internal-concentrix.workspace.group.labs.catsinclover.com.au
Open in
urlscan Pro
103.18.109.95
Malicious Activity!
Public Scan
Submission: On November 30 via api from AU — Scanned from AU
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 31st 2022. Valid for: 3 months.
This is the only time internal-concentrix.workspace.group.labs.catsinclover.com.au was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Community Verdicts: Malicious — 2 votes Show Verdicts
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 103.18.109.95 103.18.109.95 | 132680 (SYNERGYWH...) (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD) | |
1 | 172.253.118.95 172.253.118.95 | 15169 (GOOGLE) (GOOGLE) | |
1 | 141.193.213.10 141.193.213.10 | 209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare) | |
2 | 69.16.175.10 69.16.175.10 | 20446 (STACKPATH...) (STACKPATH-CDN) | |
1 | 142.250.4.94 142.250.4.94 | 15169 (GOOGLE) (GOOGLE) | |
6 | 5 |
ASN132680 (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU)
PTR: rh2.cpcloud.com.au
internal-concentrix.workspace.group.labs.catsinclover.com.au |
ASN15169 (GOOGLE, US)
PTR: sl-in-f95.1e100.net
fonts.googleapis.com |
ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)
www.sugarcrm.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 839 |
97 KB |
1 |
gstatic.com
fonts.gstatic.com |
13 KB |
1 |
sugarcrm.com
www.sugarcrm.com — Cisco Umbrella Rank: 679949 |
4 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 107 |
1 KB |
1 |
catsinclover.com.au
internal-concentrix.workspace.group.labs.catsinclover.com.au |
3 KB |
6 | 5 |
Domain | Requested by | |
---|---|---|
2 | code.jquery.com |
internal-concentrix.workspace.group.labs.catsinclover.com.au
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | www.sugarcrm.com |
internal-concentrix.workspace.group.labs.catsinclover.com.au
|
1 | fonts.googleapis.com |
internal-concentrix.workspace.group.labs.catsinclover.com.au
|
1 | internal-concentrix.workspace.group.labs.catsinclover.com.au | |
6 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
internal-concentrix.workspace.group.labs.catsinclover.com.au cPanel, Inc. Certification Authority |
2022-10-31 - 2023-01-29 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-11-02 - 2023-01-25 |
3 months | crt.sh |
www.sugarcrm.com GeoTrust RSA CA 2018 |
2022-10-14 - 2023-10-17 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-11-02 - 2023-01-25 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://internal-concentrix.workspace.group.labs.catsinclover.com.au/sso-portal/
Frame ID: 05A33A26A484F0DD7E6D7B53F883FC41
Requests: 6 HTTP requests in this frame
Screenshot
Detected technologies
WordPress (CMS) ExpandDetected patterns
- /wp-(?:content|includes)/
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jQuery UI (JavaScript Libraries) Expand
Detected patterns
- ([\d.]+)/jquery-ui(?:\.min)?\.js
- jquery-ui.*\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
internal-concentrix.workspace.group.labs.catsinclover.com.au/sso-portal/ |
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Concentrix-300x165.png
www.sugarcrm.com/wp-content/uploads/2019/07/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.1.min.js
code.jquery.com/ |
88 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui.min.js
code.jquery.com/ui/1.13.2/ |
249 KB 66 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Hw5aXo.woff2
fonts.gstatic.com/s/montserrat/v25/ |
12 KB 13 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Malicious
page.url
Submitted on
December 1st 2022, 7:22:01 pm
UTC —
From United States
Threats:
Phishing
Spearphishing
Brand Impersonation
Comment: Phishing page to steal credentials from Concentrix
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery undefined| current_fs undefined| next_fs undefined| previous_fs undefined| left undefined| opacity undefined| scale undefined| animating function| next0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
internal-concentrix.workspace.group.labs.catsinclover.com.au
www.sugarcrm.com
103.18.109.95
141.193.213.10
142.250.4.94
172.253.118.95
69.16.175.10
68654f446451e5b1a15dc48a01b85e0125d77caea18a65b9f1f5e5275ee7f94a
9528ca634fecad433d044ddd3e6f9ce1f068d5d932dafdbb19d8e6daea1968bd
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
a5feba8ce66eafb93cd4dfff5083877ea2b2bf8daaded3058288b7cddb956cfb
b3af1379cc463959d89f31444d9b3420b67d05ee7b2073fea5c31b7e2c15ce2c
ddc148b8a0a27b1449fda6033f4a0defac9bd43210117b50d5d7ad1eda09f394