training.againstphishing.com
Open in
urlscan Pro
2a06:98c1:3120::3
Malicious Activity!
Public Scan
Effective URL: https://training.againstphishing.com/cdce21c8bfff7ad8f399ef6f0108cf836459499dd1f2cf4a78e73487412af46e
Submission: On March 24 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 11th 2022. Valid for: a year.
This is the only time training.againstphishing.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 167.89.123.122 167.89.123.122 | 11377 (SENDGRID) (SENDGRID) | |
1 1 | 2a06:98c1:312... 2a06:98c1:3121::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 2a06:98c1:312... 2a06:98c1:3120::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:82a::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 192.229.221.185 192.229.221.185 | 15133 (EDGECAST) (EDGECAST) | |
1 | 2606:4700:303... 2606:4700:3032::ac43:aa75 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:3a | 20446 (STACKPATH...) (STACKPATH-CDN) | |
1 | 2a00:1450:400... 2a00:1450:4001:813::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 104.237.62.211 104.237.62.211 | 18450 (WEBNX) (WEBNX) | |
10 | 8 |
ASN11377 (SENDGRID, US)
PTR: o16789123x122.outbound-mail.sendgrid.net
u2879469.ct.sendgrid.net |
ASN18450 (WEBNX, US)
PTR: hosted-by.racknerd.com
api.ipify.org |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
againstphishing.com
training.againstphishing.com |
130 KB |
1 |
ipify.org
api.ipify.org — Cisco Umbrella Rank: 2586 |
139 B |
1 |
gstatic.com
fonts.gstatic.com |
31 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 673 |
30 KB |
1 |
symbolsecurity.com
app.symbolsecurity.com |
9 KB |
1 |
msauth.net
logincdn.msauth.net — Cisco Umbrella Rank: 3685 |
1 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 31 |
1 KB |
1 |
recordsconfirmation.com
1 redirects
training.recordsconfirmation.com |
542 B |
1 |
sendgrid.net
1 redirects
u2879469.ct.sendgrid.net |
309 B |
10 | 9 |
Domain | Requested by | |
---|---|---|
4 | training.againstphishing.com |
training.againstphishing.com
|
1 | api.ipify.org |
code.jquery.com
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | code.jquery.com |
training.againstphishing.com
|
1 | app.symbolsecurity.com |
training.againstphishing.com
|
1 | logincdn.msauth.net |
training.againstphishing.com
|
1 | fonts.googleapis.com |
training.againstphishing.com
|
1 | training.recordsconfirmation.com | 1 redirects |
1 | u2879469.ct.sendgrid.net | 1 redirects |
10 | 9 |
This site contains links to these domains. Also see Links.
Domain |
---|
app.symbolsecurity.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-05-11 - 2023-05-11 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-03-06 - 2023-05-29 |
3 months | crt.sh |
identitycdn.msauth.net Microsoft Azure TLS Issuing CA 06 |
2022-08-23 - 2023-08-18 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-03-06 - 2023-05-29 |
3 months | crt.sh |
*.ipify.org Sectigo RSA Domain Validation Secure Server CA |
2023-02-07 - 2024-02-18 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://training.againstphishing.com/cdce21c8bfff7ad8f399ef6f0108cf836459499dd1f2cf4a78e73487412af46e
Frame ID: 63C18AEB3565EC0E5B468456A23B9F6C
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
Sign in to your Microsoft accountPage URL History Show full URLs
-
https://u2879469.ct.sendgrid.net/ls/click?upn=5vEP6GR4YxDu-2Fo-2B8AkymoMioD2nVrWRZYNv8bM-2FHHqiFqrUZwnRYYOq49...
HTTP 302
https://training.recordsconfirmation.com/cdce21c8bfff7ad8f399ef6f0108cf836459499dd1f2cf4a78e73487412af46e HTTP 301
https://training.againstphishing.com/cdce21c8bfff7ad8f399ef6f0108cf836459499dd1f2cf4a78e73487412af46e Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://u2879469.ct.sendgrid.net/ls/click?upn=5vEP6GR4YxDu-2Fo-2B8AkymoMioD2nVrWRZYNv8bM-2FHHqiFqrUZwnRYYOq49go6HtXJyxOibBeKwEd0qQTwb37fEJQAiotQc9zZcnp6hkhuuYNKhrHrv3IS4mreYKkTKYLY-2BBgKGaEGXDbYHijWhXz41R66UH4YgZBnZOUoED9YNhA-3Dd7jj_uEkIHAuKEVhApV1fEfhV95HLDIWH3erNdBE-2FVr9vlZ6reiI0rssBWNb8INEbnFfwjczKXA55ZYcxhHj-2BcJFxCUF3btgLaPWx5owe9tDx51PMClEHmezyCKGZ1LHr0EdjXQmtso8wmaO7WR4-2F-2FQRZXrbUCYFRp2UccrbtAV-2B1GPYi9izDhsw1yyvakfHqvZoRs-2Brh2dh8aFs46f9-2Fqol5-2F9T6jDDfpGhQDibF4fe-2B6x4Tf2YkXJOJXTYkmLs2yxQyuilFhsO-2FTAGd1OplUxAy6pnStrSohPsc9vMCGJ1QKr1Yp9ZbIp-2FAbJOI0o0Ec7ZZFttCXj5xDUMad-2BONZ3QAOoHDdQK9Ab7DQhKSTIBxMhQlmlMZ9Vh7OQelE4IJgL11QwQyy7y-2Fv-2Bnph-2FE3lOlXWerQ7HlDggW-2BCwcmQ1XMXQjWQh0tRyXqdB7FsSuag8MJ4r-2FenQClGttJLLKxv2s8uzNUkmXMbWVMa1mc7s3arCr5WH2MkiUL8aF-2BtTvGIXK-2BcHAwWllj-2Fim6ihWZBWzj94bj4vZJ7VxY-2FCvf5SW3dysnqe-2BxTTy-2BlrxnWqJ6rvtEu3tUAebicdWW2q-2FbPjlNpQgXZAvODcyh3AHKkiNGfr6RX-2Bwesk6jn0RVwcCvShVagHgj3F-2BVjIXkGCHRQ5nnwb2irdbcAr510xn79nSz5SvTcUyV-2BOEABEJD3NNCb-2B5VattcclONUr-2FKUvs2iwCjwQ-3D-3D
HTTP 302
https://training.recordsconfirmation.com/cdce21c8bfff7ad8f399ef6f0108cf836459499dd1f2cf4a78e73487412af46e HTTP 301
https://training.againstphishing.com/cdce21c8bfff7ad8f399ef6f0108cf836459499dd1f2cf4a78e73487412af46e Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
cdce21c8bfff7ad8f399ef6f0108cf836459499dd1f2cf4a78e73487412af46e
training.againstphishing.com/ Redirect Chain
|
126 KB 76 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
8 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2_bc3d32a696895f78c19df6c717586a5d.svg
logincdn.msauth.net/shared/1.0/content/images/backgrounds/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
68 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
phished.png
training.againstphishing.com/assets/images/ |
40 KB 40 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
netflix_popup.png
training.againstphishing.com/assets/images/ |
12 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
RightNetworks.png
app.symbolsecurity.com/storage/e8dd20d6-b200-4390-9763-e1f3fd19e70b/logos/ |
8 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
email-decode.min.js
training.againstphishing.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v25/ |
30 KB 31 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
api.ipify.org/ |
64 B 139 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| $ function| jQuery boolean| isPhished string| ip string| ipifyURL function| showPopUps function| createDataEnteredEvent1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
training.againstphishing.com/ | Name: _symbol_session Value: MTY3OTY4MjQwMHxEdi1CQkFFQ180SUFBUkFCRUFBQV82UF9nZ0FEQm5OMGNtbHVad3dPQUF4eVpYRjFaWE4wYjNKZmFXUUdjM1J5YVc1bkRCWUFGR0ptT1RjMU9EbG1ZVGRrWW1Oak4yTTFNVGd4Qm5OMGNtbHVad3dVQUJKaGRYUm9aVzUwYVdOcGRIbGZkRzlyWlc0SFcxMTFhVzUwT0FvaUFDQ3J6TnRvdEpNb19maEhWV0JCcjhtb2FPczloMzVNemsyQVVMNHRNWVQwSWdaemRISnBibWNNQ1FBSFgyWnNZWE5vWHdkYlhYVnBiblE0Q2dRQUFudDl8YxI-O9maoEHGcotWlwE6FrtObTFeDAVvchuVk0yxvX4= |
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=60; includeSubDomains; preload |
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.ipify.org
app.symbolsecurity.com
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
logincdn.msauth.net
training.againstphishing.com
training.recordsconfirmation.com
u2879469.ct.sendgrid.net
104.237.62.211
167.89.123.122
192.229.221.185
2001:4de0:ac18::1:a:3a
2606:4700:3032::ac43:aa75
2a00:1450:4001:813::2003
2a00:1450:4001:82a::200a
2a06:98c1:3120::3
2a06:98c1:3121::3
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
16340e3752e5178f7ce8c6042efe2a071cb3e308dbe36ae99f4bfc5a8725f60b
198d5cd42b2a98e0ec861f7adafce306641216f9ec786cba6d2476c7298bd9c6
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
59fc62c48edbfe2d7172147a1d76d762180709c0b612ce9186fb61bc2c2bddf0
6cad848aa3eb37cf13360670f424cd26109e5e10e18fd2062231483f074aa27d
88b9efb777751157047e99394a81ab6a1ccf8e838c2c759bb73f45521021536b
ae2f298ad4faf0af07a29caef147fc820e0c4df877133ea529eae9d7b5430ab1
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
fb15e814acb33c7723f15b5107071995130e53d7e9266b9f6f2cf429bb4bef24