office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com Open in urlscan Pro
5.101.109.41  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.htm Show response office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com/	27 KB 27 KB	136ms 45ms	Document text/html	5.101.109.41 DigitalOcean
General Check archive.org Show headers Download Go to Full URL https://office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com/index.htm?c=susan_l_hartman@uhc.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 5.101.109.41 , Netherlands, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US), Reverse DNS Software / Resource Hash 3e35041d8f88ffbb90d45d992b94a3d0314a1cdb981a1bbce9a46bae851f036d Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload Request headers Host office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Sec-Fetch-User ?1 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site none Sec-Fetch-Mode navigate Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Sec-Fetch-User ?1 Response headers Content-Length 27546 Accept-Ranges bytes Last-Modified Fri, 17 Jan 2020 12:55:12 GMT ETag "d312fabc080aad1de7c7d6f838ddb6a9" x-amz-request-id tx0000000000000f58d48ab-005e21d22a-c8079e-fra1a Content-Type text/html Date Fri, 17 Jan 2020 15:26:34 GMT Strict-Transport-Security max-age=15552000; includeSubDomains; preload Vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method
GET H2	200	bootstrap.min.css stackpath.bootstrapcdn.com/bootstrap/4.1.0/css/	137 KB 21 KB	10ms 8ms	Stylesheet text/css	2001:4de0:ac19::1:b:3b Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.0/css/bootstrap.min.css Requested by Host: office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com URL: https://office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com/index.htm?c=susan_l_hartman@uhc.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:3b , Netherlands, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US), Reverse DNS Software / Resource Hash 34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Referer https://office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com/index.htm?c=susan_l_hartman@uhc.com Origin https://office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com Response headers date Fri, 17 Jan 2020 15:26:34 GMT content-encoding gzip last-modified Wed, 12 Dec 2018 18:34:10 GMT access-control-allow-origin * etag "1544639650" vary Accept-Encoding x-cache HIT content-type text/css; charset=utf-8 status 200 cache-control public, max-age=31536000 x-hello-human Say hello back! @getBootstrapCDN on Twitter accept-ranges bytes timing-allow-origin * content-length 21024
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	jquery-3.3.1.slim.min.js Show response code.jquery.com/	68 KB 24 KB	6ms 6ms	Script application/javascript	2001:4de0:ac19::1:b:3a Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.3.1.slim.min.js Requested by Host: office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com URL: https://office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com/index.htm?c=susan_l_hartman@uhc.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US), Reverse DNS Software nginx / Resource Hash dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Referer https://office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com/index.htm?c=susan_l_hartman@uhc.com Origin https://office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com Response headers Date Fri, 17 Jan 2020 15:26:34 GMT Content-Encoding gzip Last-Modified Sat, 20 Jan 2018 17:26:44 GMT Server nginx ETag W/"5a637bd4-1111d" Vary Accept-Encoding X-HW 1579274786.dop143.fr8.t,1579274794.cds142.fr8.shn,1579274794.cds142.fr8.c Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control max-age=315360000, public Connection Keep-Alive Accept-Ranges bytes Content-Length 24038
GET H2	200	popper.min.js Show response cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/	20 KB 7 KB	13ms 13ms	Script application/javascript	2606:4700::6811:4104 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js Requested by Host: office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com URL: https://office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com/index.htm?c=susan_l_hartman@uhc.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:4104 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5 Security Headers Name Value Strict-Transport-Security max-age=15780000; includeSubDomains Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Referer https://office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com/index.htm?c=susan_l_hartman@uhc.com Origin https://office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com Response headers date Fri, 17 Jan 2020 15:26:34 GMT content-encoding br cf-cache-status HIT age 6769018 cf-ray 5569592c9bc8d6bd-FRA status 200 strict-transport-security max-age=15780000; includeSubDomains alt-svc h3-24=":443"; ma=86400, h3-23=":443"; ma=86400 last-modified Thu, 17 May 2018 09:25:14 GMT server cloudflare etag W/"5afd4a7a-500f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * expires Wed, 06 Jan 2021 15:26:34 GMT cache-control public, max-age=30672000 timing-allow-origin * served-in-seconds 0.001
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/	49 KB 14 KB	12ms 12ms	Script text/javascript	2001:4de0:ac19::1:b:3b Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js Requested by Host: office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com URL: https://office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com/index.htm?c=susan_l_hartman@uhc.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:3b , Netherlands, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US), Reverse DNS Software / Resource Hash 0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Referer https://office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com/index.htm?c=susan_l_hartman@uhc.com Origin https://office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com Response headers date Fri, 17 Jan 2020 15:26:34 GMT content-encoding gzip last-modified Wed, 12 Dec 2018 18:33:53 GMT access-control-allow-origin * etag "1544639633" vary Accept-Encoding x-cache HIT content-type text/javascript; charset=utf-8 status 200 cache-control public, max-age=31536000 x-hello-human Say hello back! @getBootstrapCDN on Twitter accept-ranges bytes timing-allow-origin * content-length 14038
GET DATA	200 OK	truncated /	6 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers Content-Type image/png
GET H2	200	latest.woff2 c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/	33 KB 34 KB	32ms 9ms	Font font/woff2	2a02:26f0:10c:384::356e AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2 Requested by Host: office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com URL: https://office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com/index.htm?c=susan_l_hartman@uhc.com Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:10c:384::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash 4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Referer https://office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com/index.htm?c=susan_l_hartman@uhc.com Origin https://office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com Response headers date Fri, 17 Jan 2020 15:26:35 GMT last-modified Fri, 10 Jan 2020 19:09:43 GMT access-control-allow-origin * etag "588d483e9c7d51:0" access-control-allow-methods GET,POST content-type font/woff2 status 200 cache-control public, max-age=153669 accept-ranges bytes content-length 34052 expires Sun, 19 Jan 2020 10:07:44 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery function| Popper object| bootstrap string| $c string| $current_email function| decodeCustom function| isValidEmail function| getUrlParameter string| currentEmail object| ListEntries function| extractDomain number| passwordAttempts function| handleFormSubmit function| login function| validateEmail function| isValidPassword

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

c.s-microsoft.com
cdnjs.cloudflare.com
code.jquery.com
office2edhyh9zh9u4rat.fra1.digitaloceanspaces.com
stackpath.bootstrapcdn.com
2001:4de0:ac19::1:b:3a
2001:4de0:ac19::1:b:3b
2606:4700::6811:4104
2a02:26f0:10c:384::356e
5.101.109.41
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5
0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339
34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255
3e35041d8f88ffbb90d45d992b94a3d0314a1cdb981a1bbce9a46bae851f036d
4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1