user-webex.cf
Open in
urlscan Pro
146.148.101.196
Malicious Activity!
Public Scan
Submission: On June 28 via manual from IN
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on June 26th 2019. Valid for: 3 months.
This is the only time user-webex.cf was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Cisco Webex (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
12 | 146.148.101.196 146.148.101.196 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
12 | 1 |
ASN15169 (GOOGLE - Google LLC, US)
PTR: 196.101.148.146.bc.googleusercontent.com
user-webex.cf |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
user-webex.cf
user-webex.cf |
378 KB |
12 | 1 |
Domain | Requested by | |
---|---|---|
12 | user-webex.cf |
user-webex.cf
|
12 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.webex.com |
www.cisco.com |
meetings.webex.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
user-webex.cf Let's Encrypt Authority X3 |
2019-06-26 - 2019-09-24 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://user-webex.cf/idb/saml2/jsp/
Frame ID: 92C838C037AEF510E1C920E06E7B7F1C
Requests: 12 HTTP requests in this frame
4 Outgoing links
These are links going to different origins than the main page.
Title: Terms of Service
Search URL Search Domain Scan URL
Title: Privacy Statement
Search URL Search Domain Scan URL
Title: Learn more about
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
user-webex.cf/idb/saml2/jsp/ |
17 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
collab-ui_14aa171060ff838aa864e3a258ea231d.min.css
user-webex.cf/idb/css/ |
1 MB 100 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
collab-ui-icons_450a2769f8d9aefecb8a1422bb997346.min.css
user-webex.cf/idb/css/ |
122 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
idbstyle_symphony_94d03ed9e5833fac404765e2612e2b13.css
user-webex.cf/idb/css/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
idbstyle_service_webex.css
user-webex.cf/idb/css/ |
814 B 670 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
component_ffbc204eb8b8c20b1c0d483556979d98.js
user-webex.cf/idb/wwf/js/ |
684 KB 131 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
console_cfb0274999575ad33f5541e88b6414fd.js
user-webex.cf/idb/js/ |
89 B 452 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
auth_symphony_2d4abaa2e52c97467cadb3b5d7cd222a.js
user-webex.cf/idb/js/ |
31 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cisco-webex-lockup-blue.svg
user-webex.cf/idb/images/cisco-webex/lockup/ |
9 KB 9 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
CiscoSansTTRegular.woff2
user-webex.cf/idb/fonts/ |
52 KB 52 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
meetings-icon-color.svg
user-webex.cf/idb/images/webex-meetings/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
CiscoSansTTLight.woff2
user-webex.cf/idb/fonts/ |
52 KB 53 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Cisco Webex (Online)91 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| jMarker object| i18n string| HEMISPHERE_SOUTH string| HEMISPHERE_NORTH string| HEMISPHERE_UNKNOWN object| olson function| TimeZone function| date_is_dst function| get_date_offset function| get_timezone_info function| get_january_offset function| get_june_offset function| determine_timezone function| $ function| jQuery object| WWF object| WBX function| Class string| k string| v object| fruit function| isFunction object| logger function| trim object| rnotwhite object| trimLeft object| trimRight object| func object| mirrorPool undefined| sourceFn string| idbPageVersion function| occupyFullBrowser function| placeCursorOnFirstElm function| markupButton function| markupButton2 function| aggSubmit function| getSelectedRadioValue function| getSelectedCheckBoxValues function| strTrim function| clearFormElms function| writePasswordPolicy function| showLabel function| hideLabel function| enableButton function| disableButton function| validateForm function| initializeForm function| isPasswordResetPage function| makeReadonly function| adjustButtons function| highlightFocusedInputTextbox function| removeHighlightErrorInputTextbox function| highlightErrorInputTextbox function| highlightErrorWithoutShowErrorMsg function| showHideHelpPopup function| showHidePopup function| closePopup function| openPopup function| reloadPageWithSelectedLocale function| setHelpPopupPosition function| setLoginOptionsWidth function| setPageVersion function| addAudioTag function| bindFocusInOut function| updatePlaceHolder function| isIE function| isSafari function| passwordPolicyInit function| checkPasswordPoicy function| resetPasswordPolicyCheckStatus number| elmCount number| passwordCount number| loginOptionElmCount string| localeData string| redirectUrl boolean| nameValidated string| defaultBtn object| LoginOption function| defaultSubmit object| passwordPolicy function| LoginSubmit function| submitForm function| validateName function| processLink boolean| toggle function| toggleHelp function| hideTooltip object| antiClickjack0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
user-webex.cf
146.148.101.196
25434540002466465f8d84e944ab9b4fe2e61bc946de440f661096e2f4aa91a5
3f967a09b94b9283339c130977ef0dbd3ef8d5b231f65dee4a2b63c7413b30af
74c9df7734ebe33695af04a80d0f7339079e3985f6dce59d43b27c1d4c8e549e
77904ea504ebc691fd8193fa3c8a5e8c9a9a82d83c17482318566784137a5711
7cd5e8b09d77c0fc360fc19bc6f3bb463f743b2866fa82f52a94dd123fddc703
a4ee35f2d6dec7dc7fcdfa62f3485e232d3a52828c99b4f1c23415a30dd2f5fe
b30cf8c4465930bd7aa83b1e6d4683391cfe85cd5cba5cb6f2c43e2e879b0fe6
b9195b34a9d6807e3952cf46e9da508b5981e6d1187c9183ac59e8899b505233
c49b55f11c83766838e727a4b130bba58a7430254c6149ea49a7d187395e0f4c
d8dcc4001aab9e6914fd6319c67f6cf8e1d5e7ed3410dd3dda29bcb5f3039276
e77b9a9fa5f7f72fee5e61b8a95ac30a53f9d405b7b8aa4d017b7315663a16ec
f826288d2c18f1a34d68bcef648bd6d8ad1e993594c0fbcfbfc4684ce27f6605