indha.in Open in urlscan Pro
15.207.45.93  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response indha.in/demosite/.well-known/pki-validation/index.php/	22 KB 9 KB	916ms 645ms	Document text/html	15.207.45.93 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://indha.in/demosite/.well-known/pki-validation/index.php/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 15.207.45.93 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-15-207-45-93.ap-south-1.compute.amazonaws.com Software Apache / Resource Hash 392f16dd6f78a4276aacfda6d4cb03e4e0f1974506f329cc7c22eb450665e087 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Mon, 15 Nov 2021 07:36:55 GMT Server Apache Content-Encoding gzip Vary Accept-Encoding Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	microsoft_logo.svg indha.in/demosite/.well-known/pki-validation/index.php/naf/inf/	4 KB 4 KB	126ms 126ms	Image image/svg+xml	15.207.45.93 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://indha.in/demosite/.well-known/pki-validation/index.php/naf/inf/microsoft_logo.svg Requested by Host: indha.in URL: https://indha.in/demosite/.well-known/pki-validation/index.php/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 15.207.45.93 Mumbai, India, ASN16509 (AMAZON-02, US), Reverse DNS ec2-15-207-45-93.ap-south-1.compute.amazonaws.com Software Apache / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Accept-Language de-DE,de;q=0.9 Referer https://indha.in/demosite/.well-known/pki-validation/index.php/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Date Mon, 15 Nov 2021 07:36:56 GMT Last-Modified Fri, 18 May 2018 19:17:00 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 3651
GET DATA	200 OK	truncated /	2 KB 2 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5 Request headers Referer Origin https://indha.in Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Content-Type application/octet-stream
GET H/1.1	200 OK	pdf.png vikinggenetics-my.sharepoint.com/personal/datho_vikinggenetics_com_au/_layouts/15/images/	7 KB 8 KB	966ms 49ms	Image image/png	52.105.157.27 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://vikinggenetics-my.sharepoint.com/personal/datho_vikinggenetics_com_au/_layouts/15/images/pdf.png Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.105.157.27 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash db307fcef7f95139689007d7a623b340ec21282bd421c4e4b2ba09078f230545 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.powerapps.com *.yammer.com *.officeapps.live.com *.office.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com; Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Accept-Language de-DE,de;q=0.9 Referer https://indha.in/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers Content-Security-Policy frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.powerapps.com *.yammer.com *.officeapps.live.com *.office.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com; X-Content-Type-Options nosniff NEL {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} X-Powered-By ASP.NET P3P CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-SharePointHealthScore 2 MS-CV oANLPsKgADBx4kFznED7Fw.0 Content-Length 6830 MicrosoftSharePointTeamServices 16.0.0.21827 X-MS-InvokeApp 1; RequireReadOnly SPRequestDuration 15 Last-Modified Fri, 05 Nov 2021 00:20:53 GMT Server Microsoft-IIS/10.0 SPRequestGuid 3e4b03a0-a0c2-3000-71e2-41739c40fb17 X-FRAME-OPTIONS SAMEORIGIN Date Mon, 15 Nov 2021 07:36:57 GMT Strict-Transport-Security max-age=31536000 Report-To {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=189041&frontEnd=FarmDirect"}]} Content-Type image/png request-id 3e4b03a0-a0c2-3000-71e2-41739c40fb17 ETag "802049fedad1d71:0" Accept-Ranges bytes SPIisLatency 1

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online) Microsoft (Consumer) Sharepoint (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler number| g_responseEnd object| FabricConfig function| setImageUrl function| _spBodyOnLoad number| g_duration number| g_iisLatency number| g_requireJSDone

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

indha.in
vikinggenetics-my.sharepoint.com
15.207.45.93
52.105.157.27
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5
392f16dd6f78a4276aacfda6d4cb03e4e0f1974506f329cc7c22eb450665e087
db307fcef7f95139689007d7a623b340ec21282bd421c4e4b2ba09078f230545