www.out365.balahn.live Open in urlscan Pro
162.0.236.238  Malicious Activity! Public Scan

Submitted URL: http://officeworkk.com/
Effective URL: https://www.out365.balahn.live/tempfile/70f99a2462/login.php?SesIN=be6a75e859b0c82f7d8363a004287155&f=70f99a2462&session=160334...
Submission: On October 22 via manual from IN

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 9 HTTP transactions. The main IP is 162.0.236.238, located in Canada and belongs to NAMECHEAP-NET, US. The main domain is www.out365.balahn.live.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 16th 2020. Valid for: 3 months.
This is the only time www.out365.balahn.live was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
2 2 151.101.1.195 54113 (FASTLY)
2 10 162.0.236.238 22612 (NAMECHEAP...)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
9 2
Apex Domain
Subdomains
Transfer
10 balahn.live
www.out365.balahn.live
129 KB
2 officeworkk.com
officeworkk.com
502 B
1 jquery.com
code.jquery.com
33 KB
9 3
Domain Requested by
10 www.out365.balahn.live 2 redirects www.out365.balahn.live
2 officeworkk.com 2 redirects
1 code.jquery.com www.out365.balahn.live
9 3

This site contains no links.

Subject Issuer Validity Valid
www.out365.balahn.live
Let's Encrypt Authority X3
2020-10-16 -
2021-01-14
3 months crt.sh
jquery.org
Sectigo RSA Domain Validation Secure Server CA
2020-10-06 -
2021-10-16
a year crt.sh

This page contains 1 frames:

Primary Page: https://www.out365.balahn.live/tempfile/70f99a2462/login.php?SesIN=be6a75e859b0c82f7d8363a004287155&f=70f99a2462&session=1603346436
Frame ID: F06C3E98CF967FC63D7B9850AB044CDA
Requests: 9 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://officeworkk.com/ HTTP 301
    https://officeworkk.com/ HTTP 301
    https://www.out365.balahn.live/ HTTP 302
    https://www.out365.balahn.live/tempfile/70f99a2462/ HTTP 302
    https://www.out365.balahn.live/tempfile/70f99a2462/login.php?SesIN=be6a75e859b0c82f7d8363a004287155&f=70f99... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /Unix/i

Overall confidence: 100%
Detected patterns
  • headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

9
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

160 kB
Transfer

219 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://officeworkk.com/ HTTP 301
    https://officeworkk.com/ HTTP 301
    https://www.out365.balahn.live/ HTTP 302
    https://www.out365.balahn.live/tempfile/70f99a2462/ HTTP 302
    https://www.out365.balahn.live/tempfile/70f99a2462/login.php?SesIN=be6a75e859b0c82f7d8363a004287155&f=70f99a2462&session=1603346436 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login.php
www.out365.balahn.live/tempfile/70f99a2462/
Redirect Chain
  • http://officeworkk.com/
  • https://officeworkk.com/
  • https://www.out365.balahn.live/
  • https://www.out365.balahn.live/tempfile/70f99a2462/
  • https://www.out365.balahn.live/tempfile/70f99a2462/login.php?SesIN=be6a75e859b0c82f7d8363a004287155&f=70f99a2462&session=1603346436
9 KB
9 KB
Document
General
Full URL
https://www.out365.balahn.live/tempfile/70f99a2462/login.php?SesIN=be6a75e859b0c82f7d8363a004287155&f=70f99a2462&session=1603346436
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.0.236.238 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
svr.dks-server3.tech
Software
Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips / PHP/5.6.37
Resource Hash
50403bbb195f22e4c3e4751eb8f9487fdbc5cbd858168e537e1335fafbc85948

Request headers

Host
www.out365.balahn.live
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PHPSESSID=ab900cc390c46261ca56c13e9ef25edc
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 22 Oct 2020 05:55:36 GMT
Server
Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips
X-Powered-By
PHP/5.6.37
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Keep-Alive
timeout=5, max=98
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Redirect headers

Date
Thu, 22 Oct 2020 05:55:36 GMT
Server
Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips
X-Powered-By
PHP/5.6.37
location
login.php?SesIN=be6a75e859b0c82f7d8363a004287155&f=70f99a2462&session=1603346436
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
converged.v2.login.min.css
www.out365.balahn.live/tempfile/70f99a2462/assets/
106 KB
106 KB
Stylesheet
General
Full URL
https://www.out365.balahn.live/tempfile/70f99a2462/assets/converged.v2.login.min.css
Requested by
Host: www.out365.balahn.live
URL: https://www.out365.balahn.live/tempfile/70f99a2462/login.php?SesIN=be6a75e859b0c82f7d8363a004287155&f=70f99a2462&session=1603346436
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.0.236.238 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
svr.dks-server3.tech
Software
Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips /
Resource Hash
a96b2b12489a80eafe62cc4bcc04cb367e2b54efc3039e484211c7deec12c0b8

Request headers

Origin
https://www.out365.balahn.live
Referer
https://www.out365.balahn.live/tempfile/70f99a2462/login.php?SesIN=be6a75e859b0c82f7d8363a004287155&f=70f99a2462&session=1603346436
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 22 Oct 2020 05:55:37 GMT
Last-Modified
Thu, 22 Oct 2020 05:55:36 GMT
Server
Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips
ETag
W/"1a716-5b23c1cea02c4"
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
108310
jquery-1.11.1.min.js
code.jquery.com/
94 KB
33 KB
Script
General
Full URL
https://code.jquery.com/jquery-1.11.1.min.js
Requested by
Host: www.out365.balahn.live
URL: https://www.out365.balahn.live/tempfile/70f99a2462/login.php?SesIN=be6a75e859b0c82f7d8363a004287155&f=70f99a2462&session=1603346436
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

Referer
https://www.out365.balahn.live/tempfile/70f99a2462/login.php?SesIN=be6a75e859b0c82f7d8363a004287155&f=70f99a2462&session=1603346436
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 22 Oct 2020 05:55:37 GMT
content-encoding
gzip
last-modified
Fri, 24 Oct 2014 00:16:07 GMT
server
nginx
status
200
etag
W/"54499a47-1762a"
vary
Accept-Encoding
x-hw
1603346137.dop005.fr8.t,1603346137.cds215.fr8.hn,1603346137.cds227.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
33202
logo.svg
www.out365.balahn.live/tempfile/70f99a2462/assets/
4 KB
4 KB
Image
General
Full URL
https://www.out365.balahn.live/tempfile/70f99a2462/assets/logo.svg
Requested by
Host: www.out365.balahn.live
URL: https://www.out365.balahn.live/tempfile/70f99a2462/login.php?SesIN=be6a75e859b0c82f7d8363a004287155&f=70f99a2462&session=1603346436
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.0.236.238 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
svr.dks-server3.tech
Software
Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Referer
https://www.out365.balahn.live/tempfile/70f99a2462/login.php?SesIN=be6a75e859b0c82f7d8363a004287155&f=70f99a2462&session=1603346436
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 22 Oct 2020 05:55:37 GMT
Last-Modified
Thu, 22 Oct 2020 05:55:36 GMT
Server
Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips
ETag
W/"e43-5b23c1cea02c4"
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
3651
arrow_left.svg
www.out365.balahn.live/tempfile/70f99a2462/assets/
513 B
819 B
Image
General
Full URL
https://www.out365.balahn.live/tempfile/70f99a2462/assets/arrow_left.svg
Requested by
Host: www.out365.balahn.live
URL: https://www.out365.balahn.live/tempfile/70f99a2462/login.php?SesIN=be6a75e859b0c82f7d8363a004287155&f=70f99a2462&session=1603346436
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.0.236.238 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
svr.dks-server3.tech
Software
Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips /
Resource Hash
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

Request headers

Referer
https://www.out365.balahn.live/tempfile/70f99a2462/login.php?SesIN=be6a75e859b0c82f7d8363a004287155&f=70f99a2462&session=1603346436
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 22 Oct 2020 05:55:37 GMT
Last-Modified
Thu, 22 Oct 2020 05:55:36 GMT
Server
Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips
ETag
"201-5b23c1cea02c4"
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
513
ellipsis.svg
www.out365.balahn.live/tempfile/70f99a2462/assets/
900 B
1 KB
Image
General
Full URL
https://www.out365.balahn.live/tempfile/70f99a2462/assets/ellipsis.svg
Requested by
Host: www.out365.balahn.live
URL: https://www.out365.balahn.live/tempfile/70f99a2462/login.php?SesIN=be6a75e859b0c82f7d8363a004287155&f=70f99a2462&session=1603346436
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.0.236.238 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
svr.dks-server3.tech
Software
Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips /
Resource Hash
61d7ccc5d2c41bf86be6cefb0063405067849ba64e9f219f60596ef09a54a942

Request headers

Referer
https://www.out365.balahn.live/tempfile/70f99a2462/login.php?SesIN=be6a75e859b0c82f7d8363a004287155&f=70f99a2462&session=1603346436
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 22 Oct 2020 05:55:37 GMT
Last-Modified
Thu, 22 Oct 2020 05:55:36 GMT
Server
Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips
ETag
"384-5b23c1cea02c4"
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
900
ellipsis_grey.svg
www.out365.balahn.live/tempfile/70f99a2462/assets/
915 B
1 KB
Image
General
Full URL
https://www.out365.balahn.live/tempfile/70f99a2462/assets/ellipsis_grey.svg
Requested by
Host: www.out365.balahn.live
URL: https://www.out365.balahn.live/tempfile/70f99a2462/login.php?SesIN=be6a75e859b0c82f7d8363a004287155&f=70f99a2462&session=1603346436
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.0.236.238 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
svr.dks-server3.tech
Software
Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips /
Resource Hash
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6

Request headers

Referer
https://www.out365.balahn.live/tempfile/70f99a2462/login.php?SesIN=be6a75e859b0c82f7d8363a004287155&f=70f99a2462&session=1603346436
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 22 Oct 2020 05:55:37 GMT
Last-Modified
Thu, 22 Oct 2020 05:55:36 GMT
Server
Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips
ETag
"393-5b23c1cea02c4"
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
915
postscript.js
www.out365.balahn.live/tempfile/70f99a2462/assets/
3 KB
3 KB
Script
General
Full URL
https://www.out365.balahn.live/tempfile/70f99a2462/assets/postscript.js
Requested by
Host: www.out365.balahn.live
URL: https://www.out365.balahn.live/tempfile/70f99a2462/login.php?SesIN=be6a75e859b0c82f7d8363a004287155&f=70f99a2462&session=1603346436
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.0.236.238 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
svr.dks-server3.tech
Software
Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips /
Resource Hash
d6e4edef81f555b9e0f0a946c21bcf480c5e5f05d180d2c94de8497387c6ad68

Request headers

Referer
https://www.out365.balahn.live/tempfile/70f99a2462/login.php?SesIN=be6a75e859b0c82f7d8363a004287155&f=70f99a2462&session=1603346436
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 22 Oct 2020 05:55:37 GMT
Last-Modified
Thu, 22 Oct 2020 05:55:36 GMT
Server
Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips
ETag
W/"c7f-5b23c1cea06ac"
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
3199
bg.svg
www.out365.balahn.live/tempfile/70f99a2462/assets/
2 KB
2 KB
Image
General
Full URL
https://www.out365.balahn.live/tempfile/70f99a2462/assets/bg.svg
Requested by
Host: www.out365.balahn.live
URL: https://www.out365.balahn.live/tempfile/70f99a2462/login.php?SesIN=be6a75e859b0c82f7d8363a004287155&f=70f99a2462&session=1603346436
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.0.236.238 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
svr.dks-server3.tech
Software
Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips /
Resource Hash
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

Referer
https://www.out365.balahn.live/tempfile/70f99a2462/login.php?SesIN=be6a75e859b0c82f7d8363a004287155&f=70f99a2462&session=1603346436
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 22 Oct 2020 05:55:37 GMT
Last-Modified
Thu, 22 Oct 2020 05:55:36 GMT
Server
Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips
ETag
"748-5b23c1cea02c4"
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
1864

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| $ function| jQuery function| ajaxObj function| ajaxReturn function| emptyElement object| input function| next function| back function| signup

1 Cookies

Domain/Path Name / Value
www.out365.balahn.live/ Name: PHPSESSID
Value: ab900cc390c46261ca56c13e9ef25edc