3.92.138.129
Open in
urlscan Pro
3.92.138.129
Malicious Activity!
Public Scan
URL:
http://3.92.138.129/baited/O365_FakeSignInPage/
Submission: On December 21 via api from JP — Scanned from JP
Submission: On December 21 via api from JP — Scanned from JP
Form analysis
1 forms found in the DOMPOST /baited/SIHarvestingCredentialsLandingPage_1/index.php
<form action="/baited/SIHarvestingCredentialsLandingPage_1/index.php" id="form123" method="post">
<div class="textfield" id="userid2">
<div class="input_border2"><span class="textf"><input alt="Email" aria-label="User account" autocomplete="off" class="email2" id="somefield" name="Email" style="height:30px; width:350px; font-size:12pt;" tabindex="1" type="text"
placeholder="Email"> </span></div>
</div>
<input type="hidden" name="id" value="">
<input type="hidden" name="companyId" value="">
<input type="hidden" name="id" value="">
<input type="hidden" name="campaignId" value="">
<input type="hidden" name="userId" value="">
<div class="login_textfield textfield" id="cred_password_container" style="opacity: 1;"><span class="input_field textfield"><label class="no_display" for="cred_password_inputtext" aria-hidden="true">Password</label> </span>
<div class="input_border"><span class="input_field textfield"><input alt="Password" aria-label="Password" class="loginpp" id="password" name="password" placeholder="Password" spellcheck="false" style="height:30px; width:350px; font-size:12pt;"
tabindex="2" type="password" value=""> </span></div>
<span class="input_field textfield"> </span>
</div>
<input class="button rc-button-submit" id="submit" tabindex="11" type="submit" value="Sign in">
</form>
Text Content
Sign in with your account * Password * Keep me signed in