fedauth.colorado.edu
Open in
urlscan Pro
128.138.129.198
Public Scan
Effective URL: https://fedauth.colorado.edu/idp/profile/SAML2/POST/SSO?execution=e1s2
Submission Tags: opendir censys opendir_recursion Search All
Submission: On December 16 via api from FI — Scanned from FI
Summary
TLS certificate: Issued by Sectigo RSA Organization Validation S... on December 11th 2023. Valid for: a year.
This is the only time fedauth.colorado.edu was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 34.136.115.75 34.136.115.75 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
2 3 | 35.208.18.231 35.208.18.231 | 15169 (GOOGLE) (GOOGLE) | |
2 8 | 128.138.129.198 128.138.129.198 | 104 (COLORADO-AS) (COLORADO-AS) | |
1 | 142.250.184.202 142.250.184.202 | 15169 (GOOGLE) (GOOGLE) | |
2 | 142.250.184.227 142.250.184.227 | 15169 (GOOGLE) (GOOGLE) | |
11 | 5 |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 75.115.136.34.bc.googleusercontent.com
34.136.115.75 |
ASN15169 (GOOGLE, US)
PTR: 231.18.208.35.bc.googleusercontent.com
8706785.labs.csci3403.com | |
csci3403.com |
ASN104 (COLORADO-AS, US)
PTR: fedauth-comp.colorado.edu
fedauth.colorado.edu |
ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f10.1e100.net
fonts.googleapis.com |
ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f3.1e100.net
fonts.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
colorado.edu
2 redirects
fedauth.colorado.edu |
44 KB |
3 |
csci3403.com
2 redirects
8706785.labs.csci3403.com csci3403.com |
5 KB |
2 |
gstatic.com
fonts.gstatic.com |
31 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 29 |
1 KB |
11 | 4 |
Domain | Requested by | |
---|---|---|
8 | fedauth.colorado.edu |
2 redirects
fedauth.colorado.edu
|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | csci3403.com | 1 redirects |
1 | fonts.googleapis.com |
fedauth.colorado.edu
|
1 | 8706785.labs.csci3403.com | 1 redirects |
11 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.colorado.edu |
oit.colorado.edu |
Subject Issuer | Validity | Valid | |
---|---|---|---|
csci3403.com R3 |
2023-09-17 - 2023-12-16 |
3 months | crt.sh |
fedauth.colorado.edu Sectigo RSA Organization Validation Secure Server CA |
2023-12-11 - 2025-01-09 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-11-20 - 2024-02-12 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-11-20 - 2024-02-12 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://fedauth.colorado.edu/idp/profile/SAML2/POST/SSO?execution=e1s2
Frame ID: 6D693237F4719C6B41DA2AE0F77216D8
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
Federated Identity Service | University of Colorado BoulderPage URL History Show full URLs
- http://34.136.115.75:8082/NeilAttack2.html Page URL
-
https://8706785.labs.csci3403.com/transaction
HTTP 302
http://csci3403.com/saml2/login/ HTTP 301
https://csci3403.com/saml2/login/ Page URL
-
https://fedauth.colorado.edu/idp/profile/SAML2/POST/SSO
HTTP 302
https://fedauth.colorado.edu/idp/profile/SAML2/POST/SSO?execution=e1s1 Page URL
-
https://fedauth.colorado.edu/idp/profile/SAML2/POST/SSO?execution=e1s1
HTTP 302
https://fedauth.colorado.edu/idp/profile/SAML2/POST/SSO?execution=e1s2 Page URL
Detected technologies
Google Font API (Font Scripts) ExpandDetected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Need help logging in?
Search URL Search Domain Scan URL
Title: Office of Information Technology
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Legal & Trademarks
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://34.136.115.75:8082/NeilAttack2.html Page URL
-
https://8706785.labs.csci3403.com/transaction
HTTP 302
http://csci3403.com/saml2/login/ HTTP 301
https://csci3403.com/saml2/login/ Page URL
-
https://fedauth.colorado.edu/idp/profile/SAML2/POST/SSO
HTTP 302
https://fedauth.colorado.edu/idp/profile/SAML2/POST/SSO?execution=e1s1 Page URL
-
https://fedauth.colorado.edu/idp/profile/SAML2/POST/SSO?execution=e1s1
HTTP 302
https://fedauth.colorado.edu/idp/profile/SAML2/POST/SSO?execution=e1s2 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- https://8706785.labs.csci3403.com/transaction HTTP 302
- http://csci3403.com/saml2/login/ HTTP 301
- https://csci3403.com/saml2/login/
- https://fedauth.colorado.edu/idp/profile/SAML2/POST/SSO HTTP 302
- https://fedauth.colorado.edu/idp/profile/SAML2/POST/SSO?execution=e1s1
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.0 |
NeilAttack2.html
34.136.115.75/ |
671 B 856 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
csci3403.com/saml2/login/ Redirect Chain
|
5 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SSO
fedauth.colorado.edu/idp/profile/SAML2/POST/ Redirect Chain
|
3 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.css
fedauth.colorado.edu/idp/css/ |
7 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
SSO
fedauth.colorado.edu/idp/profile/SAML2/POST/ Redirect Chain
|
6 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
7 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.css
fedauth.colorado.edu/idp/css/ |
7 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cu-boulder-logo-text-black.svg
fedauth.colorado.edu/idp//images/ |
15 KB 15 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
be-boulder-white.svg
fedauth.colorado.edu/idp/images/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| toggle function| toggleDos2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
fedauth.colorado.edu/idp | Name: JSESSIONID Value: 9311654296762F59F14C434AB52ECFE8 |
|
.csci3403.com/ | Name: saml_session Value: rjxy301v3yc8wx7t0h2n0p63hr6i7a1g |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
8706785.labs.csci3403.com
csci3403.com
fedauth.colorado.edu
fonts.googleapis.com
fonts.gstatic.com
128.138.129.198
142.250.184.202
142.250.184.227
34.136.115.75
35.208.18.231
325680580cd08db6f1222efafae3de12bd9d6fbe9131668496773596dff49bbf
73d7006d71d71bd53c47667c18b0756e3923e72b590447dc48f8359f2cb49b67
76816754315df405e9974adf775f26722c751a4ea0f094fa3890402a96d4c6fd
94582966f3a08046e4f6b05276fe17cf7d9babc30fb844e85f5f7a37edd23c8f
a6edc874b1f593db9d97c1d69e1d122e60c8e42acca1148d1e57283f3acec42e
c3121377252e9afb656b5e8d23c619a1cead4545e31ed1fde80e9ad778391cbf
c9e31f9893030e21aa09eefaceacdd1775f6a789fea8c2245ba8ac57dad845c5
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615