login.aurora.tromkom.no Open in urlscan Pro
185.96.73.211 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://login.aurora.tromkom.no/
Submission: On September 03 via automatic, source certstream-suspicious (September 3rd 2021, 8:45:14 am UTC)

Summary HTTP 9 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 185.96.73.211, located in Tromsø, Norway and belongs to BREDBANDSFYLKET-TROMS, NO. The main domain is login.aurora.tromkom.no.
TLS certificate: Issued by R3 on September 3rd 2021. Valid for: 3 months.

This is the only time login.aurora.tromkom.no was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
8	185.96.73.211 185.96.73.211	61006 (BREDBANDS...) (BREDBANDSFYLKET-TROMS)
1	2a00:1450:400... 2a00:1450:4001:811::200a	15169 (GOOGLE) (GOOGLE)
9	2

8 185.96.73.211 (Tromsø, Norway)

ASN61006 (BREDBANDSFYLKET-TROMS, NO)

login.aurora.tromkom.no	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.aurora.tromkom.no	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	tromkom.no login.aurora.tromkom.no api.aurora.tromkom.no	166 KB
1	googleapis.com fonts.googleapis.com	474 B
9	2

	Domain	Requested by
4	api.aurora.tromkom.no	login.aurora.tromkom.no
4	login.aurora.tromkom.no	login.aurora.tromkom.no
1	fonts.googleapis.com	login.aurora.tromkom.no
9	3

This site contains links to these domains. Also see Links.

Domain
api.aurora.tromkom.no

Subject Issuer	Validity	Valid
login.aurora.tromkom.no R3	`2021-09-03` - `2021-12-02`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-08-16` - `2021-11-08`	3 months	crt.sh
api.aurora.tromkom.no R3	`2021-09-02` - `2021-12-01`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://login.aurora.tromkom.no/
Frame ID: 037D9BDD9DDD8659B05F57C0B8F385F0
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Aurora Innlogging

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

9
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

167 kB
Transfer

490 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://api.aurora.tromkom.no/oidc/initialize?state=next=https://login.aurora.tromkom.no/
Title: Fortsett med elektronisk ID

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
login.aurora.tromkom.no/ 2 KB
1 KB 222ms
71ms Document
text/html 185.96.73.211
BREDBANDSFYLKET-T...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.aurora.tromkom.no/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.96.73.211 Tromsø, Norway, ASN61006 (BREDBANDSFYLKET-TROMS, NO),

Reverse DNS

Software

Resource Hash

8419c165040c3aac0b5a64cdfe8387c26172fa54844a6c4e3d36e76fde97e547

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

:method: GET
:authority: login.aurora.tromkom.no
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 03 Sep 2021 08:44:55 GMT
content-type: text/html; charset=utf-8
content-disposition: inline; filename="index.html"
accept-ranges: bytes
etag: "95224757c5146f33f86459865b396448064f7f2f"
vary: Accept-Encoding
content-encoding: gzip
strict-transport-security: max-age=15724800; includeSubDomains

GET
H2 200 icon
fonts.googleapis.com/ 568 B
474 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/icon?family=Material+Icons

Requested by

Host: login.aurora.tromkom.no
URL: https://login.aurora.tromkom.no/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

80b252c5e024e15162180f33565a89511dd7f94e7f3716d55fda1a0a751bd082

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://login.aurora.tromkom.no/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 03 Sep 2021 08:44:55 GMT
server: ESF
date: Fri, 03 Sep 2021 08:44:55 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 03 Sep 2021 08:44:55 GMT

GET
H2 200 main.9a21fb7b.chunk.css
login.aurora.tromkom.no/static/css/ 698 B
938 B 72ms
71ms Stylesheet
text/css 185.96.73.211
BREDBANDSFYLKET-T...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.aurora.tromkom.no/static/css/main.9a21fb7b.chunk.css

Requested by

Host: login.aurora.tromkom.no
URL: https://login.aurora.tromkom.no/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.96.73.211 Tromsø, Norway, ASN61006 (BREDBANDSFYLKET-TROMS, NO),

Reverse DNS

Software

Resource Hash

7d85f2823c71b428eaa82ef4ea0c87948c551dbdeb8cf27c6351316af96625ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

:path: /static/css/main.9a21fb7b.chunk.css
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: login.aurora.tromkom.no
referer: https://login.aurora.tromkom.no/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://login.aurora.tromkom.no/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 03 Sep 2021 08:44:55 GMT
etag: "92c58c363dac5de7a44778b48c66c19daa8179d1"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
content-disposition: inline; filename="main.9a21fb7b.chunk.css"
strict-transport-security: max-age=15724800; includeSubDomains
accept-ranges: bytes
content-length: 698

GET
H2 200 2.814a9020.chunk.js Show response
login.aurora.tromkom.no/static/js/ 449 KB
153 KB 74ms
73ms Script
application/javascript 185.96.73.211
BREDBANDSFYLKET-T...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.aurora.tromkom.no/static/js/2.814a9020.chunk.js

Requested by

Host: login.aurora.tromkom.no
URL: https://login.aurora.tromkom.no/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.96.73.211 Tromsø, Norway, ASN61006 (BREDBANDSFYLKET-TROMS, NO),

Reverse DNS

Software

Resource Hash

6e173103724938133d342c3ec3944b2ded32a5f47932dea060cccb228be1847a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

:path: /static/js/2.814a9020.chunk.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: login.aurora.tromkom.no
referer: https://login.aurora.tromkom.no/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://login.aurora.tromkom.no/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 03 Sep 2021 08:44:55 GMT
content-encoding: gzip
etag: "cdd32cb6c7c494b0067569b73f2ea13034b23bf4"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
content-disposition: inline; filename="2.814a9020.chunk.js"
strict-transport-security: max-age=15724800; includeSubDomains
accept-ranges: bytes

GET
H2 200 main.9833356f.chunk.js Show response
login.aurora.tromkom.no/static/js/ 38 KB
11 KB 74ms
74ms Script
application/javascript 185.96.73.211
BREDBANDSFYLKET-T...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.aurora.tromkom.no/static/js/main.9833356f.chunk.js

Requested by

Host: login.aurora.tromkom.no
URL: https://login.aurora.tromkom.no/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.96.73.211 Tromsø, Norway, ASN61006 (BREDBANDSFYLKET-TROMS, NO),

Reverse DNS

Software

Resource Hash

9dd741deae554e7b8f4ccc70a007fbcf69f501e0c0cc59f663c9083ad45d405e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

:path: /static/js/main.9833356f.chunk.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: login.aurora.tromkom.no
referer: https://login.aurora.tromkom.no/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://login.aurora.tromkom.no/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 03 Sep 2021 08:44:55 GMT
content-encoding: gzip
etag: "7510e05a90a96d92ab552e7bb50b23b5dd224901"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
content-disposition: inline; filename="main.9833356f.chunk.js"
strict-transport-security: max-age=15724800; includeSubDomains
accept-ranges: bytes

GET
H2 401 auth Show response
api.aurora.tromkom.no/ 39 B
315 B 219ms
73ms Fetch
application/json 185.96.73.211
BREDBANDSFYLKET-T...

General

Check archive.org

Show headers Download Go to

Full URL

https://api.aurora.tromkom.no/auth

Requested by

Host: login.aurora.tromkom.no
URL: https://login.aurora.tromkom.no/static/js/2.814a9020.chunk.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.96.73.211 Tromsø, Norway, ASN61006 (BREDBANDSFYLKET-TROMS, NO),

Reverse DNS

Software

Resource Hash

a13f9230a61cba78745b6edc4293800637030e2447cc88e054173aebd5a8a55f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://login.aurora.tromkom.no/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 03 Sep 2021 08:44:56 GMT
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://login.aurora.tromkom.no
x-ratelimit-remaining: 3597
access-control-allow-credentials: true
x-ratelimit-reset: 1630661870
x-ratelimit-limit: 3600
strict-transport-security: max-age=15724800; includeSubDomains
content-length: 39

GET
H2 200 services.json Show response
api.aurora.tromkom.no/.well-known/ 27 B
298 B 220ms
75ms Fetch
application/json 185.96.73.211
BREDBANDSFYLKET-T...

General

Check archive.org

Show headers Download Go to

Full URL

https://api.aurora.tromkom.no/.well-known/services.json

Requested by

Host: login.aurora.tromkom.no
URL: https://login.aurora.tromkom.no/static/js/2.814a9020.chunk.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.96.73.211 Tromsø, Norway, ASN61006 (BREDBANDSFYLKET-TROMS, NO),

Reverse DNS

Software

Resource Hash

e10a9514e5a76762ac59f776e5ef5cd378d93871bd863a29b49184635dedf7c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://login.aurora.tromkom.no/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 03 Sep 2021 08:44:56 GMT
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://login.aurora.tromkom.no
x-ratelimit-remaining: 3596
access-control-allow-credentials: true
x-ratelimit-reset: 1630661870
x-ratelimit-limit: 3600
strict-transport-security: max-age=15724800; includeSubDomains
content-length: 27

OPTIONS
H2 204 auth
api.aurora.tromkom.no/ 0
0 276ms
70ms Preflight 185.96.73.211
BREDBANDSFYLKET-T...

General

Check archive.org

Show headers Download Go to

Full URL

https://api.aurora.tromkom.no/auth

Protocol

Server

185.96.73.211 Tromsø, Norway, ASN61006 (BREDBANDSFYLKET-TROMS, NO),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: https://login.aurora.tromkom.no
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Fri, 03 Sep 2021 08:44:56 GMT
vary: Origin
access-control-allow-origin: https://login.aurora.tromkom.no
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,POST,DELETE,PATCH
access-control-allow-headers: content-type
strict-transport-security: max-age=15724800; includeSubDomains

OPTIONS
H2 204 services.json
api.aurora.tromkom.no/.well-known/ 0
0 276ms
70ms Preflight 185.96.73.211
BREDBANDSFYLKET-T...

General

Check archive.org

Show headers Download Go to

Full URL

https://api.aurora.tromkom.no/.well-known/services.json

Protocol

Server

185.96.73.211 Tromsø, Norway, ASN61006 (BREDBANDSFYLKET-TROMS, NO),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: https://login.aurora.tromkom.no
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Fri, 03 Sep 2021 08:44:56 GMT
vary: Origin
access-control-allow-origin: https://login.aurora.tromkom.no
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,POST,DELETE,PATCH
access-control-allow-headers: content-type
strict-transport-security: max-age=15724800; includeSubDomains

Verdicts & Comments Add Verdict or Comment

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.aurora.tromkom.no
fonts.googleapis.com
login.aurora.tromkom.no
185.96.73.211
2a00:1450:4001:811::200a
6e173103724938133d342c3ec3944b2ded32a5f47932dea060cccb228be1847a
7d85f2823c71b428eaa82ef4ea0c87948c551dbdeb8cf27c6351316af96625ce
80b252c5e024e15162180f33565a89511dd7f94e7f3716d55fda1a0a751bd082
8419c165040c3aac0b5a64cdfe8387c26172fa54844a6c4e3d36e76fde97e547
9dd741deae554e7b8f4ccc70a007fbcf69f501e0c0cc59f663c9083ad45d405e
a13f9230a61cba78745b6edc4293800637030e2447cc88e054173aebd5a8a55f
e10a9514e5a76762ac59f776e5ef5cd378d93871bd863a29b49184635dedf7c0

login.aurora.tromkom.no Open in urlscan Pro 185.96.73.211 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

50 %IPv6

2 Domains

3 Subdomains

2 IPs

2 Countries

167 kBTransfer

490 kBSize

0 Cookies

1 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

15 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

login.aurora.tromkom.no Open in urlscan Pro
185.96.73.211 Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

167 kB
Transfer

490 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions