sandbox.secure-web.sco.cisco.com
urlscan Pro

2620:101:2005:11f0::1000 Malicious Activity!

Go To Report Rescan

Submitted URL:
http://secure-web.cisco.com/1SP-b39CIS97GhpuExMsP-tgtC7yWvVaFxMvdlTpmJiKlgVLlg_kdOBvnRzqv6NTsTNXgwBYvziWFcAx6r409uvBzfOvELNPL0U6CWBGN5w1sip7mr9SCbZ2ZNwrK4EGO2sHugwNdszJNyiiUNs7pRrD0cchPWNa6ucpJTDAKUVlRqCPOQXquemTOlhygnbH-YuVeP30bk1jkjRWUIiTWZ-vUnJrA1e7y1Em3nJOBIVwxHsVSygBmFUQQTWrKlt4QaFiJHtR-d5XyStlxe_3G9qP-XUcr02BEqzUkKrTVEdflWt8PUzMNoE05C4PU7V6VkcLVVeidrWupnmk7OjpH43DVrmUlzBBVHhTtUSEoBBrQ_cSxQ9DFhOS8HptveLwQL_312Y0eALDn4VzjV3dv60jfx7o_EFtWbnIz8_3Bvzk/http%3A%2F%2Fmx.google.com
Effective URL:
http://sandbox.secure-web.sco.cisco.com/auth=11c5CBK0uNJXkYNpv002ktoA0Uhd43&url=http%3A%2F%2Fmx.google.com
Submission: On January 14 via api (January 14th 2021, 1:19:21 am) from DK

Summary HTTP 11 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 2620:101:2005:11f0::1000, located in United States and belongs to IRONPORT-SYSTEMS-INC, US. The main domain is sandbox.secure-web.sco.cisco.com.

This is the only time sandbox.secure-web.sco.cisco.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
2	2620:101:2005... 2620:101:2005:11f0::1001	16417 (IRONPORT-...) (IRONPORT-SYSTEMS-INC)
1 2	23.8.6.53 23.8.6.53	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
8	2620:101:2005... 2620:101:2005:11f0::1000	16417 (IRONPORT-...) (IRONPORT-SYSTEMS-INC)
11	3

2 2620:101:2005:11f0::1001 (United States)

ASN16417 (IRONPORT-SYSTEMS-INC, US)

secure-web.cisco.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.8.6.53 (Netherlands) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-8-6-53.deploy.static.akamaitechnologies.com

www.dhl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2620:101:2005:11f0::1000 (United States)

ASN16417 (IRONPORT-SYSTEMS-INC, US)

sandbox.secure-web.sco.cisco.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Domain Subdomains	Transfer
10	cisco.com	344 KB
2	dhl.com 1 redirects	825 B
11	2

	Domain	Requested by
8	sandbox.secure-web.sco.cisco.com	sandbox.secure-web.sco.cisco.com
2	www.dhl.com	1 redirects secure-web.cisco.com
2	secure-web.cisco.com	secure-web.cisco.com
11	3

This site contains links to these domains. Also see Links.

Domain

Subject / Issuer	Validity	Valid
www.dhl.com GlobalSign RSA OV SSL CA 2018	`2020-04-07` - `2021-04-08`	a year

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Website

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Stats

0
Requests

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

0
IPs

0
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page. For each link, only the first name is shown.

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK http%3A%2F%2Fmx.google.com Show response
secure-web.cisco.com/1SP-b39CIS97GhpuExMsP-tgtC7yWvVaFxMvdlTpmJiKlgVLlg_kdOBvnRzqv6NTsTNXgwBYvziWFcAx6r409uvBzfOvELNPL0U6CWBGN5w1sip7mr9SCbZ2ZNwrK4EGO2sHugwNdszJNyiiUNs7pRrD0cchPWNa6ucpJTDAKUVlRqCP... 1 KB
1 KB 286ms
143ms Document
text/html 2620:101:2005:11f0::1001
IRONPORT-SYSTEMS-INC

General

Check archive.org

Show headers Download Go to

Full URL: http://secure-web.cisco.com/1SP-b39CIS97GhpuExMsP-tgtC7yWvVaFxMvdlTpmJiKlgVLlg_kdOBvnRzqv6NTsTNXgwBYvziWFcAx6r409uvBzfOvELNPL0U6CWBGN5w1sip7mr9SCbZ2ZNwrK4EGO2sHugwNdszJNyiiUNs7pRrD0cchPWNa6ucpJTDAKUVlRqCPOQXquemTOlhygnbH-YuVeP30bk1jkjRWUIiTWZ-vUnJrA1e7y1Em3nJOBIVwxHsVSygBmFUQQTWrKlt4QaFiJHtR-d5XyStlxe_3G9qP-XUcr02BEqzUkKrTVEdflWt8PUzMNoE05C4PU7V6VkcLVVeidrWupnmk7OjpH43DVrmUlzBBVHhTtUSEoBBrQ_cSxQ9DFhOS8HptveLwQL_312Y0eALDn4VzjV3dv60jfx7o_EFtWbnIz8_3Bvzk/http%3A%2F%2Fmx.google.com
Protocol: HTTP/1.1
Server: 2620:101:2005:11f0::1001 , United States, ASN16417 (IRONPORT-SYSTEMS-INC, US),
Reverse DNS
Software: nginx/1.17.8 /
Resource Hash: 599eda917e730517616467004da64a1e31d190b23542d31d29965108b842493f

Request headers

Host: secure-web.cisco.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: nginx/1.17.8
Date: Thu, 14 Jan 2021 01:19:21 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Harpe-Token
X-Harpe-Verdict: aegis_v2

GET
H/1.1 200
OK block.css
secure-web.cisco.com/static/block 1 KB
1 KB 143ms
143ms Stylesheet
text/css 2620:101:2005:11f0::1001
IRONPORT-SYSTEMS-INC

General

Check archive.org

Show headers Download Go to

Full URL: http://secure-web.cisco.com/static/block/block.css
Requested by: Host: secure-web.cisco.com
URL: http://secure-web.cisco.com/1SP-b39CIS97GhpuExMsP-tgtC7yWvVaFxMvdlTpmJiKlgVLlg_kdOBvnRzqv6NTsTNXgwBYvziWFcAx6r409uvBzfOvELNPL0U6CWBGN5w1sip7mr9SCbZ2ZNwrK4EGO2sHugwNdszJNyiiUNs7pRrD0cchPWNa6ucpJTDAKUVlRqCPOQXquemTOlhygnbH-YuVeP30bk1jkjRWUIiTWZ-vUnJrA1e7y1Em3nJOBIVwxHsVSygBmFUQQTWrKlt4QaFiJHtR-d5XyStlxe_3G9qP-XUcr02BEqzUkKrTVEdflWt8PUzMNoE05C4PU7V6VkcLVVeidrWupnmk7OjpH43DVrmUlzBBVHhTtUSEoBBrQ_cSxQ9DFhOS8HptveLwQL_312Y0eALDn4VzjV3dv60jfx7o_EFtWbnIz8_3Bvzk/http%3A%2F%2Fmx.google.com
Protocol: HTTP/1.1
Server: 2620:101:2005:11f0::1001 , United States, ASN16417 (IRONPORT-SYSTEMS-INC, US),
Reverse DNS
Software: nginx/1.17.8 /
Resource Hash: d619df79da1222d1c0261844715bb4a8fe040eae75350c9807435cf7a16d7a41

Request headers

Referer: http://secure-web.cisco.com/1SP-b39CIS97GhpuExMsP-tgtC7yWvVaFxMvdlTpmJiKlgVLlg_kdOBvnRzqv6NTsTNXgwBYvziWFcAx6r409uvBzfOvELNPL0U6CWBGN5w1sip7mr9SCbZ2ZNwrK4EGO2sHugwNdszJNyiiUNs7pRrD0cchPWNa6ucpJTDAKUVlRqCPOQXquemTOlhygnbH-YuVeP30bk1jkjRWUIiTWZ-vUnJrA1e7y1Em3nJOBIVwxHsVSygBmFUQQTWrKlt4QaFiJHtR-d5XyStlxe_3G9qP-XUcr02BEqzUkKrTVEdflWt8PUzMNoE05C4PU7V6VkcLVVeidrWupnmk7OjpH43DVrmUlzBBVHhTtUSEoBBrQ_cSxQ9DFhOS8HptveLwQL_312Y0eALDn4VzjV3dv60jfx7o_EFtWbnIz8_3Bvzk/http%3A%2F%2Fmx.google.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 14 Jan 2021 01:19:21 GMT
Last-Modified: Fri, 13 Nov 2020 16:32:14 GMT
Server: nginx/1.17.8
ETag: "5faeb50e-498"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1176

GET
H2

200

dhl_logo.gif
www.dhl.com/img/meta
Redirect Chain

http://www.dhl.com/img/meta/dhl_logo.gif
https://www.dhl.com/img/meta/dhl_logo.gif

443 B
637 B

116ms
38ms

Image
image/gif

23.8.6.53
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dhl.com/img/meta/dhl_logo.gif

Requested by

Host: secure-web.cisco.com
URL: http://secure-web.cisco.com/1SP-b39CIS97GhpuExMsP-tgtC7yWvVaFxMvdlTpmJiKlgVLlg_kdOBvnRzqv6NTsTNXgwBYvziWFcAx6r409uvBzfOvELNPL0U6CWBGN5w1sip7mr9SCbZ2ZNwrK4EGO2sHugwNdszJNyiiUNs7pRrD0cchPWNa6ucpJTDAKUVlRqCPOQXquemTOlhygnbH-YuVeP30bk1jkjRWUIiTWZ-vUnJrA1e7y1Em3nJOBIVwxHsVSygBmFUQQTWrKlt4QaFiJHtR-d5XyStlxe_3G9qP-XUcr02BEqzUkKrTVEdflWt8PUzMNoE05C4PU7V6VkcLVVeidrWupnmk7OjpH43DVrmUlzBBVHhTtUSEoBBrQ_cSxQ9DFhOS8HptveLwQL_312Y0eALDn4VzjV3dv60jfx7o_EFtWbnIz8_3Bvzk/http%3A%2F%2Fmx.google.com

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.8.6.53 , Netherlands, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-8-6-53.deploy.static.akamaitechnologies.com

Software

Resource Hash

2f680b51b19fc3c5befd02bd9d0d4e88c2722a5210157e4ef68933c5ba352109

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://secure-web.cisco.com/1SP-b39CIS97GhpuExMsP-tgtC7yWvVaFxMvdlTpmJiKlgVLlg_kdOBvnRzqv6NTsTNXgwBYvziWFcAx6r409uvBzfOvELNPL0U6CWBGN5w1sip7mr9SCbZ2ZNwrK4EGO2sHugwNdszJNyiiUNs7pRrD0cchPWNa6ucpJTDAKUVlRqCPOQXquemTOlhygnbH-YuVeP30bk1jkjRWUIiTWZ-vUnJrA1e7y1Em3nJOBIVwxHsVSygBmFUQQTWrKlt4QaFiJHtR-d5XyStlxe_3G9qP-XUcr02BEqzUkKrTVEdflWt8PUzMNoE05C4PU7V6VkcLVVeidrWupnmk7OjpH43DVrmUlzBBVHhTtUSEoBBrQ_cSxQ9DFhOS8HptveLwQL_312Y0eALDn4VzjV3dv60jfx7o_EFtWbnIz8_3Bvzk/http%3A%2F%2Fmx.google.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 14 Jan 2021 01:19:21 GMT
x-content-type-options: nosniff
last-modified: Fri, 14 Feb 2020 10:10:25 GMT
etag: "160229-1bb-59e866a03e640"
content-type: image/gif
cache-control: public, max-age=7486
accept-ranges: bytes
content-length: 443
x-xss-protection: 1; mode=block

Redirect headers

Location: https://www.dhl.com/img/meta/dhl_logo.gif
Date: Thu, 14 Jan 2021 01:19:21 GMT
Server: AkamaiGHost
Connection: keep-alive
Content-Length: 0

GET
H/1.1 200
OK auth=11c5CBK0uNJXkYNpv002ktoA0Uhd43&url=http%3A%2F%2Fmx.google.com Show response 10 KB
10 KB 287ms
144ms Document
text/html 2620:101:2005:11f0::1000
IRONPORT-SYSTEMS-INC

General

Check archive.org

Show headers Download Go to

Full URL: http://sandbox.secure-web.sco.cisco.com/auth=11c5CBK0uNJXkYNpv002ktoA0Uhd43&url=http%3A%2F%2Fmx.google.com
Protocol: HTTP/1.1
Server: 2620:101:2005:11f0::1000 , United States, ASN16417 (IRONPORT-SYSTEMS-INC, US),
Reverse DNS
Software: nginx/1.17.8 /
Resource Hash: 8e8300cb185921eda4f4ece7b50d6b890c6a843448da16b26b9f00b365787010

Request headers

Host: sandbox.secure-web.sco.cisco.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://secure-web.cisco.com/1SP-b39CIS97GhpuExMsP-tgtC7yWvVaFxMvdlTpmJiKlgVLlg_kdOBvnRzqv6NTsTNXgwBYvziWFcAx6r409uvBzfOvELNPL0U6CWBGN5w1sip7mr9SCbZ2ZNwrK4EGO2sHugwNdszJNyiiUNs7pRrD0cchPWNa6ucpJTDAKUVlRqCPOQXquemTOlhygnbH-YuVeP30bk1jkjRWUIiTWZ-vUnJrA1e7y1Em3nJOBIVwxHsVSygBmFUQQTWrKlt4QaFiJHtR-d5XyStlxe_3G9qP-XUcr02BEqzUkKrTVEdflWt8PUzMNoE05C4PU7V6VkcLVVeidrWupnmk7OjpH43DVrmUlzBBVHhTtUSEoBBrQ_cSxQ9DFhOS8HptveLwQL_312Y0eALDn4VzjV3dv60jfx7o_EFtWbnIz8_3Bvzk/http%3A%2F%2Fmx.google.com
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://secure-web.cisco.com/1SP-b39CIS97GhpuExMsP-tgtC7yWvVaFxMvdlTpmJiKlgVLlg_kdOBvnRzqv6NTsTNXgwBYvziWFcAx6r409uvBzfOvELNPL0U6CWBGN5w1sip7mr9SCbZ2ZNwrK4EGO2sHugwNdszJNyiiUNs7pRrD0cchPWNa6ucpJTDAKUVlRqCPOQXquemTOlhygnbH-YuVeP30bk1jkjRWUIiTWZ-vUnJrA1e7y1Em3nJOBIVwxHsVSygBmFUQQTWrKlt4QaFiJHtR-d5XyStlxe_3G9qP-XUcr02BEqzUkKrTVEdflWt8PUzMNoE05C4PU7V6VkcLVVeidrWupnmk7OjpH43DVrmUlzBBVHhTtUSEoBBrQ_cSxQ9DFhOS8HptveLwQL_312Y0eALDn4VzjV3dv60jfx7o_EFtWbnIz8_3Bvzk/http%3A%2F%2Fmx.google.com

Response headers

Server: nginx/1.17.8
Date: Thu, 14 Jan 2021 01:19:31 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 10542
Connection: keep-alive

GET
H/1.1 200
OK bootstrap.min.css
/static/css/lib 152 KB
152 KB 143ms
142ms Stylesheet
text/css 2620:101:2005:11f0::1000
IRONPORT-SYSTEMS-INC

General

Check archive.org

Show headers Download Go to

Full URL: http://sandbox.secure-web.sco.cisco.com/static/css/lib/bootstrap.min.css
Requested by: Host: sandbox.secure-web.sco.cisco.com
URL: http://sandbox.secure-web.sco.cisco.com/auth=11c5CBK0uNJXkYNpv002ktoA0Uhd43&url=http%3A%2F%2Fmx.google.com
Protocol: HTTP/1.1
Server: 2620:101:2005:11f0::1000 , United States, ASN16417 (IRONPORT-SYSTEMS-INC, US),
Reverse DNS
Software: nginx/1.17.8 /
Resource Hash: 60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36

Request headers

Referer: http://sandbox.secure-web.sco.cisco.com/auth=11c5CBK0uNJXkYNpv002ktoA0Uhd43&url=http%3A%2F%2Fmx.google.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 14 Jan 2021 01:19:32 GMT
Last-Modified: Mon, 07 Sep 2020 21:46:33 GMT
Server: nginx/1.17.8
ETag: "5f56aa39-2606e"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 155758

GET
H/1.1 200
OK style.css
/static/css 288 B
525 B 282ms
141ms Stylesheet
text/css 2620:101:2005:11f0::1000
IRONPORT-SYSTEMS-INC

General

Check archive.org

Show headers Download Go to

Full URL: http://sandbox.secure-web.sco.cisco.com/static/css/style.css
Requested by: Host: sandbox.secure-web.sco.cisco.com
URL: http://sandbox.secure-web.sco.cisco.com/auth=11c5CBK0uNJXkYNpv002ktoA0Uhd43&url=http%3A%2F%2Fmx.google.com
Protocol: HTTP/1.1
Server: 2620:101:2005:11f0::1000 , United States, ASN16417 (IRONPORT-SYSTEMS-INC, US),
Reverse DNS
Software: nginx/1.17.8 /
Resource Hash: 52af52f0b180f826e7d04782c512d67aef702cfd7451d5cb6adc17c916b2bf63

Request headers

Referer: http://sandbox.secure-web.sco.cisco.com/auth=11c5CBK0uNJXkYNpv002ktoA0Uhd43&url=http%3A%2F%2Fmx.google.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 14 Jan 2021 01:19:32 GMT
Last-Modified: Mon, 07 Sep 2020 21:46:33 GMT
Server: nginx/1.17.8
ETag: "5f56aa39-120"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 288

GET
H/1.1 200
OK cisco_security_logo.png
/static/img 9 KB
10 KB 284ms
142ms Image
image/png 2620:101:2005:11f0::1000
IRONPORT-SYSTEMS-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://sandbox.secure-web.sco.cisco.com/static/img/cisco_security_logo.png
Requested by: Host: sandbox.secure-web.sco.cisco.com
URL: http://sandbox.secure-web.sco.cisco.com/auth=11c5CBK0uNJXkYNpv002ktoA0Uhd43&url=http%3A%2F%2Fmx.google.com
Protocol: HTTP/1.1
Server: 2620:101:2005:11f0::1000 , United States, ASN16417 (IRONPORT-SYSTEMS-INC, US),
Reverse DNS
Software: nginx/1.17.8 /
Resource Hash: 30fc88e67db076822ebc800baa73231d0d9ff65c849f1c3289ed3dad2e653b27

Request headers

Referer: http://sandbox.secure-web.sco.cisco.com/auth=11c5CBK0uNJXkYNpv002ktoA0Uhd43&url=http%3A%2F%2Fmx.google.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 14 Jan 2021 01:19:32 GMT
Last-Modified: Mon, 07 Sep 2020 21:46:33 GMT
Server: nginx/1.17.8
ETag: "5f56aa39-25cb"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 9675

GET
H/1.1 200
OK jquery-3.3.1.min.js Show response
/static/js/lib 85 KB
85 KB 284ms
141ms Script
application/javascript 2620:101:2005:11f0::1000
IRONPORT-SYSTEMS-INC

General

Check archive.org

Show headers Download Go to

Full URL: http://sandbox.secure-web.sco.cisco.com/static/js/lib/jquery-3.3.1.min.js
Requested by: Host: sandbox.secure-web.sco.cisco.com
URL: http://sandbox.secure-web.sco.cisco.com/auth=11c5CBK0uNJXkYNpv002ktoA0Uhd43&url=http%3A%2F%2Fmx.google.com
Protocol: HTTP/1.1
Server: 2620:101:2005:11f0::1000 , United States, ASN16417 (IRONPORT-SYSTEMS-INC, US),
Reverse DNS
Software: nginx/1.17.8 /
Resource Hash: 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

Referer: http://sandbox.secure-web.sco.cisco.com/auth=11c5CBK0uNJXkYNpv002ktoA0Uhd43&url=http%3A%2F%2Fmx.google.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 14 Jan 2021 01:19:32 GMT
Last-Modified: Mon, 07 Sep 2020 21:46:33 GMT
Server: nginx/1.17.8
ETag: "5f56aa39-1538f"
Content-Type: application/javascript; charset=utf-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 86927

GET
H/1.1 200
OK bootstrap.bundle.min.js Show response
/static/js/lib 77 KB
77 KB 284ms
142ms Script
application/javascript 2620:101:2005:11f0::1000
IRONPORT-SYSTEMS-INC

General

Check archive.org

Show headers Download Go to

Full URL: http://sandbox.secure-web.sco.cisco.com/static/js/lib/bootstrap.bundle.min.js
Requested by: Host: sandbox.secure-web.sco.cisco.com
URL: http://sandbox.secure-web.sco.cisco.com/auth=11c5CBK0uNJXkYNpv002ktoA0Uhd43&url=http%3A%2F%2Fmx.google.com
Protocol: HTTP/1.1
Server: 2620:101:2005:11f0::1000 , United States, ASN16417 (IRONPORT-SYSTEMS-INC, US),
Reverse DNS
Software: nginx/1.17.8 /
Resource Hash: 7f3145c87d3570154f633975e8a4f8d30aa38603edaba145501e9c90ddbe186c

Request headers

Referer: http://sandbox.secure-web.sco.cisco.com/auth=11c5CBK0uNJXkYNpv002ktoA0Uhd43&url=http%3A%2F%2Fmx.google.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 14 Jan 2021 01:19:32 GMT
Last-Modified: Mon, 07 Sep 2020 21:46:33 GMT
Server: nginx/1.17.8
ETag: "5f56aa39-1332b"
Content-Type: application/javascript; charset=utf-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 78635

POST
H/1.1 200
OK 1
/api/process 136 B
291 B 3802ms
3802ms XHR
application/json 2620:101:2005:11f0::1000
IRONPORT-SYSTEMS-INC

General

Check archive.org

Show headers Download Go to

Full URL: http://sandbox.secure-web.sco.cisco.com/api/process/1
Requested by: Host: sandbox.secure-web.sco.cisco.com
URL: http://sandbox.secure-web.sco.cisco.com/static/js/lib/jquery-3.3.1.min.js
Protocol: HTTP/1.1
Server: 2620:101:2005:11f0::1000 , United States, ASN16417 (IRONPORT-SYSTEMS-INC, US),
Reverse DNS
Software: nginx/1.17.8 /
Resource Hash: 5f66ff4f3960c65b4543340ebf9f951c1f1cb674cecd2698206352b4f875ed8f

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: http://sandbox.secure-web.sco.cisco.com/auth=11c5CBK0uNJXkYNpv002ktoA0Uhd43&url=http%3A%2F%2Fmx.google.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

Date: Thu, 14 Jan 2021 01:19:36 GMT
Server: nginx/1.17.8
Connection: keep-alive
Content-Length: 136
Content-Type: application/json

GET
H/1.1 200
OK 1019737987f942599d155fb704beaaf3.jpg
/api/img 5 KB
6 KB 144ms
144ms Image
image/jpg 2620:101:2005:11f0::1000
IRONPORT-SYSTEMS-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://sandbox.secure-web.sco.cisco.com/api/img/1019737987f942599d155fb704beaaf3.jpg
Protocol: HTTP/1.1
Server: 2620:101:2005:11f0::1000 , United States, ASN16417 (IRONPORT-SYSTEMS-INC, US),
Reverse DNS
Software: nginx/1.17.8 /
Resource Hash: 19d9e97856e5e4435009b82bf284cc49fbb2befe42f55db3baed7bd5a890c250

Request headers

Referer: http://sandbox.secure-web.sco.cisco.com/auth=11c5CBK0uNJXkYNpv002ktoA0Uhd43&url=http%3A%2F%2Fmx.google.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 14 Jan 2021 01:19:36 GMT
Last-Modified: Thu, 14 Jan 2021 01:19:36 GMT
Server: nginx/1.17.8
ETag: "1610587176.4114225-5445-2581532496"
Content-Type: image/jpg
Cache-Control: public, max-age=43200
Connection: keep-alive
Content-Length: 5445
Expires: Thu, 14 Jan 2021 13:19:36 GMT

Redirect requests

There were HTTP redirects (301, 302) for the following requests:

Request 2

http://www.dhl.com/img/meta/dhl_logo.gif
https://www.dhl.com/img/meta/dhl_logo.gif

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

sandbox.secure-web.sco.cisco.com
secure-web.cisco.com
www.dhl.com
23.8.6.53
2620:101:2005:11f0::1000
2620:101:2005:11f0::1001
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
19d9e97856e5e4435009b82bf284cc49fbb2befe42f55db3baed7bd5a890c250
2f680b51b19fc3c5befd02bd9d0d4e88c2722a5210157e4ef68933c5ba352109
30fc88e67db076822ebc800baa73231d0d9ff65c849f1c3289ed3dad2e653b27
52af52f0b180f826e7d04782c512d67aef702cfd7451d5cb6adc17c916b2bf63
599eda917e730517616467004da64a1e31d190b23542d31d29965108b842493f
5f66ff4f3960c65b4543340ebf9f951c1f1cb674cecd2698206352b4f875ed8f
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
7f3145c87d3570154f633975e8a4f8d30aa38603edaba145501e9c90ddbe186c
8e8300cb185921eda4f4ece7b50d6b890c6a843448da16b26b9f00b365787010
d619df79da1222d1c0261844715bb4a8fe040eae75350c9807435cf7a16d7a41

sandbox.secure-web.sco.cisco.com urlscan Pro 2620:101:2005:11f0::1000 Malicious Activity!

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Stats

0 Requests

0 %HTTPS

0 %IPv6

0 Domains

0 Subdomains

0 IPs

0 Countries

0 kBTransfer

0 kBSize

0 Cookies

0 Outgoing links

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect requests

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Indicators

sandbox.secure-web.sco.cisco.com
urlscan Pro

2620:101:2005:11f0::1000 Malicious Activity!

Screenshot
Live screenshot

Full Image

0
Requests

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

0
IPs

0
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!