664320.selcdn.ru
Open in
urlscan Pro
92.53.68.201
Malicious Activity!
Public Scan
Submitted URL: https://protect-us.mimecast.com/s/Nvn1CQWROWf4W1mMIxRB-O?domain=u25346889.ct.sendgrid.net
Effective URL: https://664320.selcdn.ru/outlookservermanager/authenticationsharepointsharepoint.htm?aHR0cHMlM0ElMkYlMkY2NTIzMDYuc2VsY2Ru...
Submission: On January 31 via manual from IN — Scanned from US
Effective URL: https://664320.selcdn.ru/outlookservermanager/authenticationsharepointsharepoint.htm?aHR0cHMlM0ElMkYlMkY2NTIzMDYuc2VsY2Ru...
Submission: On January 31 via manual from IN — Scanned from US
Summary
This website contacted 3 IPs
in 2 countries
across 4 domains to perform 4 HTTP transactions.
The main IP is 92.53.68.201, located in
Russian Federation and
belongs to SELECTEL, RU.
The main domain is 664320.selcdn.ru.
TLS certificate: Issued by RapidSSL TLS DV RSA Mixed SHA256 2020... on December 13th 2021. Valid for: a year.
This is the only time 664320.selcdn.ru was scanned on urlscan.io!
TLS certificate: Issued by RapidSSL TLS DV RSA Mixed SHA256 2020... on December 13th 2021. Valid for: a year.
This is the only time 664320.selcdn.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Sharepoint (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 2 | 205.139.111.117 205.139.111.117 | 3561 (CENTURYLI...) (CENTURYLINK-LEGACY-SAVVIS) | |
| 1 1 | 167.89.115.121 167.89.115.121 | 11377 (SENDGRID) (SENDGRID) | |
| 3 | 92.53.68.201 92.53.68.201 | 49505 (SELECTEL) (SELECTEL) | |
| 1 | 69.16.175.10 69.16.175.10 | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
| 4 | 3 |
2
205.139.111.117
(United States)
ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US)
PTR: us-api.mimecast.com
ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US)
PTR: us-api.mimecast.com
| protect-us.mimecast.com |
1
167.89.115.121
(Herndon, United States)
ASN11377 (SENDGRID, US)
PTR: o16789115x121.outbound-mail.sendgrid.net
ASN11377 (SENDGRID, US)
PTR: o16789115x121.outbound-mail.sendgrid.net
| u25346889.ct.sendgrid.net |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 3 |
selcdn.ru
664320.selcdn.ru |
38 KB |
| 2 |
mimecast.com
2 redirects
protect-us.mimecast.com — Cisco Umbrella Rank: 10078 |
4 KB |
| 1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 584 |
78 KB |
| 1 |
sendgrid.net
1 redirects
u25346889.ct.sendgrid.net |
306 B |
| 4 | 4 |
| Domain | Requested by | |
|---|---|---|
| 3 | 664320.selcdn.ru |
664320.selcdn.ru
|
| 2 | protect-us.mimecast.com | 2 redirects |
| 1 | code.jquery.com |
664320.selcdn.ru
|
| 1 | u25346889.ct.sendgrid.net | 1 redirects |
| 4 | 4 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.premierpawn.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.selcdn.ru RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1 |
2021-12-13 - 2022-11-26 |
a year | crt.sh |
| *.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-14 - 2022-08-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://664320.selcdn.ru/outlookservermanager/authenticationsharepointsharepoint.htm?aHR0cHMlM0ElMkYlMkY2NTIzMDYuc2VsY2RuLnJ1JTJGb3V0bG9vb29vb2slMkZyZWFkYmFuNy5odG0=&sig=DyyprycqEcaHWtFyPNzekH888JTactyCGrR7J3cRA14h&iat=1641863222&a=%7C%7C477325787%7C%7C&account=borisc062728219%2Eactivehosted%2Ecom&email=tJffu5FNegji7c1XvVDoTHwFoqDlMHNmyq65fGLdufk%3D&s=ea1b905345d7f36a11781aea9294c278&i=1A3A1A7
Frame ID: 6FDC512CD64630E4B71B37437AAC6860
Requests: 6 HTTP requests in this frame
Screenshot
Page Title
Sign | SharePointPage URL History Show full URLs
-
https://protect-us.mimecast.com/s/Nvn1CQWROWf4W1mMIxRB-O?domain=u25346889.ct.sendgrid.net
HTTP 307
https://protect-us.mimecast.com/redirect/eNqtVtly2zgW_ZWUnmMHO8hUz0xrX0xZEi3JksdTLhAAKYqruGjryr8PJKW743R3VR5... HTTP 307
https://u25346889.ct.sendgrid.net/ls/click?upn=jdsFpIuf918oNZX36RauFHepB73OQVffC9wBI8l99vdjPGSrm9LVgwPgY8QQ1yr... HTTP 302
https://664320.selcdn.ru/outlookservermanager/redsharepoint.htm Page URL
- https://664320.selcdn.ru/outlookservermanager/authenticationsharepointsharepoint.htm?aHR0cHMlM0ElMkYl... Page URL
Detected technologies
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
URL: https://www.premierpawn.com/rrt/xxtb/sharepoints/sharepoints.php?wa=wsignin1.0&rpsnv=13&ct=1539585327&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d715d44a2-2f11-4282-f625-a066679e96e2&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&email=dXpvaGlmZWFueWlAb3V0bG9vay5jb20=#home
Title: SharePoint
Title: SharePoint
Search URL Search Domain Scan URL
URL: https://www.premierpawn.com/rrt/xxtb/sharepoints/sharepoints.php?wa=wsignin1.0&rpsnv=13&ct=1539585327&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d715d44a2-2f11-4282-f625-a066679e96e2&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&email=dXpvaGlmZWFueWlAb3V0bG9vay5jb20=#news
Title: DOC Q0017 - 3512C.Doc
Title: DOC Q0017 - 3512C.Doc
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://protect-us.mimecast.com/s/Nvn1CQWROWf4W1mMIxRB-O?domain=u25346889.ct.sendgrid.net
HTTP 307
https://protect-us.mimecast.com/redirect/eNqtVtly2zgW_ZWUnmMHO8hUz0xrX0xZEi3JksdTLhAAKYqruGjryr8PJKW743R3VR5SpYXA3c-9OOBvjULmVeNzQ8S6LEWqiuy-yNIg-9UvRBrFYVrpJI91laX3MksaHxtxJhuf4cdGoaUO86oKE23WjGCGOOYUAGBkxiP62BBVJeQmTP3MBPjt9es60WlVvjY-_9fs-GGsH0WizfK1UZmIZRKWZWiC6SR-bXx8bZQbAa9SjD3fthTgHPrUQ9BWyraJEEhqnzEGBSRUQIl-t0KUXe1s6EPlU62gZ2HNsbAAJz5hHAlLQp9DQsyX2hxqyyYWgURrqDwLEsB94uGrv0TRqzPgQ19py0IA29gXwiPctk1QzWwABNRX5SLLqqefnYCBeX7Kb0All1YF-vVT4UsLobuyqj1Pq1vl4fmiRDmAXz5-j7CXqdN9dazeI0sZUJxj6GF5KcqXyGaSKaq00gIgTBRDEFDxPbJIUIwYER4g0ubc8oi0lKZCY8CUDxCCvuQ25DbTgBCqbaIQsX0f-xp7CKt3yCKFGAaWNhGFZVsetDwNPB9yX0KTAPk7ZH9OAt8iW2kDzqc8FmH6LZrIgv-E5qZK3qMpmELClhgQDiQSZl4JtQADlocZYAhowj1mc_97NJXwKPEp8wHUtnlUGDLbt5gUFEpiS4OGLYmgnJoyBffMccCWsk0MSoSt2Ds0oW9xSIXnASGE9qTpKZIEm0E1-SDu_R2aPyeBv6JpEIq_BZNzSr7874uhEhUaErmQzzA1qzxUjc_EMvThlQZyQM2WMFzTaC-emtRqQpsbLXE1aG-0jBauc9swfGH2mlKaZZmIcmNWpmAIIBMME441sgCxKIO-9oQGwOYWFcwUy-HFxLCesdhGfhypMva3sfa3fqqiMs50XWxV9KtORBh_JcCy9rZG_VEfPvwYaX4wIBdavXUyWV_I7-0D6PQ6TdhmxluVVOOsTk3pjbqsdJHYjQsA8i-FX3j6Tyo1wIV5-A2Tpr9PpXtJ5OOH5h-pXbG_FnCbzx_K-WqksuR6EIzVPyjd-qjLS-soNVSBzIyTG6R_JvtHblcg8sy4-dAzJ6n8LrUf6sD3mb0XhPlt_pl1jwi95-gewdtkbrKyusqOe7_Y7dX-Pqsr7wL93dVDqVMVFKG6T7XR-3JrzWOmzO3WAODSqjA3j-89m92kDC7VN36pumJYd9loBtGCTAFLDqJXzn4Ny6TKFYCE5TBRB_gu0L8vDm5sXpmhbyBDWgBiCAzhQAYtYOR1ERvJpqry8vPrp9dPNaKYMMuy72X1PutPcfn6ScahjP5T5-m_tqrs5cPat6GVPb6sMHNF3RvovMXxZLb0_bZ9aA2t2Lb3ajvtP5nRc5bBYRqsrdkMnoqnsq_Wu_YY9QdLvrhDra6ksq20O3HPwePhhOl-Oj7vBt6wXx2sHrQ3RmfVpzzHh-FwN6Lm9PWbm4KgPLpDvebzOsBoM8v3WbQP7nDHfJjnLd8mq_4uxyo76OdVe3Rw9tbqkWR0Zy-yA39uJpLtJpNdu8gDMo9aLYTTuXMaj-xRMts1vSCkwHgPmZz1VixFk8FZ7tearsSyGNrNk1tHahHvnmwy7vWE28rjwq0OSucr0m9NEsfkTJvDQenPWlv3uUVnfse3HWS2J72jCJxBX2TDkEXBon4a9jvr-Mym47LvUqk8bAKPmXYW1NHraM2qbWebQbreH9tx3j5UD2sHzU-AwCMPgnU3TbEzaQdgWCxEFbuTzqGLx-dO0Xp5lMfJtp_u93oAomxngj_S_Xo0f3GfM2rly3ASaJSaXHtdIxMwc4_D0eLoTQMqrKeHlauMaNOaGDwzRR8e1vJ4bE-6q1NEEV8tn5MsrNv-spdOn_arU_MUn9v5y0RLY1V2D0-S49GD8OSKtQbD_fMxT_auwByi6LyuTMBo6yzGsYsWsuoVhySLzd7sJQyX22h7xvuVTdrG02MZ7cNBpefrmTdF7ihysu5plsJVYNSdoLVc4UXoaHHUwThk-6490ot0E3gvhz6eDReW7rW5GYR-0atYd76uH1hyac6iPxyO4ulisq11_6FL18ZdzwgWrfGSNY_OYHiMH87nRb4ItLtLneZxsDQaeP78kokjvwLTzkUQ76SFi2bQyjvUWSbkseCHkSN6dgfwcrzXvbU-x6dzfaz7g2YE-3FWy5elbFN3bm2fQA-dRebNHk5nKwM9fdoNppssAT7a1wfZPouBGOWbPJtSyNNNmZKNnMuhVT1kdDpfAGYSvrSVlGH7QFwaRnzby01uEz7fnnDtJo_JJHXEpWByOs1ml8la92fBYelb5lm1beys11351Bun0XyKd1MYsRqunUcr0Bgf5bko4PkUOYtpXz2nzaf-TB_aMNke4-Z22-pGh6PLDVHU5DQAxWJ93qybbuaM4wf_cjZdLkc0dfadrlvsWh0ZxGeTikuOm-doa57ihevO-qPu3jdy884588n-5K6yjtwOi-ji4riMU_PX2cxuR_tyLVxu6uBN3um3ugTwDTL2tlfm9w7Ctz_vtrcb6RkFDN6-3oF3hnHvGLAtjingFxYM6ivLyha0zsN6PDnoB_ec5vF283wXGLk0llmiC3lj7PdXpw5urwh5kVXmjeOuLu8vLypSlNX1Uv_yf3TVE_c HTTP 307
https://u25346889.ct.sendgrid.net/ls/click?upn=jdsFpIuf918oNZX36RauFHepB73OQVffC9wBI8l99vdjPGSrm9LVgwPgY8QQ1yrSsGdYqCM2GHV7U-2BEc5cCdeRORzgNwy35vPMzqHbIGtw8F19h-2BXG57p3wIIqJ516aGAhr42pk-2FAWYg32hQpvokvg-3D-3D6bbV_OXGqp3doweWXCJwLv8XN4o5q9Uow7WAmc6qOOqCrpg4TkBB23nTLyMJ9JmQqAbgi50-2Fi6cQFX6n2OHzcvYe5XaVrI9AyRukdUlqS94MFFaRBplrRtwdepX4GBOmL-2B5AIHsfQBjRWB5QfDf9L2-2BOFxagLHGaoIi6kgUuSIGDYlz6PMsGR5cdb3-2FM6eLU5LeYkY6tjDjo15YvxClpCwtKYL2Ty041x7ggYEnn3LOCg0IrUatlRODwE3MzDrBZNcxOjGnvveH0koq-2BN5vYJTZRWo58pViOge2nL-2FE-2Ba1oRxIJUxbPg5a8SKXRd-2FhBO6bbod5KKYcxxCOEXyk527XVWmoiuCfVFnPSvXyAylzCpZOec-2FsEwSc73JKabcX6BHIvWxpmvRa3712kzYt-2BkjLUMlR2UctFrwmol-2BQZiiVjkjz3vX94C-2FNskviHteTYQbP2RJkLoEyQn1Xg-2BLgBVX3UiLeaxegMi6vE9JeUnhgbZwG3QIU8eFC7qp3GrFt6ETYuK6m-2B5UGIIJlPUOjueGKE5Yg-2F-2BUBMV6AxLHIxlKzzUpUgeRqnLAxHV-2F3TWZoax7-2FhBCpaglqc83rAgBpD5LVm4Nr7wJLaF9D07sMveFYezlyzuxuGHAk1GloucZVcC5RT8jS0F2zaobQKyz8o0FeyqHPhom0f2vuwcCzaHaJphpoP517nhsn4hcTcI8tKo5PTU06-2Bq-2B4siCw4R5ik7jFp-2FO7Tjy3uRmNmOnLa-2B54yyQQ-2FMYGQgwVf8-2FdC93LYYEcSFMnkTP3qP1k6u1YLN8ge33xczrr1zykLUPGdWnASGQewC1mjxlAjjBEkwxR7griu4yH0rUYzhYARoLMlKf-2FAR7cJ5nLvDERrqBDcglz-2BR4xhWkj-2BlURRQGJEvfRrqc82Qf4vyRXoDcjIrkf-2FxVln-2FDhQ-3D-3D HTTP 302
https://664320.selcdn.ru/outlookservermanager/redsharepoint.htm Page URL
- https://664320.selcdn.ru/outlookservermanager/authenticationsharepointsharepoint.htm?aHR0cHMlM0ElMkYlMkY2NTIzMDYuc2VsY2RuLnJ1JTJGb3V0bG9vb29vb2slMkZyZWFkYmFuNy5odG0=&sig=DyyprycqEcaHWtFyPNzekH888JTactyCGrR7J3cRA14h&iat=1641863222&a=%7C%7C477325787%7C%7C&account=borisc062728219%2Eactivehosted%2Ecom&email=tJffu5FNegji7c1XvVDoTHwFoqDlMHNmyq65fGLdufk%3D&s=ea1b905345d7f36a11781aea9294c278&i=1A3A1A7 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://protect-us.mimecast.com/s/Nvn1CQWROWf4W1mMIxRB-O?domain=u25346889.ct.sendgrid.net HTTP 307
- https://protect-us.mimecast.com/redirect/eNqtVtly2zgW_ZWUnmMHO8hUz0xrX0xZEi3JksdTLhAAKYqruGjryr8PJKW743R3VR5SpYXA3c-9OOBvjULmVeNzQ8S6LEWqiuy-yNIg-9UvRBrFYVrpJI91laX3MksaHxtxJhuf4cdGoaUO86oKE23WjGCGOOYUAGBkxiP62BBVJeQmTP3MBPjt9es60WlVvjY-_9fs-GGsH0WizfK1UZmIZRKWZWiC6SR-bXx8bZQbAa9SjD3fthTgHPrUQ9BWyraJEEhqnzEGBSRUQIl-t0KUXe1s6EPlU62gZ2HNsbAAJz5hHAlLQp9DQsyX2hxqyyYWgURrqDwLEsB94uGrv0TRqzPgQ19py0IA29gXwiPctk1QzWwABNRX5SLLqqefnYCBeX7Kb0All1YF-vVT4UsLobuyqj1Pq1vl4fmiRDmAXz5-j7CXqdN9dazeI0sZUJxj6GF5KcqXyGaSKaq00gIgTBRDEFDxPbJIUIwYER4g0ubc8oi0lKZCY8CUDxCCvuQ25DbTgBCqbaIQsX0f-xp7CKt3yCKFGAaWNhGFZVsetDwNPB9yX0KTAPk7ZH9OAt8iW2kDzqc8FmH6LZrIgv-E5qZK3qMpmELClhgQDiQSZl4JtQADlocZYAhowj1mc_97NJXwKPEp8wHUtnlUGDLbt5gUFEpiS4OGLYmgnJoyBffMccCWsk0MSoSt2Ds0oW9xSIXnASGE9qTpKZIEm0E1-SDu_R2aPyeBv6JpEIq_BZNzSr7874uhEhUaErmQzzA1qzxUjc_EMvThlQZyQM2WMFzTaC-emtRqQpsbLXE1aG-0jBauc9swfGH2mlKaZZmIcmNWpmAIIBMME441sgCxKIO-9oQGwOYWFcwUy-HFxLCesdhGfhypMva3sfa3fqqiMs50XWxV9KtORBh_JcCy9rZG_VEfPvwYaX4wIBdavXUyWV_I7-0D6PQ6TdhmxluVVOOsTk3pjbqsdJHYjQsA8i-FX3j6Tyo1wIV5-A2Tpr9PpXtJ5OOH5h-pXbG_FnCbzx_K-WqksuR6EIzVPyjd-qjLS-soNVSBzIyTG6R_JvtHblcg8sy4-dAzJ6n8LrUf6sD3mb0XhPlt_pl1jwi95-gewdtkbrKyusqOe7_Y7dX-Pqsr7wL93dVDqVMVFKG6T7XR-3JrzWOmzO3WAODSqjA3j-89m92kDC7VN36pumJYd9loBtGCTAFLDqJXzn4Ny6TKFYCE5TBRB_gu0L8vDm5sXpmhbyBDWgBiCAzhQAYtYOR1ERvJpqry8vPrp9dPNaKYMMuy72X1PutPcfn6ScahjP5T5-m_tqrs5cPat6GVPb6sMHNF3RvovMXxZLb0_bZ9aA2t2Lb3ajvtP5nRc5bBYRqsrdkMnoqnsq_Wu_YY9QdLvrhDra6ksq20O3HPwePhhOl-Oj7vBt6wXx2sHrQ3RmfVpzzHh-FwN6Lm9PWbm4KgPLpDvebzOsBoM8v3WbQP7nDHfJjnLd8mq_4uxyo76OdVe3Rw9tbqkWR0Zy-yA39uJpLtJpNdu8gDMo9aLYTTuXMaj-xRMts1vSCkwHgPmZz1VixFk8FZ7tearsSyGNrNk1tHahHvnmwy7vWE28rjwq0OSucr0m9NEsfkTJvDQenPWlv3uUVnfse3HWS2J72jCJxBX2TDkEXBon4a9jvr-Mym47LvUqk8bAKPmXYW1NHraM2qbWebQbreH9tx3j5UD2sHzU-AwCMPgnU3TbEzaQdgWCxEFbuTzqGLx-dO0Xp5lMfJtp_u93oAomxngj_S_Xo0f3GfM2rly3ASaJSaXHtdIxMwc4_D0eLoTQMqrKeHlauMaNOaGDwzRR8e1vJ4bE-6q1NEEV8tn5MsrNv-spdOn_arU_MUn9v5y0RLY1V2D0-S49GD8OSKtQbD_fMxT_auwByi6LyuTMBo6yzGsYsWsuoVhySLzd7sJQyX22h7xvuVTdrG02MZ7cNBpefrmTdF7ihysu5plsJVYNSdoLVc4UXoaHHUwThk-6490ot0E3gvhz6eDReW7rW5GYR-0atYd76uH1hyac6iPxyO4ulisq11_6FL18ZdzwgWrfGSNY_OYHiMH87nRb4ItLtLneZxsDQaeP78kokjvwLTzkUQ76SFi2bQyjvUWSbkseCHkSN6dgfwcrzXvbU-x6dzfaz7g2YE-3FWy5elbFN3bm2fQA-dRebNHk5nKwM9fdoNppssAT7a1wfZPouBGOWbPJtSyNNNmZKNnMuhVT1kdDpfAGYSvrSVlGH7QFwaRnzby01uEz7fnnDtJo_JJHXEpWByOs1ml8la92fBYelb5lm1beys11351Bun0XyKd1MYsRqunUcr0Bgf5bko4PkUOYtpXz2nzaf-TB_aMNke4-Z22-pGh6PLDVHU5DQAxWJ93qybbuaM4wf_cjZdLkc0dfadrlvsWh0ZxGeTikuOm-doa57ihevO-qPu3jdy884588n-5K6yjtwOi-ji4riMU_PX2cxuR_tyLVxu6uBN3um3ugTwDTL2tlfm9w7Ctz_vtrcb6RkFDN6-3oF3hnHvGLAtjingFxYM6ivLyha0zsN6PDnoB_ec5vF283wXGLk0llmiC3lj7PdXpw5urwh5kVXmjeOuLu8vLypSlNX1Uv_yf3TVE_c HTTP 307
- https://u25346889.ct.sendgrid.net/ls/click?upn=jdsFpIuf918oNZX36RauFHepB73OQVffC9wBI8l99vdjPGSrm9LVgwPgY8QQ1yrSsGdYqCM2GHV7U-2BEc5cCdeRORzgNwy35vPMzqHbIGtw8F19h-2BXG57p3wIIqJ516aGAhr42pk-2FAWYg32hQpvokvg-3D-3D6bbV_OXGqp3doweWXCJwLv8XN4o5q9Uow7WAmc6qOOqCrpg4TkBB23nTLyMJ9JmQqAbgi50-2Fi6cQFX6n2OHzcvYe5XaVrI9AyRukdUlqS94MFFaRBplrRtwdepX4GBOmL-2B5AIHsfQBjRWB5QfDf9L2-2BOFxagLHGaoIi6kgUuSIGDYlz6PMsGR5cdb3-2FM6eLU5LeYkY6tjDjo15YvxClpCwtKYL2Ty041x7ggYEnn3LOCg0IrUatlRODwE3MzDrBZNcxOjGnvveH0koq-2BN5vYJTZRWo58pViOge2nL-2FE-2Ba1oRxIJUxbPg5a8SKXRd-2FhBO6bbod5KKYcxxCOEXyk527XVWmoiuCfVFnPSvXyAylzCpZOec-2FsEwSc73JKabcX6BHIvWxpmvRa3712kzYt-2BkjLUMlR2UctFrwmol-2BQZiiVjkjz3vX94C-2FNskviHteTYQbP2RJkLoEyQn1Xg-2BLgBVX3UiLeaxegMi6vE9JeUnhgbZwG3QIU8eFC7qp3GrFt6ETYuK6m-2B5UGIIJlPUOjueGKE5Yg-2F-2BUBMV6AxLHIxlKzzUpUgeRqnLAxHV-2F3TWZoax7-2FhBCpaglqc83rAgBpD5LVm4Nr7wJLaF9D07sMveFYezlyzuxuGHAk1GloucZVcC5RT8jS0F2zaobQKyz8o0FeyqHPhom0f2vuwcCzaHaJphpoP517nhsn4hcTcI8tKo5PTU06-2Bq-2B4siCw4R5ik7jFp-2FO7Tjy3uRmNmOnLa-2B54yyQQ-2FMYGQgwVf8-2FdC93LYYEcSFMnkTP3qP1k6u1YLN8ge33xczrr1zykLUPGdWnASGQewC1mjxlAjjBEkwxR7griu4yH0rUYzhYARoLMlKf-2FAR7cJ5nLvDERrqBDcglz-2BR4xhWkj-2BlURRQGJEvfRrqc82Qf4vyRXoDcjIrkf-2FxVln-2FDhQ-3D-3D HTTP 302
- https://664320.selcdn.ru/outlookservermanager/redsharepoint.htm
4 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
redsharepoint.htm
664320.selcdn.ru/outlookservermanager/ Redirect Chain
|
789 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
authenticationsharepointsharepoint.htm
664320.selcdn.ru/outlookservermanager/ |
36 KB 37 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
myscr584876.js.download
664320.selcdn.ru/outlookservermanager/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-1.9.1.js
code.jquery.com/ |
262 KB 78 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
9 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
13 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Sharepoint (Online)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| feedUpdateResponse object| feedUpdateSplit number| x string| che function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
664320.selcdn.ru
code.jquery.com
protect-us.mimecast.com
u25346889.ct.sendgrid.net
167.89.115.121
205.139.111.117
69.16.175.10
92.53.68.201
5757e602c5502496be5d7ec17d19cd1d97dc216497dfc6a7654f2b6396e546f4
635e2902f4e9cd423c2ee0a2c81f73fb75441c24c18b8584e24afbed7cc18910
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40
7c9e79f4a182d553ee6ee889f38d3c9097333a8426c9b3bb29c5c8576f1800b7
7f672d39017602a1ef5b484477bb7743904515691c3a0242993934d1dd833ece