sharebox.org Open in urlscan Pro
27.121.64.175 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://sharebox.org/hotmail/hotis/step2-authen.php
Submission: On June 14 via automatic, source openphish (June 14th 2018, 3:53:57 am UTC)

Summary HTTP 7 Redirects Links 4 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 7 HTTP transactions. The main IP is 27.121.64.175, located in Brisbane, Australia and belongs to NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU. The main domain is sharebox.org.

This is the only time sharebox.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
1	27.121.64.175 27.121.64.175		24446 (NETREGIST...) (NETREGISTRY-AS-AP NetRegistry Pty Ltd.)
5	2.19.41.58 2.19.41.58		20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	40.101.90.2 40.101.90.2		8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
7	3

1 27.121.64.175 (Brisbane, Australia)

ASN24446 (NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU)
PTR: cp175.ezyreg.com

sharebox.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2.19.41.58 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-19-41-58.deploy.static.akamaitechnologies.com

auth.gfx.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 40.101.90.2 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

outlook.office365.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	gfx.ms auth.gfx.ms	82 KB
1	office365.com outlook.office365.com
1	sharebox.org sharebox.org	17 KB
7	3

	Domain	Requested by
5	auth.gfx.ms	sharebox.org
1	outlook.office365.com	sharebox.org
1	sharebox.org
7	3

This site contains links to these domains. Also see Links.

Domain
account.live.com
login.live.com

Subject Issuer	Validity	Valid
outlook.com DigiCert Cloud Services CA-1	`2017-09-13` - `2018-09-13`	a year	crt.sh

This page contains 2 frames:

Primary Page: http://sharebox.org/hotmail/hotis/step2-authen.php
Frame ID: 31E0CA92E596292C026B8265A7EB044D
Requests: 6 HTTP requests in this frame

Frame: https://outlook.office365.com/owa/prefetch.aspx?id=292841&mkt=EN-GB
Frame ID: F74537D58E9C4EDCB86225040313649A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_ssl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_ssl(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
headers server /mod_ssl(?:\/([\d.]+))?/i

webpack (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

env /^webpackJsonp$/i

Page Statistics

7
Requests

14 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

99 kB
Transfer

304 kB
Size

3
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.0%26rpsnv%3d13%26ct%3d1479722006%26rver%3d6.4.6456.0%26wp%3dMBI_SSL%26wreply%3dhttps%253a%252f%252foutlook.live.com%252fowa%252f%26lc%3d2057%26id%3d292841%26mkt%3den-gb%26cbcxt%3dout%26fl%3dwld%26contextid%3d3120DC6F591A060F%26bk%3d1479722009&id=292841&uiflavor=web&uaid=2419581f135940218028ecd616c02d58&mkt=EN-GB&lc=2057&bk=1479722009
Title: Forgotten my password

Search URL Search Domain Scan URL

URL: https://login.live.com/logout.srf?wa=wsignin1.0&rpsnv=13&ct=1479722006&rver=6.4.6456.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f&lc=2057&id=292841&mkt=en-gb&cbcxt=out&fl=wld&contextid=3120DC6F591A060F&ru=https://outlook.live.com/owa/&bk=1479722009&lm=I
Title: Sign in with a different Microsoft account

Search URL Search Domain Scan URL

URL: https://login.live.com/gls.srf?urlID=WinLiveTermsOfUse&mkt=EN-GB&vv=1600
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://login.live.com/gls.srf?urlID=MSNPrivacyStatement&mkt=EN-GB&vv=1600
Title: Privacy & Cookies

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set step2-authen.php Show response
sharebox.org/hotmail/hotis/ 17 KB
17 KB 678ms
377ms Document
text/html 27.121.64.175
NETREGISTRY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: http://sharebox.org/hotmail/hotis/step2-authen.php
Protocol: HTTP/1.1
Server: 27.121.64.175 Brisbane, Australia, ASN24446 (NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU),
Reverse DNS: cp175.ezyreg.com
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 / PHP/5.3.29
Resource Hash: 185cff29d1ed12c007635573c747aa18e5e643b02c69bbde899e196bb11d7995

Request headers

Host: sharebox.org
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 31E0CA92E596292C026B8265A7EB044D

Response headers

Date: Thu, 14 Jun 2018 03:53:45 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
X-Powered-By: PHP/5.3.29
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=c83ekui5so76gecth0jql2hmm4; path=/
Keep-Alive: timeout=3, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

GET
H/1.1 200
OK Default2057.css
auth.gfx.ms/16.000.26754.00.1/ 74 KB
15 KB 24ms
9ms Stylesheet
text/css 2.19.41.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://auth.gfx.ms/16.000.26754.00.1/Default2057.css
Requested by: Host: sharebox.org
URL: http://sharebox.org/hotmail/hotis/step2-authen.php
Protocol: HTTP/1.1
Server: 2.19.41.58 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-41-58.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/8.5 /
Resource Hash: ca078e9833f067c6e28abe33c37a8ca9565fd02abe961e2ebc227635b1b03027

Request headers

Referer: http://sharebox.org/hotmail/hotis/step2-authen.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 14 Jun 2018 03:53:45 GMT
Content-Encoding: gzip
Last-Modified: Tue, 15 Nov 2016 09:04:22 GMT
PPServer: PPV: 30 H: BL2IDSPRTS1C004 V: 0
ETag: "02f58411f3fd21:0"
Vary: Accept-Encoding
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=366635
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 14670
Server: Microsoft-IIS/8.5

GET
H/1.1 200
OK DefaultLoginPaginatedStrings.EN-GB.js Show response
auth.gfx.ms/16.000.26754.00.1/ 11 KB
4 KB 21ms
6ms Script
application/javascript 2.19.41.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://auth.gfx.ms/16.000.26754.00.1/DefaultLoginPaginatedStrings.EN-GB.js
Requested by: Host: sharebox.org
URL: http://sharebox.org/hotmail/hotis/step2-authen.php
Protocol: HTTP/1.1
Server: 2.19.41.58 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-41-58.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/8.5 /
Resource Hash: c582c2fe5f74458f0af90fa1469af95bf4eb88601cc4d017bd7ef5e1b52ffaf4

Request headers

Referer: http://sharebox.org/hotmail/hotis/step2-authen.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 14 Jun 2018 03:53:45 GMT
Content-Encoding: gzip
Last-Modified: Tue, 15 Nov 2016 09:11:52 GMT
PPServer: PPV: 30 H: BL2IDSPRTS1C004 V: 0
ETag: "0bc904d203fd21:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=478793
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3794
Server: Microsoft-IIS/8.5

GET
H/1.1 200
OK DefaultLogin_PCore.js Show response
auth.gfx.ms/16.000.26754.00.1/ 190 KB
57 KB 27ms
13ms Script
application/javascript 2.19.41.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://auth.gfx.ms/16.000.26754.00.1/DefaultLogin_PCore.js
Requested by: Host: sharebox.org
URL: http://sharebox.org/hotmail/hotis/step2-authen.php
Protocol: HTTP/1.1
Server: 2.19.41.58 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-41-58.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/8.5 /
Resource Hash: 8a3aa480509e9e782ec14eb1592d7fc0f68c82b443045751fcdfd051b03029ac

Request headers

Referer: http://sharebox.org/hotmail/hotis/step2-authen.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 14 Jun 2018 03:53:45 GMT
Content-Encoding: gzip
Last-Modified: Thu, 17 Nov 2016 17:19:24 GMT
PPServer: PPV: 30 H: BL2IDSPRTS1C004 V: 0
ETag: "036f1bdf640d21:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=324516
Transfer-Encoding: chunked
Connection: keep-alive, Transfer-Encoding
Accept-Ranges: bytes
Server: Microsoft-IIS/8.5

GET
H/1.1 200
OK AppCentipede_Microsoft.svg
auth.gfx.ms/16.000.26754.00.1/images/AppCentipede/ 7 KB
3 KB 6ms
6ms Image
image/svg+xml 2.19.41.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth.gfx.ms/16.000.26754.00.1/images/AppCentipede/AppCentipede_Microsoft.svg
Requested by: Host: sharebox.org
URL: http://sharebox.org/hotmail/hotis/step2-authen.php
Protocol: HTTP/1.1
Server: 2.19.41.58 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-41-58.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/8.5 /
Resource Hash: bde5e27f76f371121f1955806f1b662f323f3793b079455f5bfe83365a393625

Request headers

Referer: http://sharebox.org/hotmail/hotis/step2-authen.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 14 Jun 2018 03:53:45 GMT
Content-Encoding: gzip
Last-Modified: Wed, 19 Oct 2016 13:11:49 GMT
PPServer: PPV: 30 H: BAYIDSPRTS3G004 V: 0
ETag: "8058b159a2ad21:0"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Cache-Control: max-age=178396
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2946
Server: Microsoft-IIS/8.5

GET
H/1.1 200
OK Microsoft_Logotype_Gray.svg
auth.gfx.ms/16.000.26754.00.1/images/ 5 KB
3 KB 6ms
6ms Image
image/svg+xml 2.19.41.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth.gfx.ms/16.000.26754.00.1/images/Microsoft_Logotype_Gray.svg
Requested by: Host: sharebox.org
URL: http://sharebox.org/hotmail/hotis/step2-authen.php
Protocol: HTTP/1.1
Server: 2.19.41.58 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-41-58.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/8.5 /
Resource Hash: 356f7d1241f92c9de9c9cfd0bebb6c10d1b38508a3f37cebc26329c656bad19f

Request headers

Referer: http://sharebox.org/hotmail/hotis/step2-authen.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 14 Jun 2018 03:53:45 GMT
Content-Encoding: gzip
Last-Modified: Wed, 19 Oct 2016 13:11:49 GMT
PPServer: PPV: 30 H: BAYIDSPRTS3G004 V: 0
ETag: "8058b159a2ad21:0"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Cache-Control: max-age=354204
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2160
Server: Microsoft-IIS/8.5

GET
H/1.1 200
OK Cookie set prefetch.aspx
outlook.office365.com/owa/ Frame F745 0
0 115ms
69ms Document
text/html 40.101.90.2
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://outlook.office365.com/owa/prefetch.aspx?id=292841&mkt=EN-GB

Requested by

Host: sharebox.org
URL: http://sharebox.org/hotmail/hotis/step2-authen.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

40.101.90.2 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Host: outlook.office365.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://sharebox.org/hotmail/hotis/step2-authen.php
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 31E0CA92E596292C026B8265A7EB044D
Referer: http://sharebox.org/hotmail/hotis/step2-authen.php

Response headers

Cache-Control: private, no-store
Content-Type: text/html
Server: Microsoft-IIS/10.0
request-id: 573002d3-dfbf-46ca-be8a-32730545f525
X-CalculatedFETarget: HE1PR09CU002.internal.outlook.com
X-BackEndHttpStatus: 200 200
Set-Cookie: ClientId=48E44C17FF5C475AA5A8F104D61A33AF; expires=Fri, 14-Jun-2019 03:53:45 GMT; path=/; secure ClientId=48E44C17FF5C475AA5A8F104D61A33AF; expires=Fri, 14-Jun-2019 03:53:45 GMT; path=/; secure OIDC=1; expires=Fri, 14-Dec-2018 03:53:45 GMT; path=/; secure; HttpOnly
X-FEProxyInfo: HE1PR09CA0047.EURPRD09.PROD.OUTLOOK.COM
X-CalculatedBETarget: HE1PR07MB0985.EURPRD07.PROD.OUTLOOK.COM
X-RUM-Validated: 1
X-Content-Type-Options: nosniff
X-OWA-Version: 15.20.884.12
X-OWA-DiagnosticsInfo: 3;0;0
X-BackEnd-Begin: 2018-06-14T03:53:45.874
X-BackEnd-End: 2018-06-14T03:53:45.874
X-DiagInfo: HE1PR07MB0985
X-BEServer: HE1PR07MB0985
X-UA-Compatible: IE=EmulateIE7
Strict-Transport-Security: max-age=31536000; includeSubDomains max-age=31536000; includeSubDomains
X-FEServer: HE1PR09CA0047 AM6PR07CA0003
X-Powered-By: ASP.NET
Date: Thu, 14 Jun 2018 03:53:45 GMT
Content-Length: 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| PROOF number| g_iSRSFailed string| g_sSRSSuccess function| SRSRetry object| g_dtFirstByte object| g_objPageMode object| StringRepository boolean| __DefaultLoginPaginatedStrings function| webpackJsonp function| check

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			outlook.office365.com/	1970-01-18 21:05:59	Name: OIDC Value: 1
			outlook.office365.com/	1970-01-19 01:28:04	Name: ClientId Value: 48E44C17FF5C475AA5A8F104D61A33AF
			sharebox.org/	1969-12-31 23:59:59	Name: PHPSESSID Value: c83ekui5so76gecth0jql2hmm4

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

auth.gfx.ms
outlook.office365.com
sharebox.org
2.19.41.58
27.121.64.175
40.101.90.2
185cff29d1ed12c007635573c747aa18e5e643b02c69bbde899e196bb11d7995
356f7d1241f92c9de9c9cfd0bebb6c10d1b38508a3f37cebc26329c656bad19f
8a3aa480509e9e782ec14eb1592d7fc0f68c82b443045751fcdfd051b03029ac
bde5e27f76f371121f1955806f1b662f323f3793b079455f5bfe83365a393625
c582c2fe5f74458f0af90fa1469af95bf4eb88601cc4d017bd7ef5e1b52ffaf4
ca078e9833f067c6e28abe33c37a8ca9565fd02abe961e2ebc227635b1b03027