36dnwcoh.fortitrustid.forticloud.com
Open in
urlscan Pro
154.52.4.227
Public Scan
Submitted URL: https://client.fss.bhenicker.com/
Effective URL: https://36dnwcoh.fortitrustid.forticloud.com/saml-idp/bhenicker/login/?SAMLRequest=nJLRb9MwEMb%2FlcjvSRzTea21RCqrEJUGVGvhgTfXvqwWzjn4Loz996jt...
Submission: On October 09 via automatic, source certstream-suspicious — Scanned from CA
Effective URL: https://36dnwcoh.fortitrustid.forticloud.com/saml-idp/bhenicker/login/?SAMLRequest=nJLRb9MwEMb%2FlcjvSRzTea21RCqrEJUGVGvhgTfXvqwWzjn4Loz996jt...
Submission: On October 09 via automatic, source certstream-suspicious — Scanned from CA
Summary
This website contacted 1 IPs
in 2 countries
across 2 domains to perform 7 HTTP transactions.
The main IP is 154.52.4.227, located in
San Jose, United States and
belongs to FORTINET, US.
The main domain is 36dnwcoh.fortitrustid.forticloud.com.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on January 18th 2024. Valid for: a year.
This is the only time 36dnwcoh.fortitrustid.forticloud.com was scanned on urlscan.io!
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on January 18th 2024. Valid for: a year.
This is the only time 36dnwcoh.fortitrustid.forticloud.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 142.134.100.245 142.134.100.245 | 855 (CANET-ASN-4) (CANET-ASN-4) | |
| 7 | 154.52.4.227 154.52.4.227 | 40934 (FORTINET) (FORTINET) | |
| 7 | 1 |
1
142.134.100.245
(Fredericton, Canada)
ASN855 (CANET-ASN-4, CA)
PTR: fctnnbsc38w-142-134-100-245.dhcp-dynamic.fibreop.nb.bellaliant.net
ASN855 (CANET-ASN-4, CA)
PTR: fctnnbsc38w-142-134-100-245.dhcp-dynamic.fibreop.nb.bellaliant.net
| client.fss.bhenicker.com |
7
154.52.4.227
(San Jose, United States)
ASN40934 (FORTINET, US)
ASN40934 (FORTINET, US)
| 36dnwcoh.fortitrustid.forticloud.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
forticloud.com
36dnwcoh.fortitrustid.forticloud.com |
447 KB |
| 1 |
bhenicker.com
1 redirects
client.fss.bhenicker.com |
2 KB |
| 7 | 2 |
| Domain | Requested by | |
|---|---|---|
| 7 | 36dnwcoh.fortitrustid.forticloud.com |
36dnwcoh.fortitrustid.forticloud.com
|
| 1 | client.fss.bhenicker.com | 1 redirects |
| 7 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| fortitrustid.forticloud.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-01-18 - 2025-02-17 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://36dnwcoh.fortitrustid.forticloud.com/saml-idp/bhenicker/login/?SAMLRequest=nJLRb9MwEMb%2FlcjvSRzTea21RCqrEJUGVGvhgTfXvqwWzjn4Loz996jtGOOlQjzavu%2F73X2%2BG7JDHM1y4gPew%2FcJiIufQ0Qyx4dWTBlNshTIoB2ADDuzXX64M6qSxhJB5pBQvJKMlzVjTpxciqJYr1oRfCl7K5Vv5MxfzWdz7VyvF%2FJq1sybvVrM53ulrG6utRbFF8gUErZCVVIUa6IJ1khskVuhpJqVjSzlYtcsjNKmkdW11l9FsQLigJZPygPzSKau32iPjy4dqj5lDpwn4uDPBxfT5CuXhvo4TRn8WO8PgMF9g1zH9BCwFsXy9%2BS3CWkaIG8h%2FwgOPt%2Ff%2FYG4GAC56omqF4cX49o6EsXmOY23AX3Ah8vR7c9FZN7vdpty82m7E93p%2B8wpi1y8S3mwfNnkeBN82Z9KDSAHfhLdv7U8AFtv2d7Ur6jd8wZ9tAOsV5sUg3v6j044W6QjXBTLGNPjbQbL0ArOE4i6OyP%2F3tPuVwAAAP%2F%2F&RelayState=MUDG7aC5ZSppzMXhR6nLl7DPauxu67hDHiy7lUn_hQ4iWLVDEipq9muT&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1&Signature=FTie%2BFmg8Jhx8RCSB7RHz6Z71IYIxsM%2FjsQ4WUTuBRzKC5iz%2F57jFMcOFl%2Bg5KL6amav2XHQAmWQ78tjOVtSJGXnhxtaInewrwuFtjRWYOelom2BFwLo5f%2BvNZKELpwZeHwn%2BKK3Kkj%2F4AVzKXyiX%2FBh3sFe9Ymrzi7nQiwffi%2Bduld6bh%2FMYGXLubDZHZggUZcix7YLo9c9RaiOwrY%2FLmectzlE3F%2FAlksNc31iODhBFvzwhI6LUf2mfVB3kEldeOHNvTGG8Tdkor1cjjJETf33%2B5QuSJWCVn5RA6bnoIJePM4NEAisyGPQSgOnCR4yy3FI8ouC8NNRn982Vpqt%2FA%3D%3D
Frame ID: 6F3AFB983C0FD8CCAE7BBEAEA24F2C8B
Requests: 7 HTTP requests in this frame
Screenshot
Page Title
LoginPage URL History Show full URLs
-
https://client.fss.bhenicker.com/
HTTP 302
https://36dnwcoh.fortitrustid.forticloud.com/saml-idp/bhenicker/login/?SAMLRequest=nJLRb9MwEMb%2FlcjvSRzTea21RCqrEJUGVGvh... Page URL
Detected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
Django
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- (?:powered by <a[^>]+>Django ?([\d.]+)?<\/a>|<input[^>]*name=["']csrfmiddlewaretoken["'][^>]*>)
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://client.fss.bhenicker.com/
HTTP 302
https://36dnwcoh.fortitrustid.forticloud.com/saml-idp/bhenicker/login/?SAMLRequest=nJLRb9MwEMb%2FlcjvSRzTea21RCqrEJUGVGvhgTfXvqwWzjn4Loz996jtGOOlQjzavu%2F73X2%2BG7JDHM1y4gPew%2FcJiIufQ0Qyx4dWTBlNshTIoB2ADDuzXX64M6qSxhJB5pBQvJKMlzVjTpxciqJYr1oRfCl7K5Vv5MxfzWdz7VyvF%2FJq1sybvVrM53ulrG6utRbFF8gUErZCVVIUa6IJ1khskVuhpJqVjSzlYtcsjNKmkdW11l9FsQLigJZPygPzSKau32iPjy4dqj5lDpwn4uDPBxfT5CuXhvo4TRn8WO8PgMF9g1zH9BCwFsXy9%2BS3CWkaIG8h%2FwgOPt%2Ff%2FYG4GAC56omqF4cX49o6EsXmOY23AX3Ah8vR7c9FZN7vdpty82m7E93p%2B8wpi1y8S3mwfNnkeBN82Z9KDSAHfhLdv7U8AFtv2d7Ur6jd8wZ9tAOsV5sUg3v6j044W6QjXBTLGNPjbQbL0ArOE4i6OyP%2F3tPuVwAAAP%2F%2F&RelayState=MUDG7aC5ZSppzMXhR6nLl7DPauxu67hDHiy7lUn_hQ4iWLVDEipq9muT&SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1&Signature=FTie%2BFmg8Jhx8RCSB7RHz6Z71IYIxsM%2FjsQ4WUTuBRzKC5iz%2F57jFMcOFl%2Bg5KL6amav2XHQAmWQ78tjOVtSJGXnhxtaInewrwuFtjRWYOelom2BFwLo5f%2BvNZKELpwZeHwn%2BKK3Kkj%2F4AVzKXyiX%2FBh3sFe9Ymrzi7nQiwffi%2Bduld6bh%2FMYGXLubDZHZggUZcix7YLo9c9RaiOwrY%2FLmectzlE3F%2FAlksNc31iODhBFvzwhI6LUf2mfVB3kEldeOHNvTGG8Tdkor1cjjJETf33%2B5QuSJWCVn5RA6bnoIJePM4NEAisyGPQSgOnCR4yy3FI8ouC8NNRn982Vpqt%2FA%3D%3D Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
36dnwcoh.fortitrustid.forticloud.com/saml-idp/bhenicker/login/ Redirect Chain
|
8 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
font-awesome.css
36dnwcoh.fortitrustid.forticloud.com/site_media/css/font-awesome/css/ |
137 KB 137 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.css
36dnwcoh.fortitrustid.forticloud.com/site_media/css/ |
118 KB 118 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
switch_field.css
36dnwcoh.fortitrustid.forticloud.com/site_media/css/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
/
36dnwcoh.fortitrustid.forticloud.com/customviews/image/fortinet_logo:f0a067275aba3c71c62cffa2f50ac69c/ |
15 KB 16 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fa-solid-900.woff2
36dnwcoh.fortitrustid.forticloud.com/site_media/css/font-awesome/webfonts/ |
146 KB 147 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon.ico
36dnwcoh.fortitrustid.forticloud.com/ |
18 KB 19 KB |
Other
image/x-ico |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| fido_submit_btn string| trustedEndpointAutoRedirect function| trusted_endpoint_sso_fn2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| client.fss.bhenicker.com/saml/acs | Name: saml_MUDG7aC5ZSppzMXhR6nLl7DPauxu67hDHiy7lUn_hQ4iWLVDEipq9muT Value: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJodHRwczovL2NsaWVudC5mc3MuYmhlbmlja2VyLmNvbSIsImV4cCI6MTcyODUwMjA2MCwiaWF0IjoxNzI4NTAxOTcwLCJpc3MiOiJodHRwczovL2NsaWVudC5mc3MuYmhlbmlja2VyLmNvbSIsIm5iZiI6MTcyODUwMTk3MCwic3ViIjoiTVVERzdhQzVaU3Bwek1YaFI2bkxsN0RQYXV4dTY3aERIaXk3bFVuX2hRNGlXTFZERWlwcTltdVQiLCJpZCI6ImlkLTBmYTAyZDEwNGQ1ODQ4NmNjZjY5MDU0MTgxYjI5ODhiMjJhNjE3NjYiLCJ1cmkiOiIvIiwic2FtbC1hdXRobi1yZXF1ZXN0Ijp0cnVlfQ.Y0A_vt9iSuPGa1ttqQVnUb95gN6IGCn9qZ4GcVInL96VZBXUoar32QMVADL7qHYy9rcmN3ZRcJqg70e_G1-EYBI8fBLln49uWnrbtHr4VqUPZzVz8Cn8AEJ93rtal-I3ypNpd-1lAtR6JA6898rWZcs0owlo4kghO24ZcKkhQjbRZbmLx-ZlTWMqexqyySsZVYgCSTi29GwvIkOb91a5lphrdhCKmjjjUgoFFDIAjUqN6Y82jaub5ac0a4DW2s5KPhePrpX8ywS8avzA4OW3IM8IL19RB4Y1ZZPyZeeT4kSwjP4Ba6cCaxAfIUyfw_OE8c0mOe0xAvD7-7xF67KHuQ |
|
| 36dnwcoh.fortitrustid.forticloud.com/ | Name: samlsessionid Value: dzcdlte0jbst1vgfad8r6rdvw1pwoigi |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| X-Content-Type-Options | nosniff |
| X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
36dnwcoh.fortitrustid.forticloud.com
client.fss.bhenicker.com
142.134.100.245
154.52.4.227
2669e517ee7a43bdac428d08aead6d49a6ae563f98665ae6490de1e52aaf7754
2ff2a134258453be978f1c423bd8e72e7243c444909c55ec1fc2ac4a36411fff
316ac2754b346c6b62de826ca9eebcf494916ae11b24e8b674f2c735479b33d5
6ddc5fdfa0b38f7596833dd728753e2dc32324cbfb2d001e79b1fba95da7e1d6
bae45b77a8c03dcabe942b0dfb92bf04f6837a3becca1b03ca62d1178fcce0ba
dc646ce3fe7bee7bb9a005f53598dd3b6b395829a8a5628743aae210a1b12987
e2c5cf547e2e8d74a17d05c5ad9f1f593ca526452e228124294fa983b908ff82