secureauthentication.cgclogin.com
Open in
urlscan Pro
124.82.4.169
Malicious Activity!
Public Scan
URL:
https://secureauthentication.cgclogin.com/
Submission: On August 29 via automatic, source certstream-suspicious — Scanned from DE
Submission: On August 29 via automatic, source certstream-suspicious — Scanned from DE
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 5 HTTP transactions.
The main IP is 124.82.4.169, located in
Subang Jaya, Malaysia and
belongs to TMNET-AS-AP TM Net, Internet Service Provider, MY.
The main domain is secureauthentication.cgclogin.com.
TLS certificate: Issued by R3 on August 29th 2022. Valid for: 3 months.
This is the only time secureauthentication.cgclogin.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on August 29th 2022. Valid for: 3 months.
This is the only time secureauthentication.cgclogin.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 5 | 124.82.4.169 124.82.4.169 | 4788 (TMNET-AS-...) (TMNET-AS-AP TM Net) | |
| 5 | 1 |
5
124.82.4.169
(Subang Jaya, Malaysia)
ASN4788 (TMNET-AS-AP TM Net, Internet Service Provider, MY)
PTR: mail.askpentest.com
ASN4788 (TMNET-AS-AP TM Net, Internet Service Provider, MY)
PTR: mail.askpentest.com
| secureauthentication.cgclogin.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 5 |
cgclogin.com
secureauthentication.cgclogin.com |
424 KB |
| 5 | 1 |
| Domain | Requested by | |
|---|---|---|
| 5 | secureauthentication.cgclogin.com |
secureauthentication.cgclogin.com
|
| 5 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| signup.live.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| secureauthentication.cgclogin.com R3 |
2022-08-29 - 2022-11-27 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://secureauthentication.cgclogin.com/
Frame ID: 4C9DCB4F7320303434CA316FF1423A8C
Requests: 5 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
URL: https://signup.live.com/signup
Title: Create one!
Title: Create one!
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
secureauthentication.cgclogin.com/ |
1 KB 748 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
styles.css
secureauthentication.cgclogin.com/styles/ |
7 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logo.png
secureauthentication.cgclogin.com/img/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
mainBG.png
secureauthentication.cgclogin.com/img/ |
416 KB 417 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bglogin2.png
secureauthentication.cgclogin.com/img/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
secureauthentication.cgclogin.com
124.82.4.169
13248bdd2dfee8cc17683f658da09df9a7b6746dd2b06891f2855ee3cda91f9d
3a807d62e9796401ae8bfff6e8bb5df46679f47bd17cc98fea4b8fec6cda4b22
5ce984a52c48f62774fef0de1051bb0225ce5f4d7746ee6c270ae805a466aedc
bd973904042707e496f6f4962f603783459b70530101bf52531b787af1f941f4
dadfbe44aea8e289679212a525e8176478419a9e3e82a7426bfc74ae008490b1