aevbhquzr.accounts.ondemand.com
Open in
urlscan Pro
157.133.170.72
Public Scan
Effective URL: https://aevbhquzr.accounts.ondemand.com/saml2/idp/sso/aevbhquzr.accounts.ondemand.com?SAMLRequest=tVPJbtswEL37KwTdJVKLFxG2ATfuYsC1hdjtoZ...
Submission: On April 21 via manual from HU — Scanned from DE
Summary
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on November 21st 2022. Valid for: a year.
This is the only time aevbhquzr.accounts.ondemand.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 34.209.80.95 34.209.80.95 | 16509 (AMAZON-02) (AMAZON-02) | |
3 3 | 2606:4700::68... 2606:4700::6811:68b7 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 2606:4700::68... 2606:4700::6811:1f01 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
6 | 157.133.170.72 157.133.170.72 | 35039 (SAP_CC) (SAP_CC) | |
1 | 52.219.169.166 52.219.169.166 | 16509 (AMAZON-02) (AMAZON-02) | |
7 | 3 |
ASN16509 (AMAZON-02, US)
PTR: ec2-34-209-80-95.us-west-2.compute.amazonaws.com
cas5-0-urlprotect.trendmicro.com |
ASN13335 (CLOUDFLARENET, US)
aldi-sued.requests.eu.people-doc.com |
ASN16509 (AMAZON-02, US)
PTR: s3-r-w.eu-central-1.amazonaws.com
prod-s3karriere-s3karrierebucket-1c6e8i3nquiqf.s3-eu-central-1.amazonaws.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
ondemand.com
aevbhquzr.accounts.ondemand.com |
201 KB |
3 |
people-doc.com
3 redirects
aldi-sued.requests.eu.people-doc.com |
861 B |
1 |
amazonaws.com
prod-s3karriere-s3karrierebucket-1c6e8i3nquiqf.s3-eu-central-1.amazonaws.com |
1 MB |
1 |
safe-access.com
1 redirects
novaauth.safe-access.com |
1 KB |
1 |
trendmicro.com
1 redirects
cas5-0-urlprotect.trendmicro.com |
152 B |
7 | 5 |
Domain | Requested by | |
---|---|---|
6 | aevbhquzr.accounts.ondemand.com |
aevbhquzr.accounts.ondemand.com
|
3 | aldi-sued.requests.eu.people-doc.com | 3 redirects |
1 | prod-s3karriere-s3karrierebucket-1c6e8i3nquiqf.s3-eu-central-1.amazonaws.com |
aevbhquzr.accounts.ondemand.com
|
1 | novaauth.safe-access.com | 1 redirects |
1 | cas5-0-urlprotect.trendmicro.com | 1 redirects |
7 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.accounts.ondemand.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-11-21 - 2023-12-21 |
a year | crt.sh |
*.s3.eu-central-1.amazonaws.com Amazon |
2022-09-21 - 2023-09-09 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://aevbhquzr.accounts.ondemand.com/saml2/idp/sso/aevbhquzr.accounts.ondemand.com?SAMLRequest=tVPJbtswEL37KwTdJVKLFxG2ATfuYsC1hdjtoZeAIkcxAYlUOJS7fH0ppU2aQ9NTeeIyb%2BEbcom8bTq26d1F38JDD%2BgmQfCtbTSy8WgV9lYzw1Eh07wFZE6w0%2BbjnqUxZZ01zgjThC9Ar2M4IlinjB5Au%2B0qPB7e7o%2Fvd4c7mmczkUFS0KzKkkWepZmfFHUhYcFnVU2LaU6n09kA%2FAwWPccq9JTDOghKa65Kgj14xVVYguka2BoRnMpRCLGHnUbHtfMgmmYRzaM0OSeU0QWj%2BZehauvvrzR3I%2FPFuQ4ZIRyu1eWh%2F2FjLoTptcPYaAkt1zIWpiXDlVOiZEcQzb%2BqB5XyV2pvlJZK378eV%2FVYhOzD%2BVxG5fF0Hig2v0O8MRr7FuwJ7FUJ%2BHS7fzauzZVz39kYeQ2RtwOIT44JdiRL0ixJRB7NKMyjvJjXUSEpjwSts5zyal4t8jvvnN%2BDJVwgCddj1MuBgI2R2vX%2FUWvBcckdJ0vyp9izfMeGRu%2B2pWmU%2BD7uD%2BOdsS13f480iZNxR8moHkuZb41qNlJa7zd84tk0jfl6Y4E7%2F5ic7SEMyHoyeXTz8sOsfwI%3D&RelayState=https%3A%2F%2Faldi-sued.requests.eu.people-doc.com%2Fmanager%2Flogin%2Fcheck%2F%3Fnext%3D%2Fmanager%2Frequest%2F370088%2F&Signature=Wm0FPpP6L282bG01aivI3gHchIW7pXtkaPRfJSCN7hbxzxLGNyKzmbYGfCbPAYqCAKQeq%2B6xvKqoprcEVf0Ftx9vcO1CAumEKFots1wVVxh8rxp745qGGTqwNHWnjwUqS4CGVUafr9zXqqDJj3tR9py03vFqMGrOFDlASauaO2qWDgxhdf20h9q3%2B5cvNA0QM523coqvGPSJKr8yZy3hH7dH9k%2BY6mwRVMmq%2B%2FvEQgh669ZhPm0C%2F3rm%2BTHEOuBdZk%2FNF%2BUwQbDj8SHAkAI6vAiTVqADy0E5raS67M06YXK621wAdbggI6P3NBxhk%2Bt6661N96%2Bc%2BUgEtbI4l3y1eA%3D%3D&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256
Frame ID: C38A2FFD4EFE3E56FB348C9A0A8F31C5
Requests: 10 HTTP requests in this frame
Screenshot
Page Title
MeinHR Manager: AnmeldenPage URL History Show full URLs
-
https://cas5-0-urlprotect.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2faldi%2dsued.requests.eu.people%2ddo...
HTTP 302
https://aldi-sued.requests.eu.people-doc.com/manager/request/370088/ HTTP 302
https://aldi-sued.requests.eu.people-doc.com/manager/login/?next=/manager/request/370088/ HTTP 302
https://aldi-sued.requests.eu.people-doc.com/manager/login/check/?next=/manager/request/370088/ HTTP 302
https://novaauth.safe-access.com/session/?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuZXh0IjoiaHR0cHM6Ly9hbG... HTTP 302
https://aevbhquzr.accounts.ondemand.com/saml2/idp/sso/aevbhquzr.accounts.ondemand.com?SAMLRequest=tVPJbtswEL37KwTdJV... Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://cas5-0-urlprotect.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2faldi%2dsued.requests.eu.people%2ddoc.com%2fmanager%2frequest%2f370088%2f&umid=fccc2c6f-856d-434e-8915-96aba2aeb0fd&auth=3bd1ed0ea25e030aebac2180cda48b2d7a1ccc30-e9825ecd8394fb9090367b8f9bdb997cf1c3c1e8
HTTP 302
https://aldi-sued.requests.eu.people-doc.com/manager/request/370088/ HTTP 302
https://aldi-sued.requests.eu.people-doc.com/manager/login/?next=/manager/request/370088/ HTTP 302
https://aldi-sued.requests.eu.people-doc.com/manager/login/check/?next=/manager/request/370088/ HTTP 302
https://novaauth.safe-access.com/session/?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuZXh0IjoiaHR0cHM6Ly9hbGRpLXN1ZWQucmVxdWVzdHMuZXUucGVvcGxlLWRvYy5jb20vbWFuYWdlci9sb2dpbi9jaGVjay8_bmV4dD0vbWFuYWdlci9yZXF1ZXN0LzM3MDA4OC8iLCJzY29wZSI6IjMxMjMxMWM0LTYwZTctNDk3Zi05ZDBhLWMwZjM0MGFiN2I4NF9tYW5hZ2VyIiwibmV4dF9mYWlsIjoiaHR0cHM6Ly9hbGRpLXN1ZWQucmVxdWVzdHMuZXUucGVvcGxlLWRvYy5jb20vbWFuYWdlci9sb2dpbi9jaGVjay8_bmV4dD0vbWFuYWdlci9yZXF1ZXN0LzM3MDA4OC8iLCJqdGkiOiI5ZjM4Nzc2OS1mMDA3LTQ1MGItOGViMy04MzIwYmUyODYxM2YifQ.OE2cio4rwNCyps1xlqLwYJ-NewNKYCE-TGC1nxsliDE HTTP 302
https://aevbhquzr.accounts.ondemand.com/saml2/idp/sso/aevbhquzr.accounts.ondemand.com?SAMLRequest=tVPJbtswEL37KwTdJVKLFxG2ATfuYsC1hdjtoZeAIkcxAYlUOJS7fH0ppU2aQ9NTeeIyb%2BEbcom8bTq26d1F38JDD%2BgmQfCtbTSy8WgV9lYzw1Eh07wFZE6w0%2BbjnqUxZZ01zgjThC9Ar2M4IlinjB5Au%2B0qPB7e7o%2Fvd4c7mmczkUFS0KzKkkWepZmfFHUhYcFnVU2LaU6n09kA%2FAwWPccq9JTDOghKa65Kgj14xVVYguka2BoRnMpRCLGHnUbHtfMgmmYRzaM0OSeU0QWj%2BZehauvvrzR3I%2FPFuQ4ZIRyu1eWh%2F2FjLoTptcPYaAkt1zIWpiXDlVOiZEcQzb%2BqB5XyV2pvlJZK378eV%2FVYhOzD%2BVxG5fF0Hig2v0O8MRr7FuwJ7FUJ%2BHS7fzauzZVz39kYeQ2RtwOIT44JdiRL0ixJRB7NKMyjvJjXUSEpjwSts5zyal4t8jvvnN%2BDJVwgCddj1MuBgI2R2vX%2FUWvBcckdJ0vyp9izfMeGRu%2B2pWmU%2BD7uD%2BOdsS13f480iZNxR8moHkuZb41qNlJa7zd84tk0jfl6Y4E7%2F5ic7SEMyHoyeXTz8sOsfwI%3D&RelayState=https%3A%2F%2Faldi-sued.requests.eu.people-doc.com%2Fmanager%2Flogin%2Fcheck%2F%3Fnext%3D%2Fmanager%2Frequest%2F370088%2F&Signature=Wm0FPpP6L282bG01aivI3gHchIW7pXtkaPRfJSCN7hbxzxLGNyKzmbYGfCbPAYqCAKQeq%2B6xvKqoprcEVf0Ftx9vcO1CAumEKFots1wVVxh8rxp745qGGTqwNHWnjwUqS4CGVUafr9zXqqDJj3tR9py03vFqMGrOFDlASauaO2qWDgxhdf20h9q3%2B5cvNA0QM523coqvGPSJKr8yZy3hH7dH9k%2BY6mwRVMmq%2B%2FvEQgh669ZhPm0C%2F3rm%2BTHEOuBdZk%2FNF%2BUwQbDj8SHAkAI6vAiTVqADy0E5raS67M06YXK621wAdbggI6P3NBxhk%2Bt6661N96%2Bc%2BUgEtbI4l3y1eA%3D%3D&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
aevbhquzr.accounts.ondemand.com
aevbhquzr.accounts.ondemand.com/saml2/idp/sso/ Redirect Chain
|
12 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ids-fc2dae44d4617819d75f2a433ae989e8865cce116f675b906a274d168416832f.css
aevbhquzr.accounts.ondemand.com/universalui/assets/ |
136 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
RESOURCE_STYLESHEET
aevbhquzr.accounts.ondemand.com/ui/public/cached/ALDICSSohneFooter/v/3/ |
81 KB 41 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo
aevbhquzr.accounts.ondemand.com/ui/public/cached/6070580cfe68495bad2718e7/v/2/ |
28 KB 28 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tenant_logo
aevbhquzr.accounts.ondemand.com/ui/public/cached/tenant/v/7/ |
36 KB 36 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
application-7d4853c26492fba7f72bbe4378978d93aef4eab7b2fd2a817db4ea2814c211f9.js
aevbhquzr.accounts.ondemand.com/universalui/assets/ |
193 KB 64 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SFBackground.png
prod-s3karriere-s3karrierebucket-1c6e8i3nquiqf.s3-eu-central-1.amazonaws.com/sf/ |
1 MB 1 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
258 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
236 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
56 KB 56 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
30 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| idsClose function| idsShowHelp function| idsInputReveal function| idsShowInputHint function| idsExpand function| idsInputClear function| idsDetectWebAuthnSupport function| idsBufferEncode function| idsStringEncode function| idsConstructUserCredentials function| idsBuildFlashMessage function| idsWebAuthnRegister function| idsWebAuthnLogin function| $ function| jQuery object| html5 object| Modernizr function| _ object| Backbone function| FlashMessage function| EditableLinks function| HintPasswordValidate function| setPasswordRepeatValidator function| resize_overlay function| InputHintPageUpdater function| EventEmitter object| eventie function| imagesLoaded boolean| wro_flag3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
novaauth.safe-access.com/ | Name: sessionid Value: i1yity4qbau5lx77o27tijad2933f2mu |
|
aevbhquzr.accounts.ondemand.com/ | Name: XSRF_COOKIE Value: EO+/vSYrHCwwPC1e77+9RO+/ve+/ve+/ve+/ve+/ve+/vduk77+977+9dO+/vREl77+9dlBTAO+/vToxNjgyMDcxNjg0MzI3 |
|
aevbhquzr.accounts.ondemand.com/ | Name: JSESSIONID Value: 039D4541D6968646F376104F80729C88 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | script-src 'self' consent.trustarc.com 'nonce-R1Tg0VsGQHiuiNS9Eh/V0qKKpDp5Kw/tNLTzCWpHRm8=' |
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload |
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aevbhquzr.accounts.ondemand.com
aldi-sued.requests.eu.people-doc.com
cas5-0-urlprotect.trendmicro.com
novaauth.safe-access.com
prod-s3karriere-s3karrierebucket-1c6e8i3nquiqf.s3-eu-central-1.amazonaws.com
157.133.170.72
2606:4700::6811:1f01
2606:4700::6811:68b7
34.209.80.95
52.219.169.166
106db0a9d1d36d994b91ad4f94fd0f16bdea9baa2ce894e7767c6e36d4abfbd2
7d4853c26492fba7f72bbe4378978d93aef4eab7b2fd2a817db4ea2814c211f9
a26bd82ba4d0362f90fe0096cff40672fd0df2fe689e11e6597524db672dba5e
bbd792a6fcd8417bce3a2cff35bc1754aa2171687748c060d8bf3a64aa95fac4
bd0a21a99afbf031b7cdc86e6eb3e8cca841f96d46a1285387572205c4d15f46
c7fe5bf674d128658141e1ca7723bf036160dd80a00ec2af33a73cf2d90df180
ca35f778de98ca1544de7e5d943cdf05cd678be271741d78b5ef06d4da76bbb9
d7945e6c39510c2bcd91a6007e0cb0af1defef4cd177e710483ad7de54029f97
fac7f738c8e50fc17ea3c1b47d5701d4138eec5a31f5e4a4e67d9dc73a392277
fc2dae44d4617819d75f2a433ae989e8865cce116f675b906a274d168416832f