shibb-idp.georgetown.edu
Open in
urlscan Pro
141.161.99.110
Public Scan
Effective URL: https://shibb-idp.georgetown.edu/idp/profile/SAML2/POST/SSO?execution=e1s1
Submission Tags: phishingrod
Submission: On July 16 via api from DE — Scanned from DE
Summary
TLS certificate: Issued by InCommon RSA Server CA 2 on December 11th 2023. Valid for: a year.
This is the only time shibb-idp.georgetown.edu was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 35.158.127.52 35.158.127.52 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 44.241.154.132 44.241.154.132 | 16509 (AMAZON-02) (AMAZON-02) | |
1 5 | 141.161.99.110 141.161.99.110 | 11318 (GU) (GU) | |
7 | 3 |
ASN16509 (AMAZON-02, US)
PTR: ec2-35-158-127-52.eu-central-1.compute.amazonaws.com
salesforcetestcommunity2.georgetown.edu |
ASN16509 (AMAZON-02, US)
PTR: ec2-44-241-154-132.us-west-2.compute.amazonaws.com
gu360.my.salesforce.com |
ASN11318 (GU, US)
PTR: shibb-idp.georgetown.edu
shibb-idp.georgetown.edu |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
georgetown.edu
2 redirects
salesforcetestcommunity2.georgetown.edu shibb-idp.georgetown.edu — Cisco Umbrella Rank: 647370 |
26 KB |
3 |
salesforce.com
gu360.my.salesforce.com |
12 KB |
7 | 2 |
Domain | Requested by | |
---|---|---|
5 | shibb-idp.georgetown.edu |
1 redirects
shibb-idp.georgetown.edu
|
3 | gu360.my.salesforce.com |
gu360.my.salesforce.com
|
1 | salesforcetestcommunity2.georgetown.edu | 1 redirects |
7 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
password.georgetown.edu |
Subject Issuer | Validity | Valid | |
---|---|---|---|
usa562.sfdc-lywfpd.salesforce.com DigiCert TLS RSA SHA256 2020 CA1 |
2024-07-15 - 2025-07-15 |
a year | crt.sh |
shibb-idp.georgetown.edu InCommon RSA Server CA 2 |
2023-12-11 - 2024-12-10 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://shibb-idp.georgetown.edu/idp/profile/SAML2/POST/SSO?execution=e1s1
Frame ID: FDA1DDD9C6EBF4E2B990FE3CA59363A0
Requests: 8 HTTP requests in this frame
Screenshot
Page Title
Single Signon - Georgetown UniversityPage URL History Show full URLs
-
https://salesforcetestcommunity2.georgetown.edu/
HTTP 302
https://gu360.my.salesforce.com/0I41Q0000008PJP Page URL
- https://gu360.my.salesforce.com/saml/authn-request.jsp?saml_request_id=_2CAAAAZFJqvMfMDAwMDAwMDAwMDAwMDAwAAA... Page URL
-
https://shibb-idp.georgetown.edu/idp/profile/SAML2/POST/SSO
HTTP 302
https://shibb-idp.georgetown.edu/idp/profile/SAML2/POST/SSO?execution=e1s1 Page URL
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Forgot Password?
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://salesforcetestcommunity2.georgetown.edu/
HTTP 302
https://gu360.my.salesforce.com/0I41Q0000008PJP Page URL
- https://gu360.my.salesforce.com/saml/authn-request.jsp?saml_request_id=_2CAAAAZFJqvMfMDAwMDAwMDAwMDAwMDAwAAAA-hBNMiW5MauHtKT2EAjjvW0AKYWF3jNTLed48TlHxZNb6pZRC6ElbwWHZ8HaFN079pqUaY5MZq90n0UaWCTzg1Gxi4Y2Fb5sMuMYZK6-X6SrZyL8tJ2Z2hJ_ISRSk6YQWNRlPZNL1d2J3NAsx59pUukJFUW_YjlnMoDKN5zo-7ISNaFCcar_10ZTl8zWeRSxykyE_90jtbSbFsHOnXd2B9taKSWZ73q3-7cudKafwdqgdlE4VCNhJ3ultHZqLtiQZg&saml_acs=https%3A%2F%2Fgu360.my.salesforce.com%3Fso%3D00D36000000rQpz&saml_binding_type=HttpPost&Issuer=https%3A%2F%2Fgu360.my.salesforce.com&samlSsoConfig=0LE36000000PO5g&RelayState=%2F0I41Q0000008PJP Page URL
-
https://shibb-idp.georgetown.edu/idp/profile/SAML2/POST/SSO
HTTP 302
https://shibb-idp.georgetown.edu/idp/profile/SAML2/POST/SSO?execution=e1s1 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://salesforcetestcommunity2.georgetown.edu/ HTTP 302
- https://gu360.my.salesforce.com/0I41Q0000008PJP
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
0I41Q0000008PJP
gu360.my.salesforce.com/ Redirect Chain
|
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
authn-request.jsp
gu360.my.salesforce.com/saml/ |
7 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
SSO
shibb-idp.georgetown.edu/idp/profile/SAML2/POST/ Redirect Chain
|
2 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
gu360.my.salesforce.com/ |
5 KB 5 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.css
shibb-idp.georgetown.edu/idp/css/ |
8 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login-screen-header.png
shibb-idp.georgetown.edu/idp/images/ |
12 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
592 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
shibb-idp.georgetown.edu/ |
694 B 1 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
7 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
salesforcetestcommunity2.georgetown.edu/ | Name: CookieConsentPolicy Value: 0:0 |
|
salesforcetestcommunity2.georgetown.edu/ | Name: LSKey-c$CookieConsentPolicy Value: 0:0 |
|
gu360.my.salesforce.com/ | Name: CookieConsentPolicy Value: 0:1 |
|
gu360.my.salesforce.com/ | Name: LSKey-c$CookieConsentPolicy Value: 0:1 |
|
.salesforce.com/ | Name: BrowserId Value: FaZsmkMfEe-S3331x5W97Q |
|
shibb-idp.georgetown.edu/ | Name: __Host-JSESSIONID Value: 0F03678BA57BD14286372138818E9BDD |
|
shibb-idp.georgetown.edu/ | Name: SHIBBP Value: !Jo3aeN3qr8oubK+vsw436a7/tiRn+e+dvW/4KcPTZ5vGI/9IrcaRAmm1d8K9wkdQdnXmEU015C5C7g== |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | upgrade-insecure-requests |
Strict-Transport-Security | max-age=63072000; includeSubDomains |
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
gu360.my.salesforce.com
salesforcetestcommunity2.georgetown.edu
shibb-idp.georgetown.edu
141.161.99.110
35.158.127.52
44.241.154.132
1b16c7c8abecf8cc3c3131a1903640d2f78f4a0288d46b2e6e4b38b9fb05a9c3
97acee86b25e8b41ed0079f38fcc7360765b6b1ac545d1cb9155ebee73dc7879
b6d81a2070ce191647440e50167d59f727803f424d39f7cc25a232f429da3f5c
b8f8bc4a350555ab15fbf6f6125bca2d5b340c4459d23d460595ac0d217c931f
d92dfa0476c608b9e60eda0881a1f8c9b1013a8e9b353b7e8ac4e5a36f4a8370