www.zygalogin.zygasolutionsllc.com
Open in
urlscan Pro
195.201.204.153
Malicious Activity!
Public Scan
Effective URL: https://www.zygalogin.zygasolutionsllc.com/login
Submission: On January 24 via automatic, source certstream-suspicious — Scanned from DE
Summary
TLS certificate: Issued by R3 on January 24th 2022. Valid for: 3 months.
This is the only time www.zygalogin.zygasolutionsllc.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Workday (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 7 | 195.201.204.153 195.201.204.153 | 24940 (HETZNER-AS) (HETZNER-AS) | |
1 | 2a00:1450:400... 2a00:1450:4001:801::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:801::2003 | 15169 (GOOGLE) (GOOGLE) | |
9 | 3 |
ASN24940 (HETZNER-AS, DE)
PTR: server37.dnsbootserver.com
www.zygalogin.zygasolutionsllc.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
zygasolutionsllc.com
1 redirects
www.zygalogin.zygasolutionsllc.com |
300 KB |
2 |
gstatic.com
fonts.gstatic.com |
46 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 47 |
977 B |
9 | 3 |
Domain | Requested by | |
---|---|---|
7 | www.zygalogin.zygasolutionsllc.com |
1 redirects
www.zygalogin.zygasolutionsllc.com
|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
www.zygalogin.zygasolutionsllc.com
|
9 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.zygalogin.zygasolutionsllc.com R3 |
2022-01-24 - 2022-04-24 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2021-12-27 - 2022-03-21 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2021-12-27 - 2022-03-21 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.zygalogin.zygasolutionsllc.com/login
Frame ID: 3DADC7936E48F18B753921E9175CBF18
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
Sign in | Workday Time ClockPage URL History Show full URLs
-
https://www.zygalogin.zygasolutionsllc.com/
HTTP 302
https://www.zygalogin.zygasolutionsllc.com/login Page URL
Detected technologies
Laravel (Web Frameworks) ExpandDetected patterns
Semantic UI (UI frameworks) Expand
Detected patterns
- <link[^>]+semantic(?:\.min)\.css"
- /semantic(?:-([\d.]+))?(?:\.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.zygalogin.zygasolutionsllc.com/
HTTP 302
https://www.zygalogin.zygasolutionsllc.com/login Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login
www.zygalogin.zygasolutionsllc.com/ Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
semantic.min.css
www.zygalogin.zygasolutionsllc.com/assets/vendor/semantic-ui/ |
1 MB 158 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
auth.css
www.zygalogin.zygasolutionsllc.com/assets/css/ |
3 KB 846 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
logo.png
www.zygalogin.zygasolutionsllc.com/assets/images/img/ |
23 KB 23 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
jquery-3.5.1.min.js
www.zygalogin.zygasolutionsllc.com/assets/vendor/jquery/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
semantic.min.js
www.zygalogin.zygasolutionsllc.com/assets/vendor/semantic-ui/ |
352 KB 86 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
3 KB 977 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v20/ |
23 KB 24 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v20/ |
22 KB 23 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Workday (Online)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.zygalogin.zygasolutionsllc.com/ | Name: XSRF-TOKEN Value: eyJpdiI6IkdLWDIvT0dMVkc4NWJxVFJxZEZ0K3c9PSIsInZhbHVlIjoibktnVEF2d1NQd3pQNjhaNU5JTGFXdjJ4T3gwSFVKV2JzaFdIQ29kSzNuMXhTcEdPb01SMmF3ampjQ1JJdTVPSy81ZzlMVkN4UlBJbUF4Mi84NVZnUUdOaEZRUHVraW9TVWV2T1NDNldtczBaenNBR2w5cmNmQ3E2WXVXZ2VyWWMiLCJtYWMiOiIyNzNhNzlmOTZlNjVmMzM5NGY1YzRjZDVlZTBlMmUxZjlhY2M5NzNjMzg5MDRiNDM3ODdiZWRiN2ZlMmY1NjQ2In0%3D |
|
www.zygalogin.zygasolutionsllc.com/ | Name: laravel_session Value: eyJpdiI6IlludE9NOHZHOHV1ZXVGMFcwY3lPeEE9PSIsInZhbHVlIjoiTWpoZVk0b0w3MTdIREJFZ2ZiazhaMThwTitLOXA5OEFqM0tTeHFzeHVRNEdwYmRJQVdZK1ZuMGs1aERUU0RUMFhSNjBCeEV6N2JNWEUwNTAwd3Q2QmF6cUY4YUZ4R1FyVzBKcjBUaHBjdUZEU0FIeUg3S1pzQWlhYnpBQlI1UmQiLCJtYWMiOiI2ZGMyOTUwMTYxYTg2NmUwYmI4MDc0MzVkNmQ3NTA3ZWU1NjM5YTQxMmZiOWI4OGNmNDY5MzU1MzlhOTQ0NWQ4In0%3D |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
www.zygalogin.zygasolutionsllc.com
195.201.204.153
2a00:1450:4001:801::2003
2a00:1450:4001:801::200a
2776df3fbd9ba78febda8ffb6d00fda92d0e0d6ea1bbc7655fb6b0863f61cec5
2de2c1c460b687fe4c10771ab6702ae98967b417156333c7fc930a17ca1a188c
68b77f1363ae1b9f3f63a27604899825aedd740499a1363968c6f03378d4fde5
8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20
a65e4a5a18504bc179d555e1cf43ad395a5f5a6e56a14f92d777d3a4f67bb9e0
c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1
ca26d077abe0e18c124c551c81df8cc0f00b4d401508a4e38788cc38de23f869
dbe76cb09b60bac97f0d9659f2017d6b202047371ec1742c68ff3a138525facb
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d