totalmortal.be Open in urlscan Pro
2a02:2350:5:102:8060:606:7927:90b5  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response totalmortal.be/mfile/	22 KB 10 KB	720ms 688ms	Document text/html	2a02:2350:5:102:8060:606:7927:90b5 ONECOM
General Check archive.org Show headers Download Go to Full URL http://totalmortal.be/mfile/ Protocol HTTP/1.1 Server 2a02:2350:5:102:8060:606:7927:90b5 , Denmark, ASN51468 (ONECOM, DK), Reverse DNS Software Apache / PHP/7.4.26 Resource Hash c6812ab9400758d4dc3cacfdfc1b2aa1fbd84af6ce680ae11b97b16838775a3b Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language fr-FR,fr;q=0.9 Response headers Date Mon, 06 Dec 2021 14:50:09 GMT Server Apache X-Powered-By PHP/7.4.26 Vary Accept-Encoding Content-Encoding gzip Content-Length 9443 Content-Type text/html; charset=UTF-8 X-Varnish 198349714 Age 0 Via 1.1 varnish (Varnish/7.0) Accept-Ranges bytes Connection keep-alive
GET H/1.1	404 Not Found	microsoft_logo.svg totalmortal.be/mfile/naf/inf/	196 B 196 B	46ms 46ms	Image text/html	2a02:2350:5:102:8060:606:7927:90b5 ONECOM
General Check archive.org Show headers Download Go to Show image Full URL http://totalmortal.be/mfile/naf/inf/microsoft_logo.svg Requested by Host: totalmortal.be URL: http://totalmortal.be/mfile/ Protocol HTTP/1.1 Server 2a02:2350:5:102:8060:606:7927:90b5 , Denmark, ASN51468 (ONECOM, DK), Reverse DNS Software Apache / Resource Hash 80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880 Request headers Accept-Language fr-FR,fr;q=0.9 Referer http://totalmortal.be/mfile/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Mon, 06 Dec 2021 14:50:10 GMT Via 1.1 varnish (Varnish/7.0) Server Apache Age 0 X-Varnish 75607098 Connection keep-alive Content-Type text/html; charset=iso-8859-1 Content-Length 196
GET DATA	200 OK	truncated /	2 KB 2 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5 Request headers Referer http://totalmortal.be/ Origin http://totalmortal.be Accept-Language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Type application/octet-stream
GET H/1.1	200 OK	pdf.png vikinggenetics-my.sharepoint.com/personal/datho_vikinggenetics_com_au/_layouts/15/images/	7 KB 8 KB	521ms 56ms	Image image/png	52.105.157.27 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://vikinggenetics-my.sharepoint.com/personal/datho_vikinggenetics_com_au/_layouts/15/images/pdf.png Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.105.157.27 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash db307fcef7f95139689007d7a623b340ec21282bd421c4e4b2ba09078f230545 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.powerapps.com *.yammer.com *.officeapps.live.com *.office.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com; Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Accept-Language fr-FR,fr;q=0.9 Referer http://totalmortal.be/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Security-Policy frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.powerapps.com *.yammer.com *.officeapps.live.com *.office.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com; X-Content-Type-Options nosniff NEL {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} X-Powered-By ASP.NET P3P CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-SharePointHealthScore 1 MS-CV oAomYZHgADCGu2HfKVXeoA.0 Content-Length 6830 MicrosoftSharePointTeamServices 16.0.0.21924 X-MS-InvokeApp 1; RequireReadOnly SPRequestDuration 13 Last-Modified Thu, 02 Dec 2021 06:13:54 GMT Server Microsoft-IIS/10.0 SPRequestGuid 61260aa0-e091-3000-86bb-61df2955dea0 X-FRAME-OPTIONS SAMEORIGIN Date Mon, 06 Dec 2021 14:50:11 GMT Strict-Transport-Security max-age=31536000 Report-To {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=189041&frontEnd=FarmDirect"}]} Content-Type image/png request-id 61260aa0-e091-3000-86bb-61df2955dea0 ETag "07d4cc843e7d71:0" Accept-Ranges bytes SPIisLatency 1

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online) Sharepoint (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler number| g_responseEnd object| FabricConfig function| setImageUrl function| _spBodyOnLoad number| g_duration number| g_iisLatency number| g_requireJSDone

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://totalmortal.be/mfile/naf/inf/microsoft_logo.svg Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

totalmortal.be
vikinggenetics-my.sharepoint.com
2a02:2350:5:102:8060:606:7927:90b5
52.105.157.27
29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
c6812ab9400758d4dc3cacfdfc1b2aa1fbd84af6ce680ae11b97b16838775a3b
db307fcef7f95139689007d7a623b340ec21282bd421c4e4b2ba09078f230545