urlscan.io logo urlscan.io
SecurityTrails logo

hcarewards.lifeatworkportal.com Open in urlscan Pro
65.197.229.12  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://hcarewards.ehr.com/
Effective URL: https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
Submission: On February 06 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 5 HTTP transactions. The main IP is 65.197.229.12, located in United States and belongs to AS16983, US. The main domain is hcarewards.lifeatworkportal.com.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on November 18th 2019. Valid for: a year.
This is the only time hcarewards.lifeatworkportal.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 6 158.82.145.48 40196 (WILLISNOR...)
4 6 65.197.229.12 16983 (AS16983)
5 2
Apex Domain
Subdomains		 Transfer
6 lifeatworkportal.com
hcarewards.lifeatworkportal.com
3 KB
6 ehr.com
hcarewards.ehr.com
12 KB
5 2
Domain Requested by
6 hcarewards.lifeatworkportal.com 4 redirects hcarewards.ehr.com
6 hcarewards.ehr.com 3 redirects hcarewards.ehr.com
5 2

This site contains no links.

Subject Issuer Validity Valid
hcarewards.ehr.com
GlobalSign RSA OV SSL CA 2018		 2019-10-15 -
2021-10-15		 2 years crt.sh
hcarewards.lifeatworkportal.com
Sectigo RSA Organization Validation Secure Server CA		 2019-11-18 -
2020-11-17		 a year crt.sh

This page contains 2 frames:

Primary Page: https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
Frame ID: AB0AEBA69F148C7E98CCFCB4A00E6ECD
Requests: 4 HTTP requests in this frame

Frame: https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
Frame ID: 0EBF1D05416E3A597F7066B56589CF74
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://hcarewards.ehr.com/ HTTP 302
    https://hcarewards.ehr.com/ HTTP 302
    https://hcarewards.ehr.com/_layouts/Authenticate.aspx?Source=%2F HTTP 302
    https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSou... Page URL
  2. https://hcarewards.lifeatworkportal.com/logoff/oplogoff.jsp?url=/Benefits/ HTTP 302
    https://hcarewards.lifeatworkportal.com/opglobal/pub/logout.jsp?logofftype=null HTTP 302
    https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

11 kB
Transfer

10 kB
Size

7
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://hcarewards.ehr.com/ HTTP 302
    https://hcarewards.ehr.com/ HTTP 302
    https://hcarewards.ehr.com/_layouts/Authenticate.aspx?Source=%2F HTTP 302
    https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F Page URL
  2. https://hcarewards.lifeatworkportal.com/logoff/oplogoff.jsp?url=/Benefits/ HTTP 302
    https://hcarewards.lifeatworkportal.com/opglobal/pub/logout.jsp?logofftype=null HTTP 302
    https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://hcarewards.ehr.com/ HTTP 302
  • https://hcarewards.ehr.com/ HTTP 302
  • https://hcarewards.ehr.com/_layouts/Authenticate.aspx?Source=%2F HTTP 302
  • https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F
Request Chain 3
  • https://hcarewards.lifeatworkportal.com/logoff/oplogoff.jsp?url=/Benefits/ HTTP 302
  • https://hcarewards.lifeatworkportal.com/opglobal/pub/logout.jsp?logofftype=null HTTP 302
  • https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Cookie set default.ashx
hcarewards.ehr.com/
Redirect Chain
  • http://hcarewards.ehr.com/
  • https://hcarewards.ehr.com/
  • https://hcarewards.ehr.com/_layouts/Authenticate.aspx?Source=%2F
  • https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F
1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.82.145.48 , United States, ASN40196 (WILLISNORTHAMERICA, US),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
196d75141ee2d8a74ef3aa6fbb5084ced62dcecbc156e03ad7cfc8b0b66cc586

Request headers

Host
hcarewards.ehr.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Accept-Encoding
gzip, deflate, br
Cookie
f5-cookie=2598812938.0.0000
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Cache-Control
no-cache
Pragma
no-cache
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Expires
-1
Vary
Accept-Encoding
Server
Microsoft-IIS/7.5
SPRequestGuid
fbcf7bc1-389e-47ab-9dc6-ebd720d73cde
X-SharePointHealthScore
0
X-AspNet-Version
2.0.50727
Set-Cookie
%be%baB%0f%0a%8f%3a%aa%c4%01%84%b2%f3(%b1S%c7%3d%d9%9b%b9%12%d3)%94%be%06%14%d8D8%3d%25%5c%1d%bb%bb%98%a4%1cx3%05c%94%cad%8eApp=%ee%de%ed%a7%8e%d3R%fa%19%23H%f7H%bbb3%a2%c7%9e%19%99%ed%fd*%c7%dam%c8%f9%a9%ebT%b0%02%15%1f%ec%88%aa%0b%f8%c1J%d9%3f%ad4%03; path=/; secure; HttpOnly %be%baB%0f%0a%8f%3a%aa%c4%01%84%b2%f3(%b1S%c7%3d%d9%9b%b9%12%d3)%94%be%06%14%d8D8%3d%25%5c%1d%bb%bb%98%a4%1cx3%05c%94%cad%8eSessionHistory_Insert=False; path=/; secure; HttpOnly %be%baB%0f%0a%8f%3a%aa%c4%01%84%b2%f3(%b1S%c7%3d%d9%9b%b9%12%d3)%94%be%06%14%d8D8%3d%25%5c%1d%bb%bb%98%a4%1cx3%05c%94%cad%8eSessionHistory_Key=ea04a7f1-5474-4537-a8fb-c9c5db12ac57; path=/; secure; HttpOnly %be%baB%0f%0a%8f%3a%aa%c4%01%84%b2%f3(%b1S%c7%3d%d9%9b%b9%12%d3)%94%be%06%14%d8D8%3d%25%5c%1d%bb%bb%98%a4%1cx3%05c%94%cad%8eSessionHistory_Id=44228180; path=/; secure; HttpOnly
X-Powered-By
ASP.NET
MicrosoftSharePointTeamServices
14.0.0.7230
X-MS-InvokeApp
1; RequireReadOnly
SPServer
2
Date
Thu, 06 Feb 2020 14:56:32 GMT
Content-Length
941

Redirect headers

Cache-Control
private
Content-Type
text/html; charset=utf-8
Location
/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F
Server
Microsoft-IIS/7.5
SPRequestGuid
06bdc69f-d02f-4270-9ce4-fddcce2ef652
X-SharePointHealthScore
0
X-AspNet-Version
2.0.50727
X-Powered-By
ASP.NET
MicrosoftSharePointTeamServices
14.0.0.7230
X-MS-InvokeApp
1; RequireReadOnly
SPServer
2
Date
Thu, 06 Feb 2020 14:56:32 GMT
Content-Length
242
default.ashx
hcarewards.ehr.com/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://hcarewards.ehr.com/default.ashx?CLASSNAME=RESOURCEHANDLER&ID=%25fb%255e%25ae%25cb%25e7r%2510%2586%25e9%257bZ%2599%25f1T%25bcl
Requested by
Host: hcarewards.ehr.com
URL: https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.82.145.48 , United States, ASN40196 (WILLISNORTHAMERICA, US),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
bd263caf9c3ca3d45b10052b2e715e2b0291f1a9c88b1ebf5178e3a2473acf97

Request headers

Referer
https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Thu, 06 Feb 2020 14:56:32 GMT
Content-Encoding
gzip
SPServer
2
X-AspNet-Version
2.0.50727
X-Powered-By
ASP.NET
Transfer-Encoding
chunked
X-SharePointHealthScore
0
Content-Disposition
attachment; filename=login.css
MicrosoftSharePointTeamServices
14.0.0.7230
X-MS-InvokeApp
1; RequireReadOnly
Last-Modified
Tue, 05 Nov 2019 02:08:04 GMT
Server
Microsoft-IIS/7.5
SPRequestGuid
1ec426ff-36e0-4c8a-92d3-e8c4092840f2
ETag
ORNliv2HCLMDIZXeK+D9D05FVz8=
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public
Expires
Wed, 05 Feb 2020 22:16:32 GMT
default.ashx
hcarewards.ehr.com/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://hcarewards.ehr.com/default.ashx?CLASSNAME=RESOURCEHANDLER&ID=%251d%25b2%25fc)%259c%2b%2511dU%25e7t%2585%25f4%25f6%25f6%25bc
Requested by
Host: hcarewards.ehr.com
URL: https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.82.145.48 , United States, ASN40196 (WILLISNORTHAMERICA, US),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
38ca7c48de33fb31ae7dfe8b2963024ab33be876a88453781e369ebb02e55b06

Request headers

Referer
https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Thu, 06 Feb 2020 14:56:32 GMT
SPServer
2
X-AspNet-Version
2.0.50727
X-Powered-By
ASP.NET
X-SharePointHealthScore
0
Content-Disposition
attachment; filename=HCA_Logo.png
Content-Length
6825
MicrosoftSharePointTeamServices
14.0.0.7230
X-MS-InvokeApp
1; RequireReadOnly
Last-Modified
Tue, 05 Nov 2019 02:08:04 GMT
Server
Microsoft-IIS/7.5
SPRequestGuid
deda80ce-e43d-4d1b-8f95-19cd6a4a8a8c
ETag
IOed6NjdyQJ0lDH0yLNNKzOR794=
Content-Type
image/png
Cache-Control
public
Expires
Wed, 05 Feb 2020 22:16:32 GMT
azerror.jsp
hcarewards.lifeatworkportal.com/opglobal/pub/ Frame 0EBF
Redirect Chain
  • https://hcarewards.lifeatworkportal.com/logoff/oplogoff.jsp?url=/Benefits/
  • https://hcarewards.lifeatworkportal.com/opglobal/pub/logout.jsp?logofftype=null
  • https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
Requested by
Host: hcarewards.ehr.com
URL: https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
65.197.229.12 , United States, ASN16983 (AS16983, US),
Reverse DNS
hcarewards.lifeatworkportal.com
Software
/
Resource Hash

Request headers

Host
hcarewards.lifeatworkportal.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
nested-navigate
Referer
https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F
Accept-Encoding
gzip, deflate, br
Cookie
X-Mapping-clhgdopm=993CDF2A725F0491E286ADC56C5A21E7; SMSESSION=LOGGEDOFF; X-Mapping-edphjpip=4FBB372FF4C81CAC01D1F698878B5286; JSESSIONID=TvobAKy6OX9jNG4ZvyA9cXhPd8bqVu6JSNQhlv9OqUliHS9zK4hH!-480400725; PSESSIONID=s8kbAK03QTr444KNh7u0x4dWmx5fLmO7OmzF9wJCVR8NpH73FsTS!-480400725; LB=193.9.113.117:26180 --Sweden HCA-SPS--HCACLO
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F

Response headers

Cache-Control
no-store
Content-Type
text/html; charset=ISO-8859-1
Date
Thu, 06 Feb 2020 14:56:34 GMT
Keep-Alive
timeout=5, max=97
Via
HTTP/1.1 hcarewards.lifeatworkportal.com:80
Connection
Keep-Alive
Content-Length
152

Redirect headers

Cache-Control
no-store
Content-Type
text/html; charset=ISO-8859-1
Date
Thu, 06 Feb 2020 14:56:34 GMT
Location
https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
Keep-Alive
timeout=5, max=98
Transfer-Encoding
chunked
Via
HTTP/1.1 hcarewards.lifeatworkportal.com:80
Connection
Keep-Alive
Set-Cookie
PSESSIONID=s8kbAK03QTr444KNh7u0x4dWmx5fLmO7OmzF9wJCVR8NpH73FsTS!-480400725;Path=/;HttpOnly; secure LB=193.9.113.117:26180 --Sweden HCA-SPS--HCACLO;Path=/;Secure;HttpOnly; secure
Primary Request azerror.jsp
hcarewards.lifeatworkportal.com/opglobal/pub/
Redirect Chain
  • https://hcarewards.lifeatworkportal.com/logoff/oplogoff.jsp?url=/Benefits/
  • https://hcarewards.lifeatworkportal.com/opglobal/pub/logout.jsp?logofftype=null
  • https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
185 B
437 B 		Document
General
Check archive.org
Download Go to
Full URL
https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
65.197.229.12 , United States, ASN16983 (AS16983, US),
Reverse DNS
hcarewards.lifeatworkportal.com
Software
/
Resource Hash
3d434a50b1fed419df57ab32511579051a7cee7cb0398988285f5ebc6a96b271

Request headers

Host
hcarewards.lifeatworkportal.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Referer
https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F
Accept-Encoding
gzip, deflate, br
Cookie
X-Mapping-clhgdopm=993CDF2A725F0491E286ADC56C5A21E7; SMSESSION=LOGGEDOFF; X-Mapping-edphjpip=4FBB372FF4C81CAC01D1F698878B5286; JSESSIONID=TvobAKy6OX9jNG4ZvyA9cXhPd8bqVu6JSNQhlv9OqUliHS9zK4hH!-480400725; PSESSIONID=s8kbAK03QTr444KNh7u0x4dWmx5fLmO7OmzF9wJCVR8NpH73FsTS!-480400725; LB=193.9.113.117:26180 --Sweden HCA-SPS--HCACLO; origURL=hcarewards.lifeatworkportal.com
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://hcarewards.ehr.com/default.ashx?classname=login&ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F

Response headers

Cache-Control
no-store
Content-Type
text/html; charset=ISO-8859-1
Date
Thu, 06 Feb 2020 14:56:34 GMT
Keep-Alive
timeout=5, max=93
Via
HTTP/1.1 hcarewards.lifeatworkportal.com:80
Connection
Keep-Alive
Content-Length
185

Redirect headers

Cache-Control
no-store
Content-Type
text/html; charset=ISO-8859-1
Date
Thu, 06 Feb 2020 14:56:34 GMT
Location
https://hcarewards.lifeatworkportal.com/opglobal/pub/azerror.jsp
Keep-Alive
timeout=5, max=94
Transfer-Encoding
chunked
Via
HTTP/1.1 hcarewards.lifeatworkportal.com:80
Connection
Keep-Alive

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

7 Cookies

Domain/Path Name / Value
hcarewards.lifeatworkportal.com/ Name: LB
Value: 193.9.113.117:26180 --Sweden HCA-SPS--HCACLO
hcarewards.lifeatworkportal.com/ Name: PSESSIONID
Value: s8kbAK03QTr444KNh7u0x4dWmx5fLmO7OmzF9wJCVR8NpH73FsTS!-480400725
hcarewards.lifeatworkportal.com/ Name: JSESSIONID
Value: TvobAKy6OX9jNG4ZvyA9cXhPd8bqVu6JSNQhlv9OqUliHS9zK4hH!-480400725
hcarewards.lifeatworkportal.com/ Name: X-Mapping-edphjpip
Value: 4FBB372FF4C81CAC01D1F698878B5286
.hcarewards.lifeatworkportal.com/ Name: SMSESSION
Value: LOGGEDOFF
hcarewards.lifeatworkportal.com/ Name: origURL
Value: hcarewards.lifeatworkportal.com
hcarewards.lifeatworkportal.com/ Name: X-Mapping-clhgdopm
Value: 993CDF2A725F0491E286ADC56C5A21E7