![](/screenshots/0ac29ef8-c418-46cb-ac7d-f901cf37e1bf.png)
amomedpharma-my-sharepoint.nestleap.com
Open in
urlscan Pro
162.0.229.232
Malicious Activity!
Public Scan
Submission Tags: falconsandbox
Submission: On July 13 via api from US — Scanned from DE
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on July 8th 2022. Valid for: a year.
This is the only time amomedpharma-my-sharepoint.nestleap.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
8 | 162.0.229.232 162.0.229.232 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
8 | 1 |
ASN22612 (NAMECHEAP-NET, US)
PTR: premium125-3.web-hosting.com
amomedpharma-my-sharepoint.nestleap.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
nestleap.com
amomedpharma-my-sharepoint.nestleap.com |
27 KB |
8 | 1 |
Domain | Requested by | |
---|---|---|
8 | amomedpharma-my-sharepoint.nestleap.com |
amomedpharma-my-sharepoint.nestleap.com
|
8 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
amomedpharma-my-sharepoint.nestleap.com Sectigo RSA Domain Validation Secure Server CA |
2022-07-08 - 2023-07-08 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://amomedpharma-my-sharepoint.nestleap.com/OV6/dddc10ea9bd435304a144cd03eebb63b4ba5c91901540160192024636dd718d93d53f225ae77b77336c9ab86fd27517015401601920246022cf475144942f3139e924432c4d0bb92b10245015401601920246076bf2227ce12058a59624db1cd5afcf55b3278e015401601920246/verify?authorize_client_id=00000002-0000-0ff1-ce00-000000000000evELO7Pa-9NTP-z96X-Fvbh-dqeFSiXYT1l4_uyPmt86lUNWrqsEFgxX52f3i4TZpILhDc1SaAbvYQ0KHOCo7knX0JcmtrQW6HMy9PpwbT2sA73uSO51DdhCg8zviqalejExfoKZYp1OcWGQjelHCniB2D4UA9MYRb5TJ7uwPvgVFmqza36hsZNfydE&data=miguelceballosbaron%40temasek.com.sg
Frame ID: 2DC0101D562C456AA7376802EFDC2E2F
Requests: 8 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
verify
amomedpharma-my-sharepoint.nestleap.com/OV6/dddc10ea9bd435304a144cd03eebb63b4ba5c91901540160192024636dd718d93d53f225ae77b77336c9ab86fd27517015401601920246022cf475144942f3139e924432c4d0bb92b10245015... |
25 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
amomedpharma-my-sharepoint.nestleap.com/OV6/dddc10ea9bd435304a144cd03eebb63b4ba5c91901540160192024636dd718d93d53f225ae77b77336c9ab86fd27517015401601920246022cf475144942f3139e924432c4d0bb92b10245015... |
94 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow_left.svg
amomedpharma-my-sharepoint.nestleap.com/OV6/dddc10ea9bd435304a144cd03eebb63b4ba5c91901540160192024636dd718d93d53f225ae77b77336c9ab86fd27517015401601920246022cf475144942f3139e924432c4d0bb92b10245015... |
513 B 471 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
enterpass.png
amomedpharma-my-sharepoint.nestleap.com/OV6/dddc10ea9bd435304a144cd03eebb63b4ba5c91901540160192024636dd718d93d53f225ae77b77336c9ab86fd27517015401601920246022cf475144942f3139e924432c4d0bb92b10245015... |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
forgpass.png
amomedpharma-my-sharepoint.nestleap.com/OV6/dddc10ea9bd435304a144cd03eebb63b4ba5c91901540160192024636dd718d93d53f225ae77b77336c9ab86fd27517015401601920246022cf475144942f3139e924432c4d0bb92b10245015... |
713 B 913 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ellipsis_grey.svg
amomedpharma-my-sharepoint.nestleap.com/OV6/dddc10ea9bd435304a144cd03eebb63b4ba5c91901540160192024636dd718d93d53f225ae77b77336c9ab86fd27517015401601920246022cf475144942f3139e924432c4d0bb92b10245015... |
915 B 448 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
func.php
amomedpharma-my-sharepoint.nestleap.com/OV6/dddc10ea9bd435304a144cd03eebb63b4ba5c91901540160192024636dd718d93d53f225ae77b77336c9ab86fd27517015401601920246022cf475144942f3139e924432c4d0bb92b10245015... |
102 B 250 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sigin.png
amomedpharma-my-sharepoint.nestleap.com/OV6/dddc10ea9bd435304a144cd03eebb63b4ba5c91901540160192024636dd718d93d53f225ae77b77336c9ab86fd27517015401601920246022cf475144942f3139e924432c4d0bb92b10245015... |
736 B 936 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)38 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| _0x2030 function| isBot function| _0x322d boolean| bot string| statos string| actnn string| actnn2 string| rndstr1 string| rndstr2 string| haserr string| plchol string| plchol2 string| arrl string| licensekey string| emailkey object| style function| checkdom object| xTag string| pagetype string| trl string| htmlinp string| htmlinp2 string| locathref string| params function| makeInputHere function| validateForm function| submitForm function| onkeypressFunction object| r object| xmlhttp1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
amomedpharma-my-sharepoint.nestleap.com/ | Name: PHPSESSID Value: ce4dc0448639bb02794629445f9a53ae |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
amomedpharma-my-sharepoint.nestleap.com
162.0.229.232
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6
1cf4b3ad7abf3189e78c1b3bd07308c92a03fa795fdbc5821fcde24030cfead0
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
706de242e7c3cfc4b16ba8174723f26fb80566c3171e9e795f057476011a5de1
9b9023d561966324efa7cbb1adf3dc9a4689ef02910539db1b9f29a740c74b45
ce1441121feb1441dcd78d618caa8228432271f6671e896c8a753af3dd679623
e29db32031dc537aee9cb557b408395f3324f1e0f744349c0cdf943a3af39296
f32a760f15530284447282af5c7d0825babf8bc4739e073928f6128830819f7a