auth.threatdefence.io Open in urlscan Pro
13.210.26.168 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://portal.threatshield-security.com/
Effective URL:
https://auth.threatdefence.io/auth/realms/ThreatDefence/protocol/openid-connect/auth?client_id=td-pub-threatshieldsecurity&red...
Submission: On April 30 via automatic, source certstream-suspicious (April 30th 2024, 4:23:07 am UTC) — Scanned from AU

Summary HTTP 19 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 19 HTTP transactions. The main IP is 13.210.26.168, located in Sydney, Australia and belongs to AMAZON-02, US. The main domain is auth.threatdefence.io.
TLS certificate: Issued by Amazon RSA 2048 M03 on April 16th 2024. Valid for: a year.

This is the only time auth.threatdefence.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
7	103.18.41.158 103.18.41.158	58940 (DEDAUS-AS...) (DEDAUS-AS-AP Dedicated Servers Australia)
1	142.251.223.74 142.251.223.74	15169 (GOOGLE) (GOOGLE)
11	13.210.26.168 13.210.26.168	16509 (AMAZON-02) (AMAZON-02)
19	3

7 103.18.41.158 (Australia)

ASN58940 (DEDAUS-AS-AP Dedicated Servers Australia, AU)

portal.threatshield-security.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.223.74 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: kul09s21-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 13.210.26.168 (Sydney, Australia)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-210-26-168.ap-southeast-2.compute.amazonaws.com

auth.threatdefence.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	threatdefence.io auth.threatdefence.io	389 KB
7	threatshield-security.com portal.threatshield-security.com	1 MB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 33	1 KB
19	3

	Domain	Requested by
11	auth.threatdefence.io	portal.threatshield-security.com auth.threatdefence.io
7	portal.threatshield-security.com	portal.threatshield-security.com
1	fonts.googleapis.com	portal.threatshield-security.com
19	3

This site contains no links.

Subject Issuer	Validity	Valid
console.threatshield-security.com R3	`2024-04-30` - `2024-07-29`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-04-08` - `2024-07-01`	3 months	crt.sh
auth.threatdefence.io Amazon RSA 2048 M03	`2024-04-16` - `2025-05-15`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://auth.threatdefence.io/auth/realms/ThreatDefence/protocol/openid-connect/auth?client_id=td-pub-threatshieldsecurity&redirect_uri=https%3A%2F%2Fportal.threatshield-security.com%2F&state=7f172533-dd7f-43d3-8bc0-eedb7e3721f3&response_mode=fragment&response_type=code&scope=openid&nonce=ae4d3d72-1320-4099-8f71-5c584ef727e4&code_challenge=cNWpRckdyaHssdcNJcMOgAqd0xfpB6nYyCRly4eoa_Y&code_challenge_method=S256
Frame ID: EBB93767D06FCAC1F8BCEB0A747DF6B1
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to ThreatDefence

Page URL History Show full URLs

https://portal.threatshield-security.com/ Page URL
https://auth.threatdefence.io/auth/realms/ThreatDefence/protocol/openid-connect/auth?client_id=td-pub-thre... Page URL

Page Statistics

19
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

1603 kB
Transfer

6400 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://portal.threatshield-security.com/ Page URL
https://auth.threatdefence.io/auth/realms/ThreatDefence/protocol/openid-connect/auth?client_id=td-pub-threatshieldsecurity&redirect_uri=https%3A%2F%2Fportal.threatshield-security.com%2F&state=7f172533-dd7f-43d3-8bc0-eedb7e3721f3&response_mode=fragment&response_type=code&scope=openid&nonce=ae4d3d72-1320-4099-8f71-5c584ef727e4&code_challenge=cNWpRckdyaHssdcNJcMOgAqd0xfpB6nYyCRly4eoa_Y&code_challenge_method=S256 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
portal.threatshield-security.com/ 3 KB
1 KB 127ms
4ms Document
text/html 103.18.41.158
DEDAUS-AS-AP Dedi...

General

Check archive.org

Show headers Download Go to

Full URL: https://portal.threatshield-security.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.18.41.158 , Australia, ASN58940 (DEDAUS-AS-AP Dedicated Servers Australia, AU),
Reverse DNS
Software: nginx /
Resource Hash: e411472c159beda0815953d866b7dd6c8144501ea50139ac7ebbaa302bdfeec2

Request headers

Accept-Language: en-AU,en;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
content-type: text/html
date: Tue, 30 Apr 2024 04:23:02 GMT
etag: W/"66306844-a43"
last-modified: Tue, 30 Apr 2024 03:40:52 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 css2
fonts.googleapis.com/ 7 KB
1 KB 322ms
111ms Stylesheet
text/css 142.251.223.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;500;700&display=swap

Requested by

Host: portal.threatshield-security.com
URL: https://portal.threatshield-security.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.223.74 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

kul09s21-in-f10.1e100.net

Software

ESF /

Resource Hash

31d196afc7bf97b61be0a9881f623b3b8a7b56d4b0c08c6b78c37ce92d7827b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://portal.threatshield-security.com/
Accept-Language: en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Tue, 30 Apr 2024 04:23:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 30 Apr 2024 02:51:49 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 30 Apr 2024 04:23:02 GMT

GET
H2 200 2.38566b41.chunk.css
portal.threatshield-security.com/static/css/ 82 KB
31 KB 6ms
5ms Stylesheet
text/css 103.18.41.158
DEDAUS-AS-AP Dedi...

General

Check archive.org

Show headers Download Go to

Full URL: https://portal.threatshield-security.com/static/css/2.38566b41.chunk.css
Requested by: Host: portal.threatshield-security.com
URL: https://portal.threatshield-security.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.18.41.158 , Australia, ASN58940 (DEDAUS-AS-AP Dedicated Servers Australia, AU),
Reverse DNS
Software: nginx /
Resource Hash: 8328f814e4eb8c1c12365aa99df559d99e93a4923cb9c1c6a8737dbcc09682bf

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://portal.threatshield-security.com/
Accept-Language: en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 30 Apr 2024 04:23:02 GMT
content-encoding: gzip
last-modified: Tue, 30 Apr 2024 03:40:52 GMT
server: nginx
etag: W/"66306844-14919"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000, public
expires: Wed, 30 Apr 2025 04:23:02 GMT

GET
H2 200 main.322cfb9c.chunk.css
portal.threatshield-security.com/static/css/ 1 KB
824 B 4ms
3ms Stylesheet
text/css 103.18.41.158
DEDAUS-AS-AP Dedi...

General

Check archive.org

Show headers Download Go to

Full URL: https://portal.threatshield-security.com/static/css/main.322cfb9c.chunk.css
Requested by: Host: portal.threatshield-security.com
URL: https://portal.threatshield-security.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.18.41.158 , Australia, ASN58940 (DEDAUS-AS-AP Dedicated Servers Australia, AU),
Reverse DNS
Software: nginx /
Resource Hash: 0b6157d746ce3f83debaef6ba4229269856c07508d6db8ccce9f6c4d6eaf7a46

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://portal.threatshield-security.com/
Accept-Language: en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 30 Apr 2024 04:23:02 GMT
content-encoding: gzip
last-modified: Tue, 30 Apr 2024 03:40:52 GMT
server: nginx
etag: W/"66306844-523"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000, public
expires: Wed, 30 Apr 2025 04:23:02 GMT

GET
H2 200 spinner.svg
portal.threatshield-security.com/ 1 KB
773 B 5ms
4ms Image
image/svg+xml 103.18.41.158
DEDAUS-AS-AP Dedi...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://portal.threatshield-security.com/spinner.svg
Requested by: Host: portal.threatshield-security.com
URL: https://portal.threatshield-security.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.18.41.158 , Australia, ASN58940 (DEDAUS-AS-AP Dedicated Servers Australia, AU),
Reverse DNS
Software: nginx /
Resource Hash: c4d0c1d2307139239705d3353e569f67d3a18d951225f91304de9aacfcd942fc

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://portal.threatshield-security.com/
Accept-Language: en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 30 Apr 2024 04:23:02 GMT
content-encoding: gzip
last-modified: Tue, 30 Apr 2024 03:38:25 GMT
server: nginx
etag: W/"663067b1-431"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=2592000, public
expires: Thu, 30 May 2024 04:23:02 GMT

GET
H2 200 2.cf757291.chunk.js Show response
portal.threatshield-security.com/static/js/ 3 MB
819 KB 9ms
9ms Script
application/javascript 103.18.41.158
DEDAUS-AS-AP Dedi...

General

Check archive.org

Show headers Download Go to

Full URL: https://portal.threatshield-security.com/static/js/2.cf757291.chunk.js
Requested by: Host: portal.threatshield-security.com
URL: https://portal.threatshield-security.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.18.41.158 , Australia, ASN58940 (DEDAUS-AS-AP Dedicated Servers Australia, AU),
Reverse DNS
Software: nginx /
Resource Hash: c7fab3b0ce9be00afd183248693a873d69a60974faeee167668fd4fbaef19719

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://portal.threatshield-security.com/
Accept-Language: en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 30 Apr 2024 04:23:02 GMT
content-encoding: gzip
last-modified: Tue, 30 Apr 2024 03:40:52 GMT
server: nginx
etag: W/"66306844-2aa8b3"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Wed, 30 Apr 2025 04:23:02 GMT

GET
H2 200 main.c052d9c2.chunk.js Show response
portal.threatshield-security.com/static/js/ 2 MB
360 KB 125ms
125ms Script
application/javascript 103.18.41.158
DEDAUS-AS-AP Dedi...

General

Check archive.org

Show headers Download Go to

Full URL: https://portal.threatshield-security.com/static/js/main.c052d9c2.chunk.js
Requested by: Host: portal.threatshield-security.com
URL: https://portal.threatshield-security.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.18.41.158 , Australia, ASN58940 (DEDAUS-AS-AP Dedicated Servers Australia, AU),
Reverse DNS
Software: nginx /
Resource Hash: 33eca8fb36229be51db110f08a7bf46ca684abb4c81d60a2f5f9ae19f666c961

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://portal.threatshield-security.com/
Accept-Language: en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 30 Apr 2024 04:23:02 GMT
content-encoding: gzip
last-modified: Tue, 30 Apr 2024 03:40:52 GMT
server: nginx
etag: W/"66306844-1a0642"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Wed, 30 Apr 2025 04:23:02 GMT

GET
H2 200 spinner.svg
portal.threatshield-security.com/ 1 KB
0 0ms
0ms XHR
image/svg+xml 103.18.41.158
DEDAUS-AS-AP Dedi...

General

Check archive.org

Show headers Download Go to

Full URL: https://portal.threatshield-security.com/spinner.svg
Requested by: Host: portal.threatshield-security.com
URL: https://portal.threatshield-security.com/static/js/2.cf757291.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.18.41.158 , Australia, ASN58940 (DEDAUS-AS-AP Dedicated Servers Australia, AU),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://portal.threatshield-security.com/
Accept-Language: en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 30 Apr 2024 04:23:02 GMT
content-encoding: gzip
last-modified: Tue, 30 Apr 2024 03:38:25 GMT
server: nginx
etag: W/"663067b1-431"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=2592000, public
expires: Thu, 30 May 2024 04:23:02 GMT

GET
H2 200 Primary Request auth Show response
auth.threatdefence.io/auth/realms/ThreatDefence/protocol/openid-connect/ 4 KB
5 KB 190ms
15ms Document
text/html 13.210.26.168
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.threatdefence.io/auth/realms/ThreatDefence/protocol/openid-connect/auth?client_id=td-pub-threatshieldsecurity&redirect_uri=https%3A%2F%2Fportal.threatshield-security.com%2F&state=7f172533-dd7f-43d3-8bc0-eedb7e3721f3&response_mode=fragment&response_type=code&scope=openid&nonce=ae4d3d72-1320-4099-8f71-5c584ef727e4&code_challenge=cNWpRckdyaHssdcNJcMOgAqd0xfpB6nYyCRly4eoa_Y&code_challenge_method=S256

Requested by

Host: portal.threatshield-security.com
URL: https://portal.threatshield-security.com/static/js/2.cf757291.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.210.26.168 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-210-26-168.ap-southeast-2.compute.amazonaws.com

Software

Resource Hash

b58067bc7fbd91c6b9e2880d3f13f6c59fd3595ee5e0fd68836296d2404f0324

Security Headers

Name	Value
Content-Security-Policy	frame-src 'self'; frame-ancestors 'self'; object-src 'none';
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-AU,en;q=0.9;q=0.9
Referer: https://portal.threatshield-security.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: no-store, must-revalidate, max-age=0
content-language: en
content-length: 3984
content-security-policy: frame-src 'self'; frame-ancestors 'self'; object-src 'none';
content-type: text/html;charset=utf-8
date: Tue, 30 Apr 2024 04:23:02 GMT
referrer-policy: no-referrer
strict-transport-security: max-age=63072000
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-robots-tag: none
x-xss-protection: 1; mode=block

GET
H2 200 base.css
auth.threatdefence.io/auth/resources/710f9/common/keycloak/web_modules/@patternfly/react-core/dist/styles/ 42 KB
6 KB 6ms
5ms Stylesheet
text/css 13.210.26.168
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.threatdefence.io/auth/resources/710f9/common/keycloak/web_modules/@patternfly/react-core/dist/styles/base.css

Requested by

Host: auth.threatdefence.io
URL: https://auth.threatdefence.io/auth/realms/ThreatDefence/protocol/openid-connect/auth?client_id=td-pub-threatshieldsecurity&redirect_uri=https%3A%2F%2Fportal.threatshield-security.com%2F&state=7f172533-dd7f-43d3-8bc0-eedb7e3721f3&response_mode=fragment&response_type=code&scope=openid&nonce=ae4d3d72-1320-4099-8f71-5c584ef727e4&code_challenge=cNWpRckdyaHssdcNJcMOgAqd0xfpB6nYyCRly4eoa_Y&code_challenge_method=S256

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.210.26.168 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-210-26-168.ap-southeast-2.compute.amazonaws.com

Software

Resource Hash

4891821ebc2db4c531ab849f7ce3231cde07f577c15656d7e0ace02e15f047ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 30 Apr 2024 04:23:02 GMT
strict-transport-security: max-age=63072000
referrer-policy: no-referrer
x-content-type-options: nosniff
content-encoding: gzip
content-type: text/css;charset=UTF-8
cache-control: max-age=2592000
content-length: 6133
x-xss-protection: 1; mode=block

GET
H2 200 app.css
auth.threatdefence.io/auth/resources/710f9/common/keycloak/web_modules/@patternfly/react-core/dist/styles/ 1 MB
112 KB 10ms
9ms Stylesheet
text/css 13.210.26.168
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.threatdefence.io/auth/resources/710f9/common/keycloak/web_modules/@patternfly/react-core/dist/styles/app.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.210.26.168 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-210-26-168.ap-southeast-2.compute.amazonaws.com

Software

Resource Hash

4e2bc970afb2a8b6f20910069c4639167fd106d4a5201738a9981804f83311f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 30 Apr 2024 04:23:02 GMT
strict-transport-security: max-age=63072000
referrer-policy: no-referrer
x-content-type-options: nosniff
content-encoding: gzip
content-type: text/css;charset=UTF-8
cache-control: max-age=2592000
x-xss-protection: 1; mode=block

GET
H2 200 patternfly.min.css
auth.threatdefence.io/auth/resources/710f9/common/keycloak/node_modules/patternfly/dist/css/ 178 KB
31 KB 8ms
7ms Stylesheet
text/css 13.210.26.168
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.threatdefence.io/auth/resources/710f9/common/keycloak/node_modules/patternfly/dist/css/patternfly.min.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.210.26.168 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-210-26-168.ap-southeast-2.compute.amazonaws.com

Software

Resource Hash

acb255de3945454dfc45b4becf811efb182d3fbd67b784e0f9dd4e4c69a7264c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 30 Apr 2024 04:23:02 GMT
strict-transport-security: max-age=63072000
referrer-policy: no-referrer
x-content-type-options: nosniff
content-encoding: gzip
content-type: text/css;charset=UTF-8
cache-control: max-age=2592000
x-xss-protection: 1; mode=block

GET
H2 200 patternfly-additions.min.css
auth.threatdefence.io/auth/resources/710f9/common/keycloak/node_modules/patternfly/dist/css/ 220 KB
30 KB 19ms
18ms Stylesheet
text/css 13.210.26.168
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.threatdefence.io/auth/resources/710f9/common/keycloak/node_modules/patternfly/dist/css/patternfly-additions.min.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.210.26.168 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-210-26-168.ap-southeast-2.compute.amazonaws.com

Software

Resource Hash

2a765f666a686821e3e144abd003dafd3d7409325222fc9fd2664164f833795b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 30 Apr 2024 04:23:02 GMT
strict-transport-security: max-age=63072000
referrer-policy: no-referrer
x-content-type-options: nosniff
content-encoding: gzip
content-type: text/css;charset=UTF-8
cache-control: max-age=2592000
x-xss-protection: 1; mode=block

GET
H2 200 pficon.css
auth.threatdefence.io/auth/resources/710f9/common/keycloak/lib/pficon/ 577 B
541 B 9ms
8ms Stylesheet
text/css 13.210.26.168
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.threatdefence.io/auth/resources/710f9/common/keycloak/lib/pficon/pficon.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.210.26.168 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-210-26-168.ap-southeast-2.compute.amazonaws.com

Software

Resource Hash

81d5057a5bfc9c5b0fbbf5314433dad3bfce537c754cfcbf701dae78e59164cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 30 Apr 2024 04:23:02 GMT
strict-transport-security: max-age=63072000
referrer-policy: no-referrer
x-content-type-options: nosniff
content-encoding: gzip
content-type: text/css;charset=UTF-8
cache-control: max-age=2592000
content-length: 323
x-xss-protection: 1; mode=block

GET
H2 200 login.css
auth.threatdefence.io/auth/resources/710f9/login/keycloak/css/ 10 KB
3 KB 17ms
17ms Stylesheet
text/css 13.210.26.168
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.threatdefence.io/auth/resources/710f9/login/keycloak/css/login.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.210.26.168 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-210-26-168.ap-southeast-2.compute.amazonaws.com

Software

Resource Hash

3b1bb09f65428eb08efc361c2dbc05b3993a8b1cc2f3301e1a15c3f4523d31c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 30 Apr 2024 04:23:02 GMT
strict-transport-security: max-age=63072000
referrer-policy: no-referrer
x-content-type-options: nosniff
content-encoding: gzip
content-type: text/css;charset=UTF-8
cache-control: max-age=2592000
content-length: 2714
x-xss-protection: 1; mode=block

GET
H2 200 keycloak-bg.png
auth.threatdefence.io/auth/resources/710f9/login/keycloak/img/ 80 KB
80 KB 6ms
6ms Image
image/png 13.210.26.168
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://auth.threatdefence.io/auth/resources/710f9/login/keycloak/img/keycloak-bg.png

Requested by

Host: auth.threatdefence.io
URL: https://auth.threatdefence.io/auth/resources/710f9/login/keycloak/css/login.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.210.26.168 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-210-26-168.ap-southeast-2.compute.amazonaws.com

Software

Resource Hash

0825175291be11f7689e8718295e422bb6fa4f8fefccc5610292b720c701ac4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 30 Apr 2024 04:23:03 GMT
cache-control: max-age=2592000
referrer-policy: no-referrer
strict-transport-security: max-age=63072000
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-type: image/png

GET
H2 200 OpenSans-Regular-webfont.woff2
auth.threatdefence.io/auth/resources/710f9/common/keycloak/node_modules/patternfly/dist/fonts/ 61 KB
59 KB 8ms
8ms Font
application/octet-stream 13.210.26.168
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.threatdefence.io/auth/resources/710f9/common/keycloak/node_modules/patternfly/dist/fonts/OpenSans-Regular-webfont.woff2

Requested by

Host: auth.threatdefence.io
URL: https://auth.threatdefence.io/auth/resources/710f9/common/keycloak/node_modules/patternfly/dist/css/patternfly.min.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.210.26.168 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-210-26-168.ap-southeast-2.compute.amazonaws.com

Software

Resource Hash

3cfb28778895d6adca324710b2000c6e15ef5a7b88d461f39b29ff6fb877b778

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Origin: https://auth.threatdefence.io
Accept-Language: en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 30 Apr 2024 04:23:03 GMT
strict-transport-security: max-age=63072000
referrer-policy: no-referrer
x-content-type-options: nosniff
content-encoding: gzip
content-type: application/octet-stream
cache-control: max-age=2592000
x-xss-protection: 1; mode=block

GET
H2 200 OpenSans-Light-webfont.woff2
auth.threatdefence.io/auth/resources/710f9/common/keycloak/node_modules/patternfly/dist/fonts/ 62 KB
60 KB 4ms
4ms Font
application/octet-stream 13.210.26.168
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.threatdefence.io/auth/resources/710f9/common/keycloak/node_modules/patternfly/dist/fonts/OpenSans-Light-webfont.woff2

Requested by

Host: auth.threatdefence.io
URL: https://auth.threatdefence.io/auth/resources/710f9/common/keycloak/node_modules/patternfly/dist/css/patternfly.min.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.210.26.168 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-210-26-168.ap-southeast-2.compute.amazonaws.com

Software

Resource Hash

19edd2b018063320559188548b225aa63914bbc90fb756bc26872db1669e89f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Origin: https://auth.threatdefence.io
Accept-Language: en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 30 Apr 2024 04:23:03 GMT
strict-transport-security: max-age=63072000
referrer-policy: no-referrer
x-content-type-options: nosniff
content-encoding: gzip
content-type: application/octet-stream
cache-control: max-age=2592000
x-xss-protection: 1; mode=block

GET
H2 200 favicon.ico
auth.threatdefence.io/auth/resources/710f9/login/keycloak/img/ 627 B
868 B 6ms
5ms Other
application/octet-stream 13.210.26.168
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.threatdefence.io/auth/resources/710f9/login/keycloak/img/favicon.ico

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.210.26.168 Sydney, Australia, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-210-26-168.ap-southeast-2.compute.amazonaws.com

Software

Resource Hash

47dcf1f1a8f1afd68297a294a263849069a7a62b2e86550241416c2cc56c5676

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Accept-Language: en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 30 Apr 2024 04:23:03 GMT
strict-transport-security: max-age=63072000
referrer-policy: no-referrer
x-content-type-options: nosniff
content-encoding: gzip
content-type: application/octet-stream
cache-control: max-age=2592000
content-length: 650
x-xss-protection: 1; mode=block

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
auth.threatdefence.io/auth/realms/ThreatDefence/	1969-12-31 23:59:59	Name: AUTH_SESSION_ID Value: 9109c587-8891-4a0e-9ca3-d2b8668c3334.ip-10-221-1-7-34277
auth.threatdefence.io/auth/realms/ThreatDefence/	1969-12-31 23:59:59	Name: AUTH_SESSION_ID_LEGACY Value: 9109c587-8891-4a0e-9ca3-d2b8668c3334.ip-10-221-1-7-34277
auth.threatdefence.io/auth/realms/ThreatDefence/	1969-12-31 23:59:59	Name: KC_RESTART Value: eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI0ZGJiNTQwYi0zY2NlLTRmZGUtOTZhZi1iMzkxMGM2N2M1NzYifQ.eyJjaWQiOiJ0ZC1wdWItdGhyZWF0c2hpZWxkc2VjdXJpdHkiLCJwdHkiOiJvcGVuaWQtY29ubmVjdCIsInJ1cmkiOiJodHRwczovL3BvcnRhbC50aHJlYXRzaGllbGQtc2VjdXJpdHkuY29tLyIsImFjdCI6IkFVVEhFTlRJQ0FURSIsIm5vdGVzIjp7InNjb3BlIjoib3BlbmlkIiwiaXNzIjoiaHR0cHM6Ly9hdXRoLnRocmVhdGRlZmVuY2UuaW8vYXV0aC9yZWFsbXMvVGhyZWF0RGVmZW5jZSIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIiwiY29kZV9jaGFsbGVuZ2VfbWV0aG9kIjoiUzI1NiIsInJlZGlyZWN0X3VyaSI6Imh0dHBzOi8vcG9ydGFsLnRocmVhdHNoaWVsZC1zZWN1cml0eS5jb20vIiwic3RhdGUiOiI3ZjE3MjUzMy1kZDdmLTQzZDMtOGJjMC1lZWRiN2UzNzIxZjMiLCJub25jZSI6ImFlNGQzZDcyLTEzMjAtNDA5OS04ZjcxLTVjNTg0ZWY3MjdlNCIsImNvZGVfY2hhbGxlbmdlIjoiY05XcFJja2R5YUhzc2RjTkpjTU9nQXFkMHhmcEI2bll5Q1JseTRlb2FfWSIsInJlc3BvbnNlX21vZGUiOiJmcmFnbWVudCJ9fQ.sj5Ntto8oZr3Q0xLNQVZzLmKR3Sn6IT2jVjsX45v-8g

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

auth.threatdefence.io
fonts.googleapis.com
portal.threatshield-security.com
103.18.41.158
13.210.26.168
142.251.223.74
0825175291be11f7689e8718295e422bb6fa4f8fefccc5610292b720c701ac4e
0b6157d746ce3f83debaef6ba4229269856c07508d6db8ccce9f6c4d6eaf7a46
19edd2b018063320559188548b225aa63914bbc90fb756bc26872db1669e89f0
2a765f666a686821e3e144abd003dafd3d7409325222fc9fd2664164f833795b
31d196afc7bf97b61be0a9881f623b3b8a7b56d4b0c08c6b78c37ce92d7827b2
33eca8fb36229be51db110f08a7bf46ca684abb4c81d60a2f5f9ae19f666c961
3b1bb09f65428eb08efc361c2dbc05b3993a8b1cc2f3301e1a15c3f4523d31c1
3cfb28778895d6adca324710b2000c6e15ef5a7b88d461f39b29ff6fb877b778
47dcf1f1a8f1afd68297a294a263849069a7a62b2e86550241416c2cc56c5676
4891821ebc2db4c531ab849f7ce3231cde07f577c15656d7e0ace02e15f047ed
4e2bc970afb2a8b6f20910069c4639167fd106d4a5201738a9981804f83311f4
81d5057a5bfc9c5b0fbbf5314433dad3bfce537c754cfcbf701dae78e59164cd
8328f814e4eb8c1c12365aa99df559d99e93a4923cb9c1c6a8737dbcc09682bf
acb255de3945454dfc45b4becf811efb182d3fbd67b784e0f9dd4e4c69a7264c
b58067bc7fbd91c6b9e2880d3f13f6c59fd3595ee5e0fd68836296d2404f0324
c4d0c1d2307139239705d3353e569f67d3a18d951225f91304de9aacfcd942fc
c7fab3b0ce9be00afd183248693a873d69a60974faeee167668fd4fbaef19719
e411472c159beda0815953d866b7dd6c8144501ea50139ac7ebbaa302bdfeec2

auth.threatdefence.io Open in urlscan Pro 13.210.26.168 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

19 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

1603 kBTransfer

6400 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

3 Cookies

Indicators

auth.threatdefence.io Open in urlscan Pro
13.210.26.168 Public Scan

Screenshot
Live screenshot

Full Image

19
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

1603 kB
Transfer

6400 kB
Size

3
Cookies

19 HTTP transactions
0 data transactions