itam.sanderson.consulting Open in urlscan Pro
2a00:f10:305:0:1c00:3fff:fe00:4bb  Public Scan

URL: https://itam.sanderson.consulting/public/login
Submission Tags: @phishunt_io
Submission: On October 22 via api from ES

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 3 HTTP transactions. The main IP is 2a00:f10:305:0:1c00:3fff:fe00:4bb, located in Netherlands and belongs to PCEXTREME-, NL. The main domain is itam.sanderson.consulting.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 22nd 2020. Valid for: 3 months.
This is the only time itam.sanderson.consulting was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 2a00:f10:305:... 48635 (PCEXTREME-)
3 1
Apex Domain
Subdomains
Transfer
3 sanderson.consulting
itam.sanderson.consulting
51 KB
3 1
Domain Requested by
3 itam.sanderson.consulting itam.sanderson.consulting
3 1

This site contains no links.

Subject Issuer Validity Valid
itam.sanderson.consulting
Let's Encrypt Authority X3
2020-10-22 -
2021-01-20
3 months crt.sh

This page contains 1 frames:

Primary Page: https://itam.sanderson.consulting/public/login
Frame ID: 4ED23138F81EFF16CD358A3F4F21CC94
Requests: 3 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

3
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

51 kB
Transfer

253 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login
itam.sanderson.consulting/public/
4 KB
2 KB
Document
General
Full URL
https://itam.sanderson.consulting/public/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f10:305:0:1c00:3fff:fe00:4bb , Netherlands, ASN48635 (PCEXTREME-, NL),
Reverse DNS
Software
Apache / PHP/7.4.11
Resource Hash
7c7b4207da5cabd826924f32ad8389e4a0a668e248b511fe9327699bd8fac574
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

:method
GET
:authority
itam.sanderson.consulting
:scheme
https
:path
/public/login
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Thu, 22 Oct 2020 16:24:58 GMT
server
Apache
x-powered-by
PHP/7.4.11
cache-control
no-cache, private
x-content-type-options
nosniff
referrer-policy
same-origin
x-xss-protection
1;mode=block
x-frame-options
SAMEORIGIN
set-cookie
XSRF-TOKEN=eyJpdiI6InpodzV5SmRyR1JJdmdpcFkzME9VUlE9PSIsInZhbHVlIjoiNWc1cjV6UGxQSnhGWVhkT2ZsaTVFcEZmNHVvRDdDaHlLRXB1Z1VVUEIzNng0dFIwejNzNW4xdWVNY3dzb3hxRHVBRUhReUhYOUF6SFUwdUdhWmhLNHc9PSIsIm1hYyI6IjAyNjdmZTkzMmNlNzRiZWRlYzQyYzg5NDk4MjE5ZTRkZWJjOTIzYTk0MmU1MWU1N2U1ZTg5MzQ2MGYzZjk0NjYifQ%3D%3D; expires=Sat, 31-Oct-2020 00:24:58 GMT; Max-Age=720000; path=/ snipeit_session=MOmJ2OFQiLclbM4snSiPCzayMXzC6iWrGZrf6aIS; expires=Sat, 31-Oct-2020 00:24:58 GMT; Max-Age=720000; path=/; httponly
vary
Accept-Encoding,User-Agent
content-encoding
gzip
content-length
1117
content-type
text/html; charset=UTF-8
select2.min.css
itam.sanderson.consulting/public/js/plugins/select2/
15 KB
2 KB
Stylesheet
General
Full URL
https://itam.sanderson.consulting/public/js/plugins/select2/select2.min.css
Requested by
Host: itam.sanderson.consulting
URL: https://itam.sanderson.consulting/public/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f10:305:0:1c00:3fff:fe00:4bb , Netherlands, ASN48635 (PCEXTREME-, NL),
Reverse DNS
Software
Apache /
Resource Hash
6657a7d3ac4506ce3b0ca9234df4f63b6bff8e94e92f21f9d77921b166fc6925

Request headers

Referer
https://itam.sanderson.consulting/public/login
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 22 Oct 2020 16:24:58 GMT
content-encoding
gzip
last-modified
Thu, 09 Apr 2020 08:49:50 GMT
server
Apache
vary
Accept-Encoding,User-Agent
content-type
text/css
status
200
accept-ranges
bytes
content-length
1920
all.css
itam.sanderson.consulting/public/css/dist/
235 KB
48 KB
Stylesheet
General
Full URL
https://itam.sanderson.consulting/public/css/dist/all.css?id=41fe3b2990d453da1997
Requested by
Host: itam.sanderson.consulting
URL: https://itam.sanderson.consulting/public/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:f10:305:0:1c00:3fff:fe00:4bb , Netherlands, ASN48635 (PCEXTREME-, NL),
Reverse DNS
Software
Apache /
Resource Hash
9dbd53041572adf19f32594ef3e6743ad45b89c42c97e3f8e052ef78d3b6c40b

Request headers

Referer
https://itam.sanderson.consulting/public/login
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 22 Oct 2020 16:24:58 GMT
content-encoding
gzip
last-modified
Thu, 09 Apr 2020 08:49:50 GMT
server
Apache
vary
Accept-Encoding,User-Agent
content-type
text/css
status
200
accept-ranges
bytes
content-length
48348

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes

2 Cookies

Domain/Path Name / Value
itam.sanderson.consulting/ Name: snipeit_session
Value: MOmJ2OFQiLclbM4snSiPCzayMXzC6iWrGZrf6aIS
itam.sanderson.consulting/ Name: XSRF-TOKEN
Value: eyJpdiI6InpodzV5SmRyR1JJdmdpcFkzME9VUlE9PSIsInZhbHVlIjoiNWc1cjV6UGxQSnhGWVhkT2ZsaTVFcEZmNHVvRDdDaHlLRXB1Z1VVUEIzNng0dFIwejNzNW4xdWVNY3dzb3hxRHVBRUhReUhYOUF6SFUwdUdhWmhLNHc9PSIsIm1hYyI6IjAyNjdmZTkzMmNlNzRiZWRlYzQyYzg5NDk4MjE5ZTRkZWJjOTIzYTk0MmU1MWU1N2U1ZTg5MzQ2MGYzZjk0NjYifQ%3D%3D

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

itam.sanderson.consulting
2a00:f10:305:0:1c00:3fff:fe00:4bb
6657a7d3ac4506ce3b0ca9234df4f63b6bff8e94e92f21f9d77921b166fc6925
7c7b4207da5cabd826924f32ad8389e4a0a668e248b511fe9327699bd8fac574
9dbd53041572adf19f32594ef3e6743ad45b89c42c97e3f8e052ef78d3b6c40b