urlscan.io logo urlscan.io
SecurityTrails logo

self-service-api.harley-davidson.com Open in urlscan Pro
157.248.109.12  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://self-service-api.harley-davidson.com/
Effective URL: https://self-service-api.harley-davidson.com/login
Submission: On August 20 via automatic, source certstream-suspicious
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 3 HTTP transactions. The main IP is 157.248.109.12, located in German Valley, United States and belongs to SENTRY, US. The main domain is self-service-api.harley-davidson.com.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on June 2nd 2021. Valid for: a year.
This is the only time self-service-api.harley-davidson.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2 157.248.109.12 26190 (SENTRY)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
3 3
Domain Requested by
2 self-service-api.harley-davidson.com 1 redirects
1 getbootstrap.com self-service-api.harley-davidson.com
1 maxcdn.bootstrapcdn.com self-service-api.harley-davidson.com
3 3

This site contains no links.

Subject Issuer Validity Valid
self-service-api.harley-davidson.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-06-02 -
2022-07-03		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-03-01 -
2022-02-28		 a year crt.sh

This page contains 1 frames:

Primary Page: https://self-service-api.harley-davidson.com/login
Frame ID: 05D0E1983E3DC0C54F1AE3FEB78585C7
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Please sign in

Page URL History Show full URLs

  1. https://self-service-api.harley-davidson.com/ HTTP 302
    https://self-service-api.harley-davidson.com/login Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Page Statistics

3
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

23 kB
Transfer

124 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://self-service-api.harley-davidson.com/ HTTP 302
    https://self-service-api.harley-davidson.com/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set login
self-service-api.harley-davidson.com/
Redirect Chain
  • https://self-service-api.harley-davidson.com/
  • https://self-service-api.harley-davidson.com/login
1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://self-service-api.harley-davidson.com/login
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
157.248.109.12 German Valley, United States, ASN26190 (SENTRY, US),
Reverse DNS
Software
/
Resource Hash
32e2c28535b6bcb4271fca68ca33fa031ff5d27e1a5019243a26d11ce84be590
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Host
self-service-api.harley-davidson.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
XSRF-TOKEN=15bfb998-9794-4af9-afe2-931ae4bf8711; SESSION=ODhhODNlOWYtN2QwNy00MTJkLWE2NGItOTQxOTAxZDYyZTk0; TS018732b0=01fb4e234c0ba5991e57ac83a70e2774d91dcadc05a9c74af37e930ae2afa53fb54d047660c1aa6b04fe404a3f58e2e6a1af62f311846aeaf0e5ca2f8699259af4653adfb9; TS01bfed90=01fb4e234c7589cc52cc63aa32130119194247f13ea9c74af37e930ae2afa53fb54d047660395331d3b342b0dbeb21a69c82f3d75469c64de8f0c6debce51d2b2441618076
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

X-Request-ID
952ed45e-7d46-4384-861e-2ff8f6d8322e
Vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Pragma
no-cache
Expires
0
Strict-Transport-Security
max-age=31536000 ; includeSubDomains
X-Frame-Options
SAMEORIGIN
Content-Type
text/html;charset=UTF-8
Content-Length
1403
Date
Fri, 20 Aug 2021 09:48:10 GMT
Keep-Alive
timeout=60
Connection
keep-alive
Set-Cookie
TS018732b0=01fb4e234c0ba5991e57ac83a70e2774d91dcadc05a9c74af37e930ae2afa53fb54d047660c1aa6b04fe404a3f58e2e6a1af62f311846aeaf0e5ca2f8699259af4653adfb9; Path=/; Secure; HTTPOnly TS018732b0_26=017b38af4c8dff989f5cd3cd5fee3121c4efe8c142b6e2679dc28bcf8d3c01e9883089e3e9455c43d12a5e4db3a1220f51a3d16f69090fd6c6c4ea4de961d639ef860460c3; Path=/; Secure; HTTPOnly

Redirect headers

X-Request-ID
5bd95214-3d24-4aad-9717-920b5d656e8b
Vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
Set-Cookie
XSRF-TOKEN=15bfb998-9794-4af9-afe2-931ae4bf8711; Domain=harley-davidson.com; Path=/; Secure SESSION=ODhhODNlOWYtN2QwNy00MTJkLWE2NGItOTQxOTAxZDYyZTk0; Path=/; Secure; HttpOnly; SameSite=Lax TS018732b0=01fb4e234c0ba5991e57ac83a70e2774d91dcadc05a9c74af37e930ae2afa53fb54d047660c1aa6b04fe404a3f58e2e6a1af62f311846aeaf0e5ca2f8699259af4653adfb9; Path=/; Secure; HTTPOnly TS01bfed90=01fb4e234c7589cc52cc63aa32130119194247f13ea9c74af37e930ae2afa53fb54d047660395331d3b342b0dbeb21a69c82f3d75469c64de8f0c6debce51d2b2441618076; path=/; domain=harley-davidson.com; HTTPonly; Secure
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Pragma
no-cache
Expires
0
Strict-Transport-Security
max-age=31536000 ; includeSubDomains
X-Frame-Options
SAMEORIGIN
Location
https://self-service-api.harley-davidson.com/login
Content-Length
0
Date
Fri, 20 Aug 2021 09:48:09 GMT
Keep-Alive
timeout=60
Connection
keep-alive
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.0.0-beta/css/ 		122 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-beta/css/bootstrap.min.css
Requested by
Host: self-service-api.harley-davidson.com
URL: https://self-service-api.harley-davidson.com/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9bf87f7140c085febf881462c536ee73cf9183670811342d3dc1fd0f7a762a0d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://self-service-api.harley-davidson.com
Referer
https://self-service-api.harley-davidson.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 20 Aug 2021 09:48:10 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
cdn-edgestorageid
723, 617, 617
access-control-allow-origin
*
cdn-cachedat
2021-07-24 10:52:16
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
timing-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:04 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
3a0b1e10669dec7bf2feaf3282c80d23
cf-ray
681ab4542f8ed70d-FRA
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
signin.css
getbootstrap.com/docs/4.0/examples/signin/ 		714 B
915 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://getbootstrap.com/docs/4.0/examples/signin/signin.css
Requested by
Host: self-service-api.harley-davidson.com
URL: https://self-service-api.harley-davidson.com/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3a64 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ee23128d92f35a156f8d196a69a19af756ebdd5eaed98d756b5267951e26cd18
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://self-service-api.harley-davidson.com
Referer
https://self-service-api.harley-davidson.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fastly-request-id
3c10a2db8617af955a65cb9c7ef8015bb165b5dc
date
Fri, 20 Aug 2021 09:48:10 GMT
via
1.1 varnish
x-content-type-options
nosniff
cf-cache-status
MISS
x-cache
HIT
x-cache-hits
1
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-served-by
cache-fra19120-FRA
last-modified
Wed, 04 Aug 2021 15:48:45 GMT
server
cloudflare
x-github-request-id
7844:3FF2:5F242E:63F6B9:611ED474
x-timer
S1629452890.306267,VS0,VE1
etag
W/"610ab6dd-2ca"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
max-age=14400
x-proxy-cache
HIT
cf-ray
681ab4544c9cd6dd-FRA
x-origin-cache
HIT
expires
Thu, 19 Aug 2021 22:07:53 GMT

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated

5 Cookies

Domain/Path Name / Value
self-service-api.harley-davidson.com/ Name: TS018732b0_26
Value: 017b38af4c8dff989f5cd3cd5fee3121c4efe8c142b6e2679dc28bcf8d3c01e9883089e3e9455c43d12a5e4db3a1220f51a3d16f69090fd6c6c4ea4de961d639ef860460c3
.harley-davidson.com/ Name: TS01bfed90
Value: 01fb4e234c7589cc52cc63aa32130119194247f13ea9c74af37e930ae2afa53fb54d047660395331d3b342b0dbeb21a69c82f3d75469c64de8f0c6debce51d2b2441618076
self-service-api.harley-davidson.com/ Name: TS018732b0
Value: 01fb4e234c0ba5991e57ac83a70e2774d91dcadc05a9c74af37e930ae2afa53fb54d047660c1aa6b04fe404a3f58e2e6a1af62f311846aeaf0e5ca2f8699259af4653adfb9
self-service-api.harley-davidson.com/ Name: SESSION
Value: ODhhODNlOWYtN2QwNy00MTJkLWE2NGItOTQxOTAxZDYyZTk0
.harley-davidson.com/ Name: XSRF-TOKEN
Value: 15bfb998-9794-4af9-afe2-931ae4bf8711

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block