URL: https://sts.usgpeoplehosting.com/adfs/ls/?SAMLRequest=pZJPbxshEMW%2Fyor7LnjXcb3ItuTGqmopba3Y7SGXCMNsjMS%2FMpAm3754napppebSE2KY9%2...
Submission Tags: @phishunt_io
Submission: On March 30 via api from DE — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 193.111.13.69, located in Belgium and belongs to ESOLUTIONS-AS, BE. The main domain is sts.usgpeoplehosting.com.
TLS certificate: Issued by GlobalSign GCC R3 DV TLS CA 2020 on December 7th 2021. Valid for: a year.
This is the only time sts.usgpeoplehosting.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
4 193.111.13.69 201984 (ESOLUTION...)
4 1
Apex Domain
Subdomains
Transfer
4 usgpeoplehosting.com
sts.usgpeoplehosting.com
2 MB
4 1
Domain Requested by
4 sts.usgpeoplehosting.com sts.usgpeoplehosting.com
4 1

This site contains links to these domains. Also see Links.

Domain
www.rgfstaffing.be
servicedesk.rgfstaffing.be
Subject Issuer Validity Valid
*.usgpeoplehosting.com
GlobalSign GCC R3 DV TLS CA 2020
2021-12-07 -
2023-01-08
a year crt.sh

This page contains 1 frames:

Primary Page: https://sts.usgpeoplehosting.com/adfs/ls/?SAMLRequest=pZJPbxshEMW%2Fyor7LnjXcb3ItuTGqmopba3Y7SGXCMNsjMS%2FMpAm3754napppebSE2KY9%2BbHgwUKawJf53Ryt%2FA9A6bqyRqHfDxYkhwd9wI1cicsIE%2BS79efbnjbMB6iT156Q15J3lYIRIhJe0eq7WZJ7mf9MOuu4Hgc1IRNurloWzYfVCflu6t%2B2qmu70D1bDYHUn2DiEW5JMWoyBEzbB0m4VIpsbatWVd37MCmfNpzNrsj1abcRjuRRtUppYCcUkzYZHwI4IOBkz93PDTSWyrUgNQgJdX6F%2BW1d5gtxD3ERy3h6%2B3Nbx8Fj7UIwTw38BQiIFpQWgrTHIGitsX8HAe1XmUDTTgFOu7xsra1kDhWC0ut3WD8D1LtXgJ9r50qWG9nebw0If94OOzq3Zf9gawWZ28%2BZhNX%2F09qIQklkvgLdEFfj1lcvtDnArjd7LzR8rn64KMV6d%2F8k2YyVrSqh7GVZ4cBpB40qPIApky5jiASLEmKGQhdXYb%2B%2BVVXPwE%3D&RelayState=https%3A%2F%2Fdev-apply.expressmedical.be%2Fnl%2Fadfs%3Froute%3D&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=K1qOpSaGF2pzvpSfSxlba8Ofp8c3sSv6NVYt5EBfa92HxkVJYl4BrTWPajLq5oDFvGr8YMlQ1XRw5ZV97iLTqhmy3%2FkR2KJhJADgvduT3UDOSJAyHaZYFfKJXTz0BEB1tpDGhHlnBuk2fU9kXdLyJstNwMZgf5kLS4sobfu36avVqAcXup%2Fop7kyzZZimMn%2Fv70xZ7VPiK4LLocOncLnLb2DSqKBkCJrN30fMgw1XcO0ajyJYVRJAdg1D0tD%2BuM3mbO3v3wgRBQstbZAunpypAZtjSC1CRqlwkxwdKB3aPoRGE2WTI7PSWHBgKQqcrFHItfPrq43mBGekB4zk4adFQ%3D%3D
Frame ID: 106F5ADE7DDF711F23C3E713ED773782
Requests: 4 HTTP requests in this frame

Screenshot

Page Title

Fehler

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

2069 kB
Transfer

2063 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
sts.usgpeoplehosting.com/adfs/ls/
10 KB
10 KB
Document
General
Full URL
https://sts.usgpeoplehosting.com/adfs/ls/?SAMLRequest=pZJPbxshEMW%2Fyor7LnjXcb3ItuTGqmopba3Y7SGXCMNsjMS%2FMpAm3754napppebSE2KY9%2BbHgwUKawJf53Ryt%2FA9A6bqyRqHfDxYkhwd9wI1cicsIE%2BS79efbnjbMB6iT156Q15J3lYIRIhJe0eq7WZJ7mf9MOuu4Hgc1IRNurloWzYfVCflu6t%2B2qmu70D1bDYHUn2DiEW5JMWoyBEzbB0m4VIpsbatWVd37MCmfNpzNrsj1abcRjuRRtUppYCcUkzYZHwI4IOBkz93PDTSWyrUgNQgJdX6F%2BW1d5gtxD3ERy3h6%2B3Nbx8Fj7UIwTw38BQiIFpQWgrTHIGitsX8HAe1XmUDTTgFOu7xsra1kDhWC0ut3WD8D1LtXgJ9r50qWG9nebw0If94OOzq3Zf9gawWZ28%2BZhNX%2F09qIQklkvgLdEFfj1lcvtDnArjd7LzR8rn64KMV6d%2F8k2YyVrSqh7GVZ4cBpB40qPIApky5jiASLEmKGQhdXYb%2B%2BVVXPwE%3D&RelayState=https%3A%2F%2Fdev-apply.expressmedical.be%2Fnl%2Fadfs%3Froute%3D&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=K1qOpSaGF2pzvpSfSxlba8Ofp8c3sSv6NVYt5EBfa92HxkVJYl4BrTWPajLq5oDFvGr8YMlQ1XRw5ZV97iLTqhmy3%2FkR2KJhJADgvduT3UDOSJAyHaZYFfKJXTz0BEB1tpDGhHlnBuk2fU9kXdLyJstNwMZgf5kLS4sobfu36avVqAcXup%2Fop7kyzZZimMn%2Fv70xZ7VPiK4LLocOncLnLb2DSqKBkCJrN30fMgw1XcO0ajyJYVRJAdg1D0tD%2BuM3mbO3v3wgRBQstbZAunpypAZtjSC1CRqlwkxwdKB3aPoRGE2WTI7PSWHBgKQqcrFHItfPrq43mBGekB4zk4adFQ%3D%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.111.13.69 , Belgium, ASN201984 (ESOLUTIONS-AS, BE),
Reverse DNS
Software
Microsoft-HTTPAPI/2.0 /
Resource Hash
240ed9890dbcd486e9b8e0097524637f8d6d008c2fa4d6196e51f9c03a501880
Security Headers
Name Value
X-Frame-Options DENY

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

cache-control
no-cache,no-store
pragma
no-cache
content-length
9819
content-type
text/html; charset=utf-8
expires
-1
server
Microsoft-HTTPAPI/2.0
x-frame-options
DENY
x-ms-forwarded-status-code
500
date
Wed, 30 Mar 2022 04:49:07 GMT
style.css
sts.usgpeoplehosting.com/adfs/portal/css/
8 KB
8 KB
Stylesheet
General
Full URL
https://sts.usgpeoplehosting.com/adfs/portal/css/style.css?id=D74D4D6943F32AE6F7F11D14D601DBB0E1A58919176EE512150366B6279AAF99
Requested by
Host: sts.usgpeoplehosting.com
URL: https://sts.usgpeoplehosting.com/adfs/ls/?SAMLRequest=pZJPbxshEMW%2Fyor7LnjXcb3ItuTGqmopba3Y7SGXCMNsjMS%2FMpAm3754napppebSE2KY9%2BbHgwUKawJf53Ryt%2FA9A6bqyRqHfDxYkhwd9wI1cicsIE%2BS79efbnjbMB6iT156Q15J3lYIRIhJe0eq7WZJ7mf9MOuu4Hgc1IRNurloWzYfVCflu6t%2B2qmu70D1bDYHUn2DiEW5JMWoyBEzbB0m4VIpsbatWVd37MCmfNpzNrsj1abcRjuRRtUppYCcUkzYZHwI4IOBkz93PDTSWyrUgNQgJdX6F%2BW1d5gtxD3ERy3h6%2B3Nbx8Fj7UIwTw38BQiIFpQWgrTHIGitsX8HAe1XmUDTTgFOu7xsra1kDhWC0ut3WD8D1LtXgJ9r50qWG9nebw0If94OOzq3Zf9gawWZ28%2BZhNX%2F09qIQklkvgLdEFfj1lcvtDnArjd7LzR8rn64KMV6d%2F8k2YyVrSqh7GVZ4cBpB40qPIApky5jiASLEmKGQhdXYb%2B%2BVVXPwE%3D&RelayState=https%3A%2F%2Fdev-apply.expressmedical.be%2Fnl%2Fadfs%3Froute%3D&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=K1qOpSaGF2pzvpSfSxlba8Ofp8c3sSv6NVYt5EBfa92HxkVJYl4BrTWPajLq5oDFvGr8YMlQ1XRw5ZV97iLTqhmy3%2FkR2KJhJADgvduT3UDOSJAyHaZYFfKJXTz0BEB1tpDGhHlnBuk2fU9kXdLyJstNwMZgf5kLS4sobfu36avVqAcXup%2Fop7kyzZZimMn%2Fv70xZ7VPiK4LLocOncLnLb2DSqKBkCJrN30fMgw1XcO0ajyJYVRJAdg1D0tD%2BuM3mbO3v3wgRBQstbZAunpypAZtjSC1CRqlwkxwdKB3aPoRGE2WTI7PSWHBgKQqcrFHItfPrq43mBGekB4zk4adFQ%3D%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.111.13.69 , Belgium, ASN201984 (ESOLUTIONS-AS, BE),
Reverse DNS
Software
Microsoft-HTTPAPI/2.0 /
Resource Hash
d74d4d6943f32ae6f7f11d14d601dbb0e1a58919176ee512150366b6279aaf99

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://sts.usgpeoplehosting.com/adfs/ls/?SAMLRequest=pZJPbxshEMW%2Fyor7LnjXcb3ItuTGqmopba3Y7SGXCMNsjMS%2FMpAm3754napppebSE2KY9%2BbHgwUKawJf53Ryt%2FA9A6bqyRqHfDxYkhwd9wI1cicsIE%2BS79efbnjbMB6iT156Q15J3lYIRIhJe0eq7WZJ7mf9MOuu4Hgc1IRNurloWzYfVCflu6t%2B2qmu70D1bDYHUn2DiEW5JMWoyBEzbB0m4VIpsbatWVd37MCmfNpzNrsj1abcRjuRRtUppYCcUkzYZHwI4IOBkz93PDTSWyrUgNQgJdX6F%2BW1d5gtxD3ERy3h6%2B3Nbx8Fj7UIwTw38BQiIFpQWgrTHIGitsX8HAe1XmUDTTgFOu7xsra1kDhWC0ut3WD8D1LtXgJ9r50qWG9nebw0If94OOzq3Zf9gawWZ28%2BZhNX%2F09qIQklkvgLdEFfj1lcvtDnArjd7LzR8rn64KMV6d%2F8k2YyVrSqh7GVZ4cBpB40qPIApky5jiASLEmKGQhdXYb%2B%2BVVXPwE%3D&RelayState=https%3A%2F%2Fdev-apply.expressmedical.be%2Fnl%2Fadfs%3Froute%3D&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=K1qOpSaGF2pzvpSfSxlba8Ofp8c3sSv6NVYt5EBfa92HxkVJYl4BrTWPajLq5oDFvGr8YMlQ1XRw5ZV97iLTqhmy3%2FkR2KJhJADgvduT3UDOSJAyHaZYFfKJXTz0BEB1tpDGhHlnBuk2fU9kXdLyJstNwMZgf5kLS4sobfu36avVqAcXup%2Fop7kyzZZimMn%2Fv70xZ7VPiK4LLocOncLnLb2DSqKBkCJrN30fMgw1XcO0ajyJYVRJAdg1D0tD%2BuM3mbO3v3wgRBQstbZAunpypAZtjSC1CRqlwkxwdKB3aPoRGE2WTI7PSWHBgKQqcrFHItfPrq43mBGekB4zk4adFQ%3D%3D
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Wed, 30 Mar 2022 04:49:07 GMT
expires
Fri, 29 Apr 2022 04:49:07 GMT
server
Microsoft-HTTPAPI/2.0
etag
D74D4D6943F32AE6F7F11D14D601DBB0E1A58919176EE512150366B6279AAF99
content-length
7812
content-type
text/css
logo.png
sts.usgpeoplehosting.com/adfs/portal/logo/
10 KB
10 KB
Image
General
Full URL
https://sts.usgpeoplehosting.com/adfs/portal/logo/logo.png?id=C51624B1AD05BDAC425C132C01FE528BA40482B4798F0A042A0E6A418814451B
Requested by
Host: sts.usgpeoplehosting.com
URL: https://sts.usgpeoplehosting.com/adfs/ls/?SAMLRequest=pZJPbxshEMW%2Fyor7LnjXcb3ItuTGqmopba3Y7SGXCMNsjMS%2FMpAm3754napppebSE2KY9%2BbHgwUKawJf53Ryt%2FA9A6bqyRqHfDxYkhwd9wI1cicsIE%2BS79efbnjbMB6iT156Q15J3lYIRIhJe0eq7WZJ7mf9MOuu4Hgc1IRNurloWzYfVCflu6t%2B2qmu70D1bDYHUn2DiEW5JMWoyBEzbB0m4VIpsbatWVd37MCmfNpzNrsj1abcRjuRRtUppYCcUkzYZHwI4IOBkz93PDTSWyrUgNQgJdX6F%2BW1d5gtxD3ERy3h6%2B3Nbx8Fj7UIwTw38BQiIFpQWgrTHIGitsX8HAe1XmUDTTgFOu7xsra1kDhWC0ut3WD8D1LtXgJ9r50qWG9nebw0If94OOzq3Zf9gawWZ28%2BZhNX%2F09qIQklkvgLdEFfj1lcvtDnArjd7LzR8rn64KMV6d%2F8k2YyVrSqh7GVZ4cBpB40qPIApky5jiASLEmKGQhdXYb%2B%2BVVXPwE%3D&RelayState=https%3A%2F%2Fdev-apply.expressmedical.be%2Fnl%2Fadfs%3Froute%3D&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=K1qOpSaGF2pzvpSfSxlba8Ofp8c3sSv6NVYt5EBfa92HxkVJYl4BrTWPajLq5oDFvGr8YMlQ1XRw5ZV97iLTqhmy3%2FkR2KJhJADgvduT3UDOSJAyHaZYFfKJXTz0BEB1tpDGhHlnBuk2fU9kXdLyJstNwMZgf5kLS4sobfu36avVqAcXup%2Fop7kyzZZimMn%2Fv70xZ7VPiK4LLocOncLnLb2DSqKBkCJrN30fMgw1XcO0ajyJYVRJAdg1D0tD%2BuM3mbO3v3wgRBQstbZAunpypAZtjSC1CRqlwkxwdKB3aPoRGE2WTI7PSWHBgKQqcrFHItfPrq43mBGekB4zk4adFQ%3D%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.111.13.69 , Belgium, ASN201984 (ESOLUTIONS-AS, BE),
Reverse DNS
Software
Microsoft-HTTPAPI/2.0 /
Resource Hash
c51624b1ad05bdac425c132c01fe528ba40482b4798f0a042a0e6a418814451b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://sts.usgpeoplehosting.com/adfs/ls/?SAMLRequest=pZJPbxshEMW%2Fyor7LnjXcb3ItuTGqmopba3Y7SGXCMNsjMS%2FMpAm3754napppebSE2KY9%2BbHgwUKawJf53Ryt%2FA9A6bqyRqHfDxYkhwd9wI1cicsIE%2BS79efbnjbMB6iT156Q15J3lYIRIhJe0eq7WZJ7mf9MOuu4Hgc1IRNurloWzYfVCflu6t%2B2qmu70D1bDYHUn2DiEW5JMWoyBEzbB0m4VIpsbatWVd37MCmfNpzNrsj1abcRjuRRtUppYCcUkzYZHwI4IOBkz93PDTSWyrUgNQgJdX6F%2BW1d5gtxD3ERy3h6%2B3Nbx8Fj7UIwTw38BQiIFpQWgrTHIGitsX8HAe1XmUDTTgFOu7xsra1kDhWC0ut3WD8D1LtXgJ9r50qWG9nebw0If94OOzq3Zf9gawWZ28%2BZhNX%2F09qIQklkvgLdEFfj1lcvtDnArjd7LzR8rn64KMV6d%2F8k2YyVrSqh7GVZ4cBpB40qPIApky5jiASLEmKGQhdXYb%2B%2BVVXPwE%3D&RelayState=https%3A%2F%2Fdev-apply.expressmedical.be%2Fnl%2Fadfs%3Froute%3D&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=K1qOpSaGF2pzvpSfSxlba8Ofp8c3sSv6NVYt5EBfa92HxkVJYl4BrTWPajLq5oDFvGr8YMlQ1XRw5ZV97iLTqhmy3%2FkR2KJhJADgvduT3UDOSJAyHaZYFfKJXTz0BEB1tpDGhHlnBuk2fU9kXdLyJstNwMZgf5kLS4sobfu36avVqAcXup%2Fop7kyzZZimMn%2Fv70xZ7VPiK4LLocOncLnLb2DSqKBkCJrN30fMgw1XcO0ajyJYVRJAdg1D0tD%2BuM3mbO3v3wgRBQstbZAunpypAZtjSC1CRqlwkxwdKB3aPoRGE2WTI7PSWHBgKQqcrFHItfPrq43mBGekB4zk4adFQ%3D%3D
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Wed, 30 Mar 2022 04:49:07 GMT
expires
Fri, 29 Apr 2022 04:49:07 GMT
server
Microsoft-HTTPAPI/2.0
etag
C51624B1AD05BDAC425C132C01FE528BA40482B4798F0A042A0E6A418814451B
content-length
10096
content-type
image/png
illustration.jpg
sts.usgpeoplehosting.com/adfs/portal/illustration/
2 MB
2 MB
Image
General
Full URL
https://sts.usgpeoplehosting.com/adfs/portal/illustration/illustration.jpg?id=51832D2CC54B73ED1C20F5704D40643C19CE75E1479E529B8B4C5D35A939B1B4
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.111.13.69 , Belgium, ASN201984 (ESOLUTIONS-AS, BE),
Reverse DNS
Software
Microsoft-HTTPAPI/2.0 /
Resource Hash
51832d2cc54b73ed1c20f5704d40643c19ce75e1479e529b8b4c5d35a939b1b4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://sts.usgpeoplehosting.com/adfs/ls/?SAMLRequest=pZJPbxshEMW%2Fyor7LnjXcb3ItuTGqmopba3Y7SGXCMNsjMS%2FMpAm3754napppebSE2KY9%2BbHgwUKawJf53Ryt%2FA9A6bqyRqHfDxYkhwd9wI1cicsIE%2BS79efbnjbMB6iT156Q15J3lYIRIhJe0eq7WZJ7mf9MOuu4Hgc1IRNurloWzYfVCflu6t%2B2qmu70D1bDYHUn2DiEW5JMWoyBEzbB0m4VIpsbatWVd37MCmfNpzNrsj1abcRjuRRtUppYCcUkzYZHwI4IOBkz93PDTSWyrUgNQgJdX6F%2BW1d5gtxD3ERy3h6%2B3Nbx8Fj7UIwTw38BQiIFpQWgrTHIGitsX8HAe1XmUDTTgFOu7xsra1kDhWC0ut3WD8D1LtXgJ9r50qWG9nebw0If94OOzq3Zf9gawWZ28%2BZhNX%2F09qIQklkvgLdEFfj1lcvtDnArjd7LzR8rn64KMV6d%2F8k2YyVrSqh7GVZ4cBpB40qPIApky5jiASLEmKGQhdXYb%2B%2BVVXPwE%3D&RelayState=https%3A%2F%2Fdev-apply.expressmedical.be%2Fnl%2Fadfs%3Froute%3D&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=K1qOpSaGF2pzvpSfSxlba8Ofp8c3sSv6NVYt5EBfa92HxkVJYl4BrTWPajLq5oDFvGr8YMlQ1XRw5ZV97iLTqhmy3%2FkR2KJhJADgvduT3UDOSJAyHaZYFfKJXTz0BEB1tpDGhHlnBuk2fU9kXdLyJstNwMZgf5kLS4sobfu36avVqAcXup%2Fop7kyzZZimMn%2Fv70xZ7VPiK4LLocOncLnLb2DSqKBkCJrN30fMgw1XcO0ajyJYVRJAdg1D0tD%2BuM3mbO3v3wgRBQstbZAunpypAZtjSC1CRqlwkxwdKB3aPoRGE2WTI7PSWHBgKQqcrFHItfPrq43mBGekB4zk4adFQ%3D%3D
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Wed, 30 Mar 2022 04:49:07 GMT
expires
Fri, 29 Apr 2022 04:49:07 GMT
server
Microsoft-HTTPAPI/2.0
etag
51832D2CC54B73ED1C20F5704D40643C19CE75E1479E529B8B4C5D35A939B1B4
content-length
2084444
content-type
image/jpg

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| Errors function| ERR undefined| emails undefined| msViewportStyle undefined| viewport function| getStyle function| computeLoadIllustration

1 Cookies

Domain/Path Name / Value
sts.usgpeoplehosting.com/ Name: cookiesession1
Value: 678A8C3ATUV01234567898901234874E

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options DENY