protectionauthzoomonlinemeeting.lucerito.com.uy

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 7 HTTP transactions. The main IP is 104.156.58.14, located in Tampa, United States and belongs to HVC-AS, US. The main domain is protectionauthzoomonlinemeeting.lucerito.com.uy.
TLS certificate: Issued by R3 on January 24th 2021. Valid for: 3 months.

This is the only time protectionauthzoomonlinemeeting.lucerito.com.uy was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	110.4.45.82 110.4.45.82	46015 (EXABYTES-...) (EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd.)
1 6	104.156.58.14 104.156.58.14	29802 (HVC-AS) (HVC-AS)
2	2a02:26f0:10c... 2a02:26f0:10c:58f::35c1	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
7	2

1 110.4.45.82 (Malaysia) 1 redirects

ASN46015 (EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd., MY)
PTR: codgel.mschosting.com

pmi.talent-tech.my	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.156.58.14 (Tampa, United States) 1 redirects

ASN29802 (HVC-AS, US)
PTR: tolombon.lineadns.com

protectionauthzoomonlinemeeting.lucerito.com.uy	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:10c:58f::35c1 (Ascension Island)

ASN20940 (AKAMAI-ASN1, NL)

secure.aadcdn.microsoftonline-p.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	lucerito.com.uy 1 redirects protectionauthzoomonlinemeeting.lucerito.com.uy	122 KB
2	microsoftonline-p.com secure.aadcdn.microsoftonline-p.com	409 KB
1	talent-tech.my 1 redirects pmi.talent-tech.my	335 B
7	3

	Domain	Requested by
6	protectionauthzoomonlinemeeting.lucerito.com.uy	1 redirects protectionauthzoomonlinemeeting.lucerito.com.uy
2	secure.aadcdn.microsoftonline-p.com	protectionauthzoomonlinemeeting.lucerito.com.uy
1	pmi.talent-tech.my	1 redirects
7	3

This site contains no links.

Subject Issuer	Validity	Valid
www.protectionauthzoomonlinemeeting.lucerito.com.uy R3	`2021-01-24` - `2021-04-24`	3 months	crt.sh
secure.aadcdn.microsoftonline-p.com Microsoft RSA TLS CA 01	`2020-12-22` - `2021-12-22`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://protectionauthzoomonlinemeeting.lucerito.com.uy/login.php?ss=2&ea=66d6f6e696b612e6b69656c617240706d692e636f6d
Frame ID: 6D64AFCF88C2CB4A73516F5D1150BFD1
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://pmi.talent-tech.my/66d6f6e696b612e6b69656c617240706d692e636f6d HTTP 302
https://protectionauthzoomonlinemeeting.lucerito.com.uy/?ss=2&ea=66d6f6e696b612e6b69656c617240706d692e636f6d HTTP 302
https://protectionauthzoomonlinemeeting.lucerito.com.uy/login.php?ss=2&ea=66d6f6e696b612e6b69656c617240706d692e636f6d Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

7
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

530 kB
Transfer

532 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://pmi.talent-tech.my/66d6f6e696b612e6b69656c617240706d692e636f6d HTTP 302
https://protectionauthzoomonlinemeeting.lucerito.com.uy/?ss=2&ea=66d6f6e696b612e6b69656c617240706d692e636f6d HTTP 302
https://protectionauthzoomonlinemeeting.lucerito.com.uy/login.php?ss=2&ea=66d6f6e696b612e6b69656c617240706d692e636f6d Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request login.php Show response
protectionauthzoomonlinemeeting.lucerito.com.uy/
Redirect Chain

http://pmi.talent-tech.my/66d6f6e696b612e6b69656c617240706d692e636f6d
https://protectionauthzoomonlinemeeting.lucerito.com.uy/?ss=2&ea=66d6f6e696b612e6b69656c617240706d692e636f6d
https://protectionauthzoomonlinemeeting.lucerito.com.uy/login.php?ss=2&ea=66d6f6e696b612e6b69656c617240706d692e636f6d

15 KB
12 KB

1676ms
1675ms

Document
text/html

104.156.58.14
HVC-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://protectionauthzoomonlinemeeting.lucerito.com.uy/login.php?ss=2&ea=66d6f6e696b612e6b69656c617240706d692e636f6d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.156.58.14 Tampa, United States, ASN29802 (HVC-AS, US),
Reverse DNS: tolombon.lineadns.com
Software: Apache /
Resource Hash: cd13e147d46528a0e56e94d0ec953e745022c9cfbf258b9c4c104b9b89f2f60f

Request headers

Host: protectionauthzoomonlinemeeting.lucerito.com.uy
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: PHPSESSID=6p1k6vu0jfabqirfv5mir3ohj7
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 25 Jan 2021 10:05:33 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip
Vary: Accept-Encoding
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Mon, 25 Jan 2021 10:05:33 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip
Vary: Accept-Encoding
Set-Cookie: PHPSESSID=6p1k6vu0jfabqirfv5mir3ohj7; path=/
location: login.php?ss=2&ea=66d6f6e696b612e6b69656c617240706d692e636f6d
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK enc.js Show response
protectionauthzoomonlinemeeting.lucerito.com.uy/files/ 8 KB
9 KB 127ms
126ms Script
application/javascript 104.156.58.14
HVC-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://protectionauthzoomonlinemeeting.lucerito.com.uy/files/enc.js
Requested by: Host: protectionauthzoomonlinemeeting.lucerito.com.uy
URL: https://protectionauthzoomonlinemeeting.lucerito.com.uy/login.php?ss=2&ea=66d6f6e696b612e6b69656c617240706d692e636f6d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.156.58.14 Tampa, United States, ASN29802 (HVC-AS, US),
Reverse DNS: tolombon.lineadns.com
Software: Apache /
Resource Hash: 6369118b817a8a0549092cce8b77d77ac7ec88cc76a66d3ed9e32e9c4f6fb23f

Request headers

Referer: https://protectionauthzoomonlinemeeting.lucerito.com.uy/login.php?ss=2&ea=66d6f6e696b612e6b69656c617240706d692e636f6d
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 25 Jan 2021 10:05:35 GMT
Last-Modified: Fri, 16 Oct 2020 15:15:48 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 8505

GET
H/1.1 200
OK Converged1033.css
protectionauthzoomonlinemeeting.lucerito.com.uy/files/ 99 KB
100 KB 126ms
125ms Stylesheet
text/css 104.156.58.14
HVC-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://protectionauthzoomonlinemeeting.lucerito.com.uy/files/Converged1033.css
Requested by: Host: protectionauthzoomonlinemeeting.lucerito.com.uy
URL: https://protectionauthzoomonlinemeeting.lucerito.com.uy/login.php?ss=2&ea=66d6f6e696b612e6b69656c617240706d692e636f6d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.156.58.14 Tampa, United States, ASN29802 (HVC-AS, US),
Reverse DNS: tolombon.lineadns.com
Software: Apache /
Resource Hash: c7813d74ea586bd46be064ae15384fcb9f3a2279cc108adf711d8fa8ea523435

Request headers

Referer: https://protectionauthzoomonlinemeeting.lucerito.com.uy/login.php?ss=2&ea=66d6f6e696b612e6b69656c617240706d692e636f6d
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 25 Jan 2021 10:05:35 GMT
Last-Modified: Fri, 16 Oct 2020 15:15:48 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 101751

GET
H/1.1 200
OK bannerlogo
secure.aadcdn.microsoftonline-p.com/c1c6b6c8-ilzzekaicbb2dey8lfje0qwxcp56ljf2lld77iimldc/logintenantbranding/0/ 9 KB
9 KB 41ms
9ms Image
image/* 2a02:26f0:10c:58f::35c1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.aadcdn.microsoftonline-p.com/c1c6b6c8-ilzzekaicbb2dey8lfje0qwxcp56ljf2lld77iimldc/logintenantbranding/0/bannerlogo?ts=636120328171082153

Requested by

Host: protectionauthzoomonlinemeeting.lucerito.com.uy
URL: https://protectionauthzoomonlinemeeting.lucerito.com.uy/login.php?ss=2&ea=66d6f6e696b612e6b69656c617240706d692e636f6d

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:10c:58f::35c1 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

/

Resource Hash

50b86581deed9c986d1531e6f4aa9443c1fd937aa69603ac673e7e45114adeab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://protectionauthzoomonlinemeeting.lucerito.com.uy/login.php?ss=2&ea=66d6f6e696b612e6b69656c617240706d692e636f6d
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 25 Jan 2021 10:05:35 GMT
Last-Modified: Fri, 14 Oct 2016 09:06:57 GMT
Content-MD5: 9jqVy9AbP7Wpfyu1hyss0Q==
Strict-Transport-Security: max-age=31536000
Content-Type: image/*
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=84038
Connection: keep-alive
Content-Length: 9007

GET
H/1.1 200
OK arrow_left.png
protectionauthzoomonlinemeeting.lucerito.com.uy/files/ 240 B
482 B 204ms
126ms Image
image/png 104.156.58.14
HVC-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protectionauthzoomonlinemeeting.lucerito.com.uy/files/arrow_left.png
Requested by: Host: protectionauthzoomonlinemeeting.lucerito.com.uy
URL: https://protectionauthzoomonlinemeeting.lucerito.com.uy/login.php?ss=2&ea=66d6f6e696b612e6b69656c617240706d692e636f6d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.156.58.14 Tampa, United States, ASN29802 (HVC-AS, US),
Reverse DNS: tolombon.lineadns.com
Software: Apache /
Resource Hash: ab50358475adae73a435466c72d1a48ab124e8ae06614663716a46dce5ac8b83

Request headers

Referer: https://protectionauthzoomonlinemeeting.lucerito.com.uy/login.php?ss=2&ea=66d6f6e696b612e6b69656c617240706d692e636f6d
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 25 Jan 2021 10:05:35 GMT
Last-Modified: Fri, 16 Oct 2020 15:15:48 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 240

GET
H/1.1 200
OK 1-small.jpg
protectionauthzoomonlinemeeting.lucerito.com.uy/files2/ 987 B
1 KB 331ms
126ms Image
image/jpeg 104.156.58.14
HVC-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protectionauthzoomonlinemeeting.lucerito.com.uy/files2/1-small.jpg
Requested by: Host: protectionauthzoomonlinemeeting.lucerito.com.uy
URL: https://protectionauthzoomonlinemeeting.lucerito.com.uy/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.156.58.14 Tampa, United States, ASN29802 (HVC-AS, US),
Reverse DNS: tolombon.lineadns.com
Software: Apache /
Resource Hash: 8b34a475187302935336bf43a2bf2a4e0adb9a1e87953ea51f6fcf0ef52a4a1d

Request headers

Referer: https://protectionauthzoomonlinemeeting.lucerito.com.uy/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 25 Jan 2021 10:05:36 GMT
Last-Modified: Fri, 16 Oct 2020 15:15:48 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 987

GET
H/1.1 200
OK illustration
secure.aadcdn.microsoftonline-p.com/c1c6b6c8-ilzzekaicbb2dey8lfje0qwxcp56ljf2lld77iimldc/logintenantbranding/0/ 400 KB
400 KB 44ms
13ms Image
image/* 2a02:26f0:10c:58f::35c1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.aadcdn.microsoftonline-p.com/c1c6b6c8-ilzzekaicbb2dey8lfje0qwxcp56ljf2lld77iimldc/logintenantbranding/0/illustration?ts=636120328119354010

Requested by

Host: protectionauthzoomonlinemeeting.lucerito.com.uy
URL: https://protectionauthzoomonlinemeeting.lucerito.com.uy/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:10c:58f::35c1 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

/

Resource Hash

0dbaab64aa31723ca0cecba047a91191524c85dfa843a32bdcc3989bc376a410

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://protectionauthzoomonlinemeeting.lucerito.com.uy/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 25 Jan 2021 10:05:35 GMT
Last-Modified: Fri, 14 Oct 2016 09:06:53 GMT
Content-MD5: 7L4AqIHtpW+55wyl2vOd7g==
Strict-Transport-Security: max-age=31536000
Content-Type: image/*
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=83993
Connection: keep-alive
Content-Length: 409277

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			protectionauthzoomonlinemeeting.lucerito.com.uy/	1969-12-31 23:59:59	Name: PHPSESSID Value: 6p1k6vu0jfabqirfv5mir3ohj7

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

pmi.talent-tech.my
protectionauthzoomonlinemeeting.lucerito.com.uy
secure.aadcdn.microsoftonline-p.com
104.156.58.14
110.4.45.82
2a02:26f0:10c:58f::35c1
0dbaab64aa31723ca0cecba047a91191524c85dfa843a32bdcc3989bc376a410
50b86581deed9c986d1531e6f4aa9443c1fd937aa69603ac673e7e45114adeab
6369118b817a8a0549092cce8b77d77ac7ec88cc76a66d3ed9e32e9c4f6fb23f
8b34a475187302935336bf43a2bf2a4e0adb9a1e87953ea51f6fcf0ef52a4a1d
ab50358475adae73a435466c72d1a48ab124e8ae06614663716a46dce5ac8b83
c7813d74ea586bd46be064ae15384fcb9f3a2279cc108adf711d8fa8ea523435
cd13e147d46528a0e56e94d0ec953e745022c9cfbf258b9c4c104b9b89f2f60f

protectionauthzoomonlinemeeting.lucerito.com.uy Open in urlscan Pro 104.156.58.14 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

2 IPs

3 Countries

530 kBTransfer

532 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

22 JavaScript Global Variables

1 Cookies

Indicators

protectionauthzoomonlinemeeting.lucerito.com.uy Open in urlscan Pro
104.156.58.14 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

530 kB
Transfer

532 kB
Size

1
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!