onedriveshare.ga
Open in
urlscan Pro
206.189.210.199
Malicious Activity!
Public Scan
Effective URL: https://onedriveshare.ga/onedrv/drive/share/drive/access.php
Submission: On May 21 via manual from GB
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on May 12th 2019. Valid for: 3 months.
This is the only time onedriveshare.ga was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: OneDrive (Online) Office 365 (Online) WeTransfer (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2a00:1450:400... 2a00:1450:4001:824::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
8 | 206.189.210.199 206.189.210.199 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean) | |
1 | 2a00:1450:400... 2a00:1450:4001:824::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2a00:1450:400... 2a00:1450:4001:81f::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
11 | 4 |
ASN15169 (GOOGLE - Google LLC, US)
www.google.as |
ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
PTR: dedicated.courtneyrowlands.com
onedriveshare.ga |
ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com |
ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
onedriveshare.ga
onedriveshare.ga |
293 KB |
1 |
gstatic.com
fonts.gstatic.com |
9 KB |
1 |
googleapis.com
fonts.googleapis.com |
817 B |
1 |
google.as
www.google.as |
1008 B |
11 | 4 |
Domain | Requested by | |
---|---|---|
8 | onedriveshare.ga |
www.google.as
onedriveshare.ga |
1 | fonts.gstatic.com |
onedriveshare.ga
|
1 | fonts.googleapis.com |
onedriveshare.ga
|
1 | www.google.as | |
11 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.google.as Google Internet Authority G3 |
2019-04-30 - 2019-07-23 |
3 months | crt.sh |
onedriveshare.ga Let's Encrypt Authority X3 |
2019-05-12 - 2019-08-10 |
3 months | crt.sh |
*.googleapis.com Google Internet Authority G3 |
2019-04-30 - 2019-07-23 |
3 months | crt.sh |
*.google.com Google Internet Authority G3 |
2019-04-30 - 2019-07-23 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://onedriveshare.ga/onedrv/drive/share/drive/access.php
Frame ID: C116A215AE3BEC1484967FB49A77ECCB
Requests: 11 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://www.google.as/url?q=%68t%74%70%73%3A%2F%2F%6fn%65%64riv%65%73hare%2ega%2F%6f%6eedr%76%2Fdr... Page URL
- https://onedriveshare.ga/onedrv/drive/share/drive/access.php Page URL
Detected technologies
Google Web Server (Web Servers) ExpandDetected patterns
- headers server /gws/i
Google Font API (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://www.google.as/url?q=%68t%74%70%73%3A%2F%2F%6fn%65%64riv%65%73hare%2ega%2F%6f%6eedr%76%2Fdri%76e%2F%73%68a%72e%2F%64%72iv%65%2Fac%63%65ss.%70hp&sa=D&sntz=1&usg=AFQjCNFIycgyMJpkcgPLHe39ToRftZEfGQ Page URL
- https://onedriveshare.ga/onedrv/drive/share/drive/access.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
url
www.google.as/ |
436 B 1008 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
access.php
onedriveshare.ga/onedrv/drive/share/drive/ |
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
2 KB 817 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
onedriveshare.ga/onedrv/drive/share/drive/ |
40 KB 40 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
office365.png
onedriveshare.ga/onedrv/drive/share/drive/ |
25 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
outlook.png
onedriveshare.ga/onedrv/drive/share/drive/ |
109 KB 110 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
yahoo.png
onedriveshare.ga/onedrv/drive/share/drive/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Mimecast.png
onedriveshare.ga/onedrv/drive/share/drive/ |
43 KB 43 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Godaddy.png
onedriveshare.ga/onedrv/drive/share/drive/ |
12 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg.png
onedriveshare.ga/onedrv/drive/share/drive/ |
52 KB 52 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v16/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: OneDrive (Online) Office 365 (Online) WeTransfer (Online)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
onedriveshare.ga
www.google.as
206.189.210.199
2a00:1450:4001:81f::2003
2a00:1450:4001:824::2003
2a00:1450:4001:824::200a
18ca4331937530d982da022b8f637c4535ef6fa708b8009d13e88d55f510f54d
30b0818ed57696272dc4c81cfb7b113345f268ee992bac1082eb9d16fb19477b
44699580be638183ed3d5cc1cf77ae6d4f88a41e4423b4b015f790976c08c08c
44c4d4c588aa7b984e0ee91d211845cb588b0d17dbcd1f17bf01aa3f16f291a5
466892c00b39ade716214243e88839feab181776d1d932127901e95dfb281fb4
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
871a9faf2c93365b592f147f847b2f4e12d4463817c675621c860253c1e4e26f
8ae79a4d18eea420af0fd562d43879b569bbd2c622da6deba79f6c202e385361
8b3a7f6192679ee916ffa2faf2d9cf41330b83412985a1c31a688ab5ffe8b078
9d8ff5022a30f31fefb64bf30c92bf2387247036d96b0962f096a2db0d0318e6
e2ae6da27e4820f57e3641b237ef0593e9be975578b1855c0f50c71a19c12df7