secure-web.cisco.com
Open in
urlscan Pro
2620:101:2005:11f0::1001
Malicious Activity!
Public Scan
URL:
https://secure-web.cisco.com/14uT3x38XVdgnvUiltsRXauS6kg1MiOZnTzTlwjgkYNvrq_xrgVVVb9xREjosdbHi6zAzsfvHdSAH6VLUYfBNncJCMqeVbPu...
Submission: On May 15 via api from DK
Submission: On May 15 via api from DK
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 3 HTTP transactions.
The main IP is 2620:101:2005:11f0::1001, located in
United States and
belongs to IRONPORT-SYSTEMS-INC, US.
The main domain is secure-web.cisco.com.
TLS certificate: Issued by HydrantID SSL ICA G2 on December 2nd 2019. Valid for: 2 years.
This is the only time secure-web.cisco.com was scanned on urlscan.io!
TLS certificate: Issued by HydrantID SSL ICA G2 on December 2nd 2019. Valid for: 2 years.
This is the only time secure-web.cisco.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 | 2620:101:2005... 2620:101:2005:11f0::1001 | 16417 (IRONPORT-...) (IRONPORT-SYSTEMS-INC) | |
| 1 | 2.16.31.108 2.16.31.108 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
| 3 | 2 |
1
2.16.31.108
(Frankfurt am Main, Germany)
ASN16625 (AKAMAI-AS, US)
PTR: a2-16-31-108.deploy.static.akamaitechnologies.com
ASN16625 (AKAMAI-AS, US)
PTR: a2-16-31-108.deploy.static.akamaitechnologies.com
| www.dhl.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 2 |
cisco.com
secure-web.cisco.com |
3 KB |
| 1 |
dhl.com
www.dhl.com |
686 B |
| 3 | 2 |
| Domain | Requested by | |
|---|---|---|
| 2 | secure-web.cisco.com |
secure-web.cisco.com
|
| 1 | www.dhl.com |
secure-web.cisco.com
|
| 3 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| secure-web.cisco.com HydrantID SSL ICA G2 |
2019-12-02 - 2021-12-02 |
2 years | crt.sh |
| www.dhl.com DPDHL Global TLS CA - I5 |
2020-08-04 - 2021-08-04 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://secure-web.cisco.com/14uT3x38XVdgnvUiltsRXauS6kg1MiOZnTzTlwjgkYNvrq_xrgVVVb9xREjosdbHi6zAzsfvHdSAH6VLUYfBNncJCMqeVbPuOe_4GjIjCmWaSYZhs7qMllFtN25eIcReAXkClCiUi7AwyUFQFCdGKaKyC1JKoQmYe_g0CVJ5Q-weywVZbxbNPD54OfuQmP7o1hJ7FvcmyWmzajJ35SafVRZqotIahrFWrGsT4nAA8dOPirn838bN9iV6-pZoa_raO4LTE5M6ed93Nsswisrr7lgsVGbMIc-FlbUeZ8HpF_9ceMafyUbalsOD5KiO2LNyEBEwAWS0Q0_XPKOwAWSwUG083L5RwCXYJ8WazJvbzR86337ipkh3DA1Wv0njngUY0/https%3A%2F%2Fqrco.de%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2Fbc4Asw%2F%2F%2F%2F%2F%2F
Frame ID: 5955BAA9B61AEFF93ABB2D716EAA920D
Requests: 3 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
3 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
https%3A%2F%2Fqrco.de%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2...
secure-web.cisco.com/14uT3x38XVdgnvUiltsRXauS6kg1MiOZnTzTlwjgkYNvrq_xrgVVVb9xREjosdbHi6zAzsfvHdSAH6VLUYfBNncJCMqeVbPuOe_4GjIjCmWaSYZhs7qMllFtN25eIcReAXkClCiUi7AwyUFQFCdGKaKyC1JKoQmYe_g0CVJ5Q-weywVZ... |
1 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
block.css
secure-web.cisco.com/static/block/ |
1 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
dhl_logo.gif
www.dhl.com/img/meta/ |
443 B 686 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
secure-web.cisco.com
www.dhl.com
2.16.31.108
2620:101:2005:11f0::1001
2f680b51b19fc3c5befd02bd9d0d4e88c2722a5210157e4ef68933c5ba352109
be94850a2069d3ce3021a698a050ceafd78d50a382a5a9af265a6dd61f56c173
d619df79da1222d1c0261844715bb4a8fe040eae75350c9807435cf7a16d7a41