ssbobet24h.net Open in urlscan Pro
192.185.115.109  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response ssbobet24h.net/	22 KB 11 KB	479ms 182ms	Document text/html	192.185.115.109 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://ssbobet24h.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.185.115.109 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-185-115-109.unifiedlayer.com Software Apache / Resource Hash 68cf300d1b0fc5530385a3a529e43fedcbd4b129751206f842465e88e83c594a Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers vary Accept-Encoding content-encoding gzip content-length 10650 content-type text/html; charset=UTF-8 date Fri, 04 Mar 2022 01:13:38 GMT server Apache
GET H2	404	microsoft_logo.svg ssbobet24h.net/naf/inf/	12 KB 12 KB	155ms 155ms	Image text/html	192.185.115.109 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://ssbobet24h.net/naf/inf/microsoft_logo.svg Requested by Host: ssbobet24h.net URL: https://ssbobet24h.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.185.115.109 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-185-115-109.unifiedlayer.com Software Apache / Resource Hash bccb23d41c2cc69cf0c7d22c4314ca8181a513c6999b73e45307792830f4e482 Request headers Accept-Language de-DE,de;q=0.9 Referer https://ssbobet24h.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Fri, 04 Mar 2022 01:13:38 GMT content-encoding gzip last-modified Tue, 23 Apr 2019 06:24:10 GMT server Apache vary Accept-Encoding content-type text/html accept-ranges bytes content-length 4677
GET DATA	200 OK	truncated /	2 KB 2 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5 Request headers Referer Origin https://ssbobet24h.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Content-Type application/octet-stream
GET H2	200	pdf.png vikinggenetics-my.sharepoint.com/personal/datho_vikinggenetics_com_au/_layouts/15/images/	7 KB 8 KB	742ms 78ms	Image image/png	13.107.136.9 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://vikinggenetics-my.sharepoint.com/personal/datho_vikinggenetics_com_au/_layouts/15/images/pdf.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 13.107.136.9 Redmond, United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / ASP.NET Resource Hash db307fcef7f95139689007d7a623b340ec21282bd421c4e4b2ba09078f230545 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.powerapps.com *.yammer.com *.officeapps.live.com *.office.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com; Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Accept-Language de-DE,de;q=0.9 Referer https://ssbobet24h.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers strict-transport-security max-age=31536000 x-content-type-options nosniff nel {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} x-powered-by ASP.NET sprequestguid a24a26a0-c0b3-3000-b6b0-ffcd42775561 x-cache CONFIG_NOCACHE p3p CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" x-sharepointhealthscore 1 ms-cv oCZKorPAADC2sP/NQndVYQ.0 content-length 6830 microsoftsharepointteamservices 16.0.0.22216 x-ms-invokeapp 1; RequireReadOnly sprequestduration 18 last-modified Thu, 24 Feb 2022 03:50:02 GMT x-msedge-ref Ref A: DF365311F1924ACBAFE604776BD57F04 Ref B: ZRHEDGE1221 Ref C: 2022-03-04T01:13:39Z date Fri, 04 Mar 2022 01:13:38 GMT x-frame-options SAMEORIGIN report-to {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=Edge-Prod-ZRHr4a&frontEnd=AFD"}]} content-type image/png request-id a24a26a0-c0b3-3000-b6b0-ffcd42775561 etag "0d1ec993129d81:0" content-security-policy frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.powerapps.com *.yammer.com *.officeapps.live.com *.office.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com; accept-ranges bytes spiislatency 1

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sharepoint (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored number| g_responseEnd object| FabricConfig function| setImageUrl function| _spBodyOnLoad number| g_duration number| g_iisLatency number| g_requireJSDone

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://ssbobet24h.net/naf/inf/microsoft_logo.svg Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ssbobet24h.net
vikinggenetics-my.sharepoint.com
13.107.136.9
192.185.115.109
29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5
68cf300d1b0fc5530385a3a529e43fedcbd4b129751206f842465e88e83c594a
bccb23d41c2cc69cf0c7d22c4314ca8181a513c6999b73e45307792830f4e482
db307fcef7f95139689007d7a623b340ec21282bd421c4e4b2ba09078f230545