Submitted URL: https://na.test.mgss.customerservice.mazda.com/
Effective URL: https://portaltest.mazdausa.com/mnaofed/sps/idp_mgssoci_testokinfoctr/saml20/login
Submission: On April 20 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 2 HTTP transactions. The main IP is 204.44.186.89, located in United States and belongs to MNAO-ASN1, US. The main domain is portaltest.mazdausa.com.
TLS certificate: Issued by GeoTrust RSA CA 2018 on January 6th 2022. Valid for: a year.
This is the only time portaltest.mazdausa.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2 192.29.61.251 31898 (ORACLE-BM...)
1 204.44.186.89 27376 (MNAO-ASN1)
2 2
Apex Domain
Subdomains
Transfer
2 mazda.com
na.test.mgss.customerservice.mazda.com
4 KB
1 mazdausa.com
portaltest.mazdausa.com
3 KB
2 2
Domain Requested by
2 na.test.mgss.customerservice.mazda.com 1 redirects
1 portaltest.mazdausa.com
2 2

This site contains no links.

Subject Issuer Validity Valid
test.mgss.customerservice.mazda.com
DigiCert TLS RSA SHA256 2020 CA1
2021-11-16 -
2022-11-16
a year crt.sh
*.mazdausa.com
GeoTrust RSA CA 2018
2022-01-06 -
2023-02-06
a year crt.sh

This page contains 1 frames:

Primary Page: https://portaltest.mazdausa.com/mnaofed/sps/idp_mgssoci_testokinfoctr/saml20/login
Frame ID: 8B32451778DE12A0F6E9D1489D2E62F7
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

Access Manager for Web - Anmeldung

Page URL History Show full URLs

  1. https://na.test.mgss.customerservice.mazda.com/ HTTP 303
    https://na.test.mgss.customerservice.mazda.com/auth/login?ReturnTo=https%3A%2F%2Fna.test.mgss.customerservice.mazda.com%2F&... Page URL
  2. https://portaltest.mazdausa.com/mnaofed/sps/idp_mgssoci_testokinfoctr/saml20/login Page URL

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

6 kB
Transfer

7 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://na.test.mgss.customerservice.mazda.com/ HTTP 303
    https://na.test.mgss.customerservice.mazda.com/auth/login?ReturnTo=https%3A%2F%2Fna.test.mgss.customerservice.mazda.com%2F&IdP=https%3A%2F%2Fportaltest.mazdausa.com%2Fmnaofed%2Fsps%2Fidp_mgssoci_testokinfoctr%2Fsaml20 Page URL
  2. https://portaltest.mazdausa.com/mnaofed/sps/idp_mgssoci_testokinfoctr/saml20/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://na.test.mgss.customerservice.mazda.com/ HTTP 303
  • https://na.test.mgss.customerservice.mazda.com/auth/login?ReturnTo=https%3A%2F%2Fna.test.mgss.customerservice.mazda.com%2F&IdP=https%3A%2F%2Fportaltest.mazdausa.com%2Fmnaofed%2Fsps%2Fidp_mgssoci_testokinfoctr%2Fsaml20

2 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
login
na.test.mgss.customerservice.mazda.com/auth/
Redirect Chain
  • https://na.test.mgss.customerservice.mazda.com/
  • https://na.test.mgss.customerservice.mazda.com/auth/login?ReturnTo=https%3A%2F%2Fna.test.mgss.customerservice.mazda.com%2F&IdP=https%3A%2F%2Fportaltest.mazdausa.com%2Fmnaofed%2Fsps%2Fidp_mgssoci_te...
4 KB
3 KB
Document
General
Full URL
https://na.test.mgss.customerservice.mazda.com/auth/login?ReturnTo=https%3A%2F%2Fna.test.mgss.customerservice.mazda.com%2F&IdP=https%3A%2F%2Fportaltest.mazdausa.com%2Fmnaofed%2Fsps%2Fidp_mgssoci_testokinfoctr%2Fsaml20
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
192.29.61.251 Zurich, Switzerland, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
ZENEDGE /
Resource Hash
c83e5298f4d8665f7a3e8e36c06509b74a069baec623db18c6713cc1f20ca1fe

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-store no-cache, no-store, must-revalidate max-age=0
content-encoding
gzip
content-type
text/html
date
Wed, 20 Apr 2022 08:38:41 GMT
server
ZENEDGE
x-cache-status
MISS
x-cdn
Served-By-Zenedge
x-zen-fury
f5ed2c38740e9112666444deda4c52926c8986f6

Redirect headers

cache-control
private, max-age=0, must-revalidate
content-length
428
content-type
text/html; charset=iso-8859-1
date
Wed, 20 Apr 2022 08:38:40 GMT
location
https://na.test.mgss.customerservice.mazda.com/auth/login?ReturnTo=https%3A%2F%2Fna.test.mgss.customerservice.mazda.com%2F&IdP=https%3A%2F%2Fportaltest.mazdausa.com%2Fmnaofed%2Fsps%2Fidp_mgssoci_testokinfoctr%2Fsaml20
server
ZENEDGE
x-cache-status
MISS
x-cdn
Served-By-Zenedge
x-zen-fury
f5ed2c38740e9112666444deda4c52926c8986f6
Primary Request login
portaltest.mazdausa.com/mnaofed/sps/idp_mgssoci_testokinfoctr/saml20/
2 KB
3 KB
Document
General
Full URL
https://portaltest.mazdausa.com/mnaofed/sps/idp_mgssoci_testokinfoctr/saml20/login
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
204.44.186.89 , United States, ASN27376 (MNAO-ASN1, US),
Reverse DNS
ebsuatdim.mazdausa.com
Software
WebSEAL/10.0.3.1 /
Resource Hash
2258278cf797141886f56413396dc858e430cd49b90bd78dfd3b8c7d9352bafd
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://na.test.mgss.customerservice.mazda.com
Referer
https://na.test.mgss.customerservice.mazda.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-store
client-ip-v4
[+]X-Forwarded-For
content-length
2336
content-type
text/html
date
Wed, 20 Apr 2022 08:38:23 GMT
on_server
testwebseal1
p3p
CP="NON CUR OTPi OUR NOR UNI"
pragma
no-cache
server
WebSEAL/10.0.3.1
strict-transport-security
max-age=86400

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails string| warningString

5 Cookies

Domain/Path Name / Value
na.test.mgss.customerservice.mazda.com/ Name: track
Value: 7c01af3e.5dd11ebabd5ba
.na.test.mgss.customerservice.mazda.com/ Name: mellon-cookie
Value: cookietest
na.test.mgss.customerservice.mazda.com/ Name: __zjc6569
Value: 5185022494
.mazdausa.com/ Name: PD-S-SESSION-ID
Value: hYFcfR1dDb3hhaR35844PQ==:1_2_0_eTH8ZW2GBj+1wohACSYgU2uvschbWU+BrvvbAXnKD9YcAKcn|
portaltest.mazdausa.com/ Name: BIGipServerTam8_Test_443-X
Value: 1510014986.47873.0000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

na.test.mgss.customerservice.mazda.com
portaltest.mazdausa.com
192.29.61.251
204.44.186.89
2258278cf797141886f56413396dc858e430cd49b90bd78dfd3b8c7d9352bafd
c83e5298f4d8665f7a3e8e36c06509b74a069baec623db18c6713cc1f20ca1fe