urlscan.io logo urlscan.io
SecurityTrails logo

hcarewards.lifeatworkportal.com Open in urlscan Pro
65.197.229.12  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://hcarewards.ehr.com/
Effective URL: https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
Submission: On November 13 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 5 HTTP transactions. The main IP is 65.197.229.12, located in United States and belongs to AS16983 - Conduent Business Services, LLC, US. The main domain is hcarewards.lifeatworkportal.com.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on April 9th 2019. Valid for: a year.
This is the only time hcarewards.lifeatworkportal.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 6 158.82.145.48 40196 (WILLISNOR...)
4 6 65.197.229.12 16983 (AS16983)
5 2
Apex Domain
Subdomains		 Transfer
6 lifeatworkportal.com
hcarewards.lifeatworkportal.com
3 KB
6 ehr.com
hcarewards.ehr.com
12 KB
5 2
Domain Requested by
6 hcarewards.lifeatworkportal.com 4 redirects hcarewards.ehr.com
6 hcarewards.ehr.com 3 redirects hcarewards.ehr.com
5 2

This site contains no links.

Subject Issuer Validity Valid
hcarewards.ehr.com
GlobalSign RSA OV SSL CA 2018		 2019-10-15 -
2021-10-15		 2 years crt.sh
hcarewards.lifeatworkportal.com
Sectigo RSA Organization Validation Secure Server CA		 2019-04-09 -
2020-04-08		 a year crt.sh

This page contains 2 frames:

Primary Page: https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
Frame ID: 7AEB5B68C7D125AA12D819D60430D741
Requests: 4 HTTP requests in this frame

Frame: https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
Frame ID: DC9D413CDBECAD1B674E1D6584CF1A48
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://hcarewards.ehr.com/ HTTP 302
    https://hcarewards.ehr.com/ HTTP 302
    https://hcarewards.ehr.com/_layouts/Authenticate.aspx?Source=%2F HTTP 302
    https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSou... Page URL
  2. https://hcarewards.lifeatworkportal.com/logoff/oplogoff.jsp?url=/Benefits/ HTTP 302
    https://hcarewards.lifeatworkportal.com/opglobal/pub/logout.jsp?logofftype=null HTTP 302
    https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

11 kB
Transfer

10 kB
Size

7
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://hcarewards.ehr.com/ HTTP 302
    https://hcarewards.ehr.com/ HTTP 302
    https://hcarewards.ehr.com/_layouts/Authenticate.aspx?Source=%2F HTTP 302
    https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F Page URL
  2. https://hcarewards.lifeatworkportal.com/logoff/oplogoff.jsp?url=/Benefits/ HTTP 302
    https://hcarewards.lifeatworkportal.com/opglobal/pub/logout.jsp?logofftype=null HTTP 302
    https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://hcarewards.ehr.com/ HTTP 302
  • https://hcarewards.ehr.com/ HTTP 302
  • https://hcarewards.ehr.com/_layouts/Authenticate.aspx?Source=%2F HTTP 302
  • https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F
Request Chain 3
  • https://hcarewards.lifeatworkportal.com/logoff/oplogoff.jsp?url=/Benefits/ HTTP 302
  • https://hcarewards.lifeatworkportal.com/opglobal/pub/logout.jsp?logofftype=null HTTP 302
  • https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Cookie set default.ashx
hcarewards.ehr.com/
Redirect Chain
  • http://hcarewards.ehr.com/
  • https://hcarewards.ehr.com/
  • https://hcarewards.ehr.com/_layouts/Authenticate.aspx?Source=%2F
  • https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F
1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.82.145.48 , United States, ASN40196 (WILLISNORTHAMERICA - Willis North America Inc, US),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
196d75141ee2d8a74ef3aa6fbb5084ced62dcecbc156e03ad7cfc8b0b66cc586

Request headers

Host
hcarewards.ehr.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
none
Accept-Encoding
gzip, deflate, br
Cookie
f5-cookie=2531704074.0.0000
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Cache-Control
no-cache
Pragma
no-cache
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Expires
-1
Vary
Accept-Encoding
Server
Microsoft-IIS/7.5
SPRequestGuid
75848413-1098-494c-a030-c5ad6253bf51
X-SharePointHealthScore
0
X-AspNet-Version
2.0.50727
Set-Cookie
%be%baB%0f%0a%8f%3a%aa%c4%01%84%b2%f3(%b1S%c7%3d%d9%9b%b9%12%d3)%94%be%06%14%d8D8%3d%25%5c%1d%bb%bb%98%a4%1cx3%05c%94%cad%8eApp=%f9%b4%f97%c2%9c%c0%da%3d%5e%c0(%a3%e3%eem%18%a0%1bC%e3%b3!%e5%8dU%24%7f*%12%7cy%0a%12'%a3%e6%f8%fc%05%8f%24%81%f9%ba%80%ef%ed; path=/; secure; HttpOnly %be%baB%0f%0a%8f%3a%aa%c4%01%84%b2%f3(%b1S%c7%3d%d9%9b%b9%12%d3)%94%be%06%14%d8D8%3d%25%5c%1d%bb%bb%98%a4%1cx3%05c%94%cad%8eSessionHistory_Insert=False; path=/; secure; HttpOnly %be%baB%0f%0a%8f%3a%aa%c4%01%84%b2%f3(%b1S%c7%3d%d9%9b%b9%12%d3)%94%be%06%14%d8D8%3d%25%5c%1d%bb%bb%98%a4%1cx3%05c%94%cad%8eSessionHistory_Key=aa68d842-ed3a-4472-bbed-a899edc6f458; path=/; secure; HttpOnly %be%baB%0f%0a%8f%3a%aa%c4%01%84%b2%f3(%b1S%c7%3d%d9%9b%b9%12%d3)%94%be%06%14%d8D8%3d%25%5c%1d%bb%bb%98%a4%1cx3%05c%94%cad%8eSessionHistory_Id=41964045; path=/; secure; HttpOnly
X-Powered-By
ASP.NET
MicrosoftSharePointTeamServices
14.0.0.7230
X-MS-InvokeApp
1; RequireReadOnly
SPServer
1
Date
Wed, 13 Nov 2019 21:12:32 GMT
Content-Length
941

Redirect headers

Cache-Control
private
Content-Type
text/html; charset=utf-8
Location
/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F
Server
Microsoft-IIS/7.5
SPRequestGuid
9b14380b-561e-48ec-9f81-b1823180fd1a
X-SharePointHealthScore
0
X-AspNet-Version
2.0.50727
X-Powered-By
ASP.NET
MicrosoftSharePointTeamServices
14.0.0.7230
X-MS-InvokeApp
1; RequireReadOnly
SPServer
1
Date
Wed, 13 Nov 2019 21:12:32 GMT
Content-Length
242
default.ashx
hcarewards.ehr.com/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://hcarewards.ehr.com/default.ashx?CLASSNAME=RESOURCEHANDLER&ID=%25fb%255e%25ae%25cb%25e7r%2510%2586%25e9%257bZ%2599%25f1T%25bcl
Requested by
Host: hcarewards.ehr.com
URL: https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.82.145.48 , United States, ASN40196 (WILLISNORTHAMERICA - Willis North America Inc, US),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
bd263caf9c3ca3d45b10052b2e715e2b0291f1a9c88b1ebf5178e3a2473acf97

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 13 Nov 2019 21:12:32 GMT
Content-Encoding
gzip
SPServer
1
X-AspNet-Version
2.0.50727
X-Powered-By
ASP.NET
Transfer-Encoding
chunked
X-SharePointHealthScore
0
Content-Disposition
attachment; filename=login.css
MicrosoftSharePointTeamServices
14.0.0.7230
X-MS-InvokeApp
1; RequireReadOnly
Last-Modified
Tue, 05 Nov 2019 02:08:04 GMT
Server
Microsoft-IIS/7.5
SPRequestGuid
e85c9d6a-22ea-4dcf-9e98-7094f78ca82b
ETag
JFLwdBpt5hcoglvMKNKGhar6tpxr
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public
Expires
Wed, 13 Nov 2019 04:32:32 GMT
default.ashx
hcarewards.ehr.com/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://hcarewards.ehr.com/default.ashx?CLASSNAME=RESOURCEHANDLER&ID=%251d%25b2%25fc)%259c%2b%2511dU%25e7t%2585%25f4%25f6%25f6%25bc
Requested by
Host: hcarewards.ehr.com
URL: https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.82.145.48 , United States, ASN40196 (WILLISNORTHAMERICA - Willis North America Inc, US),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
38ca7c48de33fb31ae7dfe8b2963024ab33be876a88453781e369ebb02e55b06

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 13 Nov 2019 21:12:32 GMT
SPServer
1
X-AspNet-Version
2.0.50727
X-Powered-By
ASP.NET
X-SharePointHealthScore
0
Content-Disposition
attachment; filename=HCA_Logo.png
Content-Length
6825
MicrosoftSharePointTeamServices
14.0.0.7230
X-MS-InvokeApp
1; RequireReadOnly
Last-Modified
Tue, 05 Nov 2019 02:08:04 GMT
Server
Microsoft-IIS/7.5
SPRequestGuid
4c2ea8a6-6005-4051-b522-f53d9520315e
ETag
vB2pTUkwt//UDZN7anvxHUmt5RG4sds=
Content-Type
image/png
Cache-Control
public
Expires
Wed, 13 Nov 2019 04:32:32 GMT
azerror.jsp
hcarewards.lifeatworkportal.com/opglobal/pub/ Frame DC9D
Redirect Chain
  • https://hcarewards.lifeatworkportal.com/logoff/oplogoff.jsp?url=/Benefits/
  • https://hcarewards.lifeatworkportal.com/opglobal/pub/logout.jsp?logofftype=null
  • https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
Requested by
Host: hcarewards.ehr.com
URL: https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
65.197.229.12 , United States, ASN16983 (AS16983 - Conduent Business Services, LLC, US),
Reverse DNS
celanese.benefitcenter.com
Software
/
Resource Hash

Request headers

Host
hcarewards.lifeatworkportal.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F
Accept-Encoding
gzip, deflate, br
Cookie
X-Mapping-clhgdopm=993CDF2A725F0491E286ADC56C5A21E7; SMSESSION=LOGGEDOFF; X-Mapping-edphjpip=50101A29C4AFA45E17B22BCF4F267B45; JSESSIONID=wCdmnFmZzozHnlR8yvOmpF19zXilrjxozw9TYGxwX8PvreIx5bhA!-1329874945; PSESSIONID=rzdmnFomOBCQcpand5ncvB0w_yWpphObazR56S3siRKjSmVoEpQR!-1329874945; LB=109.236.94.25:60622 --Netherlands HCA-SPS--HCACLO
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F

Response headers

Cache-Control
no-store
Content-Type
text/html; charset=ISO-8859-1
Date
Wed, 13 Nov 2019 21:12:33 GMT
Keep-Alive
timeout=5, max=89
Via
HTTP/1.1 hcarewards.lifeatworkportal.com:80
Connection
Keep-Alive
Content-Length
152

Redirect headers

Cache-Control
no-store
Content-Type
text/html; charset=ISO-8859-1
Date
Wed, 13 Nov 2019 21:12:33 GMT
Location
https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
Keep-Alive
timeout=5, max=90
Transfer-Encoding
chunked
Via
HTTP/1.1 hcarewards.lifeatworkportal.com:80
Connection
Keep-Alive
Set-Cookie
PSESSIONID=rzdmnFomOBCQcpand5ncvB0w_yWpphObazR56S3siRKjSmVoEpQR!-1329874945;Path=/;HttpOnly; secure LB=109.236.94.25:60622 --Netherlands HCA-SPS--HCACLO;Path=/;Secure;HttpOnly; secure
Primary Request azerror.jsp
hcarewards.lifeatworkportal.com/opglobal/pub/
Redirect Chain
  • https://hcarewards.lifeatworkportal.com/logoff/oplogoff.jsp?url=/Benefits/
  • https://hcarewards.lifeatworkportal.com/opglobal/pub/logout.jsp?logofftype=null
  • https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
185 B
437 B 		Document
General
Check archive.org
Download Go to
Full URL
https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
65.197.229.12 , United States, ASN16983 (AS16983 - Conduent Business Services, LLC, US),
Reverse DNS
celanese.benefitcenter.com
Software
/
Resource Hash
3d434a50b1fed419df57ab32511579051a7cee7cb0398988285f5ebc6a96b271

Request headers

Host
hcarewards.lifeatworkportal.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F
Accept-Encoding
gzip, deflate, br
Cookie
origURL=hcarewards.lifeatworkportal.com; X-Mapping-clhgdopm=27DA8B9A8BA9D33784ED852B6CCD7164; X-Mapping-edphjpip=50101A29C4AFA45E17B22BCF4F267B45; PSESSIONID=BtxmnFsgu8mAJNYV3ivmSgFy8Kw9Rxk8p-Ms4qx2PD-EJoL4hqQQ!-1329874945; SMSESSION=LOGGEDOFF; JSESSIONID=Vj9mnFus125tWL0BLrPjL7P3qePcFzyDm_BqbdAjU5vOrircbecY!-1329874945; LB=109.236.94.25:60622 --Netherlands HCA-SPS--HCACLO
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Referer
https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F

Response headers

Cache-Control
no-store
Content-Type
text/html; charset=ISO-8859-1
Date
Wed, 13 Nov 2019 21:12:33 GMT
Keep-Alive
timeout=5, max=76
Via
HTTP/1.1 hcarewards.lifeatworkportal.com:80
Connection
Keep-Alive
Content-Length
185

Redirect headers

Cache-Control
no-store
Content-Type
text/html; charset=ISO-8859-1
Date
Wed, 13 Nov 2019 21:12:33 GMT
Location
https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
Keep-Alive
timeout=5, max=77
Transfer-Encoding
chunked
Via
HTTP/1.1 hcarewards.lifeatworkportal.com:80
Connection
Keep-Alive

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

7 Cookies

Domain/Path Name / Value
hcarewards.lifeatworkportal.com/ Name: LB
Value: 109.236.94.25:60622 --Netherlands HCA-SPS--HCACLO
hcarewards.lifeatworkportal.com/ Name: JSESSIONID
Value: Vj9mnFus125tWL0BLrPjL7P3qePcFzyDm_BqbdAjU5vOrircbecY!-1329874945
hcarewards.lifeatworkportal.com/ Name: PSESSIONID
Value: BtxmnFsgu8mAJNYV3ivmSgFy8Kw9Rxk8p-Ms4qx2PD-EJoL4hqQQ!-1329874945
.hcarewards.lifeatworkportal.com/ Name: SMSESSION
Value: LOGGEDOFF
hcarewards.lifeatworkportal.com/ Name: X-Mapping-edphjpip
Value: 50101A29C4AFA45E17B22BCF4F267B45
hcarewards.lifeatworkportal.com/ Name: X-Mapping-clhgdopm
Value: 27DA8B9A8BA9D33784ED852B6CCD7164
hcarewards.lifeatworkportal.com/ Name: origURL
Value: hcarewards.lifeatworkportal.com