sso.ou.edu
Open in
urlscan Pro
156.110.246.34
Public Scan
Effective URL: https://sso.ou.edu/idp/SSO.saml2?SAMLRequest=fZFBT4NAEIX%2FCtl7WaDElk0hwfZgk2qJoAcvBpZBNoFd3Fmk%2FffSYrVeep5v3nvzZo...
Submission Tags: phishing malicious Search All
Submission: On September 17 via api from US
Summary
TLS certificate: Issued by InCommon RSA Server CA on April 29th 2020. Valid for: 2 years.
This is the only time sso.ou.edu was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 3 | 40.90.247.53 40.90.247.53 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
6 | 156.110.246.34 156.110.246.34 | 16922 (OUHSC-EDU) (OUHSC-EDU) | |
1 | 2a00:1450:400... 2a00:1450:4001:802::200a | 15169 (GOOGLE) (GOOGLE) | |
3 | 2606:4700:10:... 2606:4700:10::6816:2d40 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2a00:1450:400... 2a00:1450:4001:81c::2003 | 15169 (GOOGLE) (GOOGLE) | |
12 | 4 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
itsupport.ou.edu |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
ou.edu
3 redirects
itsupport.ou.edu sso.ou.edu |
13 KB |
3 |
cymaticsecurity.com
sdk.cymaticsecurity.com |
184 KB |
2 |
gstatic.com
fonts.gstatic.com |
18 KB |
1 |
googleapis.com
fonts.googleapis.com |
892 B |
12 | 4 |
Domain | Requested by | |
---|---|---|
6 | sso.ou.edu |
sso.ou.edu
|
3 | sdk.cymaticsecurity.com |
sso.ou.edu
sdk.cymaticsecurity.com |
3 | itsupport.ou.edu | 3 redirects |
2 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
sso.ou.edu
|
12 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
accounts.ou.edu |
ouhsc.edu |
account.ou.edu |
needhelp.ou.edu |
Subject Issuer | Validity | Valid | |
---|---|---|---|
ou.edu InCommon RSA Server CA |
2020-04-29 - 2022-04-29 |
2 years | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-08-26 - 2020-11-18 |
3 months | crt.sh |
cymaticsecurity.com Cloudflare Inc ECC CA-3 |
2020-07-03 - 2021-07-03 |
a year | crt.sh |
*.gstatic.com GTS CA 1O1 |
2020-08-26 - 2020-11-18 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://sso.ou.edu/idp/SSO.saml2?SAMLRequest=fZFBT4NAEIX%2FCtl7WaDElk0hwfZgk2qJoAcvBpZBNoFd3Fmk%2FffSYrVeep5v3nvzZoV523Qs7k0tn%2BGzBzTWoW0ksvMgJL2WTOUokMm8BWSGszR%2B3DHPdlinlVFcNcSKEUEboeRaSexb0CnoL8Hh5XkXktqYDhmlwmDfdUobW%2FU2lD1Na1EUqgFT24iKnnQ9muzTjFibMYiQ%2BUnyT2CELqui7Gia7u1TSo9Y201I3t3FknM3qHgFlQO%2BX1Q%2BD6piCYE3X%2FjBfMQQe9hKNLk0IfEcz5k5wcxdZG7AXJfN796IlfwcdS9kKeTH7QaKCUL2kGXJbIr%2BChrPsUeARKtTQnY21lfN3pbNL3WS6HL7MAy2gbwtjyMuDjZXLcXf%2Flb0ymby7NjTqLvdJKoR%2FGjFTaOGtYbcQEhcQqNp5f%2Fro28%3D&RelayState=ss%3Amem%3Af3bb4c9313b39d89889373a91b53bd7afc775e21fbe10102a1ba872427da9837
Frame ID: 345C5180D583320096D6BE5E84FEE8AD
Requests: 12 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://itsupport.ou.edu/SBTDNext/Apps/31/Tickets/TicketTaskDet.aspx?TicketID=136&TaskID=PTfNrQ5VqKU_
HTTP 302
https://itsupport.ou.edu/SBTDNext/Login.aspx?ReturnUrl=%2fSBTDNext%2fApps%2f31%2fTickets%2fTicketTask... HTTP 302
https://itsupport.ou.edu/Shibboleth.sso/Login?entityID=sso.ou.edu&target=https%3a%2f%2fitsupport.ou.e... HTTP 302
https://sso.ou.edu/idp/SSO.saml2?SAMLRequest=fZFBT4NAEIX%2FCtl7WaDElk0hwfZgk2qJoAcvBpZBNoFd3Fmk... Page URL
Detected technologies
Windows Server (Operating Systems) ExpandDetected patterns
- url /\.aspx?(?:$|\?)/i
Microsoft ASP.NET (Web Frameworks) Expand
Detected patterns
- url /\.aspx?(?:$|\?)/i
IIS (Web Servers) Expand
Detected patterns
- url /\.aspx?(?:$|\?)/i
Google Font API (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: Norman Campus Forgot password?
Search URL Search Domain Scan URL
Title: OUHSC Campus Forgot password?
Search URL Search Domain Scan URL
Title: Forgot OUNetID?
Search URL Search Domain Scan URL
Title: needhelp.ou.edu
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://itsupport.ou.edu/SBTDNext/Apps/31/Tickets/TicketTaskDet.aspx?TicketID=136&TaskID=PTfNrQ5VqKU_
HTTP 302
https://itsupport.ou.edu/SBTDNext/Login.aspx?ReturnUrl=%2fSBTDNext%2fApps%2f31%2fTickets%2fTicketTaskDet.aspx%3fTicketID%3d136%26TaskID%3dPTfNrQ5VqKU_&TicketID=136&TaskID=PTfNrQ5VqKU_ HTTP 302
https://itsupport.ou.edu/Shibboleth.sso/Login?entityID=sso.ou.edu&target=https%3a%2f%2fitsupport.ou.edu%2fSBTDNext%2fLogin.aspx%3fReturnUrl%3d%252fSBTDNext%252fApps%252f31%252fTickets%252fTicketTaskDet.aspx%253fTicketID%253d136%2526TaskID%253dPTfNrQ5VqKU_%26TicketID%3d136%26TaskID%3dPTfNrQ5VqKU_ HTTP 302
https://sso.ou.edu/idp/SSO.saml2?SAMLRequest=fZFBT4NAEIX%2FCtl7WaDElk0hwfZgk2qJoAcvBpZBNoFd3Fmk%2FffSYrVeep5v3nvzZoV523Qs7k0tn%2BGzBzTWoW0ksvMgJL2WTOUokMm8BWSGszR%2B3DHPdlinlVFcNcSKEUEboeRaSexb0CnoL8Hh5XkXktqYDhmlwmDfdUobW%2FU2lD1Na1EUqgFT24iKnnQ9muzTjFibMYiQ%2BUnyT2CELqui7Gia7u1TSo9Y201I3t3FknM3qHgFlQO%2BX1Q%2BD6piCYE3X%2FjBfMQQe9hKNLk0IfEcz5k5wcxdZG7AXJfN796IlfwcdS9kKeTH7QaKCUL2kGXJbIr%2BChrPsUeARKtTQnY21lfN3pbNL3WS6HL7MAy2gbwtjyMuDjZXLcXf%2Flb0ymby7NjTqLvdJKoR%2FGjFTaOGtYbcQEhcQqNp5f%2Fro28%3D&RelayState=ss%3Amem%3Af3bb4c9313b39d89889373a91b53bd7afc775e21fbe10102a1ba872427da9837 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
SSO.saml2
sso.ou.edu/idp/ Redirect Chain
|
4 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
LogIn.css
sso.ou.edu/assets/css/ |
4 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.12.4.min.js
sso.ou.edu/assets/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.validate.min.js
sso.ou.edu/assets/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
log-in.min.js
sso.ou.edu/assets/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
10 KB 892 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sdk
sdk.cymaticsecurity.com/bcdfee40-d6f8-431b-a006-c6612581e884/79d56f09-6e14-47d5-ad66-6920c518ee79/ |
181 KB 182 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
sso.ou.edu/assets/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
settings
sdk.cymaticsecurity.com/bcdfee40-d6f8-431b-a006-c6612581e884/79d56f09-6e14-47d5-ad66-6920c518ee79/ |
2 KB 2 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v18/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.min.css
sdk.cymaticsecurity.com/sdk/ |
2 KB 757 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes object| CymaticXid2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
sso.ou.edu/ | Name: BIGipServerSSO.app~SSO_pool Value: 1082137098.18211.0000 |
|
sso.ou.edu/ | Name: PF Value: TnEppFEyrp5LYPprIADXG2GAs30m4CMyCaLJbQwURco8 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
itsupport.ou.edu
sdk.cymaticsecurity.com
sso.ou.edu
156.110.246.34
2606:4700:10::6816:2d40
2a00:1450:4001:802::200a
2a00:1450:4001:81c::2003
40.90.247.53
2bd0674e3ec19688a166b743b425a3d195c7d59251a612f2831cadfb96f1e90d
35901d308b760b474f8f7682022c55ef5ad97a8cf7cee503eefcb422023b705a
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
5e261f7e11c39ff6f4c8fe884e5c9de2fa15f29085a1adefdd36603ef2e23c00
790a5994bda572d1e7a4c443cfdb4288cca18daf0f88700732cb664c00a3bdc8
7c1ae0bee9100a521656f576ffc450d1653d4c7d897e8d556efa95cf365ac85f
b2a8d9dd230b818f569bfb7eda48bb50480ea3d4d0ee14a29f0d64a4027396f3
cea815d626d26003b5216eed5667393a7c6781840bf1ec4f4b0ed78732251134
fc7d5f88dea6f384a670b08c64dd179d3be1ef83e318150138c4258a87da45b8