auth.wright.edu.servisedesk.me

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 5 HTTP transactions. The main IP is 2606:4700:3036::6812:36b6, located in United States and belongs to CLOUDFLARENET, US. The main domain is auth.wright.edu.servisedesk.me.

This is the only time auth.wright.edu.servisedesk.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: US Universities (Education)

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700:303... 2606:4700:3036::6812:36b6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	130.108.73.80 130.108.73.80	600 (OARNET-AS) (OARNET-AS)
5	2

1 2606:4700:3036::6812:36b6 (United States)

ASN13335 (CLOUDFLARENET, US)

auth.wright.edu.servisedesk.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 130.108.73.80 (Dayton, United States)

ASN600 (OARNET-AS, US)
PTR: auth.wright.edu

auth.wright.edu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	wright.edu auth.wright.edu	30 KB
1	servisedesk.me auth.wright.edu.servisedesk.me	3 KB
5	2

	Domain	Requested by
4	auth.wright.edu	auth.wright.edu.servisedesk.me
1	auth.wright.edu.servisedesk.me
5	2

This site contains links to these domains. Also see Links.

Domain
www.wright.edu

Subject Issuer	Validity	Valid
auth.wright.edu InCommon RSA Server CA	`2020-07-20` - `2022-07-20`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://auth.wright.edu.servisedesk.me/idp/Authn/UserPassword/
Frame ID: 7926D7C51F74F9331A4A87B89C0B7634
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

5
Requests

80 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

33 kB
Transfer

36 kB
Size

1
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://www.wright.edu/

Search URL Search Domain Scan URL

URL: https://www.wright.edu/go/reset-password
Title: Password Management

Search URL Search Domain Scan URL

URL: https://www.wright.edu/information-technology
Title: CaTS Help Desk

Search URL Search Domain Scan URL

URL: https://www.wright.edu/accounts
Title: Wright State Accounts

Search URL Search Domain Scan URL

URL: http://www.wright.edu/about/policies/web-copyright-statement
Title: Copyright © document.write(new Date().getFullYear())2020

Search URL Search Domain Scan URL

URL: http://www.wright.edu/about/policies/web-accessibility-statement
Title: Accessibility

Search URL Search Domain Scan URL

URL: http://www.wright.edu/about/accreditation
Title: Accreditation

Search URL Search Domain Scan URL

URL: http://www.wright.edu/about/privacy-policy
Title: Privacy

Search URL Search Domain Scan URL

URL: http://www.wright.edu/title-ix
Title: Title IX

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set / Show response
auth.wright.edu.servisedesk.me/idp/Authn/UserPassword/ 7 KB
3 KB 98ms
79ms Document
text/html 2606:4700:3036::6812:36b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://auth.wright.edu.servisedesk.me/idp/Authn/UserPassword/
Protocol: HTTP/1.1
Server: 2606:4700:3036::6812:36b6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/5.6.40
Resource Hash: a3a902d0baed3b46da2f3a7a529bf1f08719833270fdd51775078d8adcd2509f

Request headers

Host: auth.wright.edu.servisedesk.me
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 05 Oct 2020 18:38:12 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=de8130e441dbc243a6388230f4d9b05491601923091; expires=Wed, 04-Nov-20 18:38:11 GMT; path=/; domain=.servisedesk.me; HttpOnly; SameSite=Lax
X-Powered-By: PHP/5.6.40
Vary: Accept-Encoding
CF-Cache-Status: DYNAMIC
cf-request-id: 059ba7a5f500001f25d1add200000001
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601923092"}],"group":"cf-nel","max_age":604800}
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 5dd9421cbb031f25-FRA
Content-Encoding: gzip

GET
H/1.1 200
OK main.css
auth.wright.edu/assets/css/ 14 KB
15 KB 814ms
219ms Stylesheet
text/css 130.108.73.80
OARNET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.wright.edu/assets/css/main.css

Requested by

Host: auth.wright.edu.servisedesk.me
URL: http://auth.wright.edu.servisedesk.me/idp/Authn/UserPassword/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

130.108.73.80 Dayton, United States, ASN600 (OARNET-AS, US),

Reverse DNS

auth.wright.edu

Software

/

Resource Hash

a36fd66a644420fdcd3fecd0d17296d73e54b548115e32228e86f20c615ee858

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://auth.wright.edu.servisedesk.me/idp/Authn/UserPassword/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 05 Oct 2020 18:38:12 GMT
Cache-Control: max-age=0, must-revalidate
Referrer-Policy: origin
Last-Modified: Tue, 17 Dec 2019 11:00:04 GMT
Content-Length: 14638
X-Frame-Options: SAMEORIGIN
Content-Type: text/css

GET
H/1.1 200
OK wsu.css
auth.wright.edu/assets/css/ 5 KB
5 KB 713ms
117ms Stylesheet
text/css 130.108.73.80
OARNET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.wright.edu/assets/css/wsu.css

Requested by

Host: auth.wright.edu.servisedesk.me
URL: http://auth.wright.edu.servisedesk.me/idp/Authn/UserPassword/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

130.108.73.80 Dayton, United States, ASN600 (OARNET-AS, US),

Reverse DNS

auth.wright.edu

Software

/

Resource Hash

fc0a24ebac66fe5f5f499c6956540fd25f5db5b7de0aae06e928e297f4c7d1cf

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://auth.wright.edu.servisedesk.me/idp/Authn/UserPassword/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 05 Oct 2020 18:38:12 GMT
Cache-Control: max-age=0, must-revalidate
Referrer-Policy: origin
Last-Modified: Tue, 17 Dec 2019 11:00:04 GMT
Content-Length: 4856
X-Frame-Options: SAMEORIGIN
Content-Type: text/css

GET
H/1.1 200
OK ping-wrightstate-wordmark.png
auth.wright.edu/assets/images2/ 3 KB
3 KB 728ms
121ms Image
image/png 130.108.73.80
OARNET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://auth.wright.edu/assets/images2/ping-wrightstate-wordmark.png

Requested by

Host: auth.wright.edu.servisedesk.me
URL: http://auth.wright.edu.servisedesk.me/idp/Authn/UserPassword/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

130.108.73.80 Dayton, United States, ASN600 (OARNET-AS, US),

Reverse DNS

auth.wright.edu

Software

/

Resource Hash

574c734c0df2b98c2399ac70c279a963607ae712ee0c26679f1173d8a87a798a

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://auth.wright.edu.servisedesk.me/idp/Authn/UserPassword/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 05 Oct 2020 18:38:12 GMT
Cache-Control: max-age=0, must-revalidate
Referrer-Policy: origin
Last-Modified: Tue, 17 Dec 2019 11:00:04 GMT
Content-Length: 3169
X-Frame-Options: SAMEORIGIN
Content-Type: image/png

GET
H/1.1 200
OK ping-biplane_white.png
auth.wright.edu/assets/images2/ 7 KB
7 KB 728ms
121ms Image
image/png 130.108.73.80
OARNET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://auth.wright.edu/assets/images2/ping-biplane_white.png

Requested by

Host: auth.wright.edu.servisedesk.me
URL: http://auth.wright.edu.servisedesk.me/idp/Authn/UserPassword/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

130.108.73.80 Dayton, United States, ASN600 (OARNET-AS, US),

Reverse DNS

auth.wright.edu

Software

/

Resource Hash

82c1f117b95aa0eb9b744902b6b848cbfd5bde968dce2b8d7e0bc6c1385e9aba

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://auth.wright.edu.servisedesk.me/idp/Authn/UserPassword/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 05 Oct 2020 18:38:12 GMT
Cache-Control: max-age=0, must-revalidate
Referrer-Policy: origin
Last-Modified: Tue, 17 Dec 2019 11:00:04 GMT
Content-Length: 7119
X-Frame-Options: SAMEORIGIN
Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: US Universities (Education)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.servisedesk.me/	1970-01-19 13:41:55	Name: __cfduid Value: de8130e441dbc243a6388230f4d9b05491601923091

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

auth.wright.edu
auth.wright.edu.servisedesk.me
130.108.73.80
2606:4700:3036::6812:36b6
574c734c0df2b98c2399ac70c279a963607ae712ee0c26679f1173d8a87a798a
82c1f117b95aa0eb9b744902b6b848cbfd5bde968dce2b8d7e0bc6c1385e9aba
a36fd66a644420fdcd3fecd0d17296d73e54b548115e32228e86f20c615ee858
a3a902d0baed3b46da2f3a7a529bf1f08719833270fdd51775078d8adcd2509f
fc0a24ebac66fe5f5f499c6956540fd25f5db5b7de0aae06e928e297f4c7d1cf

auth.wright.edu.servisedesk.me Open in urlscan Pro 2606:4700:3036::6812:36b6 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

80 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

33 kBTransfer

36 kBSize

1 Cookies

9 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

1 Cookies

Indicators

auth.wright.edu.servisedesk.me Open in urlscan Pro
2606:4700:3036::6812:36b6 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

80 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

33 kB
Transfer

36 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!