fs.nreca.org Open in urlscan Pro
74.127.88.33  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://nreca.csod.com/samldefault.aspx?ReturnUrl=%252fDeepLink%252fProcessRedirect.aspx%253fmodule%253dtranscript Page URL
2. https://fs.nreca.org/adfs/ls/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	samldefault.aspx Show response nreca.csod.com/	3 KB 2 KB	732ms 672ms	Document text/html	23.5.99.92 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://nreca.csod.com/samldefault.aspx?ReturnUrl=%252fDeepLink%252fProcessRedirect.aspx%253fmodule%253dtranscript Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.5.99.92 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-5-99-92.deploy.static.akamaitechnologies.com Software / Resource Hash f3cbe9b91ba2a69ddffafe61bfd161d051dfca98111ea62f6f92eb1943584ff8 Request headers :method GET :authority nreca.csod.com :scheme https :path /samldefault.aspx?ReturnUrl=%252fDeepLink%252fProcessRedirect.aspx%253fmodule%253dtranscript pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 sec-fetch-user ?1 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 sec-fetch-site none sec-fetch-mode navigate accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Sec-Fetch-User ?1 Response headers status 200 content-type text/html; charset=utf-8 expires -1 server x-robots-tag noindex true_route /samldefault.aspx true_status Ok correlation_id 7ff19cc6-b8c2-4332-9618-8d2b565bc8f4 s-n ECWT3003 p3p CP="DSP NON CUR ADM HIS OTP OUR DEL NOR IND DEM UNI TAI STA NAV COM SAM PUR DEV PSA PSD" pics-label (pics-1.1 "http://www.icra.org/ratingsv02.html" comment "ICRAonline EN v2.0" l r (nz 1 vz 1 lz 1 oz 1 cz 1) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0)) vary Accept-Encoding content-encoding gzip date Tue, 21 Jan 2020 19:55:07 GMT content-length 1826 set-cookie ASP.NET_SessionId=hmgxlowuwv3qf4gh5cg1axxx; path=/; secure; HttpOnly cache-control no-cache pragma no-cache
POST H/1.1	200 OK	Primary Request Cookie set / Show response fs.nreca.org/adfs/ls/	15 KB 19 KB	890ms 224ms	Document text/html	74.127.88.33 NRECA
General Check archive.org Show headers Download Go to Full URL https://fs.nreca.org/adfs/ls/ Requested by Host: nreca.csod.com URL: https://nreca.csod.com/samldefault.aspx?ReturnUrl=%252fDeepLink%252fProcessRedirect.aspx%253fmodule%253dtranscript#_blank Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_GCM Server 74.127.88.33 Ashburn, United States, ASN14064 (NRECA, US), Reverse DNS webmail.nreca.org Software / Resource Hash 7ceb937aaa1f490ef4babfbd8c2d94a3cfdfe12a50904427944fa10306e3db43 Security Headers Name Value X-Frame-Options DENY Request headers Host fs.nreca.org Connection keep-alive Content-Length 2328 Pragma no-cache Cache-Control no-cache Origin https://nreca.csod.com Upgrade-Insecure-Requests 1 Content-Type application/x-www-form-urlencoded User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer https://nreca.csod.com/samldefault.aspx?ReturnUrl=%252fDeepLink%252fProcessRedirect.aspx%253fmodule%253dtranscript Accept-Encoding gzip, deflate, br Origin https://nreca.csod.com Upgrade-Insecure-Requests 1 Content-Type application/x-www-form-urlencoded User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Referer https://nreca.csod.com/samldefault.aspx?ReturnUrl=%252fDeepLink%252fProcessRedirect.aspx%253fmodule%253dtranscript Response headers Cache-Control no-cache,no-store Pragma no-cache Content-Length 15232 Content-Type text/html; charset=utf-8 Expires -1 x-frame-options DENY P3P CP="ADFS doesn't have P3P policy, please contact your site's admin for more details." Set-Cookie MSISSamlRequest=QmFzZVVybD1odHRwcyUzYSUyZiUyZmZzLm5yZWNhLm9yZyUzYTQ0MyUyZmFkZnMlMmZscyUyZlxTQU1MUmVxdWVzdD1QRDk0Yld3Z2RtVnljMmx2YmowaU1TNHdJaUJsYm1OdlpHbHVaejBpZFhSbUxUZ2lQejQ4UVhWMGFHNVNaWEYxWlhOMElIaHRiRzV6T25oelpEMGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TVM5WVRVeFRZMmhsYldFaUlIaHRiRzV6T25oemFUMGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TVM5WVRVeFRZMmhsYldFdGFXNXpkR0Z1WTJVaUlFbEVQU0pmTjJSaFlUbGtNVFV0TkRkaE1DMDBORGN5TFdJMFpEQXRNalF3TWpKaFlqWXdZakUxSWlCV1pYSnphVzl1UFNJeUxqQWlJRWx6YzNWbFNXNXpkR0Z1ZEQwaU1qQXlNQzB3TVMweU1WUXhPVG8xTlRvd055NHhOREV4TURZM1dpSWdSR1Z6ZEdsdVlYUnBiMjQ5SW1oMGRIQnpPaTh2Wm5NdWJuSmxZMkV1YjNKbkwyRmtabk12YkhNdklpQlFjbTkwYjJOdmJFSnBibVJwYm1jOUluVnlianB2WVhOcGN6cHVZVzFsY3pwMFl6cFRRVTFNT2pJdU1EcGlhVzVrYVc1bmN6cElWRlJRTFZCUFUxUWlJRUZ6YzJWeWRHbHZia052Ym5OMWJXVnlVMlZ5ZG1salpWVlNURDBpYUhSMGNITTZMeTl1Y21WallTNWpjMjlrTG1OdmJTOXpZVzFzWkdWbVlYVnNkQzVoYzNCNElpQjRiV3h1Y3owaWRYSnVPbTloYzJsek9tNWhiV1Z6T25Sak9sTkJUVXc2TWk0d09uQnliM1J2WTI5c0lqNDhTWE56ZFdWeUlIaHRiRzV6UFNKMWNtNDZiMkZ6YVhNNmJtRnRaWE02ZEdNNlUwRk5URG95TGpBNllYTnpaWEowYVc5dUlqNW9kSFJ3Y3pvdkwyNXlaV05oTG1OemIyUXVZMjl0UEM5SmMzTjFaWEklMmJQRk5wWjI1aGRIVnlaU0I0Yld4dWN6MGlhSFIwY0RvdkwzZDNkeTUzTXk1dmNtY3ZNakF3TUM4d09TOTRiV3hrYzJsbkl5SSUyYlBGTnBaMjVsWkVsdVptOCUyYlBFTmhibTl1YVdOaGJHbDZZWFJwYjI1TlpYUm9iMlFnUVd4bmIzSnBkR2h0UFNKb2RIUndPaTh2ZDNkM0xuY3pMbTl5Wnk4eU1EQXhMekV3TDNodGJDMWxlR010WXpFMGJpTWlJQzglMmJQRk5wWjI1aGRIVnlaVTFsZEdodlpDQkJiR2R2Y21sMGFHMDlJbWgwZEhBNkx5OTNkM2N1ZHpNdWIzSm5Mekl3TURFdk1EUXZlRzFzWkhOcFp5MXRiM0psSTNKellTMXphR0V5TlRZaUlDOCUyYlBGSmxabVZ5Wlc1alpTQlZVa2s5SWlOZk4yUmhZVGxrTVRVdE5EZGhNQzAwTkRjeUxXSTBaREF0TWpRd01qSmhZall3WWpFMUlqNDhWSEpoYm5ObWIzSnRjejQ4VkhKaGJuTm1iM0p0SUVGc1oyOXlhWFJvYlQwaWFIUjBjRG92TDNkM2R5NTNNeTV2Y21jdk1qQXdNQzh3T1M5NGJXeGtjMmxuSTJWdWRtVnNiM0JsWkMxemFXZHVZWFIxY21VaUlDOCUyYlBGUnlZVzV6Wm05eWJTQkJiR2R2Y21sMGFHMDlJbWgwZEhBNkx5OTNkM2N1ZHpNdWIzSm5Mekl3TURFdk1UQXZlRzFzTFdWNFl5MWpNVFJ1SXlJZ0x6NDhMMVJ5WVc1elptOXliWE0lMmJQRVJwWjJWemRFMWxkR2h2WkNCQmJHZHZjbWwwYUcwOUltaDBkSEE2THk5M2QzY3Vkek11YjNKbkx6SXdNREV2TURRdmVH; path=/adfs; HttpOnly; Secure; SameSite=None MSISSamlRequest1=MXNaVzVqSTNOb1lUSTFOaUlnTHo0OFJHbG5aWE4wVm1Gc2RXVSUyYmREUjRNRE0xTDBvMU9WVnRTSG95ZDFwcFRYTXllVGxEWkhoVlIwMXdRMU52VUdGSE5rcDNkRU5EYnowOEwwUnBaMlZ6ZEZaaGJIVmxQand2VW1WbVpYSmxibU5sUGp3dlUybG5ibVZrU1c1bWJ6NDhVMmxuYm1GMGRYSmxWbUZzZFdVJTJiVTB0bk9FSjRkbEZOY3pJcmVYcFJjbE01VEZvM1UxSXJURFpLTVVOcGRHWmFkbTFHWW1SSWJWaGtTeTlLZFVrclRrNHZkblpzZFVvelVDdFpNV2RxVlZwb05VSkhXVWhIYlRWWmJTOUdaemxUSzFsWFFVRlRia1pLTmxZMk1IQlJNVlJ4U3pGaWFXaFJMMFUwWXl0aGMweHFkVVptZWpCWFUyOU5NMlZJTW5SS01IUnhNakJuVDJSdlVVMHplRVJKTkdaclJtbENNMEp3TXpkclFUSkxPRUpWVG5aemIwSnNabTFTZWpWMVIwUjFhSFpUUlhod2J6bHhkRk4zVGxBeGQzWkpVM0Z5VWxsV1JqTnVaR0psYVhCMVJtTjFaWHBFWWxOWlVVMXJjVVJNVEZOQmJUZ3hMMkZKVjJGSVNHRnNTR0pZVFVwUWIxUlpibUYxTURaT1ZWcEZLMjh6VTBrNVVtTlBjRXhwTVdaNlYxWlJla1pIT0ZKQlJFbGpZbk5MYUN0V1pHRktaa1ZaTUhkTk1WcHRkVVpSYTIxSlVraERhVTFQVDBaSlJtcG9lblEwTVhwbWFsbFNVRTFCWlZJdmFFTXpVbVIzUFQwOEwxTnBaMjVoZEhWeVpWWmhiSFZsUGp3dlUybG5ibUYwZFhKbFBqeE9ZVzFsU1VSUWIyeHBZM2tnUm05eWJXRjBQU0oxY200NmIyRnphWE02Ym1GdFpYTTZkR002VTBGTlREb3hMakU2Ym1GdFpXbGtMV1p2Y20xaGREcDFibk53WldOcFptbGxaQ0lnTHo0OEwwRjFkR2h1VW1WeGRXVnpkRDQlM2RcUHJvdG9jb2xCaW5kaW5nPXVybiUzYW9hc2lzJTNhbmFtZXMlM2F0YyUzYVNBTUwlM2EyLjAlM2FiaW5kaW5ncyUzYUhUVFAtUE9TVFxSZWxheVN0YXRlPSUyNTI1MmZEZWVwTGluayUyNTI1MmZQcm9jZXNzUmVkaXJlY3QuYXNweCUyNTI1M2Ztb2R1bGUlMjUyNTNkdHJhbnNjcmlwdA==; path=/adfs; HttpOnly; Secure; SameSite=None Date Tue, 21 Jan 2020 19:55:08 GMT
GET H/1.1	200 OK	style.css fs.nreca.org/adfs/portal/css/	8 KB 8 KB	113ms 112ms	Stylesheet text/css	74.127.88.33 NRECA
General Check archive.org Show headers Download Go to Full URL https://fs.nreca.org/adfs/portal/css/style.css?id=D74D4D6943F32AE6F7F11D14D601DBB0E1A58919176EE512150366B6279AAF99 Requested by Host: fs.nreca.org URL: https://fs.nreca.org/adfs/ls/ Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_GCM Server 74.127.88.33 Ashburn, United States, ASN14064 (NRECA, US), Reverse DNS webmail.nreca.org Software / Resource Hash d74d4d6943f32ae6f7f11d14d601dbb0e1a58919176ee512150366b6279aaf99 Request headers Referer https://fs.nreca.org/adfs/ls/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers Date Tue, 21 Jan 2020 19:55:08 GMT Content-Type text/css ETag D74D4D6943F32AE6F7F11D14D601DBB0E1A58919176EE512150366B6279AAF99 Content-Length 7812 Expires Thu, 20 Feb 2020 19:55:08 GMT
GET H/1.1	200 OK	logo.gif fs.nreca.org/adfs/portal/logo/	5 KB 5 KB	226ms 112ms	Image image/gif	74.127.88.33 NRECA
General Check archive.org Show headers Download Go to Show image Full URL https://fs.nreca.org/adfs/portal/logo/logo.gif?id=E5EFF36A5AE441CA016ECCE7820DA935A04222B7CFAB3135704131E0E3829EEB Requested by Host: fs.nreca.org URL: https://fs.nreca.org/adfs/ls/ Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_GCM Server 74.127.88.33 Ashburn, United States, ASN14064 (NRECA, US), Reverse DNS webmail.nreca.org Software / Resource Hash e5eff36a5ae441ca016ecce7820da935a04222b7cfab3135704131e0e3829eeb Request headers Referer https://fs.nreca.org/adfs/ls/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers Date Tue, 21 Jan 2020 19:55:08 GMT Content-Type image/gif ETag E5EFF36A5AE441CA016ECCE7820DA935A04222B7CFAB3135704131E0E3829EEB Content-Length 5097 Expires Thu, 20 Feb 2020 19:55:08 GMT
GET H/1.1	200 OK	illustration.png fs.nreca.org/adfs/portal/illustration/	597 KB 597 KB	129ms 128ms	Image image/png	74.127.88.33 NRECA
General Check archive.org Show headers Download Go to Show image Full URL https://fs.nreca.org/adfs/portal/illustration/illustration.png?id=59A7FB4927077AC0E4FE49683ED1A6788FF996E6D658FE4079312237F512CA53 Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_GCM Server 74.127.88.33 Ashburn, United States, ASN14064 (NRECA, US), Reverse DNS webmail.nreca.org Software / Resource Hash 59a7fb4927077ac0e4fe49683ed1a6788ff996e6d658fe4079312237f512ca53 Request headers Referer https://fs.nreca.org/adfs/ls/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers Date Tue, 21 Jan 2020 19:55:08 GMT Content-Type image/png ETag 59A7FB4927077AC0E4FE49683ED1A6788FF996E6D658FE4079312237F512CA53 Content-Length 610937 Expires Thu, 20 Feb 2020 19:55:08 GMT

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fs.nreca.org
nreca.csod.com
23.5.99.92
74.127.88.33
59a7fb4927077ac0e4fe49683ed1a6788ff996e6d658fe4079312237f512ca53
7ceb937aaa1f490ef4babfbd8c2d94a3cfdfe12a50904427944fa10306e3db43
d74d4d6943f32ae6f7f11d14d601dbb0e1a58919176ee512150366b6279aaf99
e5eff36a5ae441ca016ecce7820da935a04222b7cfab3135704131e0e3829eeb
f3cbe9b91ba2a69ddffafe61bfd161d051dfca98111ea62f6f92eb1943584ff8