sharepoint.secbam.repl.co Open in urlscan Pro
35.201.120.147 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://sharepoint.secbam.repl.co/
Submission: On September 28 via manual (September 28th 2020, 6:24:38 pm UTC) from SA

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 4 domains to perform 15 HTTP transactions. The main IP is 35.201.120.147, located in Ascension Island and belongs to GOOGLE, US. The main domain is sharepoint.secbam.repl.co.
TLS certificate: Issued by Let's Encrypt Authority X3 on September 28th 2020. Valid for: 3 months.

This is the only time sharepoint.secbam.repl.co was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer) OneDrive (Online)

Domain & IP information

	IP Address	AS Autonomous System
9	35.201.120.147 35.201.120.147	15169 (GOOGLE) (GOOGLE)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:1a	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:4001:808::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:818::200a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:81b::2003	15169 (GOOGLE) (GOOGLE)
15	6

9 35.201.120.147 (Ascension Island)

ASN15169 (GOOGLE, US)
PTR: 147.120.201.35.bc.googleusercontent.com

sharepoint.secbam.repl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:1a (Netherlands)

ASN20446 (HIGHWINDS3, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:818::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:81b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	repl.co sharepoint.secbam.repl.co	368 KB
3	gstatic.com fonts.gstatic.com	27 KB
2	googleapis.com ajax.googleapis.com fonts.googleapis.com	31 KB
1	bootstrapcdn.com maxcdn.bootstrapcdn.com	20 KB
15	4

	Domain	Requested by
9	sharepoint.secbam.repl.co	sharepoint.secbam.repl.co
3	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	sharepoint.secbam.repl.co
1	ajax.googleapis.com	sharepoint.secbam.repl.co
1	maxcdn.bootstrapcdn.com	sharepoint.secbam.repl.co
15	5

This site contains no links.

Subject Issuer	Validity	Valid
secbam.repl.co Let's Encrypt Authority X3	`2020-09-28` - `2020-12-27`	3 months	crt.sh
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2020-09-22` - `2021-10-12`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://sharepoint.secbam.repl.co/
Frame ID: 5DAFB764B51937A13BAC1EF7F221E734
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Page Statistics

15
Requests

100 %
HTTPS

80 %
IPv6

4
Domains

5
Subdomains

6
IPs

3
Countries

446 kB
Transfer

659 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
sharepoint.secbam.repl.co/ 40 KB
40 KB 710ms
453ms Document
text/html 35.201.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sharepoint.secbam.repl.co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.120.147 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.201.35.bc.googleusercontent.com
Software: /
Resource Hash: 8eef2ea163a79995087c0b9ef4c56f3a85ba7bef206331a1cb925725c898b16b

Request headers

:method: GET
:authority: sharepoint.secbam.repl.co
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
access-control-allow-origin: *
content-type: text/html; charset=utf-8
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-length: 40524
date: Mon, 28 Sep 2020 18:24:20 GMT

GET
H2 200 style.css
sharepoint.secbam.repl.co/css/ 5 KB
5 KB 363ms
362ms Stylesheet
text/css 35.201.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sharepoint.secbam.repl.co/css/style.css
Requested by: Host: sharepoint.secbam.repl.co
URL: https://sharepoint.secbam.repl.co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.120.147 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.201.35.bc.googleusercontent.com
Software: /
Resource Hash: 4230c9e85ab156675af58840187a83eec0c94aa38adbc83a11c0b63a78bfb984

Request headers

Referer: https://sharepoint.secbam.repl.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Mon, 28 Sep 2020 18:24:21 GMT
access-control-allow-origin: *
content-length: 5407
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-type: text/css; charset=utf-8

GET
H2 200 bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/ 141 KB
20 KB 8ms
8ms Stylesheet
text/css 2001:4de0:ac19::1:b:1a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css

Requested by

Host: sharepoint.secbam.repl.co
URL: https://sharepoint.secbam.repl.co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:1a , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://sharepoint.secbam.repl.co
Referer: https://sharepoint.secbam.repl.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 18:24:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 12 Dec 2018 18:34:10 GMT
status: 200
etag: "1544639650"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 20563

GET
H2 200 gmail.jpg
sharepoint.secbam.repl.co/images/ 14 KB
14 KB 414ms
413ms Image
image/jpeg 35.201.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sharepoint.secbam.repl.co/images/gmail.jpg
Requested by: Host: sharepoint.secbam.repl.co
URL: https://sharepoint.secbam.repl.co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.120.147 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.201.35.bc.googleusercontent.com
Software: /
Resource Hash: 0395c2d974a610a5826088c1752b49945c0b38e841389e794bf7171e2326982c

Request headers

Referer: https://sharepoint.secbam.repl.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Mon, 28 Sep 2020 18:24:21 GMT
access-control-allow-origin: *
content-length: 14617
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-type: image/jpeg

GET
H2 200 aol.jpg
sharepoint.secbam.repl.co/images/ 14 KB
14 KB 435ms
433ms Image
image/jpeg 35.201.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sharepoint.secbam.repl.co/images/aol.jpg
Requested by: Host: sharepoint.secbam.repl.co
URL: https://sharepoint.secbam.repl.co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.120.147 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.201.35.bc.googleusercontent.com
Software: /
Resource Hash: b2bf99365d81089bbb0939d15bd959809492c068555dbead87f91802589ef5a9

Request headers

Referer: https://sharepoint.secbam.repl.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Mon, 28 Sep 2020 18:24:21 GMT
access-control-allow-origin: *
content-length: 13869
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-type: image/jpeg

GET
H2 200 outlook.jpg
sharepoint.secbam.repl.co/images/ 15 KB
15 KB 353ms
351ms Image
image/jpeg 35.201.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sharepoint.secbam.repl.co/images/outlook.jpg
Requested by: Host: sharepoint.secbam.repl.co
URL: https://sharepoint.secbam.repl.co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.120.147 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.201.35.bc.googleusercontent.com
Software: /
Resource Hash: a8911de9c6b54ea92f9322ea7570ee16713718211f4dabc77b820256dc923b4c

Request headers

Referer: https://sharepoint.secbam.repl.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Mon, 28 Sep 2020 18:24:21 GMT
access-control-allow-origin: *
content-length: 15442
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-type: image/jpeg

GET
H2 200 office.jpg
sharepoint.secbam.repl.co/images/ 14 KB
14 KB 352ms
351ms Image
image/jpeg 35.201.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sharepoint.secbam.repl.co/images/office.jpg
Requested by: Host: sharepoint.secbam.repl.co
URL: https://sharepoint.secbam.repl.co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.120.147 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.201.35.bc.googleusercontent.com
Software: /
Resource Hash: bedcbef0141493931f41db1b4410c80f62812f1d5a5f98de10fcfe4da57e994d

Request headers

Referer: https://sharepoint.secbam.repl.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Mon, 28 Sep 2020 18:24:21 GMT
access-control-allow-origin: *
content-length: 14352
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-type: image/jpeg

GET
H2 200 yahoo.jpg
sharepoint.secbam.repl.co/images/ 15 KB
15 KB 481ms
480ms Image
image/jpeg 35.201.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sharepoint.secbam.repl.co/images/yahoo.jpg
Requested by: Host: sharepoint.secbam.repl.co
URL: https://sharepoint.secbam.repl.co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.120.147 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.201.35.bc.googleusercontent.com
Software: /
Resource Hash: 9dcb3f39c6f1c7f2b0fa75391efa497c84ade4b3a12867af284fbe224d24c3e9

Request headers

Referer: https://sharepoint.secbam.repl.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Mon, 28 Sep 2020 18:24:21 GMT
access-control-allow-origin: *
content-length: 14939
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-type: image/jpeg

GET
H2 200 other.jpg
sharepoint.secbam.repl.co/images/ 14 KB
14 KB 352ms
351ms Image
image/jpeg 35.201.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sharepoint.secbam.repl.co/images/other.jpg
Requested by: Host: sharepoint.secbam.repl.co
URL: https://sharepoint.secbam.repl.co/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.120.147 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.201.35.bc.googleusercontent.com
Software: /
Resource Hash: 7976b777c1a1d694739e57292d1629d371aa79be6d7a2a87bcb0d0b9edad79f2

Request headers

Referer: https://sharepoint.secbam.repl.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Mon, 28 Sep 2020 18:24:21 GMT
access-control-allow-origin: *
content-length: 14360
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-type: image/jpeg

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 85 KB
30 KB 27ms
6ms Script
text/javascript 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js

Requested by

Host: sharepoint.secbam.repl.co
URL: https://sharepoint.secbam.repl.co/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sharepoint.secbam.repl.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 16:52:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5535
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30399
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 28 Sep 2021 16:52:06 GMT

GET
DATA 200
OK truncated
/ 27 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 94f584a17bcf5868513c7e0b8a7085df161aac6fc6deef8907d1579ed8312899

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 css
fonts.googleapis.com/ 12 KB
947 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:818::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700,800

Requested by

Host: sharepoint.secbam.repl.co
URL: https://sharepoint.secbam.repl.co/css/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6876c16e0cc93e18768cdd11ed2a63d316f059b26ae6a08237895921e528f697

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://sharepoint.secbam.repl.co/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 28 Sep 2020 16:57:37 GMT
server: ESF
date: Mon, 28 Sep 2020 18:24:21 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 28 Sep 2020 18:24:21 GMT

GET
H2 200 pdf.png
sharepoint.secbam.repl.co/css/images/ 237 KB
237 KB 248ms
247ms Image
image/png 35.201.120.147
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sharepoint.secbam.repl.co/css/images/pdf.png
Requested by: Host: sharepoint.secbam.repl.co
URL: https://sharepoint.secbam.repl.co/css/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.120.147 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 147.120.201.35.bc.googleusercontent.com
Software: /
Resource Hash: fda59afa069c9c1bbb0567e2fc04274e62889fe9fb80749248ef9c58d1c4a5b3

Request headers

Referer: https://sharepoint.secbam.repl.co/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Mon, 28 Sep 2020 18:24:21 GMT
access-control-allow-origin: *
content-length: 242898
expect-ct: max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791"
content-type: image/png

GET
H2 200 mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:81b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700,800

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://sharepoint.secbam.repl.co
Referer: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700,800
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 18:22:23 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:10:27 GMT
server: sffe
age: 518518
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9080
x-xss-protection: 0
expires: Wed, 22 Sep 2021 18:22:23 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:81b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700,800

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://sharepoint.secbam.repl.co
Referer: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700,800
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 18:23:16 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:28 GMT
server: sffe
age: 518465
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9132
x-xss-protection: 0
expires: Wed, 22 Sep 2021 18:23:16 GMT

GET
H2 200 mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:81b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700,800

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://sharepoint.secbam.repl.co
Referer: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700,800
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 18:22:51 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:49 GMT
server: sffe
age: 518490
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9180
x-xss-protection: 0
expires: Wed, 22 Sep 2021 18:22:51 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer) OneDrive (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
fonts.googleapis.com
fonts.gstatic.com
maxcdn.bootstrapcdn.com
sharepoint.secbam.repl.co
2001:4de0:ac19::1:b:1a
2a00:1450:4001:808::200a
2a00:1450:4001:818::200a
2a00:1450:4001:81b::2003
35.201.120.147
0395c2d974a610a5826088c1752b49945c0b38e841389e794bf7171e2326982c
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
4230c9e85ab156675af58840187a83eec0c94aa38adbc83a11c0b63a78bfb984
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
6876c16e0cc93e18768cdd11ed2a63d316f059b26ae6a08237895921e528f697
7976b777c1a1d694739e57292d1629d371aa79be6d7a2a87bcb0d0b9edad79f2
8eef2ea163a79995087c0b9ef4c56f3a85ba7bef206331a1cb925725c898b16b
94f584a17bcf5868513c7e0b8a7085df161aac6fc6deef8907d1579ed8312899
9dcb3f39c6f1c7f2b0fa75391efa497c84ade4b3a12867af284fbe224d24c3e9
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
a8911de9c6b54ea92f9322ea7570ee16713718211f4dabc77b820256dc923b4c
b2bf99365d81089bbb0939d15bd959809492c068555dbead87f91802589ef5a9
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
bedcbef0141493931f41db1b4410c80f62812f1d5a5f98de10fcfe4da57e994d
fda59afa069c9c1bbb0567e2fc04274e62889fe9fb80749248ef9c58d1c4a5b3

sharepoint.secbam.repl.co Open in urlscan Pro 35.201.120.147 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

80 %IPv6

4 Domains

5 Subdomains

6 IPs

3 Countries

446 kBTransfer

659 kBSize

0 Cookies

0 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Indicators

sharepoint.secbam.repl.co Open in urlscan Pro
35.201.120.147 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

80 %
IPv6

4
Domains

5
Subdomains

6
IPs

3
Countries

446 kB
Transfer

659 kB
Size

0
Cookies

15 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!