Submitted URL: https://nustarenergy-my.sharepoint.com/personal/ly35m9_nustarenergy_com/Documents/Documents/12062019.docx?web=1
Effective URL: https://login.nustarenergy.com/adfs/ls/?client-request-id=f086199f-5012-9000-271c-3bff046f80d3&username=&wa=wsignin1.0&wtrealm=...
Submission: On November 20 via manual from US

Summary

This website contacted 1 IPs in 2 countries across 4 domains to perform 3 HTTP transactions. The main IP is 66.194.93.95, located in United States and belongs to LVLT-3549 - Level 3 Parent, LLC, US. The main domain is login.nustarenergy.com.
TLS certificate: Issued by DigiCert Global CA G2 on August 13th 2018. Valid for: 2 years.
This is the only time login.nustarenergy.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 3 13.107.136.9 8068 (MICROSOFT...)
2 2 20.190.129.2 8075 (MICROSOFT...)
3 66.194.93.95 3549 (LVLT-3549)
3 1
Domain Requested by
3 login.nustarenergy.com login.nustarenergy.com
3 nustarenergy-my.sharepoint.com 3 redirects
1 login.microsoftonline.com 1 redirects
1 login.windows.net 1 redirects
3 4

This site contains no links.

Subject Issuer Validity Valid
login.nustarenergy.com
DigiCert Global CA G2
2018-08-13 -
2020-08-13
2 years crt.sh

This page contains 1 frames:

Primary Page: https://login.nustarenergy.com/adfs/ls/?client-request-id=f086199f-5012-9000-271c-3bff046f80d3&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQIIAaVRPWgUQRi9uZ81uYgeMUUEixQBwTC3M7MzszMbLPZn9oJBs6bxpwmbu13vIHe77u5BYiFWIeXVNoJ2V1qJhWCbKpAuvSRYhVR2eotNSsFXPL7He8XjfQ9quI2tVfQXBiwZojjGsBuV1zVki83Wh7uHl4tBZXL_3vrvevLu9D1ojcZ5EWbRKMpeHbS7yXAKrH5RpLml69ctODxo5_2ZSpPBqCiD-k6cZMNc70VxON4r2mGe7n8B4ASACwCm1deECmIwmxHlCSS5zTCllCBGXNNRiivhckPZjmc7PmW-SyBxDWFSX5qEe55yHeEj5WClZiFKhMmRLYRE0qC-8j3XcU1DKCEQk9h2pMnoWfX2lj0u-qSkJBu8ia6q82XHnTTJi2ntn1b6XFuVlHdjGceQdwWClPU4lBJFUMScxuEuZ71QHte0JI1Gg95JHfys30QNa26u2bq1rK1UftXBx8Zs60_LPP_x9qjz7fzO1eH3hcpxQ386eJz6T1509tUa2dgLiLf97BFVkewkQba9WaxtBAbtB1vPUyoemhaeaGCiaRcauNTA0Y3K1_n_-MxZc4kgLCHGkKAVhCyKLWa8_AM1
Frame ID: 6F65BEA3E711CAD879FC5F13E115BAF2
Requests: 3 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://nustarenergy-my.sharepoint.com/personal/ly35m9_nustarenergy_com/Documents/Documents/12062019.docx?web=1 HTTP 302
    https://nustarenergy-my.sharepoint.com/personal/ly35m9_nustarenergy_com/_layouts/15/Authenticate.aspx?Source=%2Fper... HTTP 302
    https://nustarenergy-my.sharepoint.com/_forms/default.aspx?ReturnUrl=%2fpersonal%2fly35m9_nustarenergy_com%2f_layou... HTTP 302
    https://login.windows.net/946cf9ff-6c80-45d6-990e-8f64fab65da9/oauth2/authorize?client%5Fid=00000003%2... HTTP 302
    https://login.microsoftonline.com/946cf9ff-6c80-45d6-990e-8f64fab65da9/oauth2/authorize?client_id=00000003-000... HTTP 302
    https://login.nustarenergy.com/adfs/ls/?client-request-id=f086199f-5012-9000-271c-3bff046f80d3&username=&wa... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
  • html /<input[^>]+name="__VIEWSTATE/i

Overall confidence: 100%
Detected patterns
  • html /<input[^>]+name="__VIEWSTATE/i

Overall confidence: 100%
Detected patterns
  • headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
  • html /<input[^>]+name="__VIEWSTATE/i

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

1
IPs

2
Countries

7 kB
Transfer

7 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://nustarenergy-my.sharepoint.com/personal/ly35m9_nustarenergy_com/Documents/Documents/12062019.docx?web=1 HTTP 302
    https://nustarenergy-my.sharepoint.com/personal/ly35m9_nustarenergy_com/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Fly35m9%5Fnustarenergy%5Fcom%2FDocuments%2FDocuments%2F12062019%2Edocx%3Fweb%3D1 HTTP 302
    https://nustarenergy-my.sharepoint.com/_forms/default.aspx?ReturnUrl=%2fpersonal%2fly35m9_nustarenergy_com%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Fly35m9%255Fnustarenergy%255Fcom%252FDocuments%252FDocuments%252F12062019%252Edocx%253Fweb%253D1&Source=cookie HTTP 302
    https://login.windows.net/946cf9ff-6c80-45d6-990e-8f64fab65da9/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&protectedtoken=true&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=248235A52ED8096A514442052C7BEE6E8C63EABDABF45FC2%2D2C3874F9726DDECB8F0EB1EEEAB428760A8890934FEFDCBC738E880591AB9754&redirect%5Furi=https%3A%2F%2Fnustarenergy%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&domain%5Fhint=nustarenergy%2Ecom&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=f086199f%2D5012%2D9000%2D271c%2D3bff046f80d3 HTTP 302
    https://login.microsoftonline.com/946cf9ff-6c80-45d6-990e-8f64fab65da9/oauth2/authorize?client_id=00000003-0000-0ff1-ce00-000000000000&response_mode=form_post&protectedtoken=true&response_type=code%20id_token&resource=00000003-0000-0ff1-ce00-000000000000&scope=openid&nonce=248235A52ED8096A514442052C7BEE6E8C63EABDABF45FC2-2C3874F9726DDECB8F0EB1EEEAB428760A8890934FEFDCBC738E880591AB9754&redirect_uri=https:%2F%2Fnustarenergy-my.sharepoint.com%2F_forms%2Fdefault.aspx&domain_hint=nustarenergy.com&wsucxt=1&cobrandid=11bd8083-87e0-41b5-bb78-0bc43c8a8e8a&client-request-id=f086199f-5012-9000-271c-3bff046f80d3 HTTP 302
    https://login.nustarenergy.com/adfs/ls/?client-request-id=f086199f-5012-9000-271c-3bff046f80d3&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQIIAaVRPWgUQRi9uZ81uYgeMUUEixQBwTC3M7MzszMbLPZn9oJBs6bxpwmbu13vIHe77u5BYiFWIeXVNoJ2V1qJhWCbKpAuvSRYhVR2eotNSsFXPL7He8XjfQ9quI2tVfQXBiwZojjGsBuV1zVki83Wh7uHl4tBZXL_3vrvevLu9D1ojcZ5EWbRKMpeHbS7yXAKrH5RpLml69ctODxo5_2ZSpPBqCiD-k6cZMNc70VxON4r2mGe7n8B4ASACwCm1deECmIwmxHlCSS5zTCllCBGXNNRiivhckPZjmc7PmW-SyBxDWFSX5qEe55yHeEj5WClZiFKhMmRLYRE0qC-8j3XcU1DKCEQk9h2pMnoWfX2lj0u-qSkJBu8ia6q82XHnTTJi2ntn1b6XFuVlHdjGceQdwWClPU4lBJFUMScxuEuZ71QHte0JI1Gg95JHfys30QNa26u2bq1rK1UftXBx8Zs60_LPP_x9qjz7fzO1eH3hcpxQ386eJz6T1509tUa2dgLiLf97BFVkewkQba9WaxtBAbtB1vPUyoemhaeaGCiaRcauNTA0Y3K1_n_-MxZc4kgLCHGkKAVhCyKLWa8_AM1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
login.nustarenergy.com/adfs/ls/
Redirect Chain
  • https://nustarenergy-my.sharepoint.com/personal/ly35m9_nustarenergy_com/Documents/Documents/12062019.docx?web=1
  • https://nustarenergy-my.sharepoint.com/personal/ly35m9_nustarenergy_com/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Fly35m9%5Fnustarenergy%5Fcom%2FDocuments%2FDocuments%2F12062019%2Edocx%3Fwe...
  • https://nustarenergy-my.sharepoint.com/_forms/default.aspx?ReturnUrl=%2fpersonal%2fly35m9_nustarenergy_com%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Fly35m9%255Fnustarenergy%2...
  • https://login.windows.net/946cf9ff-6c80-45d6-990e-8f64fab65da9/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&protectedtoken=true&response%5Ft...
  • https://login.microsoftonline.com/946cf9ff-6c80-45d6-990e-8f64fab65da9/oauth2/authorize?client_id=00000003-0000-0ff1-ce00-000000000000&response_mode=form_post&protectedtoken=true&response_type=code...
  • https://login.nustarenergy.com/adfs/ls/?client-request-id=f086199f-5012-9000-271c-3bff046f80d3&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest...
4 KB
4 KB
Document
General
Full URL
https://login.nustarenergy.com/adfs/ls/?client-request-id=f086199f-5012-9000-271c-3bff046f80d3&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQIIAaVRPWgUQRi9uZ81uYgeMUUEixQBwTC3M7MzszMbLPZn9oJBs6bxpwmbu13vIHe77u5BYiFWIeXVNoJ2V1qJhWCbKpAuvSRYhVR2eotNSsFXPL7He8XjfQ9quI2tVfQXBiwZojjGsBuV1zVki83Wh7uHl4tBZXL_3vrvevLu9D1ojcZ5EWbRKMpeHbS7yXAKrH5RpLml69ctODxo5_2ZSpPBqCiD-k6cZMNc70VxON4r2mGe7n8B4ASACwCm1deECmIwmxHlCSS5zTCllCBGXNNRiivhckPZjmc7PmW-SyBxDWFSX5qEe55yHeEj5WClZiFKhMmRLYRE0qC-8j3XcU1DKCEQk9h2pMnoWfX2lj0u-qSkJBu8ia6q82XHnTTJi2ntn1b6XFuVlHdjGceQdwWClPU4lBJFUMScxuEuZ71QHte0JI1Gg95JHfys30QNa26u2bq1rK1UftXBx8Zs60_LPP_x9qjz7fzO1eH3hcpxQ386eJz6T1509tUa2dgLiLf97BFVkewkQba9WaxtBAbtB1vPUyoemhaeaGCiaRcauNTA0Y3K1_n_-MxZc4kgLCHGkKAVhCyKLWa8_AM1
Protocol
HTTP/1.1
Security
TLS 1.0, ECDHE_RSA, AES_256_CBC
Server
66.194.93.95 , United States, ASN3549 (LVLT-3549 - Level 3 Parent, LLC, US),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
4ce02b41d4dd56923c88aba510c10a30c5f6a367f421a607a974dd8988c308a7

Request headers

Host
login.nustarenergy.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Sec-Fetch-User
?1
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Sec-Fetch-User
?1

Response headers

Cache-Control
no-cache
Pragma
no-cache
Content-Type
text/html; charset=utf-8
Expires
-1
Server
Microsoft-IIS/7.5
X-AspNet-Version
2.0.50727
X-Powered-By
ASP.NET
Date
Wed, 20 Nov 2019 00:36:59 GMT
Content-Length
3637

Redirect headers

Cache-Control
no-cache, no-store
Pragma
no-cache
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Expires
-1
Location
https://login.nustarenergy.com/adfs/ls/?client-request-id=f086199f-5012-9000-271c-3bff046f80d3&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQIIAaVRPWgUQRi9uZ81uYgeMUUEixQBwTC3M7MzszMbLPZn9oJBs6bxpwmbu13vIHe77u5BYiFWIeXVNoJ2V1qJhWCbKpAuvSRYhVR2eotNSsFXPL7He8XjfQ9quI2tVfQXBiwZojjGsBuV1zVki83Wh7uHl4tBZXL_3vrvevLu9D1ojcZ5EWbRKMpeHbS7yXAKrH5RpLml69ctODxo5_2ZSpPBqCiD-k6cZMNc70VxON4r2mGe7n8B4ASACwCm1deECmIwmxHlCSS5zTCllCBGXNNRiivhckPZjmc7PmW-SyBxDWFSX5qEe55yHeEj5WClZiFKhMmRLYRE0qC-8j3XcU1DKCEQk9h2pMnoWfX2lj0u-qSkJBu8ia6q82XHnTTJi2ntn1b6XFuVlHdjGceQdwWClPU4lBJFUMScxuEuZ71QHte0JI1Gg95JHfys30QNa26u2bq1rK1UftXBx8Zs60_LPP_x9qjz7fzO1eH3hcpxQ386eJz6T1509tUa2dgLiLf97BFVkewkQba9WaxtBAbtB1vPUyoemhaeaGCiaRcauNTA0Y3K1_n_-MxZc4kgLCHGkKAVhCyKLWa8_AM1
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
x-ms-request-id
733618a3-7ee5-4788-bee7-13f286c10b00
x-ms-ests-server
2.1.9677.8 - CHI ProdSlices
P3P
CP="DSP CUR OTPi IND OTRi ONL FIN"
Set-Cookie
buid=AQABAAEAAACQN9QBRU3jT6bcBQLZNUj71c_rCoiPENUyu_ZBxPw266oNvV0nBoyb1s4dyc7ZAv48XBUTWAbsiS9zCtyIhpLNekquXMpDT1kilMcRBBC3JZ1kGDVrpl6CBZjy-IbFr4YgAA; expires=Fri, 20-Dec-2019 00:41:53 GMT; path=/; secure; HttpOnly; SameSite=None fpc=AvFtHRfyDX5CtkSKUDCgB4b8uatHAQAAANGCZtUOAAAA; expires=Fri, 20-Dec-2019 00:41:53 GMT; path=/; secure; HttpOnly; SameSite=None esctx=AQABAAAAAACQN9QBRU3jT6bcBQLZNUj70Wy0C6RrkYJfX4xa57-32hvsOcd5UMYBRV0zhSmknlv3gIzSi1IRQdY4wwZ2WKFwCWahzSlNjgAchwPABeUs-YceC8EcpaLLD6U3IGLhZ1RbSSTQrZ3lD3iR1z3zcMNbpg3sl0c5QzlIz669fcFst_BtbyrGWMzY3X4ufNHBIpsgAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None x-ms-gateway-slice=prod; path=/; SameSite=None; secure; HttpOnly stsservicecookie=ests; path=/; SameSite=None; secure; HttpOnly
Referrer-Policy
strict-origin-when-cross-origin
Date
Wed, 20 Nov 2019 00:41:52 GMT
Content-Length
756
StyleSheet.css
login.nustarenergy.com/adfs/ls/MasterPages/
3 KB
3 KB
Stylesheet
General
Full URL
https://login.nustarenergy.com/adfs/ls/MasterPages/StyleSheet.css
Requested by
Host: login.nustarenergy.com
URL: https://login.nustarenergy.com/adfs/ls/?client-request-id=f086199f-5012-9000-271c-3bff046f80d3&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQIIAaVRPWgUQRi9uZ81uYgeMUUEixQBwTC3M7MzszMbLPZn9oJBs6bxpwmbu13vIHe77u5BYiFWIeXVNoJ2V1qJhWCbKpAuvSRYhVR2eotNSsFXPL7He8XjfQ9quI2tVfQXBiwZojjGsBuV1zVki83Wh7uHl4tBZXL_3vrvevLu9D1ojcZ5EWbRKMpeHbS7yXAKrH5RpLml69ctODxo5_2ZSpPBqCiD-k6cZMNc70VxON4r2mGe7n8B4ASACwCm1deECmIwmxHlCSS5zTCllCBGXNNRiivhckPZjmc7PmW-SyBxDWFSX5qEe55yHeEj5WClZiFKhMmRLYRE0qC-8j3XcU1DKCEQk9h2pMnoWfX2lj0u-qSkJBu8ia6q82XHnTTJi2ntn1b6XFuVlHdjGceQdwWClPU4lBJFUMScxuEuZ71QHte0JI1Gg95JHfys30QNa26u2bq1rK1UftXBx8Zs60_LPP_x9qjz7fzO1eH3hcpxQ386eJz6T1509tUa2dgLiLf97BFVkewkQba9WaxtBAbtB1vPUyoemhaeaGCiaRcauNTA0Y3K1_n_-MxZc4kgLCHGkKAVhCyKLWa8_AM1
Protocol
HTTP/1.1
Security
TLS 1.0, ECDHE_RSA, AES_256_CBC
Server
66.194.93.95 , United States, ASN3549 (LVLT-3549 - Level 3 Parent, LLC, US),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
1e423fb9380b3f938e6e9b7e9163db597be86039c2fb036a7c65f9dc04810b0c

Request headers

Referer
https://login.nustarenergy.com/adfs/ls/?client-request-id=f086199f-5012-9000-271c-3bff046f80d3&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQIIAaVRPWgUQRi9uZ81uYgeMUUEixQBwTC3M7MzszMbLPZn9oJBs6bxpwmbu13vIHe77u5BYiFWIeXVNoJ2V1qJhWCbKpAuvSRYhVR2eotNSsFXPL7He8XjfQ9quI2tVfQXBiwZojjGsBuV1zVki83Wh7uHl4tBZXL_3vrvevLu9D1ojcZ5EWbRKMpeHbS7yXAKrH5RpLml69ctODxo5_2ZSpPBqCiD-k6cZMNc70VxON4r2mGe7n8B4ASACwCm1deECmIwmxHlCSS5zTCllCBGXNNRiivhckPZjmc7PmW-SyBxDWFSX5qEe55yHeEj5WClZiFKhMmRLYRE0qC-8j3XcU1DKCEQk9h2pMnoWfX2lj0u-qSkJBu8ia6q82XHnTTJi2ntn1b6XFuVlHdjGceQdwWClPU4lBJFUMScxuEuZ71QHte0JI1Gg95JHfys30QNa26u2bq1rK1UftXBx8Zs60_LPP_x9qjz7fzO1eH3hcpxQ386eJz6T1509tUa2dgLiLf97BFVkewkQba9WaxtBAbtB1vPUyoemhaeaGCiaRcauNTA0Y3K1_n_-MxZc4kgLCHGkKAVhCyKLWa8_AM1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Wed, 20 Nov 2019 00:36:59 GMT
ETag
"fa78bd017faca1:0"
Last-Modified
Sun, 23 May 2010 01:26:43 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
2588
header_background.png
login.nustarenergy.com/adfs/ls/App_Themes/Default/
641 B
887 B
Image
General
Full URL
https://login.nustarenergy.com/adfs/ls/App_Themes/Default/header_background.png
Protocol
HTTP/1.1
Security
TLS 1.0, ECDHE_RSA, AES_256_CBC
Server
66.194.93.95 , United States, ASN3549 (LVLT-3549 - Level 3 Parent, LLC, US),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
57694df9004deaf34cd22628a66838db5ac944d585f7deafa9a9f92351738d83

Request headers

Referer
https://login.nustarenergy.com/adfs/ls/MasterPages/StyleSheet.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36

Response headers

Date
Wed, 20 Nov 2019 00:36:59 GMT
ETag
"9b17bb017faca1:0"
Last-Modified
Sun, 23 May 2010 01:26:43 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
641

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies