urlscan.io logo urlscan.io
SecurityTrails logo

mylogon.ehi.com Open in urlscan Pro
65.197.19.60  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://158.228.159.92/
Effective URL: https://mylogon.ehi.com/idp/startSSO.ping?PartnerSpId=Kronos-PROD&ACSIdx=0&SAMLRequest=fVJdT8IwFP0rSx9822fYUiqDINOwiLKwo...
Submission: On October 22 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 2 HTTP transactions. The main IP is 65.197.19.60, located in United States and belongs to EHI-NA-AS-1 - Enterprise Holdings, Inc., US. The main domain is mylogon.ehi.com.
TLS certificate: Issued by COMODO RSA Organization Validation Se... on January 30th 2018. Valid for: 3 years.
This is the only time mylogon.ehi.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 3 158.228.159.92 46269 (KRONOS-MA)
2 65.197.19.60 13893 (EHI-NA-AS-1)
2 1
Apex Domain
Subdomains		 Transfer
2 ehi.com
mylogon.ehi.com
7 KB
2 1
Domain Requested by
2 mylogon.ehi.com mylogon.ehi.com
2 1

This site contains no links.

Subject Issuer Validity Valid
mylogon.ehi.com
COMODO RSA Organization Validation Secure Server CA		 2018-01-30 -
2021-01-29		 3 years crt.sh

This page contains 1 frames:

Primary Page: https://mylogon.ehi.com/idp/startSSO.ping?PartnerSpId=Kronos-PROD&ACSIdx=0&SAMLRequest=fVJdT8IwFP0rSx9822fYUiqDINOwiLKwoYkvpnaFNW7tbDvEf28ZkOCDPN7bc8%2B595yOJvumtnZUKiZ4DHzHAxblRJSMb2OwLh5sCCbjkcJNHbRo2umKr%2BhXR5W2zCBX6PgSg05yJLBiCnHcUIU0Qfn0aYECx0OtFFoQUQNrqhSV2kjNBFddQ2VO5Y4Rul4tYlBp3SrkurRizqcUXCiHU%2B1%2Bb4hbi63gr0xX6zQBVmLkGce6X%2Fk81fz0IOcwTUTjsrJ1lcZS5%2FnSac05k8wU3Ei2aRk%2F9vx2tlomN7hpb6ezPC33sbk%2BTWLwDkMMBwSHJaQEDvxhFHgwwkMSDSHxQ7IxMKU6mnKjwHUMAs%2BHtu%2FZQVD4IfI9FEInGEZvwMpOt98xfvT0mlEfR5BC86LI7GyZFz3BjpVUPhv0fx4B6%2BWcoKEBp7xQv6O8DOq6PD6nA8b387TvB%2Bhg0ci9JByfyr%2F%2FYfwL&RelayState=
Frame ID: D5A712A7F7E2CB0C0038D4A9824D8F8F
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://158.228.159.92/ HTTP 302
    https://158.228.159.92/ HTTP 301
    https://158.228.159.92/wfc/logon HTTP 302
    https://mylogon.ehi.com/idp/startSSO.ping?PartnerSpId=Kronos-PROD&ACSIdx=0&SAMLRequest=fVJdT8IwFP0rS... Page URL

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

7 kB
Transfer

10 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://158.228.159.92/ HTTP 302
    https://158.228.159.92/ HTTP 301
    https://158.228.159.92/wfc/logon HTTP 302
    https://mylogon.ehi.com/idp/startSSO.ping?PartnerSpId=Kronos-PROD&ACSIdx=0&SAMLRequest=fVJdT8IwFP0rSx9822fYUiqDINOwiLKwoYkvpnaFNW7tbDvEf28ZkOCDPN7bc8%2B595yOJvumtnZUKiZ4DHzHAxblRJSMb2OwLh5sCCbjkcJNHbRo2umKr%2BhXR5W2zCBX6PgSg05yJLBiCnHcUIU0Qfn0aYECx0OtFFoQUQNrqhSV2kjNBFddQ2VO5Y4Rul4tYlBp3SrkurRizqcUXCiHU%2B1%2Bb4hbi63gr0xX6zQBVmLkGce6X%2Fk81fz0IOcwTUTjsrJ1lcZS5%2FnSac05k8wU3Ei2aRk%2F9vx2tlomN7hpb6ezPC33sbk%2BTWLwDkMMBwSHJaQEDvxhFHgwwkMSDSHxQ7IxMKU6mnKjwHUMAs%2BHtu%2FZQVD4IfI9FEInGEZvwMpOt98xfvT0mlEfR5BC86LI7GyZFz3BjpVUPhv0fx4B6%2BWcoKEBp7xQv6O8DOq6PD6nA8b387TvB%2Bhg0ci9JByfyr%2F%2FYfwL&RelayState= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set startSSO.ping
mylogon.ehi.com/idp/
Redirect Chain
  • http://158.228.159.92/
  • https://158.228.159.92/
  • https://158.228.159.92/wfc/logon
  • https://mylogon.ehi.com/idp/startSSO.ping?PartnerSpId=Kronos-PROD&ACSIdx=0&SAMLRequest=fVJdT8IwFP0rSx9822fYUiqDINOwiLKwoYkvpnaFNW7tbDvEf28ZkOCDPN7bc8%2B595yOJvumtnZUKiZ4DHzHAxblRJSMb2OwLh5sCCbjkcJN...
5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://mylogon.ehi.com/idp/startSSO.ping?PartnerSpId=Kronos-PROD&ACSIdx=0&SAMLRequest=fVJdT8IwFP0rSx9822fYUiqDINOwiLKwoYkvpnaFNW7tbDvEf28ZkOCDPN7bc8%2B595yOJvumtnZUKiZ4DHzHAxblRJSMb2OwLh5sCCbjkcJNHbRo2umKr%2BhXR5W2zCBX6PgSg05yJLBiCnHcUIU0Qfn0aYECx0OtFFoQUQNrqhSV2kjNBFddQ2VO5Y4Rul4tYlBp3SrkurRizqcUXCiHU%2B1%2Bb4hbi63gr0xX6zQBVmLkGce6X%2Fk81fz0IOcwTUTjsrJ1lcZS5%2FnSac05k8wU3Ei2aRk%2F9vx2tlomN7hpb6ezPC33sbk%2BTWLwDkMMBwSHJaQEDvxhFHgwwkMSDSHxQ7IxMKU6mnKjwHUMAs%2BHtu%2FZQVD4IfI9FEInGEZvwMpOt98xfvT0mlEfR5BC86LI7GyZFz3BjpVUPhv0fx4B6%2BWcoKEBp7xQv6O8DOq6PD6nA8b387TvB%2Bhg0ci9JByfyr%2F%2FYfwL&RelayState=
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
65.197.19.60 , United States, ASN13893 (EHI-NA-AS-1 - Enterprise Holdings, Inc., US),
Reverse DNS
mylogon.ehi.com
Software
/
Resource Hash
8c50a9a6d1ebc1cea8e4afc24fc33d235e277e14aa19d75f44b209efbc13d9a2

Request headers

Host
mylogon.ehi.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Connection
Keep-Alive
Transfer-Encoding
chunked
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Date
Mon, 22 Oct 2018 15:10:58 GMT
Content-Type
text/html;charset=UTF-8
Cache-Control
no-cache, no-store
Pragma
no-cache
max-age
Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie
PF=BIcmu4RFC2aB5XYpBqc98oPL6YBB8gWrp015egn288OE;Path=/;Secure;HttpOnly
Content-Encoding
gzip
Vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache
Pragma
no-cache
Content-Type
;charset=utf-8
Content-Language
en
Location
https://mylogon.ehi.com/idp/startSSO.ping?PartnerSpId=Kronos-PROD&ACSIdx=0&SAMLRequest=fVJdT8IwFP0rSx9822fYUiqDINOwiLKwoYkvpnaFNW7tbDvEf28ZkOCDPN7bc8%2B595yOJvumtnZUKiZ4DHzHAxblRJSMb2OwLh5sCCbjkcJNHbRo2umKr%2BhXR5W2zCBX6PgSg05yJLBiCnHcUIU0Qfn0aYECx0OtFFoQUQNrqhSV2kjNBFddQ2VO5Y4Rul4tYlBp3SrkurRizqcUXCiHU%2B1%2Bb4hbi63gr0xX6zQBVmLkGce6X%2Fk81fz0IOcwTUTjsrJ1lcZS5%2FnSac05k8wU3Ei2aRk%2F9vx2tlomN7hpb6ezPC33sbk%2BTWLwDkMMBwSHJaQEDvxhFHgwwkMSDSHxQ7IxMKU6mnKjwHUMAs%2BHtu%2FZQVD4IfI9FEInGEZvwMpOt98xfvT0mlEfR5BC86LI7GyZFz3BjpVUPhv0fx4B6%2BWcoKEBp7xQv6O8DOq6PD6nA8b387TvB%2Bhg0ci9JByfyr%2F%2FYfwL&RelayState=
Server
Microsoft-IIS/8.5
Set-Cookie
JSESSIONID=szi2u-H-QQWMNnOD9qw-zkEJ; Path=/wfc; HttpOnly kronos=!tKMNXIqboJsp5kPQDjE11pzvn3Sayev/7I9unhCL1N+k18r/0RJ7cmuM2ZPvJTosUuzqLH/AxPDvRg==;HttpOnly;Secure;Path=/;Version=1;
X-Powered-By
ASP.NET
X-XSS-Protection
1; mode=block
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=63072000; includeSubdomains
Date
Mon, 22 Oct 2018 15:10:57 GMT
Connection
keep-alive
Content-Length
0
EnterpriseHoldings.jpg
mylogon.ehi.com/images/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mylogon.ehi.com/images/EnterpriseHoldings.jpg
Requested by
Host: mylogon.ehi.com
URL: https://mylogon.ehi.com/idp/startSSO.ping?PartnerSpId=Kronos-PROD&ACSIdx=0&SAMLRequest=fVJdT8IwFP0rSx9822fYUiqDINOwiLKwoYkvpnaFNW7tbDvEf28ZkOCDPN7bc8%2B595yOJvumtnZUKiZ4DHzHAxblRJSMb2OwLh5sCCbjkcJNHbRo2umKr%2BhXR5W2zCBX6PgSg05yJLBiCnHcUIU0Qfn0aYECx0OtFFoQUQNrqhSV2kjNBFddQ2VO5Y4Rul4tYlBp3SrkurRizqcUXCiHU%2B1%2Bb4hbi63gr0xX6zQBVmLkGce6X%2Fk81fz0IOcwTUTjsrJ1lcZS5%2FnSac05k8wU3Ei2aRk%2F9vx2tlomN7hpb6ezPC33sbk%2BTWLwDkMMBwSHJaQEDvxhFHgwwkMSDSHxQ7IxMKU6mnKjwHUMAs%2BHtu%2FZQVD4IfI9FEInGEZvwMpOt98xfvT0mlEfR5BC86LI7GyZFz3BjpVUPhv0fx4B6%2BWcoKEBp7xQv6O8DOq6PD6nA8b387TvB%2Bhg0ci9JByfyr%2F%2FYfwL&RelayState=
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
65.197.19.60 , United States, ASN13893 (EHI-NA-AS-1 - Enterprise Holdings, Inc., US),
Reverse DNS
mylogon.ehi.com
Software
/
Resource Hash
9b6fdecd467f8a3a46be8f0c8d563d922f7062a1c734fe510a684f07c4980fcf

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
mylogon.ehi.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://mylogon.ehi.com/idp/startSSO.ping?PartnerSpId=Kronos-PROD&ACSIdx=0&SAMLRequest=fVJdT8IwFP0rSx9822fYUiqDINOwiLKwoYkvpnaFNW7tbDvEf28ZkOCDPN7bc8%2B595yOJvumtnZUKiZ4DHzHAxblRJSMb2OwLh5sCCbjkcJNHbRo2umKr%2BhXR5W2zCBX6PgSg05yJLBiCnHcUIU0Qfn0aYECx0OtFFoQUQNrqhSV2kjNBFddQ2VO5Y4Rul4tYlBp3SrkurRizqcUXCiHU%2B1%2Bb4hbi63gr0xX6zQBVmLkGce6X%2Fk81fz0IOcwTUTjsrJ1lcZS5%2FnSac05k8wU3Ei2aRk%2F9vx2tlomN7hpb6ezPC33sbk%2BTWLwDkMMBwSHJaQEDvxhFHgwwkMSDSHxQ7IxMKU6mnKjwHUMAs%2BHtu%2FZQVD4IfI9FEInGEZvwMpOt98xfvT0mlEfR5BC86LI7GyZFz3BjpVUPhv0fx4B6%2BWcoKEBp7xQv6O8DOq6PD6nA8b387TvB%2Bhg0ci9JByfyr%2F%2FYfwL&RelayState=
Cookie
PF=BIcmu4RFC2aB5XYpBqc98oPL6YBB8gWrp015egn288OE
Connection
keep-alive
Cache-Control
no-cache
Referer
https://mylogon.ehi.com/idp/startSSO.ping?PartnerSpId=Kronos-PROD&ACSIdx=0&SAMLRequest=fVJdT8IwFP0rSx9822fYUiqDINOwiLKwoYkvpnaFNW7tbDvEf28ZkOCDPN7bc8%2B595yOJvumtnZUKiZ4DHzHAxblRJSMb2OwLh5sCCbjkcJNHbRo2umKr%2BhXR5W2zCBX6PgSg05yJLBiCnHcUIU0Qfn0aYECx0OtFFoQUQNrqhSV2kjNBFddQ2VO5Y4Rul4tYlBp3SrkurRizqcUXCiHU%2B1%2Bb4hbi63gr0xX6zQBVmLkGce6X%2Fk81fz0IOcwTUTjsrJ1lcZS5%2FnSac05k8wU3Ei2aRk%2F9vx2tlomN7hpb6ezPC33sbk%2BTWLwDkMMBwSHJaQEDvxhFHgwwkMSDSHxQ7IxMKU6mnKjwHUMAs%2BHtu%2FZQVD4IfI9FEInGEZvwMpOt98xfvT0mlEfR5BC86LI7GyZFz3BjpVUPhv0fx4B6%2BWcoKEBp7xQv6O8DOq6PD6nA8b387TvB%2Bhg0ci9JByfyr%2F%2FYfwL&RelayState=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 22 Oct 2018 15:10:59 GMT
Last-Modified
Mon, 05 Dec 2011 23:37:00 GMT
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
5265
Vary
Accept-Encoding
Content-Type
image/jpeg

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| postOk function| setFocus function| are_cookies_enabled function| enableButton

1 Cookies

Domain/Path Name / Value
mylogon.ehi.com/ Name: PF
Value: BIcmu4RFC2aB5XYpBqc98oPL6YBB8gWrp015egn288OE

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mylogon.ehi.com
158.228.159.92
65.197.19.60
8c50a9a6d1ebc1cea8e4afc24fc33d235e277e14aa19d75f44b209efbc13d9a2
9b6fdecd467f8a3a46be8f0c8d563d922f7062a1c734fe510a684f07c4980fcf