onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 7 HTTP transactions. The main IP is 144.76.81.68, located in Germany and belongs to HETZNER-AS, DE. The main domain is onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on June 18th 2019. Valid for: 3 months.

This is the only time onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) Excel / PDF download (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	125.212.211.84 125.212.211.84	7552 (VIETEL-AS...) (VIETEL-AS-AP Viettel Group)
3 9	144.76.81.68 144.76.81.68	24940 (HETZNER-AS) (HETZNER-AS)
1	54.148.84.95 54.148.84.95	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
7	2

1 125.212.211.84 (Viet Nam) 1 redirects

ASN7552 (VIETEL-AS-AP Viettel Group, VN)
PTR: vt1184.b2bdomain.com

sovilaco.com.vn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 144.76.81.68 (Germany) 3 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.68.81.76.144.clients.your-server.de

onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.148.84.95 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-148-84-95.us-west-2.compute.amazonaws.com

www.sitepoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	behingostaran.com 3 redirects onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com	249 KB
1	sitepoint.com www.sitepoint.com	6 KB
1	sovilaco.com.vn 1 redirects sovilaco.com.vn	357 B
7	3

	Domain	Requested by
9	onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com	3 redirects onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com
1	www.sitepoint.com	onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com
1	sovilaco.com.vn	1 redirects
7	3

This site contains no links.

Subject Issuer	Validity	Valid
onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com Let's Encrypt Authority X3	`2019-06-18` - `2019-09-16`	3 months	crt.sh
sitepoint.com SSL.com Premium EV CA	`2018-08-07` - `2019-09-23`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/authorize.php?client_id=response_type._12&ProductID=FB3EB4-&fid=MIEXNAE562MIEXNAE433&fav=C68E7E752B1B58-UserID&userid=ai5iZXVnZWxzQHZjZC5ubA==&client-request-id.aspx?n=MIEXNAE562MIEXNAE433&Key=4ede5ebd23cf5092affa7076c41e10c1
Frame ID: 959A96B59B72091FD432868EE1786008
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://sovilaco.com.vn/.office365/_VZp2x1QI5uVWXY.php?id=j.beugels@vcd.nl HTTP 302
https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/index.php?request=ai5iZXVnZWxzQHZjZC5ubA== HTTP 302
https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac... HTTP 301
https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac... HTTP 302
https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

254 kB
Transfer

266 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://sovilaco.com.vn/.office365/_VZp2x1QI5uVWXY.php?id=j.beugels@vcd.nl HTTP 302
https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/index.php?request=ai5iZXVnZWxzQHZjZC5ubA== HTTP 302
https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611?email=ai5iZXVnZWxzQHZjZC5ubA==&.verify?service=mail-mynfpb=true&_pageLabel=smep_portal_page_login&timedOut=true&_nfls=false=ai5iZXVnZWxzQHZjZC5ubA==&emailID=&. HTTP 301
https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/?email=ai5iZXVnZWxzQHZjZC5ubA==&.verify?service=mail-mynfpb=true&_pageLabel=smep_portal_page_login&timedOut=true&_nfls=false=ai5iZXVnZWxzQHZjZC5ubA==&emailID=&. HTTP 302
https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/authorize.php?client_id=response_type._12&ProductID=FB3EB4-&fid=MIEXNAE562MIEXNAE433&fav=C68E7E752B1B58-UserID&userid=ai5iZXVnZWxzQHZjZC5ubA==&client-request-id.aspx?n=MIEXNAE562MIEXNAE433&Key=4ede5ebd23cf5092affa7076c41e10c1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request authorize.php Show response
onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/
Redirect Chain

http://sovilaco.com.vn/.office365/_VZp2x1QI5uVWXY.php?id=j.beugels@vcd.nl
https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/index.php?request=ai5iZXVnZWxzQHZjZC5ubA==
https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611?email=ai5iZXVnZWxzQHZjZC5ubA==&.verify?servi...
https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/?email=ai5iZXVnZWxzQHZjZC5ubA==&.verify?serv...
https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/authorize.php?client_id=response_type._12&Pr...

3 KB
1 KB

13ms
12ms

Document
text/html

144.76.81.68
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/authorize.php?client_id=response_type._12&ProductID=FB3EB4-&fid=MIEXNAE562MIEXNAE433&fav=C68E7E752B1B58-UserID&userid=ai5iZXVnZWxzQHZjZC5ubA==&client-request-id.aspx?n=MIEXNAE562MIEXNAE433&Key=4ede5ebd23cf5092affa7076c41e10c1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 144.76.81.68 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.68.81.76.144.clients.your-server.de
Software: LiteSpeed / PHP/7.2.19
Resource Hash: c6ca3cf1a3c9e5390e4d20fe164031f0b8aa768617364ad4e668f6cbe9de3e46

Request headers

:method: GET
:authority: onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com
:scheme: https
:path: /login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/authorize.php?client_id=response_type._12&ProductID=FB3EB4-&fid=MIEXNAE562MIEXNAE433&fav=C68E7E752B1B58-UserID&userid=ai5iZXVnZWxzQHZjZC5ubA==&client-request-id.aspx?n=MIEXNAE562MIEXNAE433&Key=4ede5ebd23cf5092affa7076c41e10c1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
x-powered-by: PHP/7.2.19
set-cookie: PHPSESSID=f9bb12b8955b9657c3607aeea1920c65; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
content-length: 1181
content-encoding: br
vary: Accept-Encoding
date: Wed, 19 Jun 2019 12:30:22 GMT
server: LiteSpeed
alt-svc: quic=":443"; ma=2592000; v="35,39,43,44"

Redirect headers

status: 302
x-powered-by: PHP/7.2.19
location: authorize.php?client_id=response_type._12&ProductID=FB3EB4-&fid=MIEXNAE562MIEXNAE433&fav=C68E7E752B1B58-UserID&userid=ai5iZXVnZWxzQHZjZC5ubA==&client-request-id.aspx?n=MIEXNAE562MIEXNAE433&Key=4ede5ebd23cf5092affa7076c41e10c1
content-type: text/html; charset=UTF-8
content-length: 0
date: Wed, 19 Jun 2019 12:30:22 GMT
server: LiteSpeed
cache-control: no-cache, no-store, must-revalidate, max-age=0
alt-svc: quic=":443"; ma=2592000; v="35,39,43,44"

GET
H/1.1 200
OK MaskedPassword.js Show response
www.sitepoint.com/examples/password/MaskedPassword/ 17 KB
6 KB 2647ms
182ms Script
application/javascript 54.148.84.95
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://www.sitepoint.com/examples/password/MaskedPassword/MaskedPassword.js

Requested by

Host: onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com
URL: https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/authorize.php?client_id=response_type._12&ProductID=FB3EB4-&fid=MIEXNAE562MIEXNAE433&fav=C68E7E752B1B58-UserID&userid=ai5iZXVnZWxzQHZjZC5ubA==&client-request-id.aspx?n=MIEXNAE562MIEXNAE433&Key=4ede5ebd23cf5092affa7076c41e10c1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

54.148.84.95 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-148-84-95.us-west-2.compute.amazonaws.com

Software

Apache/2.2.22 (Debian) /

Resource Hash

2cfdb08c07395b0be65df154f068ade61c1bfad7e3e3e2d0e40b85319fa95825

Security Headers

Name	Value
X-Frame-Options	sameorigin

Request headers

Referer: https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/authorize.php?client_id=response_type._12&ProductID=FB3EB4-&fid=MIEXNAE562MIEXNAE433&fav=C68E7E752B1B58-UserID&userid=ai5iZXVnZWxzQHZjZC5ubA==&client-request-id.aspx?n=MIEXNAE562MIEXNAE433&Key=4ede5ebd23cf5092affa7076c41e10c1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 19 Jun 2019 12:29:37 GMT
Content-Encoding: gzip
X-Cache-Lookup: HIT from ip-172-31-22-12.us-west-2.compute.internal:3128
Last-Modified: Fri, 15 Oct 2010 00:03:45 GMT
Server: Apache/2.2.22 (Debian)
Age: 47
X-Frame-Options: sameorigin
ETag: "680936-4208-4929c8f629a40"
Vary: Accept-Encoding
X-Cache: HIT from ip-172-31-22-12.us-west-2.compute.internal
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 5767

GET
H2 200 e1.png
onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/images/ 35 KB
35 KB 12ms
11ms Image
image/png 144.76.81.68
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/images/e1.png
Requested by: Host: onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com
URL: https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/authorize.php?client_id=response_type._12&ProductID=FB3EB4-&fid=MIEXNAE562MIEXNAE433&fav=C68E7E752B1B58-UserID&userid=ai5iZXVnZWxzQHZjZC5ubA==&client-request-id.aspx?n=MIEXNAE562MIEXNAE433&Key=4ede5ebd23cf5092affa7076c41e10c1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 144.76.81.68 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.68.81.76.144.clients.your-server.de
Software: LiteSpeed /
Resource Hash: 2b3e71fdc2fdfafea8c3fb47a3c98ebaa9b36d45e24dfdcb384cb4ba5f432a8d

Request headers

Referer: https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/authorize.php?client_id=response_type._12&ProductID=FB3EB4-&fid=MIEXNAE562MIEXNAE433&fav=C68E7E752B1B58-UserID&userid=ai5iZXVnZWxzQHZjZC5ubA==&client-request-id.aspx?n=MIEXNAE562MIEXNAE433&Key=4ede5ebd23cf5092affa7076c41e10c1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 19 Jun 2019 12:30:22 GMT
last-modified: Wed, 19 Jun 2019 12:30:22 GMT
server: LiteSpeed
content-type: image/png
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,39,43,44"
content-length: 36083
expires: Wed, 26 Jun 2019 12:30:22 GMT

GET
H2 200 e2.png
onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/images/ 79 KB
79 KB 13ms
12ms Image
image/png 144.76.81.68
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/images/e2.png
Requested by: Host: onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com
URL: https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/authorize.php?client_id=response_type._12&ProductID=FB3EB4-&fid=MIEXNAE562MIEXNAE433&fav=C68E7E752B1B58-UserID&userid=ai5iZXVnZWxzQHZjZC5ubA==&client-request-id.aspx?n=MIEXNAE562MIEXNAE433&Key=4ede5ebd23cf5092affa7076c41e10c1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 144.76.81.68 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.68.81.76.144.clients.your-server.de
Software: LiteSpeed /
Resource Hash: ed62f92d22dc8d6a2b2e4427cadc70cc8e6e7fddb26a936cbc437eb7aa3b7929

Request headers

Referer: https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/authorize.php?client_id=response_type._12&ProductID=FB3EB4-&fid=MIEXNAE562MIEXNAE433&fav=C68E7E752B1B58-UserID&userid=ai5iZXVnZWxzQHZjZC5ubA==&client-request-id.aspx?n=MIEXNAE562MIEXNAE433&Key=4ede5ebd23cf5092affa7076c41e10c1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 19 Jun 2019 12:30:22 GMT
last-modified: Wed, 19 Jun 2019 12:30:22 GMT
server: LiteSpeed
content-type: image/png
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,39,43,44"
content-length: 80891
expires: Wed, 26 Jun 2019 12:30:22 GMT

GET
H2 200 e3.png
onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/images/ 114 KB
114 KB 17ms
16ms Image
image/png 144.76.81.68
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/images/e3.png
Requested by: Host: onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com
URL: https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/authorize.php?client_id=response_type._12&ProductID=FB3EB4-&fid=MIEXNAE562MIEXNAE433&fav=C68E7E752B1B58-UserID&userid=ai5iZXVnZWxzQHZjZC5ubA==&client-request-id.aspx?n=MIEXNAE562MIEXNAE433&Key=4ede5ebd23cf5092affa7076c41e10c1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 144.76.81.68 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.68.81.76.144.clients.your-server.de
Software: LiteSpeed /
Resource Hash: 67efa21d9c23bf34d55334cd7e04831f52fcf5305ab1885040a125f1e3f97752

Request headers

Referer: https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/authorize.php?client_id=response_type._12&ProductID=FB3EB4-&fid=MIEXNAE562MIEXNAE433&fav=C68E7E752B1B58-UserID&userid=ai5iZXVnZWxzQHZjZC5ubA==&client-request-id.aspx?n=MIEXNAE562MIEXNAE433&Key=4ede5ebd23cf5092affa7076c41e10c1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 19 Jun 2019 12:30:22 GMT
last-modified: Wed, 19 Jun 2019 12:30:22 GMT
server: LiteSpeed
content-type: image/png
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,39,43,44"
content-length: 116602
expires: Wed, 26 Jun 2019 12:30:22 GMT

GET
H2 200 e4.png
onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/images/ 18 KB
18 KB 17ms
17ms Image
image/png 144.76.81.68
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/images/e4.png
Requested by: Host: onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com
URL: https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/authorize.php?client_id=response_type._12&ProductID=FB3EB4-&fid=MIEXNAE562MIEXNAE433&fav=C68E7E752B1B58-UserID&userid=ai5iZXVnZWxzQHZjZC5ubA==&client-request-id.aspx?n=MIEXNAE562MIEXNAE433&Key=4ede5ebd23cf5092affa7076c41e10c1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 144.76.81.68 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.68.81.76.144.clients.your-server.de
Software: LiteSpeed /
Resource Hash: f2b8f5dbdb873081435082bf568b0c9c0b45869f6c34b51285552ce701c65022

Request headers

Referer: https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/authorize.php?client_id=response_type._12&ProductID=FB3EB4-&fid=MIEXNAE562MIEXNAE433&fav=C68E7E752B1B58-UserID&userid=ai5iZXVnZWxzQHZjZC5ubA==&client-request-id.aspx?n=MIEXNAE562MIEXNAE433&Key=4ede5ebd23cf5092affa7076c41e10c1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 19 Jun 2019 12:30:22 GMT
last-modified: Wed, 19 Jun 2019 12:30:22 GMT
server: LiteSpeed
content-type: image/png
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,39,43,44"
content-length: 17929
expires: Wed, 26 Jun 2019 12:30:22 GMT

GET
H2 200 down.png
onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/images/ 577 B
618 B 11ms
11ms Image
image/png 144.76.81.68
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/images/down.png
Requested by: Host: onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com
URL: https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/authorize.php?client_id=response_type._12&ProductID=FB3EB4-&fid=MIEXNAE562MIEXNAE433&fav=C68E7E752B1B58-UserID&userid=ai5iZXVnZWxzQHZjZC5ubA==&client-request-id.aspx?n=MIEXNAE562MIEXNAE433&Key=4ede5ebd23cf5092affa7076c41e10c1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 144.76.81.68 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.68.81.76.144.clients.your-server.de
Software: LiteSpeed /
Resource Hash: db1ce4501a389281b61ca5cf10feb133a90722022fbd558997b08d0f73e70e68

Request headers

Referer: https://onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com/login/start/OneDrive.aspx/client_id-5d0a2ade403c1_e0be436c6279f448b236ec19ac453611/authorize.php?client_id=response_type._12&ProductID=FB3EB4-&fid=MIEXNAE562MIEXNAE433&fav=C68E7E752B1B58-UserID&userid=ai5iZXVnZWxzQHZjZC5ubA==&client-request-id.aspx?n=MIEXNAE562MIEXNAE433&Key=4ede5ebd23cf5092affa7076c41e10c1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 19 Jun 2019 12:30:22 GMT
last-modified: Wed, 19 Jun 2019 12:30:22 GMT
server: LiteSpeed
content-type: image/png
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,39,43,44"
content-length: 577
expires: Wed, 26 Jun 2019 12:30:22 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) Excel / PDF download (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com
sovilaco.com.vn
www.sitepoint.com
125.212.211.84
144.76.81.68
54.148.84.95
2b3e71fdc2fdfafea8c3fb47a3c98ebaa9b36d45e24dfdcb384cb4ba5f432a8d
2cfdb08c07395b0be65df154f068ade61c1bfad7e3e3e2d0e40b85319fa95825
67efa21d9c23bf34d55334cd7e04831f52fcf5305ab1885040a125f1e3f97752
c6ca3cf1a3c9e5390e4d20fe164031f0b8aa768617364ad4e668f6cbe9de3e46
db1ce4501a389281b61ca5cf10feb133a90722022fbd558997b08d0f73e70e68
ed62f92d22dc8d6a2b2e4427cadc70cc8e6e7fddb26a936cbc437eb7aa3b7929
f2b8f5dbdb873081435082bf568b0c9c0b45869f6c34b51285552ce701c65022

onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com Open in urlscan Pro 144.76.81.68 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

3 Countries

254 kBTransfer

266 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Indicators

onedrive.office365.com-owa.realm-x8uti3utot.behingostaran.com Open in urlscan Pro
144.76.81.68 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

254 kB
Transfer

266 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!