learning.trustwave-lessonly.com
Open in
urlscan Pro
38.106.143.34
Malicious Activity!
Public Scan
Submission: On December 05 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on December 1st 2022. Valid for: 3 months.
This is the only time learning.trustwave-lessonly.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 38.106.143.34 38.106.143.34 | 33151 (TRUSTWAVE...) (TRUSTWAVE-ASN) | |
2 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2620:1ec:bdf::45 2620:1ec:bdf::45 | 8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2620:1ec:46::60 2620:1ec:46::60 | 8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
11 | 4 |
ASN33151 (TRUSTWAVE-ASN, US)
PTR: cip-34.trustwave.com
learning.trustwave-lessonly.com |
ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
aadcdn.msftauthimages.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
trustwave-lessonly.com
learning.trustwave-lessonly.com |
31 KB |
2 |
msftauthimages.net
aadcdn.msftauthimages.net — Cisco Umbrella Rank: 4071 |
256 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 242 |
50 KB |
1 |
msauth.net
aadcdn.msauth.net — Cisco Umbrella Rank: 1256 |
959 B |
11 | 4 |
Domain | Requested by | |
---|---|---|
6 | learning.trustwave-lessonly.com |
learning.trustwave-lessonly.com
|
2 | aadcdn.msftauthimages.net |
learning.trustwave-lessonly.com
|
2 | cdnjs.cloudflare.com |
learning.trustwave-lessonly.com
|
1 | aadcdn.msauth.net |
learning.trustwave-lessonly.com
|
11 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
learning.trustwave-lessonly.com R3 |
2022-12-01 - 2023-03-01 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-08-03 - 2023-08-02 |
a year | crt.sh |
aadcdn.msftauthimages.net Microsoft Azure TLS Issuing CA 06 |
2022-09-29 - 2023-09-24 |
a year | crt.sh |
aadcdn.msauth.net DigiCert SHA2 Secure Server CA |
2022-08-23 - 2023-08-23 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://learning.trustwave-lessonly.com/425
Frame ID: 41B59E1E8E58DB875ACB4E70814785B9
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
Sign in to your accountDetected technologies
TrackJs (Analytics) ExpandDetected patterns
- tracker\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
425
learning.trustwave-lessonly.com/ |
8 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
events.js
learning.trustwave-lessonly.com/js/ |
558 B 917 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
timeme.min.js
learning.trustwave-lessonly.com/js/ |
4 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
time-tracker.js
learning.trustwave-lessonly.com/js/ |
2 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
learning.trustwave-lessonly.com/public/campaign/208/215/11/ |
130 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
knockout-latest.js
cdnjs.cloudflare.com/ajax/libs/knockout/3.5.1/ |
67 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/ |
87 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bannerlogo
aadcdn.msftauthimages.net/dbd5a2dd-qm0vsd-ve8jvyua30fvokhnaycrjousvqmt6wl-gkz4/logintenantbranding/0/ |
6 KB 6 KB |
Image
image/* |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
aadcdn.msauth.net/shared/1.0/content/images/ |
513 B 959 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
illustration
aadcdn.msftauthimages.net/dbd5a2dd-qm0vsd-ve8jvyua30fvokhnaycrjousvqmt6wl-gkz4/logintenantbranding/0/ |
249 KB 249 KB |
Image
image/* |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
track-time
learning.trustwave-lessonly.com/scenario/ |
0 576 B |
Ping
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange function| lucyDispatchEvent object| TimeMe boolean| injected function| trackTime function| sendUserActivityTimeData function| runChromeTimeTracker function| isChrome object| ko function| $ function| jQuery function| vm2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
learning.trustwave-lessonly.com/ | Name: PHPSESSID Value: dupqqmba6da5tmejjel70u49a1 |
|
learning.trustwave-lessonly.com/ | Name: link Value: 425 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msauth.net
aadcdn.msftauthimages.net
cdnjs.cloudflare.com
learning.trustwave-lessonly.com
2606:4700::6811:180e
2620:1ec:46::60
2620:1ec:bdf::45
38.106.143.34
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
3ae66a8d261814acf0678914f1832973fe5be31912abf545f81fe4f97fd707dd
6d43846a2a668239591ae096d3d83ffc2d5072c3d4b77a7b81c88a363c061bdb
931560980025d359cbbd3d1e566d10012ea28ecaab022e6e7e92e7694c7543d5
a793d8fa84d3d51624347b9c40a29a66f1d51a639c4c38d629b0f1a4c18d1b9a
a8f7e59c2a6d75c51e1898b2d1ff9f6f666caad39a12d215e506202fce2ce150
ce5b41bb9e310321a957d16cbd21b476c2f68454eb3eb6c5f79a3f3e823908c0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8957bb182a5047b07bea0a49fd22b11614b1ab9ac5b8286fcb2259f48658e73
f2f1c8bee8f03941bf2567ed1a6e13c9c08b581459254d38a0a9b84ed3756ca9
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d