![](/screenshots/60bd8a3f-5618-4940-b989-73827a106c44.png)
ap.ssso.hdems.com
Open in
urlscan Pro
18.140.251.220
Public Scan
Effective URL: https://ap.ssso.hdems.com/portal/365cs2021.henngetrial.com/login/
Submission Tags: phishingrod
Submission: On June 01 via api from DE — Scanned from DE
Summary
TLS certificate: Issued by Amazon RSA 2048 M01 on July 29th 2023. Valid for: a year.
This is the only time ap.ssso.hdems.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2a05:d014:21b... 2a05:d014:21b:8e00::6e:0 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a05:d014:21b... 2a05:d014:21b:8e02::6e:5 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 18.140.251.220 18.140.251.220 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 2406:da14:b46... 2406:da14:b46:a702:b48d:b451:26a4:e555 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 20.50.88.235 20.50.88.235 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
8 | 5 |
ASN16509 (AMAZON-02, US)
sanji.365cs2021.henngetrial.com.connect.hennge.io |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-140-251-220.ap-southeast-1.compute.amazonaws.com
ap.ssso.hdems.com |
ASN16509 (AMAZON-02, US)
static.ssso.hdems.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
dc.services.visualstudio.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
hdems.com
ap.ssso.hdems.com static.ssso.hdems.com |
74 KB |
2 |
visualstudio.com
dc.services.visualstudio.com — Cisco Umbrella Rank: 751 |
293 B |
1 |
ngrok.com
idp.ngrok.com |
4 KB |
1 |
hennge.io
1 redirects
sanji.365cs2021.henngetrial.com.connect.hennge.io |
1 KB |
8 | 4 |
Domain | Requested by | |
---|---|---|
3 | static.ssso.hdems.com |
ap.ssso.hdems.com
|
2 | dc.services.visualstudio.com |
static.ssso.hdems.com
|
2 | ap.ssso.hdems.com | |
1 | idp.ngrok.com | |
1 | sanji.365cs2021.henngetrial.com.connect.hennge.io | 1 redirects |
8 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
verify.ssso.hdems.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.ngrok.com R3 |
2024-04-14 - 2024-07-13 |
3 months | crt.sh |
*.ssso.hdems.com Amazon RSA 2048 M01 |
2023-07-29 - 2024-08-26 |
a year | crt.sh |
prod.ai.ingestion.msftcloudes.com Microsoft Azure RSA TLS Issuing CA 03 |
2024-04-10 - 2025-04-05 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://ap.ssso.hdems.com/portal/365cs2021.henngetrial.com/login/
Frame ID: 48B240A12305951865934531C572E162
Requests: 8 HTTP requests in this frame
Screenshot
![](/screenshots/60bd8a3f-5618-4940-b989-73827a106c44.png)
Page Title
HENNGE K.K.Page URL History Show full URLs
-
https://sanji.365cs2021.henngetrial.com.connect.hennge.io/
HTTP 302
https://idp.ngrok.com/saml/edghtsrt_2eWtewYS7rFSLVcBpJNYWTlpURT/authn?force_authn=false&state=Ad0F... Page URL
- https://ap.ssso.hdems.com/portal/365cs2021.henngetrial.com/login/ Page URL
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Log in with Device Certificate
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://sanji.365cs2021.henngetrial.com.connect.hennge.io/
HTTP 302
https://idp.ngrok.com/saml/edghtsrt_2eWtewYS7rFSLVcBpJNYWTlpURT/authn?force_authn=false&state=Ad0FWahViwa-IBXcnl5fieGKMbHIWVZ6uaN6Y2RopZIDJC7FjQQ87_eqlDKEnFNK85EOtU1OG0msgRQ-QYnldAx3BvhC3FT_C_fL_bJeASTteuLieMoLj4vZ3sWMASeZVWeIqDUDtmdfk-RBPlxQdRZXRxDTDC-Iuvkj7IIFzBo9yxbzCcp8HpTYgfEdSpSjpyOMYENZUM0v0cTwLYyy0wJSMDCWlGYQQLiP2qLSc6JYClrxPGku9Vff8KiEMla5Eg7I-zvwsnkjUImfT9A4x15zc2Ik2bnn0oTNsMlUUwoyH02pFa262GuiFisgnGvZE63zwAZHTgMw95FYGpvuMyx3ryTe7WMVPzY0nHasplVrNVvxdzuUwROFeVwbd8O8GTyNzBM3Kmopw-0UkhM_Nn7uZGDOgCgUieYRefu1nJ1EEsm6Apm8viCoRsJIhutvIdgk8TYLekD-5RxY8BsAUy1tHgs4OOJrkhlWfqedEfsnaphhSUMiXd2TlEhAVmllsA9dYnN6tpHYNritr56tUe8KxkJ5NdLmUaCBqEeomrlresw2Lh7jN9K5mSOGd4bfVwq-nu0pjSU1YacPWvQp4qpkw7ObtskuY0ubMAwzkkMpjIiVdbovPTii_j4i_fzLEaKuTr2zoOc64sg7eEKNTtUgFTdp5Qi5qzfoaYrFzCX19RLrssPAXBFVyjr62OPjz6XcVFG1wZprgQ7i8HvmNRZT3Nej-QEFoaZARjYZ18rLntW6k1EyHhClvPJ_tADWf6dRWJJvs3QjBrA1b954tpNaqPhvab8a5mS3XjQYTO_5lOfAmZrOSCF5_LMMskMUDmF1tbQy9fMIGDQjXTW-mqLQDsBkoN8q4-2t-ecvRBDrE_O9K8FUDlc35TwA3aVP84AebaeKRg1pdLgGShanMYeIndAOLLxZ74wzxlevmEdsuOck7wURSPXS-6m432AX8QxeApCwlpelmApuhLau2A%3D%3D Page URL
- https://ap.ssso.hdems.com/portal/365cs2021.henngetrial.com/login/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://sanji.365cs2021.henngetrial.com.connect.hennge.io/ HTTP 302
- https://idp.ngrok.com/saml/edghtsrt_2eWtewYS7rFSLVcBpJNYWTlpURT/authn?force_authn=false&state=Ad0FWahViwa-IBXcnl5fieGKMbHIWVZ6uaN6Y2RopZIDJC7FjQQ87_eqlDKEnFNK85EOtU1OG0msgRQ-QYnldAx3BvhC3FT_C_fL_bJeASTteuLieMoLj4vZ3sWMASeZVWeIqDUDtmdfk-RBPlxQdRZXRxDTDC-Iuvkj7IIFzBo9yxbzCcp8HpTYgfEdSpSjpyOMYENZUM0v0cTwLYyy0wJSMDCWlGYQQLiP2qLSc6JYClrxPGku9Vff8KiEMla5Eg7I-zvwsnkjUImfT9A4x15zc2Ik2bnn0oTNsMlUUwoyH02pFa262GuiFisgnGvZE63zwAZHTgMw95FYGpvuMyx3ryTe7WMVPzY0nHasplVrNVvxdzuUwROFeVwbd8O8GTyNzBM3Kmopw-0UkhM_Nn7uZGDOgCgUieYRefu1nJ1EEsm6Apm8viCoRsJIhutvIdgk8TYLekD-5RxY8BsAUy1tHgs4OOJrkhlWfqedEfsnaphhSUMiXd2TlEhAVmllsA9dYnN6tpHYNritr56tUe8KxkJ5NdLmUaCBqEeomrlresw2Lh7jN9K5mSOGd4bfVwq-nu0pjSU1YacPWvQp4qpkw7ObtskuY0ubMAwzkkMpjIiVdbovPTii_j4i_fzLEaKuTr2zoOc64sg7eEKNTtUgFTdp5Qi5qzfoaYrFzCX19RLrssPAXBFVyjr62OPjz6XcVFG1wZprgQ7i8HvmNRZT3Nej-QEFoaZARjYZ18rLntW6k1EyHhClvPJ_tADWf6dRWJJvs3QjBrA1b954tpNaqPhvab8a5mS3XjQYTO_5lOfAmZrOSCF5_LMMskMUDmF1tbQy9fMIGDQjXTW-mqLQDsBkoN8q4-2t-ecvRBDrE_O9K8FUDlc35TwA3aVP84AebaeKRg1pdLgGShanMYeIndAOLLxZ74wzxlevmEdsuOck7wURSPXS-6m432AX8QxeApCwlpelmApuhLau2A%3D%3D
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
authn
idp.ngrok.com/saml/edghtsrt_2eWtewYS7rFSLVcBpJNYWTlpURT/ Redirect Chain
|
6 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
Primary Request
/
ap.ssso.hdems.com/portal/365cs2021.henngetrial.com/login/ |
20 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.css
static.ssso.hdems.com/-/026d1a166d6e2e95d0a9f8908f45a5947b895e48d0cc9d67d6da0c0851af1406c15a8988c2ebe9eb1dd96009db413de44f4615fe34b0ac728c7f9efd615f48a0/js/portal/ |
155 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon_login_under.png
static.ssso.hdems.com/-/5d12785f8c9ce8373e1ed0a6936748f2db5fbdc6f6655b4b190786a88f991c79b0adb1fe61c7418f7c3bffec4d091bee3a5d77016d217bfa3c0ab9c2d7d76437/img/ |
299 B 619 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ai.2.min.js
static.ssso.hdems.com/-/7492585fac87ce8cf0c5b9b3915f1e9d8b91971f3b0d00f4e353c957b2c9cb44d2431acea5f5ffbbb4f5227ebd2215798fdb9f85f2a9debd293807200181f2b3/lib/ |
127 KB 36 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
ap.ssso.hdems.com/ |
5 KB 6 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
track
dc.services.visualstudio.com/v2/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
track
dc.services.visualstudio.com/v2/ |
189 B 293 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| appInsights function| $ function| once object| google object| chromebook object| e function| t object| Microsoft function| __assign function| __extends3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
sanji.365cs2021.henngetrial.com.connect.hennge.io/ | Name: ngrok.session Value: Ab8CWahViwa-IBXcnl5fieGKMbHIWVZ6uaN6Y2RopZIDJC6O9dLW91pW3VB92daq64YvwRgA80tb-BIwXPfsCTwTgiWqyW2ux_VVN1zpKYogStgLoH2C2TEnwvXsfmB5IijaA8nFKJzJT9jZShQr0lFVRhKCkJWItgwufmTEq8_DmnZzdsreE4DfQNFr82hHKTSLHb6dDciYLzVgO3UphtYASvRC0ITAhL_3xGnKhrDoVEYiOClK7GA34V1knf8p9WagYL0xl02kZQq4Ar6qHWOMxa9vTU5fr7XX8MVus7zVtRrUPsO4N_bId5GQqqDOoHgMNSS7kk2N0Hl8MOtURwhrJiEeYgewhQCHc2Yx186xusADkGgVBkQFt_mcP1_JH58-wd2QC4FGHeR-QxxI8VPP5dCTFtA-j3yMJ5ukNzW73Q== |
|
.ssso.hdems.com/ | Name: ai_user Value: i1996|2024-06-01T04:06:28.204Z |
|
.ssso.hdems.com/ | Name: ai_session Value: LFdV+|1717214788307.9|1717214788307.9 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | default-src; script-src 'sha256-AjPdJSbZmeWHnEc5ykvJFay8FTWeTeRbs9dutfZ0HqE='; reflected-xss block; referrer no-referrer; |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ap.ssso.hdems.com
dc.services.visualstudio.com
idp.ngrok.com
sanji.365cs2021.henngetrial.com.connect.hennge.io
static.ssso.hdems.com
18.140.251.220
20.50.88.235
2406:da14:b46:a702:b48d:b451:26a4:e555
2a05:d014:21b:8e00::6e:0
2a05:d014:21b:8e02::6e:5
3563add50dc208ac56e11f895cb5f4e5eba61bdba9fc0a12904f437c1d92a2e0
8c557ef9c88c3d07a1a64e17ba44812ba04b8b03eec0bc2bf4ea819c3aeffb4e
9e49f1d355a5a14ba08e90c4e1fb1d389eda1157c0d89ddd8e14e142a614c2e6
a0b5013409a4dd0a10edb90daa4c92c08dd5277ece8ef414ea7288352bad7bd2
c3398f725ad750f86d169c4555b2b511843c0b2542056ccaab7bbf4c4bb17dff
ca41abcc7fb6d404b7761cc064195d84e59cbfbb2fdbab2c82c133672572ee95
e9806b8e1b8a87e7f39e2671d4a9208cea4e8ea05fe78f6f8f2f96bd3146db95
f856777511a3d0db323882d762a4f28d878aeb5da6f974097a3d733da9f910ba