l.correspondence.cigna.com Open in urlscan Pro
173.213.4.170 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://l.correspondence.cigna.com/rts/open.aspx?tp=i-1NGB-Ie-EH-6HLPT-1o-74MwV-1c-6Giy9-l79i4yT4WD-TfHxU%22%20height=%221%22%20wid...
Effective URL:
http://l.correspondence.cigna.com/rts/default404.aspx?aspxerrorpath=/rts/open.aspx
Submission: On February 16 via api (February 16th 2022, 2:45:06 am UTC) from US — Scanned from DE

Summary HTTP 2 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 2 HTTP transactions. The main IP is 173.213.4.170, located in United States and belongs to ASN-CHEETA-MAIL, US. The main domain is l.correspondence.cigna.com. The Cisco Umbrella rank of the primary domain is 836385.

This is the only time l.correspondence.cigna.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	173.213.4.170 173.213.4.170	53316 (ASN-CHEET...) (ASN-CHEETA-MAIL)
1	45.60.124.199 45.60.124.199	19551 (INCAPSULA) (INCAPSULA)
2	2

2 173.213.4.170 (United States) 1 redirects

ASN53316 (ASN-CHEETA-MAIL, US)

l.correspondence.cigna.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 45.60.124.199 (United States)

ASN19551 (INCAPSULA, US)

www.cheetahdigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	cigna.com 1 redirects l.correspondence.cigna.com — Cisco Umbrella Rank: 836385	3 KB
1	cheetahdigital.com www.cheetahdigital.com — Cisco Umbrella Rank: 563231	15 KB
2	2

	Domain	Requested by
2	l.correspondence.cigna.com	1 redirects
1	www.cheetahdigital.com	l.correspondence.cigna.com
2	2

This site contains links to these domains. Also see Links.

Domain
www.cheetahdigital.com

Subject Issuer	Validity	Valid
*.cheetahdigital.com DigiCert SHA2 Secure Server CA	`2020-04-09` - `2022-07-13`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://l.correspondence.cigna.com/rts/default404.aspx?aspxerrorpath=/rts/open.aspx
Frame ID: 843D7D5038467D892E68176886D8DF76
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Page not Found | Cheetah Digital

Page URL History Show full URLs

http://l.correspondence.cigna.com/rts/open.aspx?tp=i-1NGB-Ie-EH-6HLPT-1o-74MwV-1c-6Giy9-l79i4yT4WD-TfHxU%22%20... HTTP 302
http://l.correspondence.cigna.com/rts/default404.aspx?aspxerrorpath=/rts/open.aspx Page URL

Detected technologies

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

\.aspx?(?:$|\?)

Page Statistics

2
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

18 kB
Transfer

17 kB
Size

4
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.cheetahdigital.com/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://l.correspondence.cigna.com/rts/open.aspx?tp=i-1NGB-Ie-EH-6HLPT-1o-74MwV-1c-6Giy9-l79i4yT4WD-TfHxU%22%20height=%221%22%20width=%221%22%20style=%22display:none%22%3E%3C!--%20PRE-HEADER%20--%3E%20%3Cdiv%20style=%22-webkit-hyphens:none;display:none;font-size:0;height:0;opacity:0;visibility:hidden;width:0;font-family:Arial HTTP 302
http://l.correspondence.cigna.com/rts/default404.aspx?aspxerrorpath=/rts/open.aspx Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request default404.aspx Show response
l.correspondence.cigna.com/rts/
Redirect Chain

http://l.correspondence.cigna.com/rts/open.aspx?tp=i-1NGB-Ie-EH-6HLPT-1o-74MwV-1c-6Giy9-l79i4yT4WD-TfHxU%22%20height=%221%22%20width=%221%22%20style=%22display:none%22%3E%3C!--%20PRE-HEADER%20--%3E...
http://l.correspondence.cigna.com/rts/default404.aspx?aspxerrorpath=/rts/open.aspx

2 KB
3 KB

92ms
92ms

Document
text/html

173.213.4.170
ASN-CHEETA-MAIL

General

Check archive.org

Show headers Download Go to

Full URL: http://l.correspondence.cigna.com/rts/default404.aspx?aspxerrorpath=/rts/open.aspx
Protocol: HTTP/1.1
Server: 173.213.4.170 , United States, ASN53316 (ASN-CHEETA-MAIL, US),
Reverse DNS
Software: /
Resource Hash: c61f4c207bb42e5b826aff8921ebb3b4e6fc1711a92e0dcf942b2fe8b0d01c98

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Cache-Control: private
Content-Type: text/html; charset=utf-8
Server
X-Powered-By
Date: Wed, 16 Feb 2022 02:45:01 GMT
Content-Length: 2361

Redirect headers

Content-Type: text/html; charset=utf-8
Location: /rts/default404.aspx?aspxerrorpath=/rts/open.aspx
Server
X-Powered-By
Date: Wed, 16 Feb 2022 02:45:01 GMT
Content-Length: 166

GET
H2 200 Cheetah_Digital_Logo_header.png
www.cheetahdigital.com/sites/default/files/ 15 KB
15 KB 58ms
11ms Image
image/png 45.60.124.199
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cheetahdigital.com/sites/default/files/Cheetah_Digital_Logo_header.png

Requested by

Host: l.correspondence.cigna.com
URL: http://l.correspondence.cigna.com/rts/default404.aspx?aspxerrorpath=/rts/open.aspx

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.124.199 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://l.correspondence.cigna.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 16 Feb 2022 02:45:02 GMT
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 03 Aug 2021 20:03:14 GMT
x-cdn: Imperva
etag: "6109a102-161c0"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/png
x-iinfo: 12-72143497-0 0CNN RT(1644979502267 0) q(0 -1 -1 1) r(0 -1)
cache-control: max-age=0
content-security-policy: upgrade-insecure-requests
content-length: 90560
x-xss-protection: 1; mode=block

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
l.correspondence.cigna.com/	1969-12-31 23:59:59	Name: BIGipServercnv_ats_pool Value: !pL2kI5eFIq6CormoFVQbWBKi/4Lz4rozKFPUW0xVooBKkRv3jZEBxGNcZuR7/HLxzgbllUA4dkaFscs=
l.correspondence.cigna.com/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: 3nij3fhcbabjjyclcsrylgte
.cheetahdigital.com/	1970-01-20 09:41:41	Name: visid_incap_1666872 Value: LDDVE1vhSV6WioARxHQlLC5lDGIAAAAAQUIPAAAAAABBwMlG5mktYLXv1Us6oQvP
.cheetahdigital.com/	1969-12-31 23:59:59	Name: incap_ses_246_1666872 Value: 8bBpX+PiuAths15oOfhpAy5lDGIAAAAAhGekb5ikbCHCMRXHTrhLZg==

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

l.correspondence.cigna.com
www.cheetahdigital.com
173.213.4.170
45.60.124.199
c61f4c207bb42e5b826aff8921ebb3b4e6fc1711a92e0dcf942b2fe8b0d01c98
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

l.correspondence.cigna.com Open in urlscan Pro 173.213.4.170 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

2 Requests

50 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

18 kBTransfer

17 kBSize

4 Cookies

1 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

4 Cookies

Indicators

l.correspondence.cigna.com Open in urlscan Pro
173.213.4.170 Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

18 kB
Transfer

17 kB
Size

4
Cookies

2 HTTP transactions
0 data transactions