urlscan.io logo urlscan.io
SecurityTrails logo

idp.workhuman.com Open in urlscan Pro
18.66.122.60  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://www.globoforce.net/microsites/t/home?client=bnymellon&setCAG=true
Effective URL: https://idp.workhuman.com/sp/startSSO.ping?PartnerIdpId=https://dfsso.bnymellon.net/&TARGET=https%3A%2F%2Fcloud.workhuman....
Submission: On July 19 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 3 HTTP transactions. The main IP is 18.66.122.60, located in United States and belongs to AMAZON-02, US. The main domain is idp.workhuman.com. The Cisco Umbrella rank of the primary domain is 39166.
TLS certificate: Issued by Amazon RSA 2048 M02 on January 27th 2023. Valid for: a year.
This is the only time idp.workhuman.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 13.225.34.94 16509 (AMAZON-02)
1 1 13.225.34.71 16509 (AMAZON-02)
2 18.66.122.60 16509 (AMAZON-02)
3 2
Apex Domain
Subdomains		 Transfer
2 workhuman.com
cloud.workhuman.com — Cisco Umbrella Rank: 22578
idp.workhuman.com — Cisco Umbrella Rank: 39166
3 KB
2 globoforce.net
www.globoforce.net — Cisco Umbrella Rank: 198249
1 KB
0 bnymellon.net Failed
dfsso.bnymellon.net Failed
3 3
Domain Requested by
2 www.globoforce.net 2 redirects
1 idp.workhuman.com
1 cloud.workhuman.com
0 dfsso.bnymellon.net Failed
3 4

This site contains no links.

Subject Issuer Validity Valid
*.workhuman.com
Amazon RSA 2048 M02		 2023-01-27 -
2024-02-25		 a year crt.sh

This page contains 1 frames:

Frame: https://dfsso.bnymellon.net/affwebservices/public/saml2sso
Frame ID: 96F1F87AA591BA81AFC7C317B8E15EB0
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://www.globoforce.net/microsites/t/home?client=bnymellon&setCAG=true HTTP 301
    https://www.globoforce.net/microsites/t/home?client=bnymellon&setCAG=true HTTP 302
    https://cloud.workhuman.com/microsites/t/home?client=bnymellon&setCAG=true Page URL
  2. https://idp.workhuman.com/sp/startSSO.ping?PartnerIdpId=https://dfsso.bnymellon.net/&TARGET=https%3A%2... Page URL

Page Statistics

3
Requests

67 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

2
IPs

1
Countries

3 kB
Transfer

2 kB
Size

10
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://www.globoforce.net/microsites/t/home?client=bnymellon&setCAG=true HTTP 301
    https://www.globoforce.net/microsites/t/home?client=bnymellon&setCAG=true HTTP 302
    https://cloud.workhuman.com/microsites/t/home?client=bnymellon&setCAG=true Page URL
  2. https://idp.workhuman.com/sp/startSSO.ping?PartnerIdpId=https://dfsso.bnymellon.net/&TARGET=https%3A%2F%2Fcloud.workhuman.com%2Fmicrosites%2Fmotivation%2FSSOEntryPoint%3Fclient%3Dbnymellon Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://www.globoforce.net/microsites/t/home?client=bnymellon&setCAG=true HTTP 301
  • https://www.globoforce.net/microsites/t/home?client=bnymellon&setCAG=true HTTP 302
  • https://cloud.workhuman.com/microsites/t/home?client=bnymellon&setCAG=true

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
home
cloud.workhuman.com/microsites/t/
Redirect Chain
  • http://www.globoforce.net/microsites/t/home?client=bnymellon&setCAG=true
  • https://www.globoforce.net/microsites/t/home?client=bnymellon&setCAG=true
  • https://cloud.workhuman.com/microsites/t/home?client=bnymellon&setCAG=true
599 B
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cloud.workhuman.com/microsites/t/home?client=bnymellon&setCAG=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-122-60.fra60.r.cloudfront.net
Software
Apache /
Resource Hash
d8bb433ada767e5104aa1391e257b19bd4da9e97b2e51bb7bc41ba203cf3d107
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' *.quicksight.aws.amazon.com outlook.office365.com outlook.office.com teams.microsoft.com.mcas.ms teams.microsoft.com; report-uri https://68cebcfc7e2f58b08b59066f1.report-uri.com/r/d/csp/enforce
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-cache, no-store, must-revalidate
content-length
599
content-security-policy
frame-ancestors 'self' *.quicksight.aws.amazon.com outlook.office365.com outlook.office.com teams.microsoft.com.mcas.ms teams.microsoft.com; report-uri https://68cebcfc7e2f58b08b59066f1.report-uri.com/r/d/csp/enforce
content-type
text/html;charset=ISO-8859-1
date
Wed, 19 Jul 2023 19:35:56 GMT
expires
01 Apr 1995 01:10:10 GMT
pragma
no-cache
server
Apache
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 3072267d18c4d0ed9e535752800364e0.cloudfront.net (CloudFront)
x-amz-cf-id
Lg1m5YjUKCwRdtmBaLR35oGFXnaIkvIs6llqxorGprB8HgBkdnUBuQ==
x-amz-cf-pop
FRA60-P2
x-cache
Miss from cloudfront
x-content-type-options
nosniff
x-xss-protection
1; mode=block

Redirect headers

content-length
0
content-security-policy
frame-ancestors 'self' *.quicksight.aws.amazon.com outlook.office365.com outlook.office.com teams.microsoft.com.mcas.ms teams.microsoft.com; report-uri https://68cebcfc7e2f58b08b59066f1.report-uri.com/r/d/csp/enforce
date
Wed, 19 Jul 2023 19:35:56 GMT
location
https://cloud.workhuman.com/microsites/t/home?client=bnymellon&setCAG=true
server
Apache
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 95a1a2515bcfe82199fde4e864c4e6f0.cloudfront.net (CloudFront)
x-amz-cf-id
5r7jpkrw50965TgveD9-Us2Kq3s_whUK_tQQ6SpFD0HvNJ8uwidMPw==
x-amz-cf-pop
CDG3-C2
x-cache
Miss from cloudfront
x-content-type-options
nosniff
x-xss-protection
1; mode=block
Primary Request startSSO.ping
idp.workhuman.com/sp/ 		1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://idp.workhuman.com/sp/startSSO.ping?PartnerIdpId=https://dfsso.bnymellon.net/&TARGET=https%3A%2F%2Fcloud.workhuman.com%2Fmicrosites%2Fmotivation%2FSSOEntryPoint%3Fclient%3Dbnymellon
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-122-60.fra60.r.cloudfront.net
Software
/
Resource Hash
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://cloud.workhuman.com
Referer
https://cloud.workhuman.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-cache, no-store
content-length
1346
content-type
text/html;charset=utf-8
date
Wed, 19 Jul 2023 19:35:57 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
pragma
no-cache
referrer-policy
origin
via
1.1 3072267d18c4d0ed9e535752800364e0.cloudfront.net (CloudFront)
x-amz-cf-id
5zr00qRYqWoxSX7NHd1Y0am0z9_t1hkjERRkZNqYrSP2lZVzVQfnjQ==
x-amz-cf-pop
FRA60-P2
x-cache
Miss from cloudfront
x-frame-options
SAMEORIGIN
saml2sso
dfsso.bnymellon.net/affwebservices/public/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
dfsso.bnymellon.net
URL
https://dfsso.bnymellon.net/affwebservices/public/saml2sso

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Domain/Path Name / Value
cloud.workhuman.com/microsites Name: client
Value: bnymellon
www.globoforce.net/ Name: AWSALB
Value: N2aienWSuzIhvTCC/5VK/3q3k1YB0owzpKiaSGU1ym/nO/1ylHZfgaZ1PdwvhiqLlYpB3oO2+8+79OhfXbhVvyFwviSB39U9s1lrwnhfbaDnY1RC9IQ0DCgKvWmX
www.globoforce.net/ Name: AWSALBCORS
Value: N2aienWSuzIhvTCC/5VK/3q3k1YB0owzpKiaSGU1ym/nO/1ylHZfgaZ1PdwvhiqLlYpB3oO2+8+79OhfXbhVvyFwviSB39U9s1lrwnhfbaDnY1RC9IQ0DCgKvWmX
www.globoforce.net/ Name: JSESSIONID
Value: AF60EC051725399DF9EC1A0C837BAC74
www.globoforce.net/ Name: cf_client
Value: bnymellon
cloud.workhuman.com/ Name: AWSALB
Value: oJGqwFAx5/p2PVEApcj9w8t55Pz0Q46kcfZQWB3wa04Cxn0omFuv17ZFoVxeGHvbX7/ySe39nvQOqls0XGajkp8CECnnb/2E9+w6ZHUYQuksyTgTln5wBUbqdsy3
cloud.workhuman.com/ Name: AWSALBCORS
Value: oJGqwFAx5/p2PVEApcj9w8t55Pz0Q46kcfZQWB3wa04Cxn0omFuv17ZFoVxeGHvbX7/ySe39nvQOqls0XGajkp8CECnnb/2E9+w6ZHUYQuksyTgTln5wBUbqdsy3
cloud.workhuman.com/ Name: JSESSIONID
Value: A5F175EAD049EC2BD4EAD63B5394CCD4
cloud.workhuman.com/ Name: cf_client
Value: bnymellon
idp.workhuman.com/ Name: PF
Value: 4lIPq2QfJmwgsjdygCod1v

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self' *.quicksight.aws.amazon.com outlook.office365.com outlook.office.com teams.microsoft.com.mcas.ms teams.microsoft.com; report-uri https://68cebcfc7e2f58b08b59066f1.report-uri.com/r/d/csp/enforce
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cloud.workhuman.com
dfsso.bnymellon.net
idp.workhuman.com
www.globoforce.net
dfsso.bnymellon.net
13.225.34.71
13.225.34.94
18.66.122.60
d8bb433ada767e5104aa1391e257b19bd4da9e97b2e51bb7bc41ba203cf3d107