![](/screenshots/e9e1e243-ab54-44e1-8166-8da47d7a442c.png)
barthsgarage.no
Open in
urlscan Pro
5.249.226.63
Malicious Activity!
Public Scan
Effective URL: http://barthsgarage.no/language/overrides/Microsoftauto2018/63545a34d31a6bc36fc0e0eaef9b2665/index2.php?l=_JeHFUq_VJOXK...
Submission: On June 01 via manual from GB
Summary
This is the only time barthsgarage.no was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer) Office 365 (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 104.18.33.68 104.18.33.68 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
4 13 | 5.249.226.63 5.249.226.63 | 199566 (INIC) (INIC) | |
1 | 216.58.207.74 216.58.207.74 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 91.198.174.208 91.198.174.208 | 14907 (WIKIMEDIA) (WIKIMEDIA - Wikimedia Foundation Inc.) | |
4 | 216.58.207.67 216.58.207.67 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
15 | 4 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
clmeims.gcfi.org |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s25-in-f10.1e100.net
fonts.googleapis.com |
ASN14907 (WIKIMEDIA - Wikimedia Foundation Inc., US)
PTR: upload-lb.esams.wikimedia.org
upload.wikimedia.org |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s25-in-f3.1e100.net
fonts.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
barthsgarage.no
4 redirects
barthsgarage.no |
232 KB |
4 |
gstatic.com
fonts.gstatic.com |
114 KB |
1 |
wikimedia.org
upload.wikimedia.org |
25 KB |
1 |
googleapis.com
fonts.googleapis.com |
725 B |
1 |
gcfi.org
1 redirects
clmeims.gcfi.org |
668 B |
15 | 5 |
Domain | Requested by | |
---|---|---|
13 | barthsgarage.no |
4 redirects
barthsgarage.no
|
4 | fonts.gstatic.com |
barthsgarage.no
|
1 | upload.wikimedia.org |
barthsgarage.no
|
1 | fonts.googleapis.com |
barthsgarage.no
|
1 | clmeims.gcfi.org | 1 redirects |
15 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://barthsgarage.no/language/overrides/Microsoftauto2018/63545a34d31a6bc36fc0e0eaef9b2665/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=
Frame ID: CB57C73E5C6C079F37A84EBA46706EBD
Requests: 15 HTTP requests in this frame
Screenshot
![](/screenshots/e9e1e243-ab54-44e1-8166-8da47d7a442c.png)
Page URL History Show full URLs
-
http://clmeims.gcfi.org/?a
HTTP 302
http://barthsgarage.no/language/overrides/Microsoftauto2018 HTTP 301
http://barthsgarage.no/language/overrides/Microsoftauto2018/ HTTP 302
http://barthsgarage.no/language/overrides/Microsoftauto2018/63545a34d31a6bc36fc0e0eaef9b2665 HTTP 301
http://barthsgarage.no/language/overrides/Microsoftauto2018/63545a34d31a6bc36fc0e0eaef9b2665/ HTTP 302
http://barthsgarage.no/language/overrides/Microsoftauto2018/63545a34d31a6bc36fc0e0eaef9b2665/index2... Page URL
Detected technologies
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Detected patterns
- env /^Clipboard$/i
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://clmeims.gcfi.org/?a
HTTP 302
http://barthsgarage.no/language/overrides/Microsoftauto2018 HTTP 301
http://barthsgarage.no/language/overrides/Microsoftauto2018/ HTTP 302
http://barthsgarage.no/language/overrides/Microsoftauto2018/63545a34d31a6bc36fc0e0eaef9b2665 HTTP 301
http://barthsgarage.no/language/overrides/Microsoftauto2018/63545a34d31a6bc36fc0e0eaef9b2665/ HTTP 302
http://barthsgarage.no/language/overrides/Microsoftauto2018/63545a34d31a6bc36fc0e0eaef9b2665/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index2.php
barthsgarage.no/language/overrides/Microsoftauto2018/63545a34d31a6bc36fc0e0eaef9b2665/ Redirect Chain
|
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
theDocs.all.min.css
barthsgarage.no/language/overrides/Microsoftauto2018/63545a34d31a6bc36fc0e0eaef9b2665/assets/css/ |
203 KB 36 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
custom.css
barthsgarage.no/language/overrides/Microsoftauto2018/63545a34d31a6bc36fc0e0eaef9b2665/assets/css/ |
2 KB 916 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css
fonts.googleapis.com/ |
1 KB 725 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
barthsgarage.no/language/overrides/Microsoftauto2018/63545a34d31a6bc36fc0e0eaef9b2665/assets/img/ |
21 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
word.png
barthsgarage.no/language/overrides/Microsoftauto2018/63545a34d31a6bc36fc0e0eaef9b2665/assets/img/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
Office_365_logo.png
upload.wikimedia.org/wikipedia/commons/7/74/ |
25 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
theDocs.all.min.js
barthsgarage.no/language/overrides/Microsoftauto2018/63545a34d31a6bc36fc0e0eaef9b2665/assets/js/ |
222 KB 73 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
custom.js
barthsgarage.no/language/overrides/Microsoftauto2018/63545a34d31a6bc36fc0e0eaef9b2665/assets/js/ |
4 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
S6uyw4BMUTPHjx4wWw.ttf
fonts.gstatic.com/s/lato/v14/ |
59 KB 30 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1Ptrg8zYS_SKggPNwIYqWqZPBQ.ttf
fonts.gstatic.com/s/raleway/v12/ |
54 KB 26 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1Ptug8zYS_SKggPNyC0ISg.ttf
fonts.gstatic.com/s/raleway/v12/ |
52 KB 26 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
![]() barthsgarage.no/language/overrides/Microsoftauto2018/63545a34d31a6bc36fc0e0eaef9b2665/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fontawesome-webfont5b62.woff
barthsgarage.no/language/overrides/Microsoftauto2018/63545a34d31a6bc36fc0e0eaef9b2665/assets/fonts/ |
88 KB 89 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
S6u9w4BMUTPHh7USSwiPHA.ttf
fonts.gstatic.com/s/lato/v14/ |
62 KB 33 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer) Office 365 (Online)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| _self object| Prism object| httpLanguages object| options string| contentType function| $ function| jQuery function| Clipboard function| lity function| script function| click_to_download function| make_the_delay function| redirect_the function| now_download1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
barthsgarage.no/ | Name: eccaf3d3bc7d6c7c90d3b73eb9b7f35f Value: 487c8e76321592b4008fe19810df50ca |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
barthsgarage.no
clmeims.gcfi.org
fonts.googleapis.com
fonts.gstatic.com
upload.wikimedia.org
104.18.33.68
216.58.207.67
216.58.207.74
5.249.226.63
91.198.174.208
2cbcd235e7bd37011920b82ef900a4c2e87a048faa7345a1af59c1f28bce7188
2cc68b94666feb1fdd89122bf25fe10b0089cd51abbeec09913026d20f085dd5
39c5cf88c9572e0a95d3ab571906a3403c614a809f2fc88e22b92bec1e8cba38
3ae10ed925ca3203f6f4907da618fa90061d565b0b38af565b2fc5396477361a
4977f8d8f865c43ee26dc31409cd4fe8945048d5800719133d79ab053527d859
679290044ff37088379121c3590f0c580a94c679f97064d6e1739ab2b56ffda5
8178c795d51417ec3e73ea0be8fcd1d051cfbf684b83e782d7b05644762b968f
8ae79a4d18eea420af0fd562d43879b569bbd2c622da6deba79f6c202e385361
8ff299861c6ab8629f2a9847f5601b04d55793dc700ee8f7acf180e4867fcc44
9c4590446dbf83edae05be4ca28ef789ee50a01ef2cb8f1b51c5937d029cac76
a04d617e96e95a2fc781b68205e1c8ee0f99e07a6e3507653341b4a4d2ea0cae
adbc4f95eb6d7f2738959cf0ecbc374672fce47e856050a8e9791f457623ac2c
c9242c9e38a8f38f4a58d73b3fbeeee4737b123bfe0ec8bfc554b340e2310c52
f81e12f67f4c6f10ed89f3be4a9f7f4685c1e746cae88373f1e5f823980601fb