=mail.uc.edu&nonce=637154921593963997.09255936-edf5-4afc-b35f-ee98373d9afb&state=DYvJDYAwDMBamIBBeqZpyDg9JSQQr4r1ycOW_LBWSu3CJmgvUpSBAiaOARk4AzNZzxGlshl9okllNlMBpxmDTyDoXGbV8h7u_Yp7ynXb1ezoy_0 HTTP 302
https://adfs.uc.edu/adfs/ls/?client-request-id=ae96470c-ef68-4545-b560-606ca99bd373&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQIIAdNiNtQztFIxgAAjXRCpa5CWZqibnApiIYEiIS4BHvdp6zLeu7puTUjIWTn7cvEsRu7cxMwcvdJkvdSU0lWMShklJQXFVvr6-aUlOfn52Xr5aWmZyanGZqZ6yfm5-vnlifo7GBkvMDKuYjI3MzY3NDWxNDI0tTS2NDO2tDTXM7A0MgXyzHRTU9JMdU0S05J1k4xN03RTUy0tjM2NUywT05JuMfH7O5aWZBiBiPyizKrUT0ycaflFufEF-cUls5jzXSLLvFwiHctdfJ0Scz2dnFILowoqXdItvYIDA4tMigwrk_3D432cwoNLjZ29ctPLQguCnRwzE_0dg7JNHKv8oqoq3HOKM3Is87NzcvxyfJ0KKnJdQipd8iPck8IsMsxL4yMLzCvzIpIMU6vyK-MNVjETFXqbmNmAIZCbn3eKmS2_IDUvM-UCC-MrFh4DVisODi4BPgk2BYYfLIyLWIGhPOMs1914fXnv-fd6Exa7xjCcYtUP9TEviSj3KfQL09c3DAsw8siuSkn0DLfMjQxI1XfX9vbITAwMSTGoSAq1sDW0MpzAxjiBje0FG-MHNsYOdoZdnEREzC0uESMDI6CrDXWNTBQMLa1MLK0MLaMA0 HTTP 302
https://login.uc.edu/idp/profile/SAML2/Redirect/SSO?SAMLRequest=fZFLa8MwEIT%2fitDdlq04SS0cQ0goGPoiKT30psjrRmBLrlbq499XduihFHJblpmd%2fZgK5dCPYhv82RzgPQB60uw3VLfJaSXXSso24R2%2fSYqlLBO5Xi%2bSnMMiX52WpcwXlLyAQ23NhvI0o6RBDNAY9NL4uMp4lmR5wovnvBRFKThPizJ7pWQfc7SRfnaevR9RMNbbN23SoFJoA9PtyEZnO90DO27v7zg7QKsdKM%2bOx0dKdtYgTCHBGWElahRGDoDCKzHpRfxHqItIBIMjKN1paCn5GnqDYua%2b7o7x3irb07qaudzFet0kEcFNXLSeuCKWbDv8pZpmFgUfWgEy7wL6il2O19Wliod4stk%2f2V6rb3Jr3SCvQOZpPm9iXd0s%2fYu67Xv7uXMgPWxoTANKWF2x%2f53XPw%3d%3d&RelayState=4922931b-96db-4623-8a02-4591a492325f&client-request-id=ae96470c-ef68-4545-b560-606ca99bd373 HTTP 302
https://login.uc.edu/idp/profile/SAML2/Redirect/SSO;jsessionid=fdxx5rn8bgtu1apgdjxc9so5y?execution=e1s1 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
SSO;jsessionid=fdxx5rn8bgtu1apgdjxc9so5y
login.uc.edu/idp/profile/SAML2/Redirect/ Redirect Chain
|
6 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.css
login.uc.edu/content/ |
98 KB 98 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shibbolethLogin.css
login.uc.edu/content/ |
1 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
University-of-Cincinnati-Main-Campus-Ofer-Wolberger-for-NYT.jpg
login.uc.edu/content/new/ |
794 KB 794 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
UC_ID_unleashedwhite.png
login.uc.edu/content/new/ |
68 KB 68 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
login.uc.edu/content/ |
91 KB 91 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.js
login.uc.edu/content/ |
28 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shibbolethLogin.js
login.uc.edu/content/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
5 KB 686 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery object| jQuery1102007252762127846291 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
login.uc.edu/idp | Name: JSESSIONID Value: fdxx5rn8bgtu1apgdjxc9so5y |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
adfs.uc.edu
fonts.googleapis.com
fonts.gstatic.com
login.microsoftonline.com
login.uc.edu
mail.uc.edu
outlook.com
outlook.office365.com
www.outlook.com
129.137.3.196
129.137.5.111
129.137.6.64
20.190.129.160
2603:1026:206:2::2
2a00:1450:4001:820::200a
2a00:1450:4001:821::2003
40.97.128.194
042d302e9379b02e515cc61f75ae541a6034ef6010cc33b2fa567ee8392aa5de
1a71a7aa252147ca0884bb6d35cac101f826fe6fd9bf761b9f52992a062c9262
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
573b77568cb090914c3f81dad30a5594b283a29c0efc6150ea20b4b9adef3cf4
74e6940ac12e3867bd226b5018db5220b8d96d3503ccd2782cf5e67a26a7153f
898d05a17f2cfc5120ddcdba47a885c378c0b466f30f0700e502757e24b403a1
89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e
b0da72d60d5dd29e3d180e7c87781f30223e27ea0b0de30826ce5a4279f2319d
e431542d4be07619c04c64863e9943e60f6bc638bf84a5a45f651dac82357b43
e9503448692b738dd260fbd7f7cabf2e11f09b600fa97e6eb3a56eba5b1a7e9b