signon.unitedhealthgroup.com
Open in
urlscan Pro
149.111.128.130
Public Scan
Submitted URL: http://per4.ultipro.com/pulse/8c08ae32d17411e89c42fa163e47fd8f
Effective URL: https://signon.unitedhealthgroup.com/siteminderagent/forms/loginrsa-ext.fcc?TYPE=33554432&REALMOID=06-dacae52c-eaac-4ac2-afef-69142bc...
Submission: On October 23 via manual from US
Effective URL: https://signon.unitedhealthgroup.com/siteminderagent/forms/loginrsa-ext.fcc?TYPE=33554432&REALMOID=06-dacae52c-eaac-4ac2-afef-69142bc...
Submission: On October 23 via manual from US
Summary
This website contacted 1 IPs
in 1 countries
across 2 domains to perform 4 HTTP transactions.
The main IP is 149.111.128.130, located in
Plymouth, United States and
belongs to UHC - Unitedhealthcare, US.
The main domain is signon.unitedhealthgroup.com.
TLS certificate: Issued by COMODO RSA Organization Validation Se... on July 26th 2018. Valid for: a year.
This is the only time signon.unitedhealthgroup.com was scanned on urlscan.io!
TLS certificate: Issued by COMODO RSA Organization Validation Se... on July 26th 2018. Valid for: a year.
This is the only time signon.unitedhealthgroup.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 3 3 | 208.86.170.186 208.86.170.186 | 394591 (IO-PHX-AS) (IO-PHX-AS - ULTIMATE SOFTWARE GROUP) | |
| 1 1 | 168.183.36.26 168.183.36.26 | 10879 (UHC) (UHC - Unitedhealthcare) | |
| 1 5 | 149.111.128.130 149.111.128.130 | 10879 (UHC) (UHC - Unitedhealthcare) | |
| 4 | 1 |
3
208.86.170.186
(Fort Lauderdale, United States)
ASN394591 (IO-PHX-AS - ULTIMATE SOFTWARE GROUP, US)
ASN394591 (IO-PHX-AS - ULTIMATE SOFTWARE GROUP, US)
| per4.ultipro.com |
1
168.183.36.26
(Plymouth, United States)
ASN10879 (UHC - Unitedhealthcare, US)
PTR: ssoi-ctc.uhg.com
ASN10879 (UHC - Unitedhealthcare, US)
PTR: ssoi-ctc.uhg.com
| ssoi.unitedhealthgroup.com |
5
149.111.128.130
(Plymouth, United States)
ASN10879 (UHC - Unitedhealthcare, US)
PTR: signon.unitedhealthgroup.com
ASN10879 (UHC - Unitedhealthcare, US)
PTR: signon.unitedhealthgroup.com
| signon.unitedhealthgroup.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 6 |
unitedhealthgroup.com
2 redirects
ssoi.unitedhealthgroup.com signon.unitedhealthgroup.com |
21 KB |
| 3 |
ultipro.com
3 redirects
per4.ultipro.com |
2 KB |
| 4 | 2 |
| Domain | Requested by | |
|---|---|---|
| 5 | signon.unitedhealthgroup.com |
1 redirects
signon.unitedhealthgroup.com
|
| 3 | per4.ultipro.com | 3 redirects |
| 1 | ssoi.unitedhealthgroup.com | 1 redirects |
| 4 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| aa-selfservice.unitedhealthgroup.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| signon.unitedhealthgroup.com COMODO RSA Organization Validation Secure Server CA |
2018-07-26 - 2019-07-26 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://signon.unitedhealthgroup.com/siteminderagent/forms/loginrsa-ext.fcc?TYPE=33554432&REALMOID=06-dacae52c-eaac-4ac2-afef-69142bca24b8&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-5zpO%2buEyQSyJBLoTxqe0Ue378LPXDPZZbdH%2bso0UJRSXUIT%2fYflB8YD0GOqrbkMl&TARGET=-SM-HTTP%3a%2f%2fsignon%2eunitedhealthgroup%2ecom%2fping%2fKanjoyaSSORouter%2easp%3fresumePath%3d-%2Fidp-%2FGvrWt-%2FresumeSAML20-%2Fidp-%2FSSO%2eping
Frame ID: A24DE46962659200298CD3984B89AAAD
Requests: 4 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://per4.ultipro.com/pulse/8c08ae32d17411e89c42fa163e47fd8f
HTTP 302
https://per4.ultipro.com/pulse/8c08ae32d17411e89c42fa163e47fd8f HTTP 302
https://per4.ultipro.com/sso/login?identity_provider_name=uhg.int.prod.cl&relay_state=%2Fpulse%2F8c08... HTTP 302
https://ssoi.unitedhealthgroup.com/int/idp/SSO.saml2?SAMLRequest=hVJbb9sgFH7fr0C85Mn4slaqUOwobRY1aptGtVNNe2P4JG... HTTP 302
https://signon.unitedhealthgroup.com/ping/KanjoyaSSORouter.asp?resumePath=%2Fidp%2FGvrWt%2FresumeSAML20%2Fidp%2FS... HTTP 302
https://signon.unitedhealthgroup.com/siteminderagent/forms/loginrsa-ext.fcc?TYPE=33554432&REALMOID=06-dacae52c-ea... Page URL
Detected technologies
Windows Server
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /IIS(?:\/([\d.]+))?/i
IIS
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /IIS(?:\/([\d.]+))?/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
URL: https://aa-selfservice.unitedhealthgroup.com/aa-selfservice/registration
Title: Single Sign-On Account
Title: Single Sign-On Account
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://per4.ultipro.com/pulse/8c08ae32d17411e89c42fa163e47fd8f
HTTP 302
https://per4.ultipro.com/pulse/8c08ae32d17411e89c42fa163e47fd8f HTTP 302
https://per4.ultipro.com/sso/login?identity_provider_name=uhg.int.prod.cl&relay_state=%2Fpulse%2F8c08ae32d17411e89c42fa163e47fd8f%3F HTTP 302
https://ssoi.unitedhealthgroup.com/int/idp/SSO.saml2?SAMLRequest=hVJbb9sgFH7fr0C85Mn4slaqUOwobRY1aptGtVNNe2P4JGbF4HKgW%2F79iNut2x6yNzh8N32H6exHr8kLOFTWlJOcZRMCRtpWmX052TbL5GIyqz5MDWZ8HnxnHuA5AHoSaQZ5HJc0OMOtQBWvogfkXvJ6fnfLC5bxwVlvpdX0NyE%2FTRCI4HwMQ8n81%2FHKGgw9uBrci5Kwfbgtaef9gDxNB3BnLGivohOTtk8R7Uy1Qxm6PVPGszhvmYwBFjG2MuIo%2BE6PaMWCUR7aDoT23d7ZMIxCkZxGobSu7xmKXheUrBYlVW3is%2FUaPy3D4%2Fbu%2FGa4%2FNzGF8QAK4NeGF%2FSIssvkjxLio9Nfsazc15kXyjZvHVxqcxY78kevr6CkF83zSbZ3NcNJY9va6IRQKu4k5yPvo4sreuFP614nMTwuxHKwXjlD7T6o0cJw7Ec9iTMN3sQr20O0%2FTdpxr%2FwToKrRYbq5U8kLnW9vuVA%2BGhpDuhEeh%2F0%2BQs%2FydNMDiAVDsFscu0Onr%2B%2Fd%2Bqnw%3D%3D&RelayState=%2Fpulse%2F8c08ae32d17411e89c42fa163e47fd8f%3F HTTP 302
https://signon.unitedhealthgroup.com/ping/KanjoyaSSORouter.asp?resumePath=%2Fidp%2FGvrWt%2FresumeSAML20%2Fidp%2FSSO.ping HTTP 302
https://signon.unitedhealthgroup.com/siteminderagent/forms/loginrsa-ext.fcc?TYPE=33554432&REALMOID=06-dacae52c-eaac-4ac2-afef-69142bca24b8&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-5zpO%2buEyQSyJBLoTxqe0Ue378LPXDPZZbdH%2bso0UJRSXUIT%2fYflB8YD0GOqrbkMl&TARGET=-SM-HTTP%3a%2f%2fsignon%2eunitedhealthgroup%2ecom%2fping%2fKanjoyaSSORouter%2easp%3fresumePath%3d-%2Fidp-%2FGvrWt-%2FresumeSAML20-%2Fidp-%2FSSO%2eping Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
4 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
loginrsa-ext.fcc
signon.unitedhealthgroup.com/siteminderagent/forms/ Redirect Chain
|
7 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
siteminderrsaext.js
signon.unitedhealthgroup.com/cl_includes/ |
5 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
common_logon.css
signon.unitedhealthgroup.com/cl_includes/ |
17 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ESSO_Banner.png
signon.unitedhealthgroup.com/cl_includes/images/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
48 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| APPTITLE1 string| APPTITLE2 string| cl_email string| LOGOFFURI string| cltarget string| pwdreseturl string| SC string| helpurl string| welcomemessage string| message1 string| message2 string| maintainedby string| copyright string| capswarning string| pagetitle string| logintitle string| loginmessage string| badpasstitle string| badpassmessage1 string| badpassmessage2 string| accessdeniedtitle string| accessdeniedmessage1 string| accessdeniedmessage2 string| passexpiredchangenow string| logouttitle string| logoutmessage string| essoHelp string| SelfReg string| SelfRegURL string| SelfRegApp function| getQueryVariable function| capsDetect function| MWJ_say_Caps function| goHelp string| PTarget function| resetPassword function| changePassword function| signIn function| logOff function| Right function| badpassgoback string| defaultNetworkID function| SetDefaultNetworkID function| ClearDefaultNetworkID function| resetCredFields function| submitForm function| capsError function| clearForm0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
per4.ultipro.com
signon.unitedhealthgroup.com
ssoi.unitedhealthgroup.com
149.111.128.130
168.183.36.26
208.86.170.186
0f5ba774228c59b1c035520d49777d008b5b386f35e633bb9f970d39ead9c2e6
1ae7ffd37445f9d376ce72497c02febce2e15843024daf22e155e3a91407f310
b281ca75ec750ed549a489f97f0191b471237b086e63c14f4ef2048d79272d27
d39a87a5ef6a18f26791a7fcc5a5ee3c8cfa024dc0c5272142903c1f63994be1