![](/screenshots/dc42be70-05e8-4dbc-869f-97bb7d5cad98.png)
login.firstcitizens.com
Open in
urlscan Pro
107.162.164.184
Public Scan
Effective URL: https://login.firstcitizens.com/login/login.htm?fromURI=%2Fapp%2Ffirstcitizens_dbiq_1%2Fexk5d80iqb9GbCgBx357%2Fsso%2Fsaml%3FSAML...
Submission: On December 17 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by DigiCert Global CA G2 on March 13th 2020. Valid for: 2 years.
This is the only time login.firstcitizens.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 69.84.84.36 69.84.84.36 | 46646 (BT-ASN) (BT-ASN) | |
1 4 | 107.162.164.184 107.162.164.184 | 55002 (DEFENSE-NET) (DEFENSE-NET) | |
10 | 65.9.68.94 65.9.68.94 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 143.204.90.70 143.204.90.70 | 16509 (AMAZON-02) (AMAZON-02) | |
14 | 3 |
ASN46646 (BT-ASN, US)
commercialadvantage.firstcitizens.com |
ASN16509 (AMAZON-02, US)
PTR: server-143-204-90-70.fra50.r.cloudfront.net
login.okta.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
oktacdn.com
ok7static.oktacdn.com |
820 KB |
6 |
firstcitizens.com
3 redirects
commercialadvantage.firstcitizens.com login.firstcitizens.com |
113 KB |
1 |
okta.com
login.okta.com |
|
14 | 3 |
Domain | Requested by | |
---|---|---|
10 | ok7static.oktacdn.com |
login.firstcitizens.com
ok7static.oktacdn.com |
4 | login.firstcitizens.com |
1 redirects
login.firstcitizens.com
|
2 | commercialadvantage.firstcitizens.com | 2 redirects |
1 | login.okta.com |
ok7static.oktacdn.com
|
14 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
firstcitizens.com |
www.firstcitizens.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
login.firstcitizens.com DigiCert Global CA G2 |
2020-03-13 - 2022-03-14 |
2 years | crt.sh |
*.oktacdn.com DigiCert SHA2 High Assurance Server CA |
2017-11-01 - 2021-01-06 |
3 years | crt.sh |
accounts.okta.com DigiCert SHA2 High Assurance Server CA |
2019-07-29 - 2021-07-29 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
https://login.firstcitizens.com/login/login.htm?fromURI=%2Fapp%2Ffirstcitizens_dbiq_1%2Fexk5d80iqb9GbCgBx357%2Fsso%2Fsaml%3FSAMLRequest%3DfVJdT8IwFP0rS99Zu%252BEcNowEIVESP4igD76QtrtCY9eO3k7QX%252B8GfibG195zz7nnnA5RVKbm4yZs7B1sG8AQ7StjkR8GBWm85U6gRm5FBciD4ovx9RVPY8Zr74JTzpBojAg%252BaGcnzmJTgV%252BAf9EK7u%252BuCrIJoUZOqXJVO1FaGFG%252BCBvEGuIn7TEoHfQbWIxbBF1stJTOQNjEiI52Yimd3y6WJJq212krOp1vVuPW2v7BI%252Bqa%252FnpdlVJvVwmF%252FXNWDpjeyrMLOVmf7%252FtZTjupzjGJZtOCrM5OBkzmg9MEmFQiL1m%252FZGmZDkRfqVxJaGGIDcwshtZIQVKWsl6S9pJ8mWQ8y3ifPZJo%252FpHPubaltuv%252Fw5RHEPLL5XLeOxp%252BAI8Hsy2AjIbdgfwg7H%252BU9D%252Bt%252BGyGjD4T2%252B12sXsO4hDT32l8dTCkP0SPF9T8plWZTefOaPUajY1xu4kHEaAgCaGj48rvPzV6Bw%253D%253D%26RelayState%3Dss%253Amem%253A66c05e2315a7ac2d2a84b3f536601cace09202a12958fc5fe8823ff0127c3326
Frame ID: 477BE2730955B48161FC07B55262395A
Requests: 13 HTTP requests in this frame
Frame:
https://login.okta.com/discovery/iframe.html
Frame ID: 7C659A1D24BC7A29FAB2AA19CD1EBE72
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/dc42be70-05e8-4dbc-869f-97bb7d5cad98.png)
Page URL History Show full URLs
-
https://commercialadvantage.firstcitizens.com/
HTTP 301
https://commercialadvantage.firstcitizens.com/Shibboleth.sso/Login?target=/ui HTTP 302
https://login.firstcitizens.com/app/firstcitizens_dbiq_1/exk5d80iqb9GbCgBx357/sso/saml?SAMLRequest=fVJdT8IwF... HTTP 302
https://login.firstcitizens.com/login/login.htm?fromURI=%2Fapp%2Ffirstcitizens_dbiq_1%2Fexk5d80iqb9GbCgBx357... Page URL
Detected technologies
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: Login Instructions
Search URL Search Domain Scan URL
Title: Privacy & Security
Search URL Search Domain Scan URL
Title: Contact Us
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://commercialadvantage.firstcitizens.com/
HTTP 301
https://commercialadvantage.firstcitizens.com/Shibboleth.sso/Login?target=/ui HTTP 302
https://login.firstcitizens.com/app/firstcitizens_dbiq_1/exk5d80iqb9GbCgBx357/sso/saml?SAMLRequest=fVJdT8IwFP0rS99Zu%2BEcNowEIVESP4igD76QtrtCY9eO3k7QX%2B8GfibG195zz7nnnA5RVKbm4yZs7B1sG8AQ7StjkR8GBWm85U6gRm5FBciD4ovx9RVPY8Zr74JTzpBojAg%2BaGcnzmJTgV%2BAf9EK7u%2BuCrIJoUZOqXJVO1FaGFG%2BCBvEGuIn7TEoHfQbWIxbBF1stJTOQNjEiI52Yimd3y6WJJq212krOp1vVuPW2v7BI%2Bqa%2FnpdlVJvVwmF%2FXNWDpjeyrMLOVmf7%2FtZTjupzjGJZtOCrM5OBkzmg9MEmFQiL1m%2FZGmZDkRfqVxJaGGIDcwshtZIQVKWsl6S9pJ8mWQ8y3ifPZJo%2FpHPubaltuv%2Fw5RHEPLL5XLeOxp%2BAI8Hsy2AjIbdgfwg7H%2BU9D%2Bt%2BGyGjD4T2%2B12sXsO4hDT32l8dTCkP0SPF9T8plWZTefOaPUajY1xu4kHEaAgCaGj48rvPzV6Bw%3D%3D&RelayState=ss%3Amem%3A66c05e2315a7ac2d2a84b3f536601cace09202a12958fc5fe8823ff0127c3326 HTTP 302
https://login.firstcitizens.com/login/login.htm?fromURI=%2Fapp%2Ffirstcitizens_dbiq_1%2Fexk5d80iqb9GbCgBx357%2Fsso%2Fsaml%3FSAMLRequest%3DfVJdT8IwFP0rS99Zu%252BEcNowEIVESP4igD76QtrtCY9eO3k7QX%252B8GfibG195zz7nnnA5RVKbm4yZs7B1sG8AQ7StjkR8GBWm85U6gRm5FBciD4ovx9RVPY8Zr74JTzpBojAg%252BaGcnzmJTgV%252BAf9EK7u%252BuCrIJoUZOqXJVO1FaGFG%252BCBvEGuIn7TEoHfQbWIxbBF1stJTOQNjEiI52Yimd3y6WJJq212krOp1vVuPW2v7BI%252Bqa%252FnpdlVJvVwmF%252FXNWDpjeyrMLOVmf7%252FtZTjupzjGJZtOCrM5OBkzmg9MEmFQiL1m%252FZGmZDkRfqVxJaGGIDcwshtZIQVKWsl6S9pJ8mWQ8y3ifPZJo%252FpHPubaltuv%252Fw5RHEPLL5XLeOxp%252BAI8Hsy2AjIbdgfwg7H%252BU9D%252Bt%252BGyGjD4T2%252B12sXsO4hDT32l8dTCkP0SPF9T8plWZTefOaPUajY1xu4kHEaAgCaGj48rvPzV6Bw%253D%253D%26RelayState%3Dss%253Amem%253A66c05e2315a7ac2d2a84b3f536601cace09202a12958fc5fe8823ff0127c3326 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
login.htm
login.firstcitizens.com/login/ Redirect Chain
|
22 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fcb_common.js
login.firstcitizens.com/js/vendor/lib/ |
176 KB 101 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
okta-sign-in.min.js
ok7static.oktacdn.com/assets/js/sdk/okta-signin-widget/5.1.2/js/ |
1 MB 427 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
okta-sign-in.min.css
ok7static.oktacdn.com/assets/js/sdk/okta-signin-widget/5.1.2/css/ |
195 KB 34 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
custom-signin.bb8f4ce4363dd17160adb27f2ab5f478.css
ok7static.oktacdn.com/assets/loginpage/css/ |
1 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
default.6770228fb0dab49a1695ef440a5279bb.png
ok7static.oktacdn.com/assets/img/logos/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
initLoginPage.pack.e4d8da92b7fc0974c4584ead28299fec.js
ok7static.oktacdn.com/assets/js/mvc/loginpage/ |
298 KB 95 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fs02zsibf8K9KHdCH357
ok7static.oktacdn.com/fs/bco/7/ |
196 KB 197 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fs02zsl0j9IgvWGHz357
ok7static.oktacdn.com/fs/bco/1/ |
13 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
introspect
login.firstcitizens.com/api/v1/authn/ |
753 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
montserrat-light-webfont.woff
ok7static.oktacdn.com/assets/js/sdk/okta-signin-widget/5.1.2/font/ |
22 KB 22 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
iframe.html
login.okta.com/discovery/ Frame 7C65 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
checkbox-sign-in-widget.png
ok7static.oktacdn.com/assets/js/sdk/okta-signin-widget/5.1.2/img/ui/forms/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
montserrat-regular-webfont.woff
ok7static.oktacdn.com/assets/js/sdk/okta-signin-widget/5.1.2/font/ |
21 KB 22 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
30 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| __core-js_shared__ object| core function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| Backbone function| jQueryCourage function| OktaSignIn function| signInSuccessCallBackFunction object| oktaData function| runLoginPage object| OktaUtil object| config function| readCookie function| getClientName string| clientName object| oktaSignIn object| OktaLogin object| jQBrowser4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
login.firstcitizens.com/ | Name: oktaStateToken Value: 00FACEug_qRHYnbm4sQX1blQhvXappyEpKZdDVffpa |
|
login.firstcitizens.com/ | Name: JSESSIONID Value: F0F344EEC1CB13F855434030A867D6B2 |
|
login.firstcitizens.com/ | Name: DT Value: DI0qhdWwtpHR0eEQWHR1A6kIw |
|
login.firstcitizens.com/ | Name: t Value: blue-dark |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=315360000; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
commercialadvantage.firstcitizens.com
login.firstcitizens.com
login.okta.com
ok7static.oktacdn.com
107.162.164.184
143.204.90.70
65.9.68.94
69.84.84.36
04771762755c697257d78f485288424cde9b524318a03ce549a343291a4181fd
081f903294a159671406244f9cb89945a499c7515921af1eb1faa4be13d69c98
1d5325892ecf2dc3abd0caf2a1ef4eabf2477e2937c9a372760fd2acae8fddf3
3eeb37878b0ba5acacf6bff14267aeb254513b6b66de9e2023573c1503bf970d
40810b0318131f9ba52c83a17e633a0ac476ade66ea8a914d6c4980571397665
6ad0ad11086d50749bb41cf96cf712c1e61f458b4f6844f36f4ba21960417250
8df5ce41bf695c7ce30a89e366dafe45d4190a3c788c72ee4decac89df577474
90a86d91ed6fc71e95c08be31aba5b48b8b7769f4b11ba9ce02d5daef3695eb4
937282ba00e74dc13549c8c2529cab4db566cbc1779691dac58cf2dddf18e4d8
9ce729df778fbee5e9bb0b6cde926b2e5c19c87ebd301e10eeaabab0d3d89c66
d61b4f2dd4cc620335891623b4fd0b55e486252545edaaac86724bfdc6466156
e3695b76ac53b79b96829930bd94ec9f64cfc89cd99cf06031b6c07f277a1df3
feb177fb563f478cb8ecade71caea5df5ad318ca161c71875114e504ce304ace