urlscan.io logo urlscan.io
SecurityTrails logo

mylogon.ehi.com Open in urlscan Pro
12.43.140.60  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://158.228.159.92/
Effective URL: https://mylogon.ehi.com/idp/startSSO.ping?PartnerSpId=Kronos-PROD&ACSIdx=0&SAMLRequest=fVJdT8IwFP0rSx982ycKtDLIBI2LKAsbm...
Submission: On September 17 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 2 HTTP transactions. The main IP is 12.43.140.60, located in Plano, United States and belongs to EHI-NA-AS-2 - Enterprise Holdings, Inc., US. The main domain is mylogon.ehi.com.
TLS certificate: Issued by COMODO RSA Organization Validation Se... on January 30th 2018. Valid for: 3 years.
This is the only time mylogon.ehi.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 3 158.228.159.92 46269 (KRONOS-MA)
2 12.43.140.60 16711 (EHI-NA-AS-2)
2 1
Apex Domain
Subdomains		 Transfer
2 ehi.com
mylogon.ehi.com
7 KB
2 1
Domain Requested by
2 mylogon.ehi.com mylogon.ehi.com
2 1

This site contains no links.

Subject Issuer Validity Valid
mylogon.ehi.com
COMODO RSA Organization Validation Secure Server CA		 2018-01-30 -
2021-01-29		 3 years crt.sh

This page contains 1 frames:

Primary Page: https://mylogon.ehi.com/idp/startSSO.ping?PartnerSpId=Kronos-PROD&ACSIdx=0&SAMLRequest=fVJdT8IwFP0rSx982ycKtDLIBI2LKAsbmvhiSltYI2tn2yH%2Be8uABB%2Fk8d6ee86953Qw2lUbZ8uU5lLEIPQC4DBBJOViHYNF8eD2wWg40LjaRDVKGlOKOftqmDaOHRQaHV5i0CiBJNZcI4ErppEhKE%2BepyjyAlQraSSRG%2BAkWjNlrNRYCt1UTOVMbTlhi%2Fk0BqUxtUa%2Bz0rufSoppPYEM%2F73ivgbuZbijZtykU6AM7HyXGDTrnyaqn5akLefJrLyOa19bbAyeT7zanvOKLOFsJJ1SuOnlt%2FN5rPJFa7q22Scp3QX2%2BvTSQw%2BSIcGGF%2BH%2FeimxxgOCFz1OpAuO6QLIYXMwrRuWCqsgjAxiIKw7wbQDXtFCFEEUQd63Qi%2BAyc73n7HxcHTS0YtDyCNHosic7NZXrQEW06ZerHo%2FzwCzuspQUsDjnmhdkd1HtRleXxKBwzvH9O2H6G9RQP%2FnHB4LP%2F%2Bh%2BEv&RelayState=
Frame ID: 42A4AC2D19CD213A35CB6C8686DFA041
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://158.228.159.92/ HTTP 302
    https://158.228.159.92/ HTTP 301
    https://158.228.159.92/wfc/logon HTTP 302
    https://mylogon.ehi.com/idp/startSSO.ping?PartnerSpId=Kronos-PROD&ACSIdx=0&SAMLRequest=fVJdT8IwFP0rS... Page URL

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

7 kB
Transfer

10 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://158.228.159.92/ HTTP 302
    https://158.228.159.92/ HTTP 301
    https://158.228.159.92/wfc/logon HTTP 302
    https://mylogon.ehi.com/idp/startSSO.ping?PartnerSpId=Kronos-PROD&ACSIdx=0&SAMLRequest=fVJdT8IwFP0rSx982ycKtDLIBI2LKAsbmvhiSltYI2tn2yH%2Be8uABB%2Fk8d6ee86953Qw2lUbZ8uU5lLEIPQC4DBBJOViHYNF8eD2wWg40LjaRDVKGlOKOftqmDaOHRQaHV5i0CiBJNZcI4ErppEhKE%2BepyjyAlQraSSRG%2BAkWjNlrNRYCt1UTOVMbTlhi%2Fk0BqUxtUa%2Bz0rufSoppPYEM%2F73ivgbuZbijZtykU6AM7HyXGDTrnyaqn5akLefJrLyOa19bbAyeT7zanvOKLOFsJJ1SuOnlt%2FN5rPJFa7q22Scp3QX2%2BvTSQw%2BSIcGGF%2BH%2FeimxxgOCFz1OpAuO6QLIYXMwrRuWCqsgjAxiIKw7wbQDXtFCFEEUQd63Qi%2BAyc73n7HxcHTS0YtDyCNHosic7NZXrQEW06ZerHo%2FzwCzuspQUsDjnmhdkd1HtRleXxKBwzvH9O2H6G9RQP%2FnHB4LP%2F%2Bh%2BEv&RelayState= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set startSSO.ping
mylogon.ehi.com/idp/
Redirect Chain
  • http://158.228.159.92/
  • https://158.228.159.92/
  • https://158.228.159.92/wfc/logon
  • https://mylogon.ehi.com/idp/startSSO.ping?PartnerSpId=Kronos-PROD&ACSIdx=0&SAMLRequest=fVJdT8IwFP0rSx982ycKtDLIBI2LKAsbmvhiSltYI2tn2yH%2Be8uABB%2Fk8d6ee86953Qw2lUbZ8uU5lLEIPQC4DBBJOViHYNF8eD2wWg40L...
5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://mylogon.ehi.com/idp/startSSO.ping?PartnerSpId=Kronos-PROD&ACSIdx=0&SAMLRequest=fVJdT8IwFP0rSx982ycKtDLIBI2LKAsbmvhiSltYI2tn2yH%2Be8uABB%2Fk8d6ee86953Qw2lUbZ8uU5lLEIPQC4DBBJOViHYNF8eD2wWg40LjaRDVKGlOKOftqmDaOHRQaHV5i0CiBJNZcI4ErppEhKE%2BepyjyAlQraSSRG%2BAkWjNlrNRYCt1UTOVMbTlhi%2Fk0BqUxtUa%2Bz0rufSoppPYEM%2F73ivgbuZbijZtykU6AM7HyXGDTrnyaqn5akLefJrLyOa19bbAyeT7zanvOKLOFsJJ1SuOnlt%2FN5rPJFa7q22Scp3QX2%2BvTSQw%2BSIcGGF%2BH%2FeimxxgOCFz1OpAuO6QLIYXMwrRuWCqsgjAxiIKw7wbQDXtFCFEEUQd63Qi%2BAyc73n7HxcHTS0YtDyCNHosic7NZXrQEW06ZerHo%2FzwCzuspQUsDjnmhdkd1HtRleXxKBwzvH9O2H6G9RQP%2FnHB4LP%2F%2Bh%2BEv&RelayState=
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
12.43.140.60 Plano, United States, ASN16711 (EHI-NA-AS-2 - Enterprise Holdings, Inc., US),
Reverse DNS
mylogon.ehi.com
Software
/
Resource Hash
4a4f2d7b6ba795f23e651bbf79968ce7b7eae79bb145c2b96646240dba74c819

Request headers

Host
mylogon.ehi.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
42A4AC2D19CD213A35CB6C8686DFA041

Response headers

Connection
Keep-Alive
Transfer-Encoding
chunked
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Date
Mon, 17 Sep 2018 19:29:40 GMT
Content-Type
text/html;charset=UTF-8
Cache-Control
no-cache, no-store
Pragma
no-cache
max-age
Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie
PF=YngMeAphTBhhX7LkhIyDtCY2sfrVlpzzbR398sOp1OC8;Path=/;Secure;HttpOnly
Content-Encoding
gzip
Vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache
Pragma
no-cache
Content-Type
;charset=utf-8
Content-Language
en
Location
https://mylogon.ehi.com/idp/startSSO.ping?PartnerSpId=Kronos-PROD&ACSIdx=0&SAMLRequest=fVJdT8IwFP0rSx982ycKtDLIBI2LKAsbmvhiSltYI2tn2yH%2Be8uABB%2Fk8d6ee86953Qw2lUbZ8uU5lLEIPQC4DBBJOViHYNF8eD2wWg40LjaRDVKGlOKOftqmDaOHRQaHV5i0CiBJNZcI4ErppEhKE%2BepyjyAlQraSSRG%2BAkWjNlrNRYCt1UTOVMbTlhi%2Fk0BqUxtUa%2Bz0rufSoppPYEM%2F73ivgbuZbijZtykU6AM7HyXGDTrnyaqn5akLefJrLyOa19bbAyeT7zanvOKLOFsJJ1SuOnlt%2FN5rPJFa7q22Scp3QX2%2BvTSQw%2BSIcGGF%2BH%2FeimxxgOCFz1OpAuO6QLIYXMwrRuWCqsgjAxiIKw7wbQDXtFCFEEUQd63Qi%2BAyc73n7HxcHTS0YtDyCNHosic7NZXrQEW06ZerHo%2FzwCzuspQUsDjnmhdkd1HtRleXxKBwzvH9O2H6G9RQP%2FnHB4LP%2F%2Bh%2BEv&RelayState=
Server
Microsoft-IIS/8.5
Set-Cookie
JSESSIONID=m1tbbEHH8E4muJ9y-mq13nMn; Path=/wfc; HttpOnly kronos=!rbjtBdGOY4OcGS/QDjE11pzvn3SayQONA9UG6wfMXWGdIwulkybKJZzz2DTBMXVAvVgCS/J4Vn3SRQ==;HttpOnly;Secure;Path=/;Version=1;
X-Powered-By
ASP.NET
X-XSS-Protection
1; mode=block
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=63072000; includeSubdomains
Date
Mon, 17 Sep 2018 19:29:39 GMT
Connection
keep-alive
Content-Length
0
EnterpriseHoldings.jpg
mylogon.ehi.com/images/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mylogon.ehi.com/images/EnterpriseHoldings.jpg
Requested by
Host: mylogon.ehi.com
URL: https://mylogon.ehi.com/idp/startSSO.ping?PartnerSpId=Kronos-PROD&ACSIdx=0&SAMLRequest=fVJdT8IwFP0rSx982ycKtDLIBI2LKAsbmvhiSltYI2tn2yH%2Be8uABB%2Fk8d6ee86953Qw2lUbZ8uU5lLEIPQC4DBBJOViHYNF8eD2wWg40LjaRDVKGlOKOftqmDaOHRQaHV5i0CiBJNZcI4ErppEhKE%2BepyjyAlQraSSRG%2BAkWjNlrNRYCt1UTOVMbTlhi%2Fk0BqUxtUa%2Bz0rufSoppPYEM%2F73ivgbuZbijZtykU6AM7HyXGDTrnyaqn5akLefJrLyOa19bbAyeT7zanvOKLOFsJJ1SuOnlt%2FN5rPJFa7q22Scp3QX2%2BvTSQw%2BSIcGGF%2BH%2FeimxxgOCFz1OpAuO6QLIYXMwrRuWCqsgjAxiIKw7wbQDXtFCFEEUQd63Qi%2BAyc73n7HxcHTS0YtDyCNHosic7NZXrQEW06ZerHo%2FzwCzuspQUsDjnmhdkd1HtRleXxKBwzvH9O2H6G9RQP%2FnHB4LP%2F%2Bh%2BEv&RelayState=
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
12.43.140.60 Plano, United States, ASN16711 (EHI-NA-AS-2 - Enterprise Holdings, Inc., US),
Reverse DNS
mylogon.ehi.com
Software
/
Resource Hash
9b6fdecd467f8a3a46be8f0c8d563d922f7062a1c734fe510a684f07c4980fcf

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
mylogon.ehi.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://mylogon.ehi.com/idp/startSSO.ping?PartnerSpId=Kronos-PROD&ACSIdx=0&SAMLRequest=fVJdT8IwFP0rSx982ycKtDLIBI2LKAsbmvhiSltYI2tn2yH%2Be8uABB%2Fk8d6ee86953Qw2lUbZ8uU5lLEIPQC4DBBJOViHYNF8eD2wWg40LjaRDVKGlOKOftqmDaOHRQaHV5i0CiBJNZcI4ErppEhKE%2BepyjyAlQraSSRG%2BAkWjNlrNRYCt1UTOVMbTlhi%2Fk0BqUxtUa%2Bz0rufSoppPYEM%2F73ivgbuZbijZtykU6AM7HyXGDTrnyaqn5akLefJrLyOa19bbAyeT7zanvOKLOFsJJ1SuOnlt%2FN5rPJFa7q22Scp3QX2%2BvTSQw%2BSIcGGF%2BH%2FeimxxgOCFz1OpAuO6QLIYXMwrRuWCqsgjAxiIKw7wbQDXtFCFEEUQd63Qi%2BAyc73n7HxcHTS0YtDyCNHosic7NZXrQEW06ZerHo%2FzwCzuspQUsDjnmhdkd1HtRleXxKBwzvH9O2H6G9RQP%2FnHB4LP%2F%2Bh%2BEv&RelayState=
Cookie
PF=YngMeAphTBhhX7LkhIyDtCY2sfrVlpzzbR398sOp1OC8
Connection
keep-alive
Cache-Control
no-cache
Referer
https://mylogon.ehi.com/idp/startSSO.ping?PartnerSpId=Kronos-PROD&ACSIdx=0&SAMLRequest=fVJdT8IwFP0rSx982ycKtDLIBI2LKAsbmvhiSltYI2tn2yH%2Be8uABB%2Fk8d6ee86953Qw2lUbZ8uU5lLEIPQC4DBBJOViHYNF8eD2wWg40LjaRDVKGlOKOftqmDaOHRQaHV5i0CiBJNZcI4ErppEhKE%2BepyjyAlQraSSRG%2BAkWjNlrNRYCt1UTOVMbTlhi%2Fk0BqUxtUa%2Bz0rufSoppPYEM%2F73ivgbuZbijZtykU6AM7HyXGDTrnyaqn5akLefJrLyOa19bbAyeT7zanvOKLOFsJJ1SuOnlt%2FN5rPJFa7q22Scp3QX2%2BvTSQw%2BSIcGGF%2BH%2FeimxxgOCFz1OpAuO6QLIYXMwrRuWCqsgjAxiIKw7wbQDXtFCFEEUQd63Qi%2BAyc73n7HxcHTS0YtDyCNHosic7NZXrQEW06ZerHo%2FzwCzuspQUsDjnmhdkd1HtRleXxKBwzvH9O2H6G9RQP%2FnHB4LP%2F%2Bh%2BEv&RelayState=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 17 Sep 2018 19:29:40 GMT
Last-Modified
Mon, 05 Dec 2011 23:37:00 GMT
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
5265
Vary
Accept-Encoding
Content-Type
image/jpeg

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| postOk function| setFocus function| are_cookies_enabled function| enableButton

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mylogon.ehi.com
12.43.140.60
158.228.159.92
4a4f2d7b6ba795f23e651bbf79968ce7b7eae79bb145c2b96646240dba74c819
9b6fdecd467f8a3a46be8f0c8d563d922f7062a1c734fe510a684f07c4980fcf