sharepoint-datafile.tk
Open in
urlscan Pro
2606:4700:3031::6812:3ff0
Malicious Activity!
Public Scan
Effective URL: https://sharepoint-datafile.tk/RLltdp8Ej4Gyg/cloud/hr13r0Hqnq/scanned/sharepoint/login.php?cmd=login_submit&id=e9792c801ed6260e...
Submission: On March 05 via manual from IN
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on March 3rd 2020. Valid for: 7 months.
This is the only time sharepoint-datafile.tk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Sharepoint (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 167.89.118.35 167.89.118.35 | 11377 (SENDGRID) (SENDGRID) | |
3 6 | 169.47.124.23 169.47.124.23 | 36351 (SOFTLAYER) (SOFTLAYER) | |
1 12 | 2606:4700:303... 2606:4700:3031::6812:3ff0 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
14 | 2 |
ASN11377 (SENDGRID, US)
PTR: o16789118x35.outbound-mail.sendgrid.net
u15267595.ct.sendgrid.net |
ASN36351 (SOFTLAYER, US)
PTR: 17.7c.2fa9.ip4.static.sl-reverse.com
sharepoint-system.us-south.cf.appdomain.cloud |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
sharepoint-datafile.tk
1 redirects
sharepoint-datafile.tk |
314 KB |
6 |
appdomain.cloud
3 redirects
sharepoint-system.us-south.cf.appdomain.cloud |
4 KB |
1 |
sendgrid.net
1 redirects
u15267595.ct.sendgrid.net |
281 B |
14 | 3 |
Domain | Requested by | |
---|---|---|
12 | sharepoint-datafile.tk |
1 redirects
sharepoint-datafile.tk
|
6 | sharepoint-system.us-south.cf.appdomain.cloud | 3 redirects |
1 | u15267595.ct.sendgrid.net | 1 redirects |
14 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.us-south.cf.appdomain.cloud DigiCert SHA2 Secure Server CA |
2019-09-24 - 2020-09-28 |
a year | crt.sh |
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2020-03-03 - 2020-10-09 |
7 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://sharepoint-datafile.tk/RLltdp8Ej4Gyg/cloud/hr13r0Hqnq/scanned/sharepoint/login.php?cmd=login_submit&id=e9792c801ed6260ed952b249009e884ee9792c801ed6260ed952b249009e884e&session=e9792c801ed6260ed952b249009e884ee9792c801ed6260ed952b249009e884e
Frame ID: 9AC75914EBED48E2B0BAB0DE6948FEAF
Requests: 14 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://u15267595.ct.sendgrid.net/ls/click?upn=RDZWKK0bD6mcgxBg9KCK2VGxuj77JFtd-2FR42l7MqG-2FTqd14LTon74vVr565...
HTTP 302
https://sharepoint-system.us-south.cf.appdomain.cloud/index.php?login= HTTP 302
https://sharepoint-system.us-south.cf.appdomain.cloud/ona2ow2hivynuufflcbuum5d.php?login=&13InboxLightaspxn.1774256418&fid.4.12528... Page URL
-
https://sharepoint-system.us-south.cf.appdomain.cloud/index.php?login=
HTTP 302
https://sharepoint-system.us-south.cf.appdomain.cloud/r41vujmaotfozkglpidpqroi.php?login=&13InboxLightaspxn.1774256418&fid.4.12528... Page URL
-
https://sharepoint-system.us-south.cf.appdomain.cloud/index.php?login=
HTTP 302
https://sharepoint-system.us-south.cf.appdomain.cloud/s0kkmdk40x0snh5b8brtuymv.php?login=&13InboxLightaspxn.1774256418&fid.4.12528... Page URL
-
https://sharepoint-datafile.tk/RLltdp8Ej4Gyg/cloud/hr13r0Hqnq/scanned/sharepoint/index.php?login=
HTTP 302
https://sharepoint-datafile.tk/RLltdp8Ej4Gyg/cloud/hr13r0Hqnq/scanned/sharepoint/login.php?cmd=login_submit... Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://u15267595.ct.sendgrid.net/ls/click?upn=RDZWKK0bD6mcgxBg9KCK2VGxuj77JFtd-2FR42l7MqG-2FTqd14LTon74vVr565K-2BUi-2FpEqg2GrJpZzPrzr67tmMFSDnQ5cuhp9cDvQrx1qXP94-3DIoMF_5-2Bwq3Nnn3tPMBC3TcgzPGVthASuYClIhRWqQYi-2FaHq0iBHsIaG-2BX85KQWJ7bGTgXOFuB3LsDrLo2cY8-2BSy2I-2FuIFOzhXrgmnDWyLB3iUqc8TSVUPKmWFNShWje0uXRPUXlG4-2BH-2BOHp53BTE6301Z8qBlu-2BVJDSbnX-2FlFckTPBzywb8nuf0AHvwlfxhmeexCGgMdrkJseLJqui1xJhlqF03F1rHsUulZDcLDrBtWTrWc-3D
HTTP 302
https://sharepoint-system.us-south.cf.appdomain.cloud/index.php?login= HTTP 302
https://sharepoint-system.us-south.cf.appdomain.cloud/ona2ow2hivynuufflcbuum5d.php?login=&13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&login=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL
-
https://sharepoint-system.us-south.cf.appdomain.cloud/index.php?login=
HTTP 302
https://sharepoint-system.us-south.cf.appdomain.cloud/r41vujmaotfozkglpidpqroi.php?login=&13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&login=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL
-
https://sharepoint-system.us-south.cf.appdomain.cloud/index.php?login=
HTTP 302
https://sharepoint-system.us-south.cf.appdomain.cloud/s0kkmdk40x0snh5b8brtuymv.php?login=&13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&login=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL
-
https://sharepoint-datafile.tk/RLltdp8Ej4Gyg/cloud/hr13r0Hqnq/scanned/sharepoint/index.php?login=
HTTP 302
https://sharepoint-datafile.tk/RLltdp8Ej4Gyg/cloud/hr13r0Hqnq/scanned/sharepoint/login.php?cmd=login_submit&id=e9792c801ed6260ed952b249009e884ee9792c801ed6260ed952b249009e884e&session=e9792c801ed6260ed952b249009e884ee9792c801ed6260ed952b249009e884e Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://u15267595.ct.sendgrid.net/ls/click?upn=RDZWKK0bD6mcgxBg9KCK2VGxuj77JFtd-2FR42l7MqG-2FTqd14LTon74vVr565K-2BUi-2FpEqg2GrJpZzPrzr67tmMFSDnQ5cuhp9cDvQrx1qXP94-3DIoMF_5-2Bwq3Nnn3tPMBC3TcgzPGVthASuYClIhRWqQYi-2FaHq0iBHsIaG-2BX85KQWJ7bGTgXOFuB3LsDrLo2cY8-2BSy2I-2FuIFOzhXrgmnDWyLB3iUqc8TSVUPKmWFNShWje0uXRPUXlG4-2BH-2BOHp53BTE6301Z8qBlu-2BVJDSbnX-2FlFckTPBzywb8nuf0AHvwlfxhmeexCGgMdrkJseLJqui1xJhlqF03F1rHsUulZDcLDrBtWTrWc-3D HTTP 302
- https://sharepoint-system.us-south.cf.appdomain.cloud/index.php?login= HTTP 302
- https://sharepoint-system.us-south.cf.appdomain.cloud/ona2ow2hivynuufflcbuum5d.php?login=&13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&login=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
- https://sharepoint-system.us-south.cf.appdomain.cloud/index.php?login= HTTP 302
- https://sharepoint-system.us-south.cf.appdomain.cloud/r41vujmaotfozkglpidpqroi.php?login=&13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&login=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
- https://sharepoint-system.us-south.cf.appdomain.cloud/index.php?login= HTTP 302
- https://sharepoint-system.us-south.cf.appdomain.cloud/s0kkmdk40x0snh5b8brtuymv.php?login=&13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&login=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
ona2ow2hivynuufflcbuum5d.php
sharepoint-system.us-south.cf.appdomain.cloud/ Redirect Chain
|
615 B 714 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
r41vujmaotfozkglpidpqroi.php
sharepoint-system.us-south.cf.appdomain.cloud/ Redirect Chain
|
615 B 714 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s0kkmdk40x0snh5b8brtuymv.php
sharepoint-system.us-south.cf.appdomain.cloud/ Redirect Chain
|
696 B 765 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
login.php
sharepoint-datafile.tk/RLltdp8Ej4Gyg/cloud/hr13r0Hqnq/scanned/sharepoint/ Redirect Chain
|
2 KB 579 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
sharepoint-datafile.tk/RLltdp8Ej4Gyg/cloud/hr13r0Hqnq/scanned/sharepoint/css/ |
118 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
sharepoint-datafile.tk/RLltdp8Ej4Gyg/cloud/hr13r0Hqnq/scanned/sharepoint/css/ |
1 KB 481 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.png
sharepoint-datafile.tk/RLltdp8Ej4Gyg/cloud/hr13r0Hqnq/scanned/sharepoint/css/ |
16 KB 16 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3.png
sharepoint-datafile.tk/RLltdp8Ej4Gyg/cloud/hr13r0Hqnq/scanned/sharepoint/css/ |
13 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4.png
sharepoint-datafile.tk/RLltdp8Ej4Gyg/cloud/hr13r0Hqnq/scanned/sharepoint/css/ |
16 KB 16 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5.png
sharepoint-datafile.tk/RLltdp8Ej4Gyg/cloud/hr13r0Hqnq/scanned/sharepoint/css/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6.png
sharepoint-datafile.tk/RLltdp8Ej4Gyg/cloud/hr13r0Hqnq/scanned/sharepoint/css/ |
14 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
7.png
sharepoint-datafile.tk/RLltdp8Ej4Gyg/cloud/hr13r0Hqnq/scanned/sharepoint/css/ |
15 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
8.png
sharepoint-datafile.tk/RLltdp8Ej4Gyg/cloud/hr13r0Hqnq/scanned/sharepoint/css/ |
14 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.png
sharepoint-datafile.tk/RLltdp8Ej4Gyg/cloud/hr13r0Hqnq/scanned/sharepoint/css/ |
196 KB 196 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Sharepoint (Online)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
sharepoint-datafile.tk/ | Name: PHPSESSID Value: 6lksaco0p6v9hqc2nvhr2kbr40 |
|
.sharepoint-datafile.tk/ | Name: __cfduid Value: d408454b4756718bd39f7d1b3ad0af3521583416150 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
sharepoint-datafile.tk
sharepoint-system.us-south.cf.appdomain.cloud
u15267595.ct.sendgrid.net
167.89.118.35
169.47.124.23
2606:4700:3031::6812:3ff0
03e701250890224c377b2c747ba9aef46b970682d5e5aca72f9dd037d5c89440
09e10162949190f4283ec68aacac688adf4b70ef27996ed5fdb988d4b84460f7
0c09ec09a65cc1ab90220cae2a3e585c7d2c6c29e754ee577edb587b0fb3f927
3d28b1647011555b322ca6d78cda43aa12094e7ea3bb3adc2651edffd410132b
670b9398865900d230eb044384791cdb5ba6bc1d5f16bca4111e908fd571cec7
9bc072bee8f8653393501d1246e9ec6f47c317879594cc557b19e47270b3a3dc
b06388f4804f1082eee157421cf4f664dd2987e800005722efc7f15dc8c2e10e
c04d9fd8fa66ba5051f9f47189dc50717499858c9f0bf57ff7aa1c78b425930f
c4c803337c3a62a637f8946d4a0f23fcf26de1276bdb5a1ca6b24690e09a0117
d2668c50a423f55b36262bfd4bbd068261e9f06e86d226f0b42ab91dc11973c3
d9996d1cd780f411e637694c103886f81d2cef3acb58552e5674d285516ac52c
dd3e2d35ddda7e628c92e4dcb6ffbfc564b3a8754e02a5a3031a0ec8ed2962b0
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c