google.idpproxy.illinois.edu
Open in
urlscan Pro
3.139.123.108
Public Scan
Effective URL: https://google.idpproxy.illinois.edu/simplesaml/module.php/core/loginuserpass.php?AuthState=_5e59478d12d5653133fe6e57c99877fc0a383267...
Submission Tags: @phishunt_io
Submission: On October 24 via api from US — Scanned from DE
Summary
TLS certificate: Issued by Amazon on October 24th 2021. Valid for: a year.
This is the only time google.idpproxy.illinois.edu was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 7 | 3.139.123.108 3.139.123.108 | 16509 (AMAZON-02) (AMAZON-02) | |
5 | 1 |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-139-123-108.us-east-2.compute.amazonaws.com
google.idpproxy.illinois.edu |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
illinois.edu
2 redirects
google.idpproxy.illinois.edu |
22 KB |
5 | 1 |
Domain | Requested by | |
---|---|---|
7 | google.idpproxy.illinois.edu |
2 redirects
google.idpproxy.illinois.edu
|
5 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
google.idpproxy.illinois.edu Amazon |
2021-10-24 - 2022-11-21 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://google.idpproxy.illinois.edu/simplesaml/module.php/core/loginuserpass.php?AuthState=_5e59478d12d5653133fe6e57c99877fc0a383267cd%3Ahttps%3A%2F%2Fgoogle.idpproxy.illinois.edu%2Fsimplesaml%2Fmodule.php%2Fcore%2Fas_login.php%3FAuthId%3Dadmin%26ReturnTo%3Dhttps%253A%252F%252Fgoogle.idpproxy.illinois.edu%252Fsimplesaml%252Fmodule.php%252Fcore%252Ffrontpage_welcome.php
Frame ID: 5377B0FFD4A2AE5F1CA150D1F626F2CC
Requests: 5 HTTP requests in this frame
Screenshot
Page Title
Enter your username and passwordPage URL History Show full URLs
-
https://google.idpproxy.illinois.edu/simplesaml/module.php/core/loginuserpass.php?AuthState=_8564376c3f532e715dfc...
HTTP 302
https://google.idpproxy.illinois.edu/simplesaml/module.php/core/as_login.php?AuthId=admin&ReturnTo=https%3A%2F%2F... HTTP 302
https://google.idpproxy.illinois.edu/simplesaml/module.php/core/loginuserpass.php?AuthState=_5e59478d12d5653133fe... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://google.idpproxy.illinois.edu/simplesaml/module.php/core/loginuserpass.php?AuthState=_8564376c3f532e715dfcc884515c7567f513c8cc9e%3Ahttps%3A%2F%2Fgoogle.idpproxy.illinois.edu%2Fsimplesaml%2Fmodule.php%2Fcore%2Fas_login.php%3FAuthId%3Dadmin%26ReturnTo%3Dhttps%253A%252F%252Fgoogle.idpproxy.illinois.edu%252Fsimplesaml%252Fmodule.php%252Fcore%252Ffrontpage_welcome.php
HTTP 302
https://google.idpproxy.illinois.edu/simplesaml/module.php/core/as_login.php?AuthId=admin&ReturnTo=https%3A%2F%2Fgoogle.idpproxy.illinois.edu%2Fsimplesaml%2Fmodule.php%2Fcore%2Ffrontpage_welcome.php HTTP 302
https://google.idpproxy.illinois.edu/simplesaml/module.php/core/loginuserpass.php?AuthState=_5e59478d12d5653133fe6e57c99877fc0a383267cd%3Ahttps%3A%2F%2Fgoogle.idpproxy.illinois.edu%2Fsimplesaml%2Fmodule.php%2Fcore%2Fas_login.php%3FAuthId%3Dadmin%26ReturnTo%3Dhttps%253A%252F%252Fgoogle.idpproxy.illinois.edu%252Fsimplesaml%252Fmodule.php%252Fcore%252Ffrontpage_welcome.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
loginuserpass.php
google.idpproxy.illinois.edu/simplesaml/module.php/core/ Redirect Chain
|
3 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script.js
google.idpproxy.illinois.edu/simplesaml/resources/ |
789 B 983 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
default.css
google.idpproxy.illinois.edu/simplesaml/module.php/itrust/resources/css/ |
3 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
illinois.gif
google.idpproxy.illinois.edu/simplesaml/module.php/itrust/resources/images/ |
10 KB 10 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtk-dialog-authentication.48x48.png
google.idpproxy.illinois.edu/simplesaml/resources/icons/experience/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster function| SimpleSAML_focus function| SimpleSAML_show function| SimpleSAML_hide object| element1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
google.idpproxy.illinois.edu/ | Name: PHPSESSID Value: f8e473d8124d4f773f45e4360c0a9e20 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
google.idpproxy.illinois.edu
3.139.123.108
0eed6dab9318cc5b68afc37e66aa2591a99e54d7b3d288bb0ab3f8bf0b41e952
9f5569614f280abb6a1f0daf57ad1a98b4eba398487c05679951030029dae084
a77328fd780937933da8e08e77bbdc380a0b43bea7ffbc408909b0e4cc4e6570
ad19141d7778f6d8d6bbfba1f4d173bc6248abe0b3391e17cbe5b33ffb43ab0b
bf90b96f8b27dff905a17bfc4bd9ae6fe0310dce7615836e59249e30fa4573f0