Submitted URL: https://login.dev.nsf.gov/
Effective URL: https://login.dev.nsf.gov/sso/XUI/
Submission: On September 04 via automatic, source certstream-suspicious — Scanned from IT

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 128.150.221.37, located in Chantilly, United States and belongs to NSF-HQ-AS, US. The main domain is login.dev.nsf.gov.
TLS certificate: Issued by GeoTrust TLS RSA CA G1 on September 4th 2024. Valid for: a year.
This is the only time login.dev.nsf.gov was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 6 128.150.221.37 102 (NSF-HQ-AS)
4 1
Apex Domain
Subdomains
Transfer
6 nsf.gov
login.dev.nsf.gov
26 KB
4 1
Domain Requested by
6 login.dev.nsf.gov 2 redirects login.dev.nsf.gov
4 1

This site contains no links.

Subject Issuer Validity Valid
login.dev.nsf.gov
GeoTrust TLS RSA CA G1
2024-09-04 -
2025-09-26
a year crt.sh

This page contains 1 frames:

Primary Page: https://login.dev.nsf.gov/sso/XUI/
Frame ID: D86BE98EEDF6EF1C6D56CC761DD0F30E
Requests: 4 HTTP requests in this frame

Screenshot

Page Title

NSF | Research.gov

Page URL History Show full URLs

  1. https://login.dev.nsf.gov/ HTTP 302
    https://login.dev.nsf.gov/sso// Page URL
  2. https://login.dev.nsf.gov/sso//UI/Login HTTP 302
    https://login.dev.nsf.gov/sso/XUI/ Page URL

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

26 kB
Transfer

203 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://login.dev.nsf.gov/ HTTP 302
    https://login.dev.nsf.gov/sso// Page URL
  2. https://login.dev.nsf.gov/sso//UI/Login HTTP 302
    https://login.dev.nsf.gov/sso/XUI/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://login.dev.nsf.gov/ HTTP 302
  • https://login.dev.nsf.gov/sso//

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
login.dev.nsf.gov/sso//
Redirect Chain
  • https://login.dev.nsf.gov/
  • https://login.dev.nsf.gov/sso//
2 KB
2 KB
Document
General
Full URL
https://login.dev.nsf.gov/sso//
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
128.150.221.37 Chantilly, United States, ASN102 (NSF-HQ-AS, US),
Reverse DNS
login.dev.nsf.gov
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Length
1689
Content-Type
text/html
Date
Wed, 04 Sep 2024 12:10:18 GMT
ETag
W/"1689-1701278504000"
Keep-Alive
timeout=60
Last-Modified
Wed, 29 Nov 2023 17:21:44 GMT
Strict-Transport-Security
max-age=31536000;includeSubDomains
X-Content-Type-Options
nosniff
X-Frame-Options
DENY
X-XSS-Protection
1; mode=block

Redirect headers

Connection
Keep-Alive
Content-Length
0
Location
/sso//
Server
BigIP
Primary Request /
login.dev.nsf.gov/sso/XUI/
Redirect Chain
  • https://login.dev.nsf.gov/sso//UI/Login
  • https://login.dev.nsf.gov/sso/XUI/
2 KB
2 KB
Document
General
Full URL
https://login.dev.nsf.gov/sso/XUI/
Requested by
Host: login.dev.nsf.gov
URL: https://login.dev.nsf.gov/sso//
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
128.150.221.37 Chantilly, United States, ASN102 (NSF-HQ-AS, US),
Reverse DNS
login.dev.nsf.gov
Software
/
Resource Hash
8a66a62a8f8258578aaea1e84a3b0e7a54b949cde8f5f9552d0d17e5fd768790
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://login.dev.nsf.gov/sso//
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
Cache-Control
public, max-age=300
Connection
keep-alive
Content-Length
1668
Content-Type
text/html
Date
Wed, 04 Sep 2024 12:10:18 GMT
ETag
W/"1668-1724105024000"
Keep-Alive
timeout=60
Last-Modified
Mon, 19 Aug 2024 22:03:44 GMT
Strict-Transport-Security
max-age=31536000;includeSubDomains
X-Content-Type-Options
nosniff
X-Frame-Options
DENY
X-XSS-Protection
1; mode=block

Redirect headers

Connection
keep-alive
Content-Length
0
Date
Wed, 04 Sep 2024 12:10:18 GMT
Keep-Alive
timeout=60
Location
/sso/XUI/#login/
webtrends.js
login.dev.nsf.gov/sso/js/
22 KB
22 KB
Script
General
Full URL
https://login.dev.nsf.gov/sso/js/webtrends.js
Requested by
Host: login.dev.nsf.gov
URL: https://login.dev.nsf.gov/sso/XUI/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
128.150.221.37 Chantilly, United States, ASN102 (NSF-HQ-AS, US),
Reverse DNS
login.dev.nsf.gov
Software
/
Resource Hash
66f8b900a07e04b6b40297f30bf7bd2e2827483d9a4aedfbdb3c91148ef5408a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://login.dev.nsf.gov/sso/XUI/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;includeSubDomains
Date
Wed, 04 Sep 2024 12:10:18 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 29 Nov 2023 17:21:44 GMT
ETag
W/"22046-1701278504000"
X-Frame-Options
DENY
Content-Type
application/javascript
Cache-Control
public, max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=60
Content-Length
22046
X-XSS-Protection
1; mode=block
main.4744113253.js
login.dev.nsf.gov/sso/XUI/
178 KB
0
Script
General
Full URL
https://login.dev.nsf.gov/sso/XUI/main.4744113253.js
Requested by
Host: login.dev.nsf.gov
URL: https://login.dev.nsf.gov/sso/XUI/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
128.150.221.37 Chantilly, United States, ASN102 (NSF-HQ-AS, US),
Reverse DNS
login.dev.nsf.gov
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://login.dev.nsf.gov/sso/XUI/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;includeSubDomains
Date
Wed, 04 Sep 2024 12:10:18 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 19 Aug 2024 22:03:42 GMT
ETag
W/"823314-1724105022000"
X-Frame-Options
DENY
Content-Type
application/javascript
Cache-Control
public, max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=60
Content-Length
823314
X-XSS-Protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| WebTrends function| dcsMultiTrack function| dcsDebug

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000;includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

login.dev.nsf.gov
128.150.221.37
66f8b900a07e04b6b40297f30bf7bd2e2827483d9a4aedfbdb3c91148ef5408a
8a66a62a8f8258578aaea1e84a3b0e7a54b949cde8f5f9552d0d17e5fd768790