centralliberty.mycustomerconnect.com
Open in
urlscan Pro
52.34.207.165
Malicious Activity!
Public Scan
Effective URL: https://centralliberty.mycustomerconnect.com/qbo/classes/web.ox.ac.uk/?42adbb27d306b9912ec04d5a7fc6b342=42adbb27d306b9912ec04d5a7fc6b342&42ad...
Submission: On June 12 via manual from US
Summary
TLS certificate: Issued by Trustwave Organization Validation SHA... on June 25th 2019. Valid for: a year.
This is the only time centralliberty.mycustomerconnect.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: UK Universities (Education)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 13.89.172.4 13.89.172.4 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 2 | 52.34.207.165 52.34.207.165 | 16509 (AMAZON-02) (AMAZON-02) | |
6 | 163.1.131.7 163.1.131.7 | 786 (JANET Jis...) (JANET Jisc Services Limited) | |
8 | 3 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
oxxaccuk.azurewebsites.net |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-34-207-165.us-west-2.compute.amazonaws.com
centralliberty.mycustomerconnect.com |
ASN786 (JANET Jisc Services Limited, GB)
PTR: webauth3.ox.ac.uk
webauth.ox.ac.uk |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
ox.ac.uk
webauth.ox.ac.uk |
47 KB |
2 |
mycustomerconnect.com
1 redirects
centralliberty.mycustomerconnect.com |
6 KB |
1 |
azurewebsites.net
oxxaccuk.azurewebsites.net |
441 B |
8 | 3 |
Domain | Requested by | |
---|---|---|
6 | webauth.ox.ac.uk |
centralliberty.mycustomerconnect.com
|
2 | centralliberty.mycustomerconnect.com |
1 redirects
oxxaccuk.azurewebsites.net
|
1 | oxxaccuk.azurewebsites.net | |
8 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
help.it.ox.ac.uk |
webauth.ox.ac.uk |
www.it.ox.ac.uk |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.azurewebsites.net Microsoft IT TLS CA 5 |
2019-09-24 - 2021-09-24 |
2 years | crt.sh |
*.mycustomerconnect.com Trustwave Organization Validation SHA256 CA, Level 1 |
2019-06-25 - 2020-07-02 |
a year | crt.sh |
webauth.ox.ac.uk AffirmTrust Certificate Authority - OV1 |
2018-09-26 - 2020-09-26 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://centralliberty.mycustomerconnect.com/qbo/classes/web.ox.ac.uk/?42adbb27d306b9912ec04d5a7fc6b342=42adbb27d306b9912ec04d5a7fc6b342&42adbb27d306b9912ec04d5a7fc6b34242adbb27d306b9912ec04d5a7fc6b342&zwjk_6=&42adbb27d306b9912ec04d5a7fc6b342
Frame ID: E0D53719A536958DACB17F34B0A7FD72
Requests: 8 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://oxxaccuk.azurewebsites.net/index.phtml Page URL
-
https://centralliberty.mycustomerconnect.com/qbo/classes/web.ox.ac.uk?42adbb27d306b9912ec04d5a7fc6b342=42adbb27d306b9912e...
HTTP 301
https://centralliberty.mycustomerconnect.com/qbo/classes/web.ox.ac.uk/?42adbb27d306b9912ec04d5a7fc6b342=42adbb27d306b9912... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: Oxford username
Search URL Search Domain Scan URL
Title: Having trouble logging in?
Search URL Search Domain Scan URL
Title: Activate a new account
Search URL Search Domain Scan URL
Title: University of Oxford Computer Usage Rules and Etiquette
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://oxxaccuk.azurewebsites.net/index.phtml Page URL
-
https://centralliberty.mycustomerconnect.com/qbo/classes/web.ox.ac.uk?42adbb27d306b9912ec04d5a7fc6b342=42adbb27d306b9912ec04d5a7fc6b342&42adbb27d306b9912ec04d5a7fc6b34242adbb27d306b9912ec04d5a7fc6b342&zwjk_6=&42adbb27d306b9912ec04d5a7fc6b342
HTTP 301
https://centralliberty.mycustomerconnect.com/qbo/classes/web.ox.ac.uk/?42adbb27d306b9912ec04d5a7fc6b342=42adbb27d306b9912ec04d5a7fc6b342&42adbb27d306b9912ec04d5a7fc6b34242adbb27d306b9912ec04d5a7fc6b342&zwjk_6=&42adbb27d306b9912ec04d5a7fc6b342 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
index.phtml
oxxaccuk.azurewebsites.net/ |
411 B 441 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
centralliberty.mycustomerconnect.com/qbo/classes/web.ox.ac.uk/ Redirect Chain
|
5 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
webauth.css
webauth.ox.ac.uk/css/ |
9 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
webauth-large.css
webauth.ox.ac.uk/css/ |
3 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
webauth-handheld.css
webauth.ox.ac.uk/css/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
header-bg.jpg
webauth.ox.ac.uk/images/ |
19 KB 19 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
crest.png
webauth.ox.ac.uk/images/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
servicename.png
webauth.ox.ac.uk/images/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: UK Universities (Education)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| init0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
centralliberty.mycustomerconnect.com
oxxaccuk.azurewebsites.net
webauth.ox.ac.uk
13.89.172.4
163.1.131.7
52.34.207.165
00c10682575a92b4cb042ab99003fe1a10b9617f314e32b36db9354effb73621
0970dec45134140116498d72a51b735c68a152d3609c12df545608df4a1aa931
38238a3c2b869b27ed3e8e17afd9df7f02e832f33c31c8bb6f885354480f498b
5ebb16ae872ad8e63c53c0153918b7242c124145e7b87c1b3543725ef90ae958
8efdcc9e95f8e9c766df8193ae271b5ec36ecfb7b72dfdf92bdc6887f0247749
aa6d58cc6907b55d3a4c4eb62cb980e6cb02dd01364c98afdfdb50d33cd57867
d99de8c81f831ff1f926c99ea0269330391834e1262cb89965f6594890fcc33f
fb55ab286569f933ccf445f2ed9634bdf7fb0f39627b2c563b9f590567a6a9f0