br622.teste.website
Open in
urlscan Pro
50.116.112.110
Malicious Activity!
Public Scan
URL:
http://br622.teste.website/~globa379/senha.php
Submission: On January 02 via manual from TR — Scanned from DE
Submission: On January 02 via manual from TR — Scanned from DE
Summary
This website contacted 2 IPs
in 1 countries
across 2 domains to perform 14 HTTP transactions.
The main IP is 50.116.112.110, located in
United States and
belongs to UNIFIEDLAYER-AS-1, US.
The main domain is br622.teste.website.
This is the only time br622.teste.website was scanned on urlscan.io!
This is the only time br622.teste.website was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Cisco Webex (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 13 | 50.116.112.110 50.116.112.110 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
| 1 | 64.68.100.6 64.68.100.6 | 13445 (13445) (13445) | |
| 14 | 2 |
13
50.116.112.110
(United States)
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: br622.hostgator.com.br
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: br622.hostgator.com.br
| br622.teste.website |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 13 |
teste.website
br622.teste.website |
213 KB |
| 1 |
webex.com
idbroker.webex.com |
3 KB |
| 14 | 2 |
| Domain | Requested by | |
|---|---|---|
| 13 | br622.teste.website |
br622.teste.website
|
| 1 | idbroker.webex.com |
br622.teste.website
|
| 14 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| idbroker.webex.com |
| www.webex.com |
| www.cisco.com |
| help.webex.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| idbroker.webex.com HydrantID Server CA O1 |
2021-09-24 - 2022-09-24 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://br622.teste.website/~globa379/senha.php
Frame ID: 52CB8EA1AEE796B0F240E8B8829B50C7
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
Sign In - Webex MeetingsDetected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
URL: https://idbroker.webex.com/idb/saml2/jsp/doSSO.jsp
Title: Did you forget your password?
Title: Did you forget your password?
Search URL Search Domain Scan URL
URL: http://www.webex.com/terms-of-service.html
Title: Terms of the Service
Title: Terms of the Service
Search URL Search Domain Scan URL
URL: http://www.cisco.com/web/siteassets/legal/privacy.html
Title: Privacy Statement
Title: Privacy Statement
Search URL Search Domain Scan URL
URL: http://www.webex.com/why-webex/overview.html
Title: Learn more about
Title: Learn more about
Search URL Search Domain Scan URL
URL: https://help.webex.com/
Title: Help
Title: Help
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
senha.php
br622.teste.website/~globa379/ |
22 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
collab-ui_14aa171060ff838aa864e3a258ea231d.min.css
br622.teste.website/~globa379/arquivos/ |
1 MB 132 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
collab-ui-icons_450a2769f8d9aefecb8a1422bb997346.min.css
br622.teste.website/~globa379/arquivos/ |
99 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
idbstyle_symphony_2888e7d73cf2af6e24b29df9e9e093b0.css
br622.teste.website/~globa379/arquivos/ |
7 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
idbstyle_service_webex.css
br622.teste.website/~globa379/arquivos/ |
794 B 667 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-3.4.1.min.js.download
br622.teste.website/~globa379/arquivos/ |
86 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
console_cfb0274999575ad33f5541e88b6414fd.js.download
br622.teste.website/~globa379/arquivos/ |
705 B 546 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
auth_symphony_f43c84bf7826298cace43be6e534638d.js.download
br622.teste.website/~globa379/arquivos/ |
27 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cisco-webex-lockup-blue.svg
br622.teste.website/~globa379/arquivos/ |
9 KB 9 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
meetings-icon-color.svg
idbroker.webex.com/idb/images/webex-meetings/ |
2 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
CiscoSansTTRegular.woff2
br622.teste.website/~globa379/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
CiscoSansTTLight.woff2
br622.teste.website/~globa379/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
CiscoSansTTLight.woff
br622.teste.website/~globa379/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
CiscoSansTTRegular.woff
br622.teste.website/~globa379/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Cisco Webex (Online)58 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery string| idbPageVersion function| occupyFullBrowser function| placeCursorOnFirstElm function| aggSubmit function| getSelectedRadioValue function| getSelectedCheckBoxValues function| strTrim function| clearFormElms function| writePasswordPolicy function| showLabel function| hideLabel function| enableButton function| disableButton function| validateForm function| initializeForm function| isPasswordResetPage function| makeReadonly function| adjustButtons function| highlightFocusedInputTextbox function| removeHighlightErrorInputTextbox function| highlightErrorInputTextbox function| highlightErrorWithoutShowErrorMsg function| showHideHelpPopup function| showHidePopup function| closePopup function| openPopup function| reloadPageWithSelectedLocale function| setHelpPopupPosition function| setLoginOptionsWidth function| setPageVersion function| addAudioTag function| bindFocusInOut function| updatePlaceHolder function| isIE function| isSafari function| passwordPolicyInit function| checkPasswordPoicy function| resetPasswordPolicyCheckStatus number| elmCount number| passwordCount number| loginOptionElmCount string| localeData string| redirectUrl boolean| nameValidated string| defaultBtn object| LoginOption function| defaultSubmit object| passwordPolicy function| LoginSubmit function| submitForm function| validateName function| processLink boolean| toggle function| toggleHelp function| hideTooltip object| antiClickjack1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .webex.com/idb/ | Name: amlbcookie Value: 16 |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
br622.teste.website
idbroker.webex.com
50.116.112.110
64.68.100.6
073168e0c6afa306a9aefb894c5fd185684abd0ba762727200e35f2b4240d413
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
2e2526c7735f494c6c80a04ad0203e22b601b46a4185dcbdee736b08c32a3bed
5800e460d5b944b61a82903e672fa57d8c996d19710cf1a416e4184b9db47b33
b30cf8c4465930bd7aa83b1e6d4683391cfe85cd5cba5cb6f2c43e2e879b0fe6
b40295fea154f19de58ba33d07567b8471c6965e4fc68fb93b976551b8f92782
c04527cb0859edd8d37b324d7f281a43f57006b9003a7822d520918086a5cbbf
c72446dfce8059feee9df7b1bd638101541b13683cbd97bb6945e936b0cd8819
d8dcc4001aab9e6914fd6319c67f6cf8e1d5e7ed3410dd3dda29bcb5f3039276
fc2b1c1f72b9e2b9c9b37f8649163bcaa95796a95ddb05fe9610c4d32e084dbb