urlscan.io logo urlscan.io
SecurityTrails logo

www.onelogin.com Open in urlscan Pro
2600:9000:2646:5400:1f:d68f:e680:93a1  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://app.innovation.quest.com/e/er?utm_campaign=85431-78090-OneLogin-GL-OktaBreachCompetitiveTakeout&utm_medium=email&utm_sour...
Effective URL: https://www.onelogin.com/ecard/85431/78090/default.html?utm_campaign=85431-78090-OneLogin-GL-OktaBreachCompetitiveTakeout...
Submission: On November 14 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 7 HTTP transactions. The main IP is 2600:9000:2646:5400:1f:d68f:e680:93a1, located in United States and belongs to AMAZON-02, US. The main domain is www.onelogin.com. The Cisco Umbrella rank of the primary domain is 339139.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on January 5th 2023. Valid for: a year.
This is the only time www.onelogin.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 147.154.49.145 31898 (ORACLE-BM...)
5 2600:9000:264... 16509 (AMAZON-02)
2 2600:9000:211... 16509 (AMAZON-02)
7 2
Apex Domain
Subdomains		 Transfer
5 onelogin.com
www.onelogin.com — Cisco Umbrella Rank: 339139
14 KB
3 quest.com
app.innovation.quest.com
www.quest.com — Cisco Umbrella Rank: 198905
55 KB
7 2
Domain Requested by
5 www.onelogin.com www.onelogin.com
2 www.quest.com www.onelogin.com
1 app.innovation.quest.com 1 redirects
7 3

This site contains links to these domains. Also see Links.

Domain
www.linkedin.com
twitter.com
www.facebook.com
www.oneidentity.com
Subject Issuer Validity Valid
*.www.onelogin.com
Sectigo RSA Organization Validation Secure Server CA		 2023-01-05 -
2024-01-05		 a year crt.sh
*.quest.com
Sectigo RSA Organization Validation Secure Server CA		 2023-07-11 -
2024-07-10		 a year crt.sh

This page contains 1 frames:

Primary Page: https://www.onelogin.com/ecard/85431/78090/default.html?utm_campaign=85431-78090-OneLogin-GL-OktaBreachCompetitiveTakeout&utm_medium=email&utm_source=E10&utm_type=CDSGE000027568517
Frame ID: FFC83FB983F283C2327DF147838919D2
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://app.innovation.quest.com/e/er?utm_campaign=85431-78090-OneLogin-GL-OktaBreachCompetitiveTakeout&utm_m... HTTP 302
    https://www.onelogin.com/ecard/85431/78090/default.html?utm_campaign=85431-78090-OneLogin-GL-OktaBrea... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:<html [^>]*xmlns:w="urn:schemas-microsoft-com:office:word"|<w:WordDocument>|<div [^>]*class="?WordSection1[" >]|<style[^>]*>[^>]*@page WordSection1)

Page Statistics

7
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

2
IPs

1
Countries

68 kB
Transfer

124 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://app.innovation.quest.com/e/er?utm_campaign=85431-78090-OneLogin-GL-OktaBreachCompetitiveTakeout&utm_medium=email&utm_source=E10&utm_type=CDSGE000027568517&s=1009272243&lid=116127&elqTrackId=2da1e61ba9094c76a55d1fd1e0549941&elq=773d3c05ae05461dbb078ca7c07e5bde&elqaid=21059&elqat= HTTP 302
    https://www.onelogin.com/ecard/85431/78090/default.html?utm_campaign=85431-78090-OneLogin-GL-OktaBreachCompetitiveTakeout&utm_medium=email&utm_source=E10&utm_type=CDSGE000027568517 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request default.html
www.onelogin.com/ecard/85431/78090/
Redirect Chain
  • http://app.innovation.quest.com/e/er?utm_campaign=85431-78090-OneLogin-GL-OktaBreachCompetitiveTakeout&utm_medium=email&utm_source=E10&utm_type=CDSGE000027568517&s=1009272243&lid=116127&elqTrackId=...
  • https://www.onelogin.com/ecard/85431/78090/default.html?utm_campaign=85431-78090-OneLogin-GL-OktaBreachCompetitiveTakeout&utm_medium=email&utm_source=E10&utm_type=CDSGE000027568517
66 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.onelogin.com/ecard/85431/78090/default.html?utm_campaign=85431-78090-OneLogin-GL-OktaBreachCompetitiveTakeout&utm_medium=email&utm_source=E10&utm_type=CDSGE000027568517
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2646:5400:1f:d68f:e680:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
6f2629867c2737e3112cbcd2ca1f0cec4e89f1cc671a1c0c31ed00b8d6e17536
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
272
cache-control
public, max-age=604800
content-encoding
gzip
content-security-policy
upgrade-insecure-requests
content-type
text/html
date
Tue, 14 Nov 2023 07:29:36 GMT
permissions-policy
camera=(), microphone=(), payment=()
referrer-policy
strict-origin-when-cross-origin
server
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
via
1.1 628e5146add9b3daeb91ab8792398818.cloudfront.net (CloudFront)
x-amz-cf-id
8p2pHWGLeUSS3FozpMds-fQyhk6HuADURWFJUkWhMXdc1C7LXzTuBA==
x-amz-cf-pop
FRA60-P5
x-aspnet-version
4.0.30319
x-cache
Hit from cloudfront
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-permitted-cross-domain-policies
None
x-ua-compatible
IE=edge,chrome=1

Redirect headers

Cache-Control
no-store
Content-Length
309
Content-Type
text/html; charset=utf-8
Date
Tue, 14 Nov 2023 07:34:08 GMT
Expires
-1
Location
https://www.onelogin.com/ecard/85431/78090/default.html?utm_campaign=85431-78090-OneLogin-GL-OktaBreachCompetitiveTakeout&utm_medium=email&utm_source=E10&utm_type=CDSGE000027568517
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Pragma
no-cache
X-Content-Type-Options
nosniff
X-Robots-Tag
noindex, nofollow
X-Xss-Protection
1; mode=block
onelogin-white-123812.png
www.onelogin.com/ecard/logos/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.onelogin.com/ecard/logos/onelogin-white-123812.png
Requested by
Host: www.onelogin.com
URL: https://www.onelogin.com/ecard/85431/78090/default.html?utm_campaign=85431-78090-OneLogin-GL-OktaBreachCompetitiveTakeout&utm_medium=email&utm_source=E10&utm_type=CDSGE000027568517
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2646:5400:1f:d68f:e680:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
9fe8d0fbd3a6d3f79ba7326d6510705a3c24dc17bde22eff9608aee7b820424b
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.onelogin.com/ecard/85431/78090/default.html?utm_campaign=85431-78090-OneLogin-GL-OktaBreachCompetitiveTakeout&utm_medium=email&utm_source=E10&utm_type=CDSGE000027568517
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
upgrade-insecure-requests
x-content-type-options
nosniff
date
Mon, 13 Nov 2023 08:12:48 GMT
via
1.1 628e5146add9b3daeb91ab8792398818.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
None
x-aspnet-version
4.0.30319
x-amz-cf-pop
FRA60-P5
age
84078
x-cache
Hit from cloudfront
content-length
4306
x-ua-compatible
IE=edge,chrome=1
referrer-policy
strict-origin-when-cross-origin
server
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
public, max-age=604800
permissions-policy
camera=(), microphone=(), payment=()
x-amz-cf-id
Nh8oh0Olz8HQaacVGsYT_NIGWFJkncFLuEw0O46-nvdfadnSPTEL9w==
linkedin-white.png
www.onelogin.com/images/email/social/ 		322 B
884 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.onelogin.com/images/email/social/linkedin-white.png
Requested by
Host: www.onelogin.com
URL: https://www.onelogin.com/ecard/85431/78090/default.html?utm_campaign=85431-78090-OneLogin-GL-OktaBreachCompetitiveTakeout&utm_medium=email&utm_source=E10&utm_type=CDSGE000027568517
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2646:5400:1f:d68f:e680:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
3cd325977b16f277ebac0b466d0c7e07d064015365f7189c2f01c1d644a4b3aa
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.onelogin.com/ecard/85431/78090/default.html?utm_campaign=85431-78090-OneLogin-GL-OktaBreachCompetitiveTakeout&utm_medium=email&utm_source=E10&utm_type=CDSGE000027568517
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
upgrade-insecure-requests
x-content-type-options
nosniff
date
Mon, 13 Nov 2023 09:46:41 GMT
via
1.1 628e5146add9b3daeb91ab8792398818.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
None
x-aspnet-version
4.0.30319
x-amz-cf-pop
FRA60-P5
age
78446
x-cache
Hit from cloudfront
content-length
322
x-ua-compatible
IE=edge,chrome=1
referrer-policy
strict-origin-when-cross-origin
server
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
public, max-age=604800
permissions-policy
camera=(), microphone=(), payment=()
x-amz-cf-id
3Vv-wZ9lYBmMtDqWxth5nD4FqWj4OUtu5EGYxlEL9aXpSeRoyU9aLg==
twitter-white.png
www.onelogin.com/images/email/social/ 		306 B
867 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.onelogin.com/images/email/social/twitter-white.png
Requested by
Host: www.onelogin.com
URL: https://www.onelogin.com/ecard/85431/78090/default.html?utm_campaign=85431-78090-OneLogin-GL-OktaBreachCompetitiveTakeout&utm_medium=email&utm_source=E10&utm_type=CDSGE000027568517
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2646:5400:1f:d68f:e680:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
d60643a5127af76e17c8f9a3e532bbbbab191ea86a55979d48e096182c9a9fca
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.onelogin.com/ecard/85431/78090/default.html?utm_campaign=85431-78090-OneLogin-GL-OktaBreachCompetitiveTakeout&utm_medium=email&utm_source=E10&utm_type=CDSGE000027568517
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
upgrade-insecure-requests
x-content-type-options
nosniff
date
Mon, 13 Nov 2023 09:46:41 GMT
via
1.1 628e5146add9b3daeb91ab8792398818.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
None
x-aspnet-version
4.0.30319
x-amz-cf-pop
FRA60-P5
age
78446
x-cache
Hit from cloudfront
content-length
306
x-ua-compatible
IE=edge,chrome=1
referrer-policy
strict-origin-when-cross-origin
server
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
public, max-age=604800
permissions-policy
camera=(), microphone=(), payment=()
x-amz-cf-id
Y01PFc_dDCHayoeKqUHCLJVMmvuFyxQl3saPrg3H5UEqqE9yqscHfQ==
facebook-white.png
www.onelogin.com/images/email/social/ 		216 B
778 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.onelogin.com/images/email/social/facebook-white.png
Requested by
Host: www.onelogin.com
URL: https://www.onelogin.com/ecard/85431/78090/default.html?utm_campaign=85431-78090-OneLogin-GL-OktaBreachCompetitiveTakeout&utm_medium=email&utm_source=E10&utm_type=CDSGE000027568517
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2646:5400:1f:d68f:e680:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
d3fe33c2d9bf3f75735c4ea28323a7ed932e7a0a84683f7cbe1fc93375cbe61b
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.onelogin.com/ecard/85431/78090/default.html?utm_campaign=85431-78090-OneLogin-GL-OktaBreachCompetitiveTakeout&utm_medium=email&utm_source=E10&utm_type=CDSGE000027568517
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
upgrade-insecure-requests
x-content-type-options
nosniff
date
Mon, 13 Nov 2023 09:46:41 GMT
via
1.1 628e5146add9b3daeb91ab8792398818.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
None
x-aspnet-version
4.0.30319
x-amz-cf-pop
FRA60-P5
age
78446
x-cache
Hit from cloudfront
content-length
216
x-ua-compatible
IE=edge,chrome=1
referrer-policy
strict-origin-when-cross-origin
server
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
public, max-age=604800
permissions-policy
camera=(), microphone=(), payment=()
x-amz-cf-id
IDvNw4kGcSn1Rl3ep-dvXl-oFJWP6v6gllEGMlktw7OD3jBfJH4S-Q==
1f169c7f-f9a3-4ca7-9f91-8a939c677764.jpg
www.quest.com/ecard/85431/78090/body/ 		26 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.quest.com/ecard/85431/78090/body/1f169c7f-f9a3-4ca7-9f91-8a939c677764.jpg
Requested by
Host: www.onelogin.com
URL: https://www.onelogin.com/ecard/85431/78090/default.html?utm_campaign=85431-78090-OneLogin-GL-OktaBreachCompetitiveTakeout&utm_medium=email&utm_source=E10&utm_type=CDSGE000027568517
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:211e:ae00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
294a6fbed792e2f9ca8caa45937557c5fccd6ca8a2e4a412f8cdb2854ef4c71f
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.onelogin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
upgrade-insecure-requests
x-content-type-options
nosniff
date
Tue, 14 Nov 2023 06:01:45 GMT
via
1.1 fd3cce3e0bafd8b312277d0ad9f4762e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
None
x-aspnet-version
4.0.30319
x-amz-cf-pop
FRA56-C2
age
5543
x-cache
Hit from cloudfront
content-length
27094
x-ua-compatible
IE=edge,chrome=1
referrer-policy
strict-origin-when-cross-origin
server
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
public, max-age=604800
permissions-policy
camera=(), microphone=(), payment=()
x-amz-cf-id
2bj3YPg1804qNIlaB_RCM2bGm1Lt2eM7sid7bl298qPGs2jEbiRKvQ==
c3e1e3fa-b05e-4bd4-b459-22001db34a28.png
www.quest.com/ecard/85431/78090/body/ 		26 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.quest.com/ecard/85431/78090/body/c3e1e3fa-b05e-4bd4-b459-22001db34a28.png
Requested by
Host: www.onelogin.com
URL: https://www.onelogin.com/ecard/85431/78090/default.html?utm_campaign=85431-78090-OneLogin-GL-OktaBreachCompetitiveTakeout&utm_medium=email&utm_source=E10&utm_type=CDSGE000027568517
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:211e:ae00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
17b6b4b313839ffd61e4b986693045779341b928317c5378548d96f79a0e4921
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.onelogin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
upgrade-insecure-requests
x-content-type-options
nosniff
date
Tue, 14 Nov 2023 06:01:44 GMT
via
1.1 fd3cce3e0bafd8b312277d0ad9f4762e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
None
x-aspnet-version
4.0.30319
x-amz-cf-pop
FRA56-C2
age
5544
x-cache
Hit from cloudfront
content-length
26834
x-ua-compatible
IE=edge,chrome=1
referrer-policy
strict-origin-when-cross-origin
server
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
public, max-age=604800
permissions-policy
camera=(), microphone=(), payment=()
x-amz-cf-id
VVOP_r4caY56nriPcEG5CGiGsvFcOUwv-hr1nRvPttUkXFuqraOzOw==

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

3 Cookies

Domain/Path Name / Value
.app.innovation.quest.com/ Name: ELOQUA
Value: GUID=E9D1B572862442BA993FDF24437933F1
.app.innovation.quest.com/ Name: ELQSTATUS
Value: OK
www.onelogin.com/ Name: ASP.NET_SessionId
Value: lepo525u5piv531n0mdkj3su

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN