urlscan.io logo urlscan.io
SecurityTrails logo

firstamericansso.level0help.com Open in urlscan Pro
40.84.228.98  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://firstamerican.level0help.com/tip/process?cguid=391e7e9a-6bb2-11eb-8644-000d3a72bab1&tguid=&tiguid=&rtid=21&rg=0b7a6bff-6bb4-1...
Effective URL: https://firstamericansso.level0help.com/signin?ReturnUrl=https%3a%2f%2ffirstamerican.level0help.com%2ftip%2fprocess%3fcguid%3d391e7e9a-6...
Submission: On May 13 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 3 HTTP transactions. The main IP is 40.84.228.98, located in San Antonio, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is firstamericansso.level0help.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on April 27th 2021. Valid for: a year.
This is the only time firstamericansso.level0help.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 2 23.98.159.71 8075 (MICROSOFT...)
2 40.84.228.98 8075 (MICROSOFT...)
3 2
Apex Domain
Subdomains		 Transfer
4 level0help.com
firstamerican.level0help.com
firstamericansso.level0help.com
20 KB
0 firstam.com Failed
sts.firstam.com Failed
3 2
Domain Requested by
2 firstamericansso.level0help.com firstamericansso.level0help.com
2 firstamerican.level0help.com 2 redirects
0 sts.firstam.com Failed
3 3

This site contains no links.

Subject Issuer Validity Valid
*.level0help.com
Sectigo RSA Domain Validation Secure Server CA		 2021-04-27 -
2022-04-27		 a year crt.sh

This page contains 1 frames:

Frame: https://sts.firstam.com/adfs/ls/
Frame ID: 11A2DF11CA0FEA9B1447EA227C5345B1
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://firstamerican.level0help.com/tip/process?cguid=391e7e9a-6bb2-11eb-8644-000d3a72bab1&tguid=&tiguid=&rtid=2... HTTP 302
    https://firstamerican.level0help.com/loginsso?ReturnUrl=%2ftip%2fprocess%3fcguid%3d391e7e9a-6bb2-11eb-8644-000d3a... HTTP 302
    https://firstamericansso.level0help.com/signin?ReturnUrl=https%3a%2f%2ffirstamerican.level0help.com%2ftip%2fprocess%... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

Page Statistics

3
Requests

67 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

2
IPs

1
Countries

19 kB
Transfer

126 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://firstamerican.level0help.com/tip/process?cguid=391e7e9a-6bb2-11eb-8644-000d3a72bab1&tguid=&tiguid=&rtid=21&rg=0b7a6bff-6bb4-11eb-8644-000d3a72bab1&it=2 HTTP 302
    https://firstamerican.level0help.com/loginsso?ReturnUrl=%2ftip%2fprocess%3fcguid%3d391e7e9a-6bb2-11eb-8644-000d3a72bab1%26tguid%3d%26tiguid%3d%26rtid%3d21%26rg%3d0b7a6bff-6bb4-11eb-8644-000d3a72bab1%26it%3d2&cguid=391e7e9a-6bb2-11eb-8644-000d3a72bab1&tguid=&tiguid=&rtid=21&rg=0b7a6bff-6bb4-11eb-8644-000d3a72bab1&it=2 HTTP 302
    https://firstamericansso.level0help.com/signin?ReturnUrl=https%3a%2f%2ffirstamerican.level0help.com%2ftip%2fprocess%3fcguid%3d391e7e9a-6bb2-11eb-8644-000d3a72bab1%26tguid%3d%26tiguid%3d%26rtid%3d21%26rg%3d0b7a6bff-6bb4-11eb-8644-000d3a72bab1%26it%3d2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request signin
firstamericansso.level0help.com/
Redirect Chain
  • https://firstamerican.level0help.com/tip/process?cguid=391e7e9a-6bb2-11eb-8644-000d3a72bab1&tguid=&tiguid=&rtid=21&rg=0b7a6bff-6bb4-11eb-8644-000d3a72bab1&it=2
  • https://firstamerican.level0help.com/loginsso?ReturnUrl=%2ftip%2fprocess%3fcguid%3d391e7e9a-6bb2-11eb-8644-000d3a72bab1%26tguid%3d%26tiguid%3d%26rtid%3d21%26rg%3d0b7a6bff-6bb4-11eb-8644-000d3a72bab...
  • https://firstamericansso.level0help.com/signin?ReturnUrl=https%3a%2f%2ffirstamerican.level0help.com%2ftip%2fprocess%3fcguid%3d391e7e9a-6bb2-11eb-8644-000d3a72bab1%26tguid%3d%26tiguid%3d%26rtid%3d21...
2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://firstamericansso.level0help.com/signin?ReturnUrl=https%3a%2f%2ffirstamerican.level0help.com%2ftip%2fprocess%3fcguid%3d391e7e9a-6bb2-11eb-8644-000d3a72bab1%26tguid%3d%26tiguid%3d%26rtid%3d21%26rg%3d0b7a6bff-6bb4-11eb-8644-000d3a72bab1%26it%3d2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.84.228.98 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
78c43ae72cc34a2978f438b4d3304c56fd14646cccc8cf26e3fa03c79402ecef

Request headers

:method
GET
:authority
firstamericansso.level0help.com
:scheme
https
:path
/signin?ReturnUrl=https%3a%2f%2ffirstamerican.level0help.com%2ftip%2fprocess%3fcguid%3d391e7e9a-6bb2-11eb-8644-000d3a72bab1%26tguid%3d%26tiguid%3d%26rtid%3d21%26rg%3d0b7a6bff-6bb4-11eb-8644-000d3a72bab1%26it%3d2
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cache-control
private
content-type
text/html; charset=utf-8
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
date
Thu, 13 May 2021 05:07:56 GMT
content-length
1877

Redirect headers

cache-control
private
content-type
text/html; charset=utf-8
location
https://firstamericansso.level0help.com:443/signin?ReturnUrl=https%3a%2f%2ffirstamerican.level0help.com%2ftip%2fprocess%3fcguid%3d391e7e9a-6bb2-11eb-8644-000d3a72bab1%26tguid%3d%26tiguid%3d%26rtid%3d21%26rg%3d0b7a6bff-6bb4-11eb-8644-000d3a72bab1%26it%3d2
server
ServerServer
set-cookie
ASP.NET_SessionId=hry2emuigcarwr1kptvniiie; path=/; secure; HttpOnly; SameSite=Lax
strict-transport-security
max-age=31536000; includeSubdomains
x-xss-protection
1;
x-content-type-options
nosniff
content-security-policy
default-src 'self'; frame-ancestors 'self' *; child-src *; connect-src 'self' xpo-stg.csod.com cloud.scorm.com api.raygun.io media.twiliocdn.com *.twilio.com wss://*.twilio.com; font-src 'self' * data:; img-src * data: blob: ; media-src * blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' media.twiliocdn.com maxcdn.bootstrap.com cdn.raygun.io www.google.com www.gstatic.com; style-src 'self' 'unsafe-inline' maxcdn.bootstrapcdn.com fonts.googleapis.com fast.fonts.net; worker-src 'self' * blob: ;
date
Thu, 13 May 2021 05:07:55 GMT
content-length
371
bootstrap.css
firstamericansso.level0help.com/Content/ 		124 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://firstamericansso.level0help.com/Content/bootstrap.css
Requested by
Host: firstamericansso.level0help.com
URL: https://firstamericansso.level0help.com/signin?ReturnUrl=https%3a%2f%2ffirstamerican.level0help.com%2ftip%2fprocess%3fcguid%3d391e7e9a-6bb2-11eb-8644-000d3a72bab1%26tguid%3d%26tiguid%3d%26rtid%3d21%26rg%3d0b7a6bff-6bb4-11eb-8644-000d3a72bab1%26it%3d2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.84.228.98 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
28735c36b12c5499ee294b646db462f1ce046c6c575df052df11364b0114f323

Request headers

:path
/Content/bootstrap.css
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
firstamericansso.level0help.com
referer
https://firstamericansso.level0help.com/signin?ReturnUrl=https%3a%2f%2ffirstamerican.level0help.com%2ftip%2fprocess%3fcguid%3d391e7e9a-6bb2-11eb-8644-000d3a72bab1%26tguid%3d%26tiguid%3d%26rtid%3d21%26rg%3d0b7a6bff-6bb4-11eb-8644-000d3a72bab1%26it%3d2
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://firstamericansso.level0help.com/signin?ReturnUrl=https%3a%2f%2ffirstamerican.level0help.com%2ftip%2fprocess%3fcguid%3d391e7e9a-6bb2-11eb-8644-000d3a72bab1%26tguid%3d%26tiguid%3d%26rtid%3d21%26rg%3d0b7a6bff-6bb4-11eb-8644-000d3a72bab1%26it%3d2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 13 May 2021 05:07:56 GMT
content-encoding
gzip
last-modified
Thu, 30 May 2019 12:47:13 GMT
server
Microsoft-IIS/10.0
etag
"805e99cde516d51:0"
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
17404
/
sts.firstam.com/adfs/ls/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
sts.firstam.com
URL
https://sts.firstam.com/adfs/ls/

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

firstamerican.level0help.com
firstamericansso.level0help.com
sts.firstam.com
sts.firstam.com
23.98.159.71
40.84.228.98
28735c36b12c5499ee294b646db462f1ce046c6c575df052df11364b0114f323
78c43ae72cc34a2978f438b4d3304c56fd14646cccc8cf26e3fa03c79402ecef