gsl21.com
Open in
urlscan Pro
185.2.5.24
Malicious Activity!
Public Scan
Effective URL: https://gsl21.com/jd/Attachments%20-%20OneDrive.html?sitedomain=onedrive.microsoftonline.com.shared&lang=en&seamle...
Submission: On March 29 via manual from IT
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on March 12th 2020. Valid for: 3 months.
This is the only time gsl21.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: OneDrive (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 24 | 185.2.5.24 185.2.5.24 | 203461 (REGISTER_...) (REGISTER_UK-AS) | |
1 | 184.50.167.199 184.50.167.199 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
12 | 2606:2800:133... 2606:2800:133:f17:19e8:2356:251b:2a9 | 15133 (EDGECAST) (EDGECAST) | |
42 | 4 |
ASN203461 (REGISTER_UK-AS, GB)
PTR: lhcp2024.webapps.net
gsl21.com | |
www.gsl21.com |
ASN16625 (AKAMAI-AS, US)
PTR: a184-50-167-199.deploy.static.akamaitechnologies.com
r3.res.outlook.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
24 |
gsl21.com
2 redirects
gsl21.com www.gsl21.com |
1 MB |
12 |
skype.com
swx.cdn.skype.com |
754 KB |
1 |
outlook.com
r3.res.outlook.com |
|
0 |
Failed
function sub() { [native code] }. Failed |
|
42 | 4 |
Domain | Requested by | |
---|---|---|
22 | gsl21.com |
2 redirects
gsl21.com
|
12 | swx.cdn.skype.com |
gsl21.com
|
2 | www.gsl21.com |
gsl21.com
|
1 | r3.res.outlook.com |
gsl21.com
|
0 | 134.249.116.78 Failed |
gsl21.com
|
42 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
onedrive.live.com |
onedrive.uservoice.com |
g.live.com |
go.microsoft.com |
account.microsoft.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
gsl21.com Let's Encrypt Authority X3 |
2020-03-12 - 2020-06-10 |
3 months | crt.sh |
*.res.outlook.com Microsoft IT TLS CA 2 |
2019-10-21 - 2021-10-21 |
2 years | crt.sh |
*.vo.msecnd.net Microsoft IT TLS CA 2 |
2020-03-18 - 2022-03-18 |
2 years | crt.sh |
This page contains 7 frames:
Primary Page:
https://gsl21.com/jd/Attachments%20-%20OneDrive.html?sitedomain=onedrive.microsoftonline.com.shared&lang=en&seamless=novl&offerId=newmail-en-us-v2&authLev=0&siteState
Frame ID: 926E10A07A2CB7E744EF08EA71357E7D
Requests: 30 HTTP requests in this frame
Frame:
https://gsl21.com/jd/Attachments%20-%20OneDrive_files/xmlproxy.html
Frame ID: A9DBD38881C1B8AF91DBB42DBC4E2089
Requests: 3 HTTP requests in this frame
Frame:
https://gsl21.com/jd/Attachments%20-%20OneDrive_files/login.html
Frame ID: 57733388CA8AD0F0BBAE2FB0B17F5FEC
Requests: 1 HTTP requests in this frame
Frame:
https://gsl21.com/jd/Attachments%20-%20OneDrive_files/login(1).html
Frame ID: A7E324744C02873989C3847A582BEE88
Requests: 1 HTTP requests in this frame
Frame:
https://gsl21.com/jd/Attachments%20-%20OneDrive_files/login(2).html
Frame ID: E9AC2D1058BB26912EC2E19BFF8CA583
Requests: 1 HTTP requests in this frame
Frame:
https://gsl21.com/jd/Attachments%20-%20OneDrive_files/SuiteServiceProxy.html
Frame ID: CBF366D02FD171DFD1CBC783FEF158E0
Requests: 3 HTTP requests in this frame
Frame:
https://gsl21.com/jd/Attachments%20-%20OneDrive_files/silent.html
Frame ID: BA4E42FC72DD78D4D08E190DE585FE6C
Requests: 3 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://gsl21.com/jd/index.html Page URL
- https://gsl21.com/jd/Attachments%20-%20OneDrive.html?sitedomain=onedrive.microsoftonline.com.s... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
12 Outgoing links
These are links going to different origins than the main page.
Title: OneDrive
Search URL Search Domain Scan URL
Title: Choose a photo
Search URL Search Domain Scan URL
Title: Suggest a feature idea
Search URL Search Domain Scan URL
Title: Terms
Search URL Search Domain Scan URL
Title: Privacy & Cookies
Search URL Search Domain Scan URL
Title: Developers
Search URL Search Domain Scan URL
Title: Report abuse
Search URL Search Domain Scan URL
Title: My profile
Search URL Search Domain Scan URL
Title: My account
Search URL Search Domain Scan URL
Title: 410 KB used of 5 GB
Search URL Search Domain Scan URL
Title: Get the OneDrive apps
Search URL Search Domain Scan URL
Title: Files
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://gsl21.com/jd/index.html Page URL
- https://gsl21.com/jd/Attachments%20-%20OneDrive.html?sitedomain=onedrive.microsoftonline.com.shared&lang=en&seamless=novl&offerId=newmail-en-us-v2&authLev=0&siteState Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 22- https://gsl21.com/jd/Attachments%20-%20OneDrive_files/MeControlMediumUserTile HTTP 301
- https://www.gsl21.com/jd/Attachments%20-%20OneDrive_files/MeControlMediumUserTile
- https://gsl21.com/jd/Attachments%20-%20OneDrive_files/shellwofficons_ceb492ec.woff HTTP 301
- https://www.gsl21.com/jd/Attachments%20-%20OneDrive_files/shellwofficons_ceb492ec.woff
- https://gsl21.com/jd/Attachments%20-%20OneDrive_files/xmlproxy.js HTTP 301
- https://www.gsl21.com/jd/Attachments%20-%20OneDrive_files/xmlproxy.js
- https://gsl21.com/jd/Attachments%20-%20OneDrive_files/suiteserviceproxyiframe_eab542f5.js.download HTTP 301
- https://www.gsl21.com/jd/Attachments%20-%20OneDrive_files/suiteserviceproxyiframe_eab542f5.js.download
42 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
index.html
gsl21.com/jd/ |
685 B 751 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
jquery.js
134.249.116.78/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
Attachments%20-%20OneDrive.html
gsl21.com/jd/ |
824 KB 102 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shellg2coremincss_f781fed1.css
gsl21.com/jd/Attachments%20-%20OneDrive_files/ |
70 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shellg2corecss_2087ecce.css
r3.res.outlook.com/o365/versionless/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shellg2coreminthemecss_fa4e44fb.css
gsl21.com/jd/Attachments%20-%20OneDrive_files/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
common.css
gsl21.com/jd/Attachments%20-%20OneDrive_files/ |
537 KB 48 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
swx.css
gsl21.com/jd/Attachments%20-%20OneDrive_files/ |
1 MB 99 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
call-answer.m4a
swx.cdn.skype.com/assets/v/0.0.300/audio/m4a/ |
0 32 KB |
Other
audio/mp4 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
call-answer.ogg
swx.cdn.skype.com/assets/v/0.0.300/audio/ogg/ |
0 21 KB |
Other
audio/ogg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
call-dialing.m4a
swx.cdn.skype.com/assets/v/0.0.300/audio/m4a/ |
0 44 KB |
Other
audio/mp4 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
call-dialing.ogg
swx.cdn.skype.com/assets/v/0.0.300/audio/ogg/ |
0 25 KB |
Other
audio/ogg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
call-outgoing-p1.m4a
swx.cdn.skype.com/assets/v/0.0.300/audio/m4a/ |
0 138 KB |
Other
audio/mp4 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
call-outgoing-p1.ogg
swx.cdn.skype.com/assets/v/0.0.300/audio/ogg/ |
0 50 KB |
Other
audio/ogg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
call-outgoing-p2-loop.m4a
swx.cdn.skype.com/assets/v/0.0.300/audio/m4a/ |
0 148 KB |
Other
audio/mp4 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
call-outgoing-p2-loop.ogg
swx.cdn.skype.com/assets/v/0.0.300/audio/ogg/ |
0 51 KB |
Other
audio/ogg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
call-incoming-loop.m4a
swx.cdn.skype.com/assets/v/0.0.300/audio/m4a/ |
0 141 KB |
Other
audio/mp4 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
call-incoming-loop.ogg
swx.cdn.skype.com/assets/v/0.0.300/audio/ogg/ |
0 42 KB |
Other
audio/ogg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
message-received-1.m4a
swx.cdn.skype.com/assets/v/0.0.300/audio/m4a/ |
0 37 KB |
Other
audio/mp4 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
message-received-1.ogg
swx.cdn.skype.com/assets/v/0.0.300/audio/ogg/ |
0 24 KB |
Other
audio/ogg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
curatedfolders.gif
gsl21.com/jd/Attachments%20-%20OneDrive_files/ |
621 KB 621 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
officelens.gif
gsl21.com/jd/Attachments%20-%20OneDrive_files/ |
98 KB 98 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
photosview.gif
gsl21.com/jd/Attachments%20-%20OneDrive_files/ |
451 KB 451 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
MeControlMediumUserTile
www.gsl21.com/jd/Attachments%20-%20OneDrive_files/ Redirect Chain
|
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headersRedirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
premium-diamond-24.svg
gsl21.com/jd/Attachments%20-%20OneDrive_files/ |
847 B 801 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
premium-gleam-multi.svg
gsl21.com/jd/Attachments%20-%20OneDrive_files/ |
622 B 696 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pdf.png
gsl21.com/jd/Attachments%20-%20OneDrive_files/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
jquery.js
134.249.116.78/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
xmlproxy.html
gsl21.com/jd/Attachments%20-%20OneDrive_files/ Frame A9DB |
460 B 664 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.html
gsl21.com/jd/Attachments%20-%20OneDrive_files/ Frame 5773 |
793 B 884 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login(1).html
gsl21.com/jd/Attachments%20-%20OneDrive_files/ Frame A7E3 |
793 B 884 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login(2).html
gsl21.com/jd/Attachments%20-%20OneDrive_files/ Frame E9AC |
277 B 569 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SuiteServiceProxy.html
gsl21.com/jd/Attachments%20-%20OneDrive_files/ Frame CBF3 |
44 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
silent.html
gsl21.com/jd/Attachments%20-%20OneDrive_files/ Frame BA4E |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
shellwofficons_ceb492ec.woff
www.gsl21.com/jd/Attachments%20-%20OneDrive_files/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
xmlproxy.js.download
gsl21.com/jd/Attachments%20-%20OneDrive_files/ Frame A9DB |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
xmlproxy.js
www.gsl21.com/jd/Attachments%20-%20OneDrive_files/ Frame A9DB Redirect Chain
|
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headersRedirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
suiteserviceproxyiframe_eab542f5.js.download
www.gsl21.com/jd/Attachments%20-%20OneDrive_files/ Frame CBF3 Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
jquery.js
134.249.116.78/ Frame CBF3 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
HashFragment.js.download
gsl21.com/jd/Attachments%20-%20OneDrive_files/ Frame BA4E |
1 KB 762 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
jquery.js
134.249.116.78/ Frame BA4E |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
shellttficons_79de49fd.ttf
gsl21.com/jd/Attachments%20-%20OneDrive_files/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- 134.249.116.78
- URL
- http://134.249.116.78/jquery.js
- Domain
- 134.249.116.78
- URL
- http://134.249.116.78/jquery.js
- Domain
- www.gsl21.com
- URL
- https://www.gsl21.com/jd/Attachments%20-%20OneDrive_files/shellwofficons_ceb492ec.woff
- Domain
- www.gsl21.com
- URL
- https://www.gsl21.com/jd/Attachments%20-%20OneDrive_files/suiteserviceproxyiframe_eab542f5.js.download
- Domain
- 134.249.116.78
- URL
- http://134.249.116.78/jquery.js
- Domain
- 134.249.116.78
- URL
- http://134.249.116.78/jquery.js
- Domain
- gsl21.com
- URL
- https://gsl21.com/jd/Attachments%20-%20OneDrive_files/shellttficons_79de49fd.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: OneDrive (Online)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| _0x25150 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
134.249.116.78
gsl21.com
r3.res.outlook.com
swx.cdn.skype.com
www.gsl21.com
134.249.116.78
gsl21.com
www.gsl21.com
184.50.167.199
185.2.5.24
2606:2800:133:f17:19e8:2356:251b:2a9
04649dc63fcad7933ac5639729e7a643a55483812b92345c317f825f2c832a06
2578f856bd5b86151db3af8404f1cf984afe4618ab67df792b57ec7b6b4f8376
26afe5c517df89ec32c8368652fa5e98aa8d8c869c103f62292c6defeb64cebe
384d25d7cbda445bc3dec49ace73e606c0244e3c088d870b1699445a8640bbb4
55a9cfcc49e12e1f6543505a51b727d31e76d44e62483fba30f7a519368f607c
5df985d6d6ae5e8d655a6241b8ed8a6ef1511b88adbd2d46ae88718432240b9c
6ca34cb4774c25d441ddeb9326547885ab307d0b2569c5785a520f2f8c107b65
7675ff937276a1b69ca7fa830c5a55996c63afaf45f3fc751cbc4517ef3bb2a7
7e6065cd2d3cca82cb7794615620af3c32a12569d5d6d079da2b68e232e16c26
83199c5781bf62b697258a0ad10b414b71f019bb12c6258161be6f488e9c5241
84e8fceff307392eca7bc6c7f863842abc37e79ddc0226bdccebc067e3bf38c9
8d3b3fd628e49dce944f8d914004632c7fbf9e30396f9fd85270ac06e1543100
93a613f5d28db0fbc904d7cc68b320d81dfbb9f7255dbd57a957c2f925c8a301
a752165913e64967bc3a836aa51fa8493bb65e5bae1a015d13985a8a7ca06e7a
ab82997a6a3955028d71d6164896f7bc96bd396c7c06699b57b6ed86f422d67b
c37e2c670b28fade6314d69b0c24c6fb702d3c56d5ee7d9bec7677fb7b256134
d99927bc24b2adb43587eef1277c8d7f58d0fb532696182bde0653dcc535f693
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eca23a015e72ca93f1df3b18ab425eaa8241be76edf7a09d9494f60d66176d06
f4c7cecc5728079f818e241991b6268fc5c02b9b5b93f02faf5962790912ea10
fe253aa8868f751ac6a3e0a8f725722d82e8a9de68afb8cbbdd574f2fb25980b