powerhousetaxpro.com Open in urlscan Pro
216.189.154.225  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://powerplumbingshop.com/wp-admin/.wp-admin/businessfile/DocumentFile.php Page URL
2. https://powerhousetaxpro.com/wp-admin/.wp-admin/businessfile/office365/mfile/mfile/index.php Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	DocumentFile.php powerplumbingshop.com/wp-admin/.wp-admin/businessfile/	382 B 590 B	5943ms 3916ms	Document text/html	104.128.239.90 HOSTUS-GLOBAL-AS ...
General Check archive.org Show headers Download Go to Full URL https://powerplumbingshop.com/wp-admin/.wp-admin/businessfile/DocumentFile.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 104.128.239.90 Dallas, United States, ASN7489 (HOSTUS-GLOBAL-AS HostUS, HK), Reverse DNS Software Apache / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Wed, 26 Oct 2022 18:15:58 GMT Keep-Alive timeout=5, max=100 Server Apache Transfer-Encoding chunked
GET		index.php powerhousetaxpro.com/wp-admin/.wp-admin/businessfile/office365/mfile/mfile/	0 0
GET H/1.1	200 OK	Primary Request index.php Show response powerhousetaxpro.com/wp-admin/.wp-admin/businessfile/office365/mfile/mfile/	22 KB 22 KB	4356ms 2546ms	Document text/html	216.189.154.225 HOSTUS-GLOBAL-AS ...
General Check archive.org Show headers Download Go to Full URL https://powerhousetaxpro.com/wp-admin/.wp-admin/businessfile/office365/mfile/mfile/index.php Requested by Host: powerplumbingshop.com URL: https://powerplumbingshop.com/wp-admin/.wp-admin/businessfile/DocumentFile.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 216.189.154.225 Washington, United States, ASN7489 (HOSTUS-GLOBAL-AS HostUS, HK), Reverse DNS Software Apache / Resource Hash c6812ab9400758d4dc3cacfdfc1b2aa1fbd84af6ce680ae11b97b16838775a3b Request headers Referer https://powerplumbingshop.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Wed, 26 Oct 2022 18:16:03 GMT Keep-Alive timeout=5, max=100 Server Apache Transfer-Encoding chunked
GET H/1.1	200 OK	microsoft_logo.svg powerhousetaxpro.com/wp-admin/.wp-admin/businessfile/office365/mfile/mfile/naf/inf/	4 KB 4 KB	744ms 743ms	Image image/svg+xml	216.189.154.225 HOSTUS-GLOBAL-AS ...
General Check archive.org Show headers Download Go to Show image Full URL https://powerhousetaxpro.com/wp-admin/.wp-admin/businessfile/office365/mfile/mfile/naf/inf/microsoft_logo.svg Requested by Host: powerhousetaxpro.com URL: https://powerhousetaxpro.com/wp-admin/.wp-admin/businessfile/office365/mfile/mfile/index.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 216.189.154.225 Washington, United States, ASN7489 (HOSTUS-GLOBAL-AS HostUS, HK), Reverse DNS Software Apache / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers accept-language de-DE,de;q=0.9 Referer https://powerhousetaxpro.com/wp-admin/.wp-admin/businessfile/office365/mfile/mfile/index.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Date Wed, 26 Oct 2022 18:16:06 GMT Last-Modified Tue, 29 Jun 2021 05:04:22 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 3651
GET DATA	200 OK	truncated /	2 KB 2 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5 Request headers Referer Origin https://powerhousetaxpro.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers Content-Type application/octet-stream
GET H2	200	pdf.png vikinggenetics-my.sharepoint.com/personal/datho_vikinggenetics_com_au/_layouts/15/images/	7 KB 8 KB	592ms 113ms	Image image/png	13.107.138.9 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://vikinggenetics-my.sharepoint.com/personal/datho_vikinggenetics_com_au/_layouts/15/images/pdf.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 13.107.138.9 Redmond, United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / ASP.NET Resource Hash db307fcef7f95139689007d7a623b340ec21282bd421c4e4b2ba09078f230545 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.powerapps.com *.yammer.com *.officeapps.live.com *.office.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com securebroker.sharepointonline.com; Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://powerhousetaxpro.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-security-policy frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.powerapps.com *.yammer.com *.officeapps.live.com *.office.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com securebroker.sharepointonline.com; x-content-type-options nosniff date Wed, 26 Oct 2022 18:16:07 GMT nel {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} x-powered-by ASP.NET x-cache CONFIG_NOCACHE p3p CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" x-sharepointhealthscore 2 x-databoundary None request-id f17a72a0-c038-5000-7c65-9be5dd63d070 ms-cv oHJ68TjAAFB8ZZvl3WPQcA.0 content-length 6830 microsoftsharepointteamservices 16.0.0.23012 x-ms-invokeapp 1; RequireReadOnly sprequestduration 18 last-modified Sat, 15 Oct 2022 03:40:36 GMT sprequestguid f17a72a0-c038-5000-7c65-9be5dd63d070 x-msedge-ref Ref A: 1D3C244B893F495FAAED25ADED96CB45 Ref B: AMS04EDGE2021 Ref C: 2022-10-26T18:16:07Z etag "0d2cfe247e0d81:0" x-frame-options SAMEORIGIN report-to {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=Edge-Prod-AMS04r5b&frontEnd=AFD"}]} content-type image/png x-1dscollectorurl https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ x-ariacollectorurl https://eu-mobile.events.data.microsoft.com/Collector/3.0 accept-ranges bytes spiislatency 1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

powerhousetaxpro.com

URL

https://powerhousetaxpro.com/wp-admin/.wp-admin/businessfile/office365/mfile/mfile/index.php

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online) Microsoft (Consumer) Sharepoint (Online)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation number| g_responseEnd object| FabricConfig function| setImageUrl function| _spBodyOnLoad number| g_duration number| g_iisLatency number| g_requireJSDone

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

powerhousetaxpro.com
powerplumbingshop.com
vikinggenetics-my.sharepoint.com
powerhousetaxpro.com
104.128.239.90
13.107.138.9
216.189.154.225
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5
c6812ab9400758d4dc3cacfdfc1b2aa1fbd84af6ce680ae11b97b16838775a3b
db307fcef7f95139689007d7a623b340ec21282bd421c4e4b2ba09078f230545