webex-here.cf
Open in
urlscan Pro
35.202.83.17
Malicious Activity!
Public Scan
Effective URL: https://webex-here.cf/idb/saml2/jsp/
Submission: On October 23 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on October 23rd 2019. Valid for: 3 months.
This is the only time webex-here.cf was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Cisco Webex (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 14 | 35.202.83.17 35.202.83.17 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
12 | 1 |
ASN15169 (GOOGLE - Google LLC, US)
PTR: 17.83.202.35.bc.googleusercontent.com
webex-here.cf |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
webex-here.cf
2 redirects
webex-here.cf |
378 KB |
12 | 1 |
Domain | Requested by | |
---|---|---|
14 | webex-here.cf |
2 redirects
webex-here.cf
|
12 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.webex.com |
www.cisco.com |
meetings.webex.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
webex-here.cf Let's Encrypt Authority X3 |
2019-10-23 - 2020-01-21 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://webex-here.cf/idb/saml2/jsp/
Frame ID: 0D22CBF22E30FB1FB4AB68E190F75A9D
Requests: 12 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://webex-here.cf/
HTTP 302
https://webex-here.cf/idb/saml2/jsp HTTP 301
https://webex-here.cf/idb/saml2/jsp/ Page URL
Detected technologies
Ubuntu (Operating Systems) ExpandDetected patterns
- headers server /Ubuntu/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: Terms of Service
Search URL Search Domain Scan URL
Title: Privacy Statement
Search URL Search Domain Scan URL
Title: Learn more about
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://webex-here.cf/
HTTP 302
https://webex-here.cf/idb/saml2/jsp HTTP 301
https://webex-here.cf/idb/saml2/jsp/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
webex-here.cf/idb/saml2/jsp/ Redirect Chain
|
17 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
collab-ui_14aa171060ff838aa864e3a258ea231d.min.css
webex-here.cf/idb/css/ |
1 MB 100 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
collab-ui-icons_450a2769f8d9aefecb8a1422bb997346.min.css
webex-here.cf/idb/css/ |
122 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
idbstyle_symphony_94d03ed9e5833fac404765e2612e2b13.css
webex-here.cf/idb/css/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
idbstyle_service_webex.css
webex-here.cf/idb/css/ |
814 B 670 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
component_ffbc204eb8b8c20b1c0d483556979d98.js
webex-here.cf/idb/wwf/js/ |
684 KB 131 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
console_cfb0274999575ad33f5541e88b6414fd.js
webex-here.cf/idb/js/ |
89 B 453 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
auth_symphony_2d4abaa2e52c97467cadb3b5d7cd222a.js
webex-here.cf/idb/js/ |
31 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cisco-webex-lockup-blue.svg
webex-here.cf/idb/images/cisco-webex/lockup/ |
9 KB 9 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
CiscoSansTTRegular.woff2
webex-here.cf/idb/fonts/ |
52 KB 52 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
meetings-icon-color.svg
webex-here.cf/idb/images/webex-meetings/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
CiscoSansTTLight.woff2
webex-here.cf/idb/fonts/ |
52 KB 53 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Cisco Webex (Online)90 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| jMarker object| i18n string| HEMISPHERE_SOUTH string| HEMISPHERE_NORTH string| HEMISPHERE_UNKNOWN object| olson function| TimeZone function| date_is_dst function| get_date_offset function| get_timezone_info function| get_january_offset function| get_june_offset function| determine_timezone function| $ function| jQuery object| WWF object| WBX function| Class string| k string| v object| fruit function| isFunction object| logger function| trim object| rnotwhite object| trimLeft object| trimRight object| func object| mirrorPool undefined| sourceFn string| idbPageVersion function| occupyFullBrowser function| placeCursorOnFirstElm function| markupButton function| markupButton2 function| aggSubmit function| getSelectedRadioValue function| getSelectedCheckBoxValues function| strTrim function| clearFormElms function| writePasswordPolicy function| showLabel function| hideLabel function| enableButton function| disableButton function| validateForm function| initializeForm function| isPasswordResetPage function| makeReadonly function| adjustButtons function| highlightFocusedInputTextbox function| removeHighlightErrorInputTextbox function| highlightErrorInputTextbox function| highlightErrorWithoutShowErrorMsg function| showHideHelpPopup function| showHidePopup function| closePopup function| openPopup function| reloadPageWithSelectedLocale function| setHelpPopupPosition function| setLoginOptionsWidth function| setPageVersion function| addAudioTag function| bindFocusInOut function| updatePlaceHolder function| isIE function| isSafari function| passwordPolicyInit function| checkPasswordPoicy function| resetPasswordPolicyCheckStatus number| elmCount number| passwordCount number| loginOptionElmCount string| localeData string| redirectUrl boolean| nameValidated string| defaultBtn object| LoginOption function| defaultSubmit object| passwordPolicy function| LoginSubmit function| submitForm function| validateName function| processLink boolean| toggle function| toggleHelp function| hideTooltip object| antiClickjack0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
webex-here.cf
35.202.83.17
25434540002466465f8d84e944ab9b4fe2e61bc946de440f661096e2f4aa91a5
3f967a09b94b9283339c130977ef0dbd3ef8d5b231f65dee4a2b63c7413b30af
74c9df7734ebe33695af04a80d0f7339079e3985f6dce59d43b27c1d4c8e549e
77904ea504ebc691fd8193fa3c8a5e8c9a9a82d83c17482318566784137a5711
7cd5e8b09d77c0fc360fc19bc6f3bb463f743b2866fa82f52a94dd123fddc703
a4ee35f2d6dec7dc7fcdfa62f3485e232d3a52828c99b4f1c23415a30dd2f5fe
b30cf8c4465930bd7aa83b1e6d4683391cfe85cd5cba5cb6f2c43e2e879b0fe6
b9195b34a9d6807e3952cf46e9da508b5981e6d1187c9183ac59e8899b505233
c49b55f11c83766838e727a4b130bba58a7430254c6149ea49a7d187395e0f4c
d8dcc4001aab9e6914fd6319c67f6cf8e1d5e7ed3410dd3dda29bcb5f3039276
e77b9a9fa5f7f72fee5e61b8a95ac30a53f9d405b7b8aa4d017b7315663a16ec
f826288d2c18f1a34d68bcef648bd6d8ad1e993594c0fbcfbfc4684ce27f6605