![](/screenshots/e9dd3de6-275f-4985-8be2-d42fb5b935c6.png)
wangal.org
Open in
urlscan Pro
104.143.10.117
Malicious Activity!
Public Scan
Effective URL: http://wangal.org/wp-includes/js/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1...
Submission: On August 17 via automatic, source openphish
Summary
This is the only time wangal.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Office 365 (Online) Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 104.143.10.117 104.143.10.117 | 36114 (VERSAWEB-ASN) (VERSAWEB-ASN - Versaweb) | |
2 | 2a02:26f0:122... 2a02:26f0:122:393::fb1 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
11 | 2 |
ASN20940 (AKAMAI-ASN1, US)
secure.aadcdn.microsoftonline-p.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
wangal.org
wangal.org |
581 KB |
2 |
microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com |
4 KB |
11 | 2 |
Domain | Requested by | |
---|---|---|
9 | wangal.org |
wangal.org
|
2 | secure.aadcdn.microsoftonline-p.com |
wangal.org
|
11 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
login.live.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
secure.aadcdn.microsoftonline-p.com Symantec Class 3 Secure Server CA - G4 |
2016-09-01 - 2017-09-01 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://wangal.org/wp-includes/js/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YWx5c29uQGRlYWxtYWtlcnMubmV0&.rand=13InboxLight.aspx?n=1774256418&fid=4
Frame ID: 4098.1
Requests: 11 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Title: Sign in with a Microsoft account
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Sign-in.php
wangal.org/wp-includes/js/office/ Redirect Chain
|
29 KB 29 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.css
wangal.org/wp-includes/js/office/files/ |
21 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_hover.css
wangal.org/wp-includes/js/office/files/ |
89 B 89 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
wangal.org/wp-includes/js/office/files/ |
108 KB 108 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aad.js
wangal.org/wp-includes/js/office/files/ |
174 KB 174 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
heroillustration.jpg
wangal.org/wp-includes/js/office/files/ |
199 KB 199 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bannerlogo.png
wangal.org/wp-includes/js/office/files/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
microsoft_logo.png
wangal.org/wp-includes/js/office/files/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_hover.min.css
secure.aadcdn.microsoftonline-p.com/ests/2.1.5898.9/content/cdnbundles/ |
89 B 82 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
watson.min.js
secure.aadcdn.microsoftonline-p.com/ests/2.1.5898.9/content/cdnbundles/ |
10 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
watson
wangal.org/common/handlers/ |
44 KB 45 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Office 365 (Online) Microsoft (Consumer)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
wangal.org/wp-includes/js/office | Name: testcookie Value: testcookie |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
secure.aadcdn.microsoftonline-p.com
wangal.org
104.143.10.117
2a02:26f0:122:393::fb1
080ff245615e719959bc5537e164ac4495c4b8036462dfee2076dd92f22c8491
784272794b86d17613d2311fa54eab23d223252eebe139ce8113eaca26a03f86
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
91c2b74542e11d0278e02715a980b39582eae2e3b519ddd2d4f9ca939e58109c
b849c8da2fb4163b99fb3e45081f8622cba52359d9d68749aa0a6a1db7d7e97f
c30d787135a944e2e921e185df8a0be5f1fd25183d7db959af732f95e733a3ed
ca5896e71cda62c2be576048f73ca40094592f9fd2a62f7c2b4d8c94b03191e3
ea66d01bcec187149de1e5e7ec80fe423819460484efc95150efd36bbcf963ec
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603