signin-webex-cisco.com
Open in
urlscan Pro
35.203.142.127
Malicious Activity!
Public Scan
Submitted URL: http://www.nongkhanan.go.th/site/images/banners/admin.php?=Webex-Meeting
Effective URL: https://signin-webex-cisco.com/idb/saml/jsp/index.php?zTFwBbpas8MECDf6-ZIw/wk0VCqBT
Submission: On August 26 via manual from US
Effective URL: https://signin-webex-cisco.com/idb/saml/jsp/index.php?zTFwBbpas8MECDf6-ZIw/wk0VCqBT
Submission: On August 26 via manual from US
Summary
This website contacted 1 IPs
in 2 countries
across 2 domains to perform 13 HTTP transactions.
The main IP is 35.203.142.127, located in
Mountain View, United States and
belongs to GOOGLE - Google LLC, US.
The main domain is signin-webex-cisco.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on August 26th 2019. Valid for: 3 months.
This is the only time signin-webex-cisco.com was scanned on urlscan.io!
TLS certificate: Issued by Let's Encrypt Authority X3 on August 26th 2019. Valid for: 3 months.
This is the only time signin-webex-cisco.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Cisco Webex (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 103.4.217.3 103.4.217.3 | 63940 (DRAGONHIS...) (DRAGONHISPEED-AS-AP dragonhispeed) | |
| 13 | 35.203.142.127 35.203.142.127 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 13 | 1 |
13
35.203.142.127
(Mountain View, United States)
ASN15169 (GOOGLE - Google LLC, US)
PTR: 127.142.203.35.bc.googleusercontent.com
ASN15169 (GOOGLE - Google LLC, US)
PTR: 127.142.203.35.bc.googleusercontent.com
| signin-webex-cisco.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 13 |
signin-webex-cisco.com
signin-webex-cisco.com |
378 KB |
| 1 |
nongkhanan.go.th
1 redirects
www.nongkhanan.go.th |
229 B |
| 13 | 2 |
| Domain | Requested by | |
|---|---|---|
| 13 | signin-webex-cisco.com |
signin-webex-cisco.com
|
| 1 | www.nongkhanan.go.th | 1 redirects |
| 13 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.webex.com |
| www.cisco.com |
| meetings.webex.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| signin-webex-cisco.com Let's Encrypt Authority X3 |
2019-08-26 - 2019-11-24 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://signin-webex-cisco.com/idb/saml/jsp/index.php?zTFwBbpas8MECDf6-ZIw/wk0VCqBT
Frame ID: 49265A7952C6FE294FFA5427FA3E6604
Requests: 13 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://www.nongkhanan.go.th/site/images/banners/admin.php?=Webex-Meeting
HTTP 302
https://signin-webex-cisco.com/ Page URL
- https://signin-webex-cisco.com/idb/saml/jsp/index.php?zTFwBbpas8MECDf6-ZIw/wk0VCqBT Page URL
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Ubuntu
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /Ubuntu/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
URL: http://www.webex.com/terms-of-service.html
Title: Terms of Service
Title: Terms of Service
Search URL Search Domain Scan URL
URL: http://www.cisco.com/web/siteassets/legal/privacy.html
Title: Privacy Statement
Title: Privacy Statement
Search URL Search Domain Scan URL
URL: http://www.webex.com/why-webex/overview.html
Title: Learn more about
Title: Learn more about
Search URL Search Domain Scan URL
URL: https://meetings.webex.com/collabs/support/nfaqs
Title: Help
Title: Help
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.nongkhanan.go.th/site/images/banners/admin.php?=Webex-Meeting
HTTP 302
https://signin-webex-cisco.com/ Page URL
- https://signin-webex-cisco.com/idb/saml/jsp/index.php?zTFwBbpas8MECDf6-ZIw/wk0VCqBT Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://www.nongkhanan.go.th/site/images/banners/admin.php?=Webex-Meeting HTTP 302
- https://signin-webex-cisco.com/
13 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
 Cookie set
/
signin-webex-cisco.com/ Redirect Chain
|
158 B 589 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
index.php
signin-webex-cisco.com/idb/saml/jsp/ |
17 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
collab-ui_14aa171060ff838aa864e3a258ea231d.min.css
signin-webex-cisco.com/idb/css/ |
1 MB 100 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
collab-ui-icons_450a2769f8d9aefecb8a1422bb997346.min.css
signin-webex-cisco.com/idb/css/ |
122 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
idbstyle_symphony_94d03ed9e5833fac404765e2612e2b13.css
signin-webex-cisco.com/idb/css/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
idbstyle_service_webex.css
signin-webex-cisco.com/idb/css/ |
814 B 670 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
component_ffbc204eb8b8c20b1c0d483556979d98.js
signin-webex-cisco.com/idb/wwf/js/ |
684 KB 131 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
console_cfb0274999575ad33f5541e88b6414fd.js
signin-webex-cisco.com/idb/js/ |
89 B 453 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
auth_symphony_2d4abaa2e52c97467cadb3b5d7cd222a.js
signin-webex-cisco.com/idb/js/ |
31 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cisco-webex-lockup-blue.svg
signin-webex-cisco.com/idb/images/cisco-webex/lockup/ |
9 KB 9 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
CiscoSansTTRegular.woff2
signin-webex-cisco.com/idb/fonts/ |
52 KB 52 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
meetings-icon-color.svg
signin-webex-cisco.com/idb/images/webex-meetings/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
CiscoSansTTLight.woff2
signin-webex-cisco.com/idb/fonts/ |
52 KB 53 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Cisco Webex (Online)88 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| jMarker object| i18n string| HEMISPHERE_SOUTH string| HEMISPHERE_NORTH string| HEMISPHERE_UNKNOWN object| olson function| TimeZone function| date_is_dst function| get_date_offset function| get_timezone_info function| get_january_offset function| get_june_offset function| determine_timezone function| $ function| jQuery object| WWF object| WBX function| Class string| k string| v object| fruit function| isFunction object| logger function| trim object| rnotwhite object| trimLeft object| trimRight object| func object| mirrorPool undefined| sourceFn string| idbPageVersion function| occupyFullBrowser function| placeCursorOnFirstElm function| markupButton function| markupButton2 function| aggSubmit function| getSelectedRadioValue function| getSelectedCheckBoxValues function| strTrim function| clearFormElms function| writePasswordPolicy function| showLabel function| hideLabel function| enableButton function| disableButton function| validateForm function| initializeForm function| isPasswordResetPage function| makeReadonly function| adjustButtons function| highlightFocusedInputTextbox function| removeHighlightErrorInputTextbox function| highlightErrorInputTextbox function| highlightErrorWithoutShowErrorMsg function| showHideHelpPopup function| showHidePopup function| closePopup function| openPopup function| reloadPageWithSelectedLocale function| setHelpPopupPosition function| setLoginOptionsWidth function| setPageVersion function| addAudioTag function| bindFocusInOut function| updatePlaceHolder function| isIE function| isSafari function| passwordPolicyInit function| checkPasswordPoicy function| resetPasswordPolicyCheckStatus number| elmCount number| passwordCount number| loginOptionElmCount string| localeData string| redirectUrl boolean| nameValidated string| defaultBtn object| LoginOption function| defaultSubmit object| passwordPolicy function| LoginSubmit function| submitForm function| validateName function| processLink boolean| toggle function| toggleHelp function| hideTooltip object| antiClickjack0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
signin-webex-cisco.com
www.nongkhanan.go.th
103.4.217.3
35.203.142.127
25434540002466465f8d84e944ab9b4fe2e61bc946de440f661096e2f4aa91a5
3f967a09b94b9283339c130977ef0dbd3ef8d5b231f65dee4a2b63c7413b30af
74c9df7734ebe33695af04a80d0f7339079e3985f6dce59d43b27c1d4c8e549e
77904ea504ebc691fd8193fa3c8a5e8c9a9a82d83c17482318566784137a5711
7cd5e8b09d77c0fc360fc19bc6f3bb463f743b2866fa82f52a94dd123fddc703
a4ee35f2d6dec7dc7fcdfa62f3485e232d3a52828c99b4f1c23415a30dd2f5fe
a808c93c868e854a9bd055009ae41e10e5a61e16bb52671d76b122052f44875b
b30cf8c4465930bd7aa83b1e6d4683391cfe85cd5cba5cb6f2c43e2e879b0fe6
b9195b34a9d6807e3952cf46e9da508b5981e6d1187c9183ac59e8899b505233
c49b55f11c83766838e727a4b130bba58a7430254c6149ea49a7d187395e0f4c
d8dcc4001aab9e6914fd6319c67f6cf8e1d5e7ed3410dd3dda29bcb5f3039276
e77b9a9fa5f7f72fee5e61b8a95ac30a53f9d405b7b8aa4d017b7315663a16ec
f826288d2c18f1a34d68bcef648bd6d8ad1e993594c0fbcfbfc4684ce27f6605