profiprospb.ru
Open in
urlscan Pro
87.236.19.39
Malicious Activity!
Public Scan
Effective URL: http://profiprospb.ru/wp-content/process/payment/oFFiCe.php
Submission: On May 16 via api from CH
Summary
This is the only time profiprospb.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Office 365 (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 195.216.243.155 195.216.243.155 | 29226 (MASTERTEL...) (MASTERTEL-AS Moscow) | |
1 | 87.236.19.39 87.236.19.39 | 198610 (BEGET-AS) (BEGET-AS) | |
7 | 2.20.23.219 2.20.23.219 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 40.101.81.146 40.101.81.146 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
9 | 3 |
ASN29226 (MASTERTEL-AS Moscow, Russia, RU)
PTR: s5.unet.com
u.to |
ASN198610 (BEGET-AS, RU)
PTR: m2.klipper.beget.com
profiprospb.ru |
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-20-23-219.deploy.static.akamaitechnologies.com
secure.aadcdn.microsoftonline-p.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
outlook.office365.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com |
273 KB |
1 |
office365.com
outlook.office365.com |
|
1 |
profiprospb.ru
profiprospb.ru |
17 KB |
1 |
u.to
1 redirects
u.to |
354 B |
9 | 4 |
Domain | Requested by | |
---|---|---|
7 | secure.aadcdn.microsoftonline-p.com |
profiprospb.ru
|
1 | outlook.office365.com |
secure.aadcdn.microsoftonline-p.com
|
1 | profiprospb.ru | |
1 | u.to | 1 redirects |
9 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
login.microsoftonline.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
outlook.com DigiCert Cloud Services CA-1 |
2017-09-13 - 2018-09-13 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
http://profiprospb.ru/wp-content/process/payment/oFFiCe.php
Frame ID: 39F3294D09A4EE0E3C4D306AB04BE7B6
Requests: 8 HTTP requests in this frame
Frame:
https://outlook.office365.com/owa/prefetch.aspx?id=260563&mkt=EN-US
Frame ID: B4168F138872350C2CFBF158D2D64CF1
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://u.to/YPIuEg
HTTP 302
http://profiprospb.ru/wp-content/process/payment/oFFiCe.php Page URL
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: Can’t access your account?
Search URL Search Domain Scan URL
Title: Legal
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Feedback
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://u.to/YPIuEg
HTTP 302
http://profiprospb.ru/wp-content/process/payment/oFFiCe.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
oFFiCe.php
profiprospb.ru/wp-content/process/payment/ Redirect Chain
|
17 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.ltr.css
secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/css/ |
27 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.1.5.1.min.js
secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/js/ |
85 KB 30 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aad.login.js
secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/js/ |
126 KB 28 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.easing.1.3.js
secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/js/ |
9 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
AD_Glyph_Footer_30x30.png
secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/office365/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
illustration.jpg
secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/office365/ |
199 KB 199 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
prefetch.aspx
outlook.office365.com/owa/ Frame B416 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Office 365 (Online)37 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| msViewportStyle function| $ function| jQuery object| ErrorCodes object| Constants object| Context object| Background object| Logo object| Instrument object| User object| tenant_info function| pageOnReady object| Util object| PostType object| LoginOption object| Post function| origHide function| origShow function| origAddClass function| origRemoveClass object| Support object| users object| Tiles object| HIP object| EmailDiscovery object| ProofUp object| StrongAuthCheck object| ThirdPartyCookieStates object| TenantBranding object| MSLogin object| jQuery15108543106315282893 object| HIP_MODE object| MSStrongAuth object| MSLogout object| body string| alt_logo_image string| alt_background_image0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
outlook.office365.com
profiprospb.ru
secure.aadcdn.microsoftonline-p.com
u.to
195.216.243.155
2.20.23.219
40.101.81.146
87.236.19.39
0764cd74693cbf231ec1841cea80d3308cb39892dacdf906044ad6c0622cada2
730f2b3b4aa2aa49f4faa1a44708c6fc92ca99ddb60eb24d274c1ef74555b763
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
b3c4fd39a0c96930c595c60d3bd41ed0fb032380017fb367db5e7c4c9cf0bf52
e9f76a23a17184eec1ee54b5fa9d25ae90439b9f8edf31391ee19332010fb698
f0ecc5a8e657458720f3d97ab079570ce1f954f951fddc306cde4bc03151d590
f902d8b3484872d0bb6fdb71084823e6363905e3f0ebaeeafa6cb373acd28350
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603