![](/screenshots/a42c7416-7449-4aec-b419-de376c495242.png)
login.ubuntu.com
Open in
urlscan Pro
162.213.33.106
Public Scan
Effective URL: https://login.ubuntu.com/+login?next=%2Fsaml%2Fprocess
Submission Tags: phishingrod
Submission: On February 06 via api from DE — Scanned from GB
Summary
TLS certificate: Issued by R3 on December 18th 2022. Valid for: 3 months.
This is the only time login.ubuntu.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 162.213.33.98 162.213.33.98 | 41231 (CANONICAL-AS) (CANONICAL-AS) | |
4 12 | 162.213.33.106 162.213.33.106 | 41231 (CANONICAL-AS) (CANONICAL-AS) | |
6 | 2620:2d:4000:... 2620:2d:4000:1::28 | 41231 (CANONICAL-AS) (CANONICAL-AS) | |
1 | 2a00:1450:400... 2a00:1450:400d:806::2008 | 15169 (GOOGLE) (GOOGLE) | |
15 | 3 |
ASN41231 (CANONICAL-AS, GB)
PTR: discourse.canonical.com
discourse.canonical.com |
ASN41231 (CANONICAL-AS, GB)
PTR: login.ubuntu.com
login.ubuntu.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
ubuntu.com
4 redirects
login.ubuntu.com — Cisco Umbrella Rank: 848181 assets.ubuntu.com — Cisco Umbrella Rank: 90377 |
519 KB |
2 |
canonical.com
2 redirects
discourse.canonical.com |
2 KB |
1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 40 |
47 KB |
15 | 3 |
Domain | Requested by | |
---|---|---|
12 | login.ubuntu.com |
4 redirects
login.ubuntu.com
|
6 | assets.ubuntu.com |
login.ubuntu.com
|
2 | discourse.canonical.com | 2 redirects |
1 | www.googletagmanager.com |
login.ubuntu.com
|
15 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.ubuntu.com |
help.ubuntu.com |
bugs.launchpad.net |
ubuntu.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
login.ubuntu.com R3 |
2022-12-18 - 2023-03-18 |
3 months | crt.sh |
assets.ubuntu.com R3 |
2023-01-14 - 2023-04-14 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2023-01-09 - 2023-04-03 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://login.ubuntu.com/+login?next=%2Fsaml%2Fprocess
Frame ID: 4A60A7BEA8A362BC674B7984AB53F3FA
Requests: 15 HTTP requests in this frame
Screenshot
![](/screenshots/a42c7416-7449-4aec-b419-de376c495242.png)
Page Title
Log inPage URL History Show full URLs
-
https://discourse.canonical.com/
HTTP 302
https://discourse.canonical.com/auth/saml HTTP 302
https://login.ubuntu.com/+saml?SAMLRequest=hZFLT8NADIT%2FSm57QHk%2FoKumUkQvlcqlBQ69IGdj6IrEG9a7iJ9PEo... HTTP 302
https://login.ubuntu.com/saml/process HTTP 302
https://login.ubuntu.com/+login?next=/saml/process HTTP 302
https://login.ubuntu.com/+cookie?next=%2F%2Blogin%3Fnext%3D%2Fsaml%2Fprocess HTTP 302
https://login.ubuntu.com/+login?next=%2Fsaml%2Fprocess Page URL
Detected technologies
![](/vendor/wappa/icons/Django.png)
Detected patterns
- (?:powered by <a[^>]+>Django ?([\d.]+)?<\/a>|<input[^>]*name=["']csrfmiddlewaretoken["'][^>]*>)
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- googletagmanager\.com/ns\.html[^>]+></iframe>
- <!-- (?:End )?Google Tag Manager -->
- googletagmanager\.com/gtm\.js
![](/vendor/wappa/icons/YUI.png)
Detected patterns
- (?:/yui/|yui\.yahooapis\.com)
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Title: Ubuntu One terms of service
Search URL Search Domain Scan URL
Title: data privacy policy
Search URL Search Domain Scan URL
Title: Canonical's SSO privacy notice
Search URL Search Domain Scan URL
Title: Support
Search URL Search Domain Scan URL
Title: Report a bug on this site
Search URL Search Domain Scan URL
Title: cookie policy
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://discourse.canonical.com/
HTTP 302
https://discourse.canonical.com/auth/saml HTTP 302
https://login.ubuntu.com/+saml?SAMLRequest=hZFLT8NADIT%2FSm57QHk%2FoKumUkQvlcqlBQ69IGdj6IrEG9a7iJ9PEoQoFzjamvnGGq8Zhn6UjXdnOuCbR3ZBw4zWaUO3htgPaI9o37XCh8O%2BFmfnRpZx3GlWxlvGSAEZ0gr6SJkhhokUz9B42vQtqFcRbCeqJpiRP4DevGiKfOvJ%2BcV5NbtEsNvW4gnSZyw6qEJASMNipbqwvU7LsLvJ06LNsC3zcpIye9wROyBXiyzJ8jDJwqS6T3NZVLJYnUTwiJaX3CxKRPAx9MRyDqqFtyQNsGZJMCBLp%2BSxudvLSSjhu4JLy%2Fi3Z7TGGWV6sVnParlcZzf%2FFLaOL8Vf0%2B9%2FbD4B HTTP 302
https://login.ubuntu.com/saml/process HTTP 302
https://login.ubuntu.com/+login?next=/saml/process HTTP 302
https://login.ubuntu.com/+cookie?next=%2F%2Blogin%3Fnext%3D%2Fsaml%2Fprocess HTTP 302
https://login.ubuntu.com/+login?next=%2Fsaml%2Fprocess Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
+login
login.ubuntu.com/ Redirect Chain
|
15 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.31e541bac65173e36e0150005d21a631.css
login.ubuntu.com/assets/vanilla-css/ |
171 KB 30 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
d738f754-Ubuntu_One_Mono_Logo.svg
assets.ubuntu.com/v1/ |
11 KB 12 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
login.ubuntu.com/combo/ |
87 KB 26 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
f3dee679-cookie-policy-v3.2.0.css
assets.ubuntu.com/v1/ |
81 KB 82 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b9fc480c-cookie-policy-v3.2.0.js
assets.ubuntu.com/v1/ |
13 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
e8c07df6-Ubuntu-L_W.woff2
assets.ubuntu.com/v1/ |
124 KB 125 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
7f100985-Ubuntu-Th_W.woff2
assets.ubuntu.com/v1/ |
56 KB 57 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
f8097dea-Ubuntu-LI_W.woff2
assets.ubuntu.com/v1/ |
123 KB 123 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
login.ubuntu.com/combo/ |
74 KB 25 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
login.ubuntu.com/combo/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ |
121 KB 47 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
login.ubuntu.com/combo/ |
4 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
login.ubuntu.com/combo/ |
384 B 917 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
login.ubuntu.com/combo/ |
39 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange object| YUI_config function| YUI object| cpNs object| dataLayer object| google_tag_manager5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
discourse.canonical.com/ | Name: destination_url Value: https%3A%2F%2Fdiscourse.canonical.com%2F |
|
discourse.canonical.com/ | Name: _forum_session Value: WlphOFlDN3E1NXk0OHA2YTQxSUltNEFXOGE4MG9BVGptbThyeFIwc3pRUlpTem85RE84TWJrNzB5R2N5bnFVMEpLNjdzd2VkNFFRT0tESVdHbGl5OXlTK3cvd0kvRUx1OThDU09pVnJxNTU2SGowTzlDQTBKYU82NjJuSDNtVXRiUncwdGRNSjFPY3l1UEJMQjhyRGp3PT0tLTlMZXhpY0hrUVd5OG9GYUtidEtxNmc9PQ%3D%3D--0dd99b383fc0fc140d966c35bddf3053b4362cbe |
|
login.ubuntu.com/ | Name: sessionid Value: 55i5wbfje1j77zll3pa8mi85vx9ipqzy |
|
login.ubuntu.com/ | Name: C Value: 1 |
|
login.ubuntu.com/ | Name: csrftoken Value: KCpfdwGajdlrDhoCiog1nOCeuIVkbrP7koHuxcMsEx7r81kFac5yim9LQV3Ybnsh |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=15768000; includeSubDomains; preload |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.ubuntu.com
discourse.canonical.com
login.ubuntu.com
www.googletagmanager.com
162.213.33.106
162.213.33.98
2620:2d:4000:1::28
2a00:1450:400d:806::2008
232862b241b9acbf1daab862f21a2e1dba0e1f6dd88b878d2487bdbfd9e2fb12
3102e9bdbe0d80f6c005c605a5a35b50241122256f6285b536cae6cfd363ba1e
313196be867d47ba65ff36e6a7b97199a20a0e2e8301e8a0826891c5e142f516
5711215c8e2187eb6f02b283db8dc49fa6d3bd9f1386fdbc28dc1e891acd88cb
5c237f218b5478f01d59dea192070befd053a5f1fb2bfce2671302efe1e64225
5e63d606e7156dce67c2f50eac8e29cabf588ae0ad41d564569d65d36dc516bb
6ea4c3e8227c05d3b7d0d3d93d553bfb37c398b4b6481ddc587d29b14c164b0a
8170b53fa2c3f4b7dcb8702c191836d39cc879ef2540bd0887000aaacf8f5958
97684b117317459e0c16f074a67e2455d50c0ac4fab96e952c868e1d5630fe2a
ad2ca64d6c56373db8a53c8164f459d04cc8f2a6f40a3c266ae567534c72efa2
b557eae258050a0d01f5ebf35501d86261c0c4c8293275080939c18cf81fb4e6
c6324234e218f932c5c94771a12278709ed6c44ffb8b16e1721eb5894182e0fa
c910a0ce672f90269cd4533d33cabdbca9a3608eb5dd21d167d06f5b58f9f2d1
d9ea15d5120edd5eb648e543cf0d19c3e955b9c432ecc007f9c62469e8f52fb6
ecfd34ff5259fee59d97d1d13c5cd9ecd543baae4eae67222f8f35127b4e1dac