duosec.login.duosecurity.com Open in urlscan Pro
76.223.17.190 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://duo.my.salesforce.com/setup/emailverif?oid=00D70000000Mjg8&k=Cj4KNQoPMDBENzAwMDAwMDBNamc4Eg8wMkcwZzAwMDAwMGdJbGsaDzAwN...
Effective URL:
https://duosec.login.duosecurity.com/email_first?authkey=AS2PRVUJCXJZ6SM5QV38&aid=b4a04ac75ade44669383401673722c05&req-trace-group=12...
Submission: On March 08 via manual (March 8th 2022, 10:11:21 pm UTC) from US — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 9 HTTP transactions. The main IP is 76.223.17.190, located in United States and belongs to AMAZON-02, US. The main domain is duosec.login.duosecurity.com.
TLS certificate: Issued by Amazon on December 1st 2021. Valid for: a year.

This is the only time duosec.login.duosecurity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	13.110.46.79 13.110.46.79	14340 (SALESFORCE) (SALESFORCE)
1 6	76.223.17.190 76.223.17.190	16509 (AMAZON-02) (AMAZON-02)
2	13.224.89.123 13.224.89.123	16509 (AMAZON-02) (AMAZON-02)
9	3

2 13.110.46.79 (United States)

ASN14340 (SALESFORCE, US)
PTR: dcl15-ncg1-c6-iad5.na147-ia5.my.salesforce.com

duo.my.salesforce.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 76.223.17.190 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: a404ea7289a1df014.awsglobalaccelerator.com

sso-791b28e9.sso.duosecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
duosec.login.duosecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.224.89.123 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-89-123.zrh50.r.cloudfront.net

ux-asset-commercial.duosecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	duosecurity.com 1 redirects sso-791b28e9.sso.duosecurity.com duosec.login.duosecurity.com ux-asset-commercial.duosecurity.com — Cisco Umbrella Rank: 237799	468 KB
2	salesforce.com duo.my.salesforce.com — Cisco Umbrella Rank: 349604	6 KB
9	2

	Domain	Requested by
5	duosec.login.duosecurity.com	duosec.login.duosecurity.com
2	ux-asset-commercial.duosecurity.com	duosec.login.duosecurity.com
2	duo.my.salesforce.com	duo.my.salesforce.com
1	sso-791b28e9.sso.duosecurity.com	1 redirects
9	4

This site contains no links.

Subject Issuer	Validity	Valid
*.my.salesforce.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-09` - `2022-07-08`	a year	crt.sh
*.login.duosecurity.com Amazon	`2021-12-01` - `2022-12-29`	a year	crt.sh
ux-asset-commercial.duosecurity.com Amazon	`2021-07-13` - `2022-08-11`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://duosec.login.duosecurity.com/email_first?authkey=AS2PRVUJCXJZ6SM5QV38&aid=b4a04ac75ade44669383401673722c05&req-trace-group=129bfb50bcce49ed8a87e894
Frame ID: 9AD9FE97E7F97320681C40B242F957B0
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login

Page URL History Show full URLs

https://duo.my.salesforce.com/setup/emailverif?oid=00D70000000Mjg8&k=Cj4KNQoPMDBENzAwMDAwMDBNamc4Eg8wMkcwZ... Page URL
https://duo.my.salesforce.com/saml/authn-request.jsp?saml_request_id=_2CAAAAX_7yDiQMDAwMDAwMDAwMDAwMDAwAAA... Page URL
https://sso-791b28e9.sso.duosecurity.com/saml2/sp/DIJUFKZVI8XNR18B2UP4/sso HTTP 302
https://duosec.login.duosecurity.com/email_first?authkey=AS2PRVUJCXJZ6SM5QV38&aid=b4a04ac75ade44669383401673722c0... Page URL

Detected technologies

Lodash (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

lodash.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

4
Subdomains

3
IPs

1
Countries

474 kB
Transfer

1125 kB
Size

9
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://duo.my.salesforce.com/setup/emailverif?oid=00D70000000Mjg8&k=Cj4KNQoPMDBENzAwMDAwMDBNamc4Eg8wMkcwZzAwMDAwMGdJbGsaDzAwNTR1MDAwMDA3VUdmTiAFGJG_s4X1LxIQ9QbxOZTkEy_D6KxMVbQBuBoM811gnHFGUFMpSJNkImwnjHnjiHy5s-Xn7zF7Dxjh1M-xaWG3co71Qc7ie-Yiguwj6XWjGzRX5mh9k8fKL8ghT7U0bXaBs8SFjX8DsyO6wJPSnCpM6QE4HpM0JfhwlI8y3N6VDZ2A0gnZS6h4XoeRKATgviTA7UURPHk%3D Page URL
https://duo.my.salesforce.com/saml/authn-request.jsp?saml_request_id=_2CAAAAX_7yDiQMDAwMDAwMDAwMDAwMDAwAAAA7BoLsB7LrfD5a5lqrTxbHSclu0BT7u8pBS8V6K3UWfzJ6bXD-6QZaneoxYMSTb8V873gNs5Uhck1NQz1qNXVnO7rZWQpBuiYE7SvCQ0q8y4yjEdHWPU2LSnRqPAKCkmAM-3AO_6gzuuuZCTYLlbhR_HZulPmvWh7flBb9eqhdi3aOufL9_Wlp4IvOi2NoX9_0yBMzX1PFAkNclutgCp8V8ysGs4jvyI226y1IfW3K0ReS4iKOUqwAFaUSSptCK1URA&saml_acs=https%3A%2F%2Fduo.my.salesforce.com%3Fso%3D00D70000000Mjg8&saml_binding_type=HttpPost&Issuer=https%3A%2F%2Fduo.my.salesforce.com&samlSsoConfig=0LE0g000000fxU7&RelayState=%2Fhome%2Fhome.jsp Page URL
https://sso-791b28e9.sso.duosecurity.com/saml2/sp/DIJUFKZVI8XNR18B2UP4/sso HTTP 302
https://duosec.login.duosecurity.com/email_first?authkey=AS2PRVUJCXJZ6SM5QV38&aid=b4a04ac75ade44669383401673722c05&req-trace-group=129bfb50bcce49ed8a87e894 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK emailverif
duo.my.salesforce.com/setup/ 2 KB
2 KB 681ms
114ms Document
text/html 13.110.46.79
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://duo.my.salesforce.com/setup/emailverif?oid=00D70000000Mjg8&k=Cj4KNQoPMDBENzAwMDAwMDBNamc4Eg8wMkcwZzAwMDAwMGdJbGsaDzAwNTR1MDAwMDA3VUdmTiAFGJG_s4X1LxIQ9QbxOZTkEy_D6KxMVbQBuBoM811gnHFGUFMpSJNkImwnjHnjiHy5s-Xn7zF7Dxjh1M-xaWG3co71Qc7ie-Yiguwj6XWjGzRX5mh9k8fKL8ghT7U0bXaBs8SFjX8DsyO6wJPSnCpM6QE4HpM0JfhwlI8y3N6VDZ2A0gnZS6h4XoeRKATgviTA7UURPHk%3D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.110.46.79 , United States, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl15-ncg1-c6-iad5.na147-ia5.my.salesforce.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Robots-Tag: none
Referrer-Policy: origin-when-cross-origin
Cache-Control: must-revalidate,no-cache,no-store
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Connection: close

GET
H/1.1 200
OK authn-request.jsp Show response
duo.my.salesforce.com/saml/ 7 KB
5 KB 328ms
142ms Document
text/html 13.110.46.79
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://duo.my.salesforce.com/saml/authn-request.jsp?saml_request_id=_2CAAAAX_7yDiQMDAwMDAwMDAwMDAwMDAwAAAA7BoLsB7LrfD5a5lqrTxbHSclu0BT7u8pBS8V6K3UWfzJ6bXD-6QZaneoxYMSTb8V873gNs5Uhck1NQz1qNXVnO7rZWQpBuiYE7SvCQ0q8y4yjEdHWPU2LSnRqPAKCkmAM-3AO_6gzuuuZCTYLlbhR_HZulPmvWh7flBb9eqhdi3aOufL9_Wlp4IvOi2NoX9_0yBMzX1PFAkNclutgCp8V8ysGs4jvyI226y1IfW3K0ReS4iKOUqwAFaUSSptCK1URA&saml_acs=https%3A%2F%2Fduo.my.salesforce.com%3Fso%3D00D70000000Mjg8&saml_binding_type=HttpPost&Issuer=https%3A%2F%2Fduo.my.salesforce.com&samlSsoConfig=0LE0g000000fxU7&RelayState=%2Fhome%2Fhome.jsp

Requested by

Host: duo.my.salesforce.com
URL: https://duo.my.salesforce.com/setup/emailverif?oid=00D70000000Mjg8&k=Cj4KNQoPMDBENzAwMDAwMDBNamc4Eg8wMkcwZzAwMDAwMGdJbGsaDzAwNTR1MDAwMDA3VUdmTiAFGJG_s4X1LxIQ9QbxOZTkEy_D6KxMVbQBuBoM811gnHFGUFMpSJNkImwnjHnjiHy5s-Xn7zF7Dxjh1M-xaWG3co71Qc7ie-Yiguwj6XWjGzRX5mh9k8fKL8ghT7U0bXaBs8SFjX8DsyO6wJPSnCpM6QE4HpM0JfhwlI8y3N6VDZ2A0gnZS6h4XoeRKATgviTA7UURPHk%3D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.110.46.79 , United States, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl15-ncg1-c6-iad5.na147-ia5.my.salesforce.com

Software

Resource Hash

05cdf0f24a2c270f195076afe75363fa59d7e2b035d620eb87b738067831bc65

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://duo.my.salesforce.com/setup/emailverif?oid=00D70000000Mjg8&k=Cj4KNQoPMDBENzAwMDAwMDBNamc4Eg8wMkcwZzAwMDAwMGdJbGsaDzAwNTR1MDAwMDA3VUdmTiAFGJG_s4X1LxIQ9QbxOZTkEy_D6KxMVbQBuBoM811gnHFGUFMpSJNkImwnjHnjiHy5s-Xn7zF7Dxjh1M-xaWG3co71Qc7ie-Yiguwj6XWjGzRX5mh9k8fKL8ghT7U0bXaBs8SFjX8DsyO6wJPSnCpM6QE4HpM0JfhwlI8y3N6VDZ2A0gnZS6h4XoeRKATgviTA7UURPHk%3D

Response headers

Date: Tue, 08 Mar 2022 22:11:17 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Robots-Tag: none
Referrer-Policy: origin-when-cross-origin
Cache-Control: no-cache,must-revalidate,max-age=0,no-store,private
Content-Type: text/html;charset=UTF-8
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding: gzip
Transfer-Encoding: chunked

GET
H2

200

Primary Request email_first Show response
duosec.login.duosecurity.com/
Redirect Chain

https://sso-791b28e9.sso.duosecurity.com/saml2/sp/DIJUFKZVI8XNR18B2UP4/sso
https://duosec.login.duosecurity.com/email_first?authkey=AS2PRVUJCXJZ6SM5QV38&aid=b4a04ac75ade44669383401673722c05&req-trace-group=129bfb50bcce49ed8a87e894

2 KB
3 KB

189ms
188ms

Document
text/html

76.223.17.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://duosec.login.duosecurity.com/email_first?authkey=AS2PRVUJCXJZ6SM5QV38&aid=b4a04ac75ade44669383401673722c05&req-trace-group=129bfb50bcce49ed8a87e894

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

76.223.17.190 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

a404ea7289a1df014.awsglobalaccelerator.com

Software

Duo/1.0 /

Resource Hash

226c6b21d311b34bcc961a24117c8a1b3c9fd1812f176413c441cd65bca2a96e

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'self' https://beta.pwl.login.duosecurity.com; script-src 'self' https://beta.pwl.login.duosecurity.com; font-src 'self'; frame-src 'self' com-duosecurity-devicehealth://*; frame-ancestors 'none'; img-src 'self' ux-asset-commercial.duosecurity.com https://beta.pwl.login.duosecurity.com; connect-src 'self' https://beta.pwl.login.duosecurity.com https://127.0.0.1:53100 https://127.0.0.1:53101 https://127.0.0.1:53102 https://127.0.0.1:53103 https://127.0.0.1:53104 https://127.0.0.1:53105 http://127.0.0.1:53106 http://127.0.0.1:53107 http://127.0.0.1:53108 http://127.0.0.1:53109 http://127.0.0.1:53110 http://127.0.0.1:53111 https://localhost:53100 https://localhost:53101 https://localhost:53102 https://localhost:53103 https://localhost:53104 https://localhost:53105
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
Origin: https://duo.my.salesforce.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://duo.my.salesforce.com/

Response headers

date: Tue, 08 Mar 2022 22:11:18 GMT
content-type: text/html; charset=UTF-8
server: Duo/1.0
x-duo-endpoint-health-appserver-url: https://127.0.0.1:53100 https://127.0.0.1:53101 https://127.0.0.1:53102 https://127.0.0.1:53103 https://127.0.0.1:53104 https://127.0.0.1:53105 http://127.0.0.1:53106 http://127.0.0.1:53107 http://127.0.0.1:53108 http://127.0.0.1:53109 http://127.0.0.1:53110 http://127.0.0.1:53111 https://localhost:53100 https://localhost:53101 https://localhost:53102 https://localhost:53103 https://localhost:53104 https://localhost:53105
x-duo-endpoint-health-uri: com-duosecurity-devicehealth://*
x-s3-assets: ux-asset-commercial.duosecurity.com
etag: W/"d016f57053eab8af263ca47e61a5b414c62835ad"
strict-transport-security: max-age=31536000
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-robots-tag: noindex, nofollow
content-security-policy: default-src 'none'; style-src 'self' https://beta.pwl.login.duosecurity.com; script-src 'self' https://beta.pwl.login.duosecurity.com; font-src 'self'; frame-src 'self' com-duosecurity-devicehealth://*; frame-ancestors 'none'; img-src 'self' ux-asset-commercial.duosecurity.com https://beta.pwl.login.duosecurity.com; connect-src 'self' https://beta.pwl.login.duosecurity.com https://127.0.0.1:53100 https://127.0.0.1:53101 https://127.0.0.1:53102 https://127.0.0.1:53103 https://127.0.0.1:53104 https://127.0.0.1:53105 http://127.0.0.1:53106 http://127.0.0.1:53107 http://127.0.0.1:53108 http://127.0.0.1:53109 http://127.0.0.1:53110 http://127.0.0.1:53111 https://localhost:53100 https://localhost:53101 https://localhost:53102 https://localhost:53103 https://localhost:53104 https://localhost:53105
content-encoding: gzip

Redirect headers

date: Tue, 08 Mar 2022 22:11:18 GMT
content-type: text/html; charset=UTF-8
content-length: 0
location: https://duosec.login.duosecurity.com/email_first?authkey=AS2PRVUJCXJZ6SM5QV38&aid=b4a04ac75ade44669383401673722c05&req-trace-group=129bfb50bcce49ed8a87e894
server: Duo/1.0
cache-control: no-cache, no-store, max-age=0, must-revalidate
expires: 0
pragma: no-cache
strict-transport-security: max-age=31536000
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-robots-tag: noindex, nofollow
content-security-policy: default-src 'none'; style-src 'self' https://beta.pwl.login.duosecurity.com; script-src 'self' https://beta.pwl.login.duosecurity.com; font-src 'self'; frame-src 'self' ; frame-ancestors 'none'; img-src 'self' https://beta.pwl.login.duosecurity.com; connect-src 'self' https://beta.pwl.login.duosecurity.com

GET
H2 200 email-first.css
duosec.login.duosecurity.com/static/css/page/ 71 KB
14 KB 163ms
162ms Stylesheet
text/css 76.223.17.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://duosec.login.duosecurity.com/static/css/page/email-first.css?v=83cbf

Requested by

Host: duosec.login.duosecurity.com
URL: https://duosec.login.duosecurity.com/email_first?authkey=AS2PRVUJCXJZ6SM5QV38&aid=b4a04ac75ade44669383401673722c05&req-trace-group=129bfb50bcce49ed8a87e894

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

76.223.17.190 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

a404ea7289a1df014.awsglobalaccelerator.com

Software

Duo/1.0 /

Resource Hash

83cbf4df3c54560adb16975ab36df38bf5a0bdb5b3789c7207bb3c78ff22d37f

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'self' https://beta.pwl.login.duosecurity.com; script-src 'self' https://beta.pwl.login.duosecurity.com; font-src 'self'; frame-src 'self' ; frame-ancestors 'none'; img-src 'self' https://beta.pwl.login.duosecurity.com; connect-src 'self' https://beta.pwl.login.duosecurity.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://duosec.login.duosecurity.com/email_first?authkey=AS2PRVUJCXJZ6SM5QV38&aid=b4a04ac75ade44669383401673722c05&req-trace-group=129bfb50bcce49ed8a87e894
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 08 Mar 2022 22:11:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 04 Mar 2022 18:51:28 GMT
server: Duo/1.0
etag: W/"62225fb0-11caf"
x-frame-options: DENY
content-type: text/css
cache-control: max-age=315360000
content-security-policy: default-src 'none'; style-src 'self' https://beta.pwl.login.duosecurity.com; script-src 'self' https://beta.pwl.login.duosecurity.com; font-src 'self'; frame-src 'self' ; frame-ancestors 'none'; img-src 'self' https://beta.pwl.login.duosecurity.com; connect-src 'self' https://beta.pwl.login.duosecurity.com
strict-transport-security: max-age=31536000
x-robots-tag: noindex, nofollow
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery-legacy.min.js Show response
duosec.login.duosecurity.com/static/shared/lib/jquery/ 144 KB
50 KB 159ms
158ms Script
application/javascript 76.223.17.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://duosec.login.duosecurity.com/static/shared/lib/jquery/jquery-legacy.min.js?v=72e7b

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

76.223.17.190 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

a404ea7289a1df014.awsglobalaccelerator.com

Software

Duo/1.0 /

Resource Hash

72e7b44ab6aaa3d7b3b572d710622f62afd4f13cc15e54fed26e0eb5c9418511

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'self' https://beta.pwl.login.duosecurity.com; script-src 'self' https://beta.pwl.login.duosecurity.com; font-src 'self'; frame-src 'self' ; frame-ancestors 'none'; img-src 'self' https://beta.pwl.login.duosecurity.com; connect-src 'self' https://beta.pwl.login.duosecurity.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://duosec.login.duosecurity.com/email_first?authkey=AS2PRVUJCXJZ6SM5QV38&aid=b4a04ac75ade44669383401673722c05&req-trace-group=129bfb50bcce49ed8a87e894
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 08 Mar 2022 22:11:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 04 Mar 2022 18:51:28 GMT
server: Duo/1.0
etag: W/"62225fb0-23fd1"
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=315360000
content-security-policy: default-src 'none'; style-src 'self' https://beta.pwl.login.duosecurity.com; script-src 'self' https://beta.pwl.login.duosecurity.com; font-src 'self'; frame-src 'self' ; frame-ancestors 'none'; img-src 'self' https://beta.pwl.login.duosecurity.com; connect-src 'self' https://beta.pwl.login.duosecurity.com
strict-transport-security: max-age=31536000
x-robots-tag: noindex, nofollow
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 lodash.min.js Show response
duosec.login.duosecurity.com/static/shared/lib/lodash/ 26 KB
11 KB 158ms
157ms Script
application/javascript 76.223.17.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://duosec.login.duosecurity.com/static/shared/lib/lodash/lodash.min.js?v=14516

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

76.223.17.190 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

a404ea7289a1df014.awsglobalaccelerator.com

Software

Duo/1.0 /

Resource Hash

14516091eb8d2c89f743086fc7e770b3de538eac779b0cd69a612483547208c1

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'self' https://beta.pwl.login.duosecurity.com; script-src 'self' https://beta.pwl.login.duosecurity.com; font-src 'self'; frame-src 'self' ; frame-ancestors 'none'; img-src 'self' https://beta.pwl.login.duosecurity.com; connect-src 'self' https://beta.pwl.login.duosecurity.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://duosec.login.duosecurity.com/email_first?authkey=AS2PRVUJCXJZ6SM5QV38&aid=b4a04ac75ade44669383401673722c05&req-trace-group=129bfb50bcce49ed8a87e894
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 08 Mar 2022 22:11:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 04 Mar 2022 18:51:28 GMT
server: Duo/1.0
etag: W/"62225fb0-68f6"
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=315360000
content-security-policy: default-src 'none'; style-src 'self' https://beta.pwl.login.duosecurity.com; script-src 'self' https://beta.pwl.login.duosecurity.com; font-src 'self'; frame-src 'self' ; frame-ancestors 'none'; img-src 'self' https://beta.pwl.login.duosecurity.com; connect-src 'self' https://beta.pwl.login.duosecurity.com
strict-transport-security: max-age=31536000
x-robots-tag: noindex, nofollow
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 email-first.js Show response
duosec.login.duosecurity.com/static/js/page/ 682 KB
198 KB 304ms
304ms Script
application/javascript 76.223.17.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://duosec.login.duosecurity.com/static/js/page/email-first.js?v=44386

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

76.223.17.190 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

a404ea7289a1df014.awsglobalaccelerator.com

Software

Duo/1.0 /

Resource Hash

4438689129adcb30830b134a730f55b3743f2480bdce5b17704d1d95d5793cae

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'self' https://beta.pwl.login.duosecurity.com; script-src 'self' https://beta.pwl.login.duosecurity.com; font-src 'self'; frame-src 'self' ; frame-ancestors 'none'; img-src 'self' https://beta.pwl.login.duosecurity.com; connect-src 'self' https://beta.pwl.login.duosecurity.com
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://duosec.login.duosecurity.com/email_first?authkey=AS2PRVUJCXJZ6SM5QV38&aid=b4a04ac75ade44669383401673722c05&req-trace-group=129bfb50bcce49ed8a87e894
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 08 Mar 2022 22:11:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 04 Mar 2022 18:51:28 GMT
server: Duo/1.0
etag: W/"62225fb0-aa9e2"
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=315360000
content-security-policy: default-src 'none'; style-src 'self' https://beta.pwl.login.duosecurity.com; script-src 'self' https://beta.pwl.login.duosecurity.com; font-src 'self'; frame-src 'self' ; frame-ancestors 'none'; img-src 'self' https://beta.pwl.login.duosecurity.com; connect-src 'self' https://beta.pwl.login.duosecurity.com
strict-transport-security: max-age=31536000
x-robots-tag: noindex, nofollow
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 logo_image.png
ux-asset-commercial.duosecurity.com/customization/account/SqpAKQsH8QaYgwQ30-1c7EZ7TO_T4cbPCytC-eJUe0o/ 5 KB
5 KB 60ms
17ms Image
image/png 13.224.89.123
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ux-asset-commercial.duosecurity.com/customization/account/SqpAKQsH8QaYgwQ30-1c7EZ7TO_T4cbPCytC-eJUe0o/logo_image.png?versionId=D5KWGPXiASyHWFPjOMXy1j.FX6Ljofox
Requested by: Host: duosec.login.duosecurity.com
URL: https://duosec.login.duosecurity.com/email_first?authkey=AS2PRVUJCXJZ6SM5QV38&aid=b4a04ac75ade44669383401673722c05&req-trace-group=129bfb50bcce49ed8a87e894
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.89.123 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-89-123.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5365b3ff10d5deced90e0efac63b7631455a389366dec42ffefe785f2eefe0d4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://duosec.login.duosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 08 Mar 2022 17:19:29 GMT
via: 1.1 8c175d0adc08dac3750e9201b76886e8.cloudfront.net (CloudFront)
age: 17510
x-cache: Hit from cloudfront
x-amz-meta-content-type: image/png
x-amz-replication-status: FAILED
content-length: 4973
accept-ranges: bytes
last-modified: Wed, 13 Oct 2021 18:29:58 GMT
server: AmazonS3
etag: "246714fe98a32abefc5b46fff94fdbfd"
x-amz-version-id: D5KWGPXiASyHWFPjOMXy1j.FX6Ljofox
x-amz-cf-pop: ZRH50-C1
x-amz-meta-content-length: 4973
content-type: image/png
x-amz-cf-id: azHFrFidA2O1mCv2zGfxgnOvqbz8PRfNrVQNZ_ycCeeuyuuKTWeJoQ==

GET
H2 200 background_image.png
ux-asset-commercial.duosecurity.com/customization/account/SqpAKQsH8QaYgwQ30-1c7EZ7TO_T4cbPCytC-eJUe0o/ 185 KB
185 KB 69ms
26ms Image
image/png 13.224.89.123
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ux-asset-commercial.duosecurity.com/customization/account/SqpAKQsH8QaYgwQ30-1c7EZ7TO_T4cbPCytC-eJUe0o/background_image.png?versionId=Duder7nJFP6W9.vlRyuhhXQMVTx4NNsq
Requested by: Host: duosec.login.duosecurity.com
URL: https://duosec.login.duosecurity.com/static/css/page/email-first.css?v=83cbf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.89.123 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-89-123.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6566a88fdf00059d878cb583a6fbf03e46f5955283111703b7d6037173d4ef4e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://duosec.login.duosecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id: Duder7nJFP6W9.vlRyuhhXQMVTx4NNsq
via: 1.1 8c175d0adc08dac3750e9201b76886e8.cloudfront.net (CloudFront)
etag: "761a304f44a9a9ae3429afdd1ad03291"
age: 50536
x-cache: Hit from cloudfront
x-amz-meta-content-type: image/png
x-amz-replication-status: FAILED
content-length: 189180
accept-ranges: bytes
last-modified: Wed, 13 Oct 2021 18:29:58 GMT
server: AmazonS3
date: Tue, 08 Mar 2022 08:09:03 GMT
content-type: image/png
x-amz-cf-pop: ZRH50-C1
x-amz-meta-content-length: 189180
x-amz-cf-id: erSlpkRXkxKv3eUb8Ly6NJvWj98cDUWLdfPMjNj7UEhLDC1_NRr_7g==

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

9 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
duo.my.salesforce.com/	1970-01-20 10:11:53	Name: CookieConsentPolicy Value: 0:1
duo.my.salesforce.com/	1970-01-20 10:11:53	Name: LSKey-c$CookieConsentPolicy Value: 0:1
.salesforce.com/	1970-01-20 10:11:53	Name: BrowserId Value: rQ9v1J8sEeyDgmEP7cQ_pg
.salesforce.com/	1970-01-20 10:11:53	Name: BrowserId_sec Value: rQ9v1J8sEeyDgmEP7cQ_pg
sso-791b28e9.sso.duosecurity.com/	1969-12-31 23:59:59	Name: sid Value: "N2IyOTFlNzVkMzFkNDRjM2EyNmQ5ZTE5MmEyYzA2NGI=\|217.138.194.163\|1646777478\|e0058e24703a0218cea8f0d61f69e0e0bf00debc"
sso-791b28e9.sso.duosecurity.com/	1969-12-31 23:59:59	Name: sid-init-608d6ba082d6410286b8b4957b936e8c Value: "N2IyOTFlNzVkMzFkNDRjM2EyNmQ5ZTE5MmEyYzA2NGI=\|217.138.194.163\|1646777478\|f17ed84f633a06452c4cd9746c4cd019b68b240d"
duosec.login.duosecurity.com/	1969-12-31 23:59:59	Name: sid Value: "YzdmZmYwOWVjZjIxNGQ2Yjk3NDZiZmQ1MTIzYjhhZDk=\|217.138.194.163\|1646777478\|3c7b9848bef43b513a031b13c218e51f97331b55"
duosec.login.duosecurity.com/	1969-12-31 23:59:59	Name: sid-init-c909cfd7c89b4c76a68793e899d0a797 Value: "YzdmZmYwOWVjZjIxNGQ2Yjk3NDZiZmQ1MTIzYjhhZDk=\|217.138.194.163\|1646777478\|474ab5c32ae833ae04ca0d4ff52aab3cb69aa591"
duosec.login.duosecurity.com/	1969-12-31 23:59:59	Name: _xsrf Value: "ZTY3Zjk3ZmE2ZDFkNGRjYThlYWQ5ZjkyNTQ4Nzg4MTA=\|217.138.194.163\|1646777478\|65852d3c1e0042325d896eab855e3adbcbdf7b65"

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

duo.my.salesforce.com
duosec.login.duosecurity.com
sso-791b28e9.sso.duosecurity.com
ux-asset-commercial.duosecurity.com
13.110.46.79
13.224.89.123
76.223.17.190
05cdf0f24a2c270f195076afe75363fa59d7e2b035d620eb87b738067831bc65
14516091eb8d2c89f743086fc7e770b3de538eac779b0cd69a612483547208c1
226c6b21d311b34bcc961a24117c8a1b3c9fd1812f176413c441cd65bca2a96e
4438689129adcb30830b134a730f55b3743f2480bdce5b17704d1d95d5793cae
5365b3ff10d5deced90e0efac63b7631455a389366dec42ffefe785f2eefe0d4
6566a88fdf00059d878cb583a6fbf03e46f5955283111703b7d6037173d4ef4e
72e7b44ab6aaa3d7b3b572d710622f62afd4f13cc15e54fed26e0eb5c9418511
83cbf4df3c54560adb16975ab36df38bf5a0bdb5b3789c7207bb3c78ff22d37f

duosec.login.duosecurity.com Open in urlscan Pro 76.223.17.190 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

2 Domains

4 Subdomains

3 IPs

1 Countries

474 kBTransfer

1125 kBSize

9 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

9 Cookies

Security Headers

Indicators

duosec.login.duosecurity.com Open in urlscan Pro
76.223.17.190 Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

4
Subdomains

3
IPs

1
Countries

474 kB
Transfer

1125 kB
Size

9
Cookies

9 HTTP transactions
0 data transactions