sophosteam.com Open in urlscan Pro
52.56.69.186  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response sophosteam.com/	8 KB 3 KB	659ms 590ms	Document text/html	52.56.69.186 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://sophosteam.com/?em=f44f8261-2c66-4fbd-92b9-54d0d786a6cd&id=a64e585b-b4b5-4738-cc35-93a60af4a1cf Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.56.69.186 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-56-69-186.eu-west-2.compute.amazonaws.com Software nginx / Resource Hash 63ba4190b06f8dfc74a363e5ba2fff27c521880a00b3dab8da7429dcdbc6cf9f Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority sophosteam.com :scheme https :path /?em=f44f8261-2c66-4fbd-92b9-54d0d786a6cd&id=a64e585b-b4b5-4738-cc35-93a60af4a1cf pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 02 Dec 2020 04:05:24 GMT content-type text/html; charset=UTF-8 set-cookie AWSALB=+hwlCKEcuac7IHQQXEQOSWHNquj4mzEvBXalgvwMUAh9i+tSnkzjaSzmmJlfIRfRi42sFAslSEd/vYUyP/ijDlvRtL82j8gxrK/eH6T7DR/pPq/up6xwLA0wTiK7; Expires=Wed, 09 Dec 2020 04:05:23 GMT; Path=/ AWSALBCORS=+hwlCKEcuac7IHQQXEQOSWHNquj4mzEvBXalgvwMUAh9i+tSnkzjaSzmmJlfIRfRi42sFAslSEd/vYUyP/ijDlvRtL82j8gxrK/eH6T7DR/pPq/up6xwLA0wTiK7; Expires=Wed, 09 Dec 2020 04:05:23 GMT; Path=/; SameSite=None; Secure laravel_session=eyJpdiI6InlIeHE0bys4QUNKT2tCWUEzQis3WGc9PSIsInZhbHVlIjoiWjBmcnZrY3Exblo4QUNFOUR6VCs2OWxwQWxtTHl0SmFvM2ExK0pCcDNxYnY2TVozMGhWYkpEaCswTVh5VnBiWCIsIm1hYyI6IjZhYWZjNmFhOTliNjYwMmEzNWE2NzQ0YTk2ZjIwZDMzZTM0MTM4M2VmOWJhOTU5Y2FmNGIzNzkyYzE5NzBkNGIifQ%3D%3D; expires=Wed, 02-Dec-2020 06:05:24 GMT; Max-Age=7200; path=/; httponly server nginx vary Accept-Encoding cache-control no-cache, private x-content-type-options nosniff x-frame-options SAMEORIGIN x-xss-protection 1; mode=block content-encoding gzip
GET		style.css sophosteam.com/	0 0
GET H2	200	css fonts.googleapis.com/	2 KB 528 B	17ms 16ms	Stylesheet text/css	2a00:1450:4001:814::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Lato:400,700,900&display=swap Requested by Host: sophosteam.com URL: https://sophosteam.com/?em=f44f8261-2c66-4fbd-92b9-54d0d786a6cd&id=a64e585b-b4b5-4738-cc35-93a60af4a1cf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash ba76edb43d3f178a00aa4f704ad4518599d1338cd10e6d1355fa1ee5c2538227 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://sophosteam.com/?em=f44f8261-2c66-4fbd-92b9-54d0d786a6cd&id=a64e585b-b4b5-4738-cc35-93a60af4a1cf User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff last-modified Wed, 02 Dec 2020 02:28:21 GMT server ESF link <https://fonts.gstatic.com>; rel=preconnect; crossorigin date Wed, 02 Dec 2020 04:05:24 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 expires Wed, 02 Dec 2020 04:05:24 GMT
GET H2	200	png sophosteam.com/media/officelogo/	19 KB 20 KB	41ms 41ms	Image image/png	52.56.69.186 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://sophosteam.com/media/officelogo/png Requested by Host: sophosteam.com URL: https://sophosteam.com/?em=f44f8261-2c66-4fbd-92b9-54d0d786a6cd&id=a64e585b-b4b5-4738-cc35-93a60af4a1cf Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.56.69.186 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-56-69-186.eu-west-2.compute.amazonaws.com Software nginx / Resource Hash 7d9efb8a4223c5a409e3fec8a1e496601acca6ad97af9958904571fc7112c63c Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://sophosteam.com/?em=f44f8261-2c66-4fbd-92b9-54d0d786a6cd&id=a64e585b-b4b5-4738-cc35-93a60af4a1cf User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 02 Dec 2020 04:05:24 GMT x-content-type-options nosniff server nginx x-frame-options SAMEORIGIN content-length 19842 x-xss-protection 1; mode=block content-type image/png
GET H2	200	svg sophosteam.com/media/arrow/	778 B 1 KB	45ms 45ms	Image image/svg+xml	52.56.69.186 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://sophosteam.com/media/arrow/svg Requested by Host: sophosteam.com URL: https://sophosteam.com/?em=f44f8261-2c66-4fbd-92b9-54d0d786a6cd&id=a64e585b-b4b5-4738-cc35-93a60af4a1cf Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.56.69.186 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-56-69-186.eu-west-2.compute.amazonaws.com Software nginx / Resource Hash 7b9549b57de2ab1aafdb799323c9aa144df986d3945afb53628f81e478fcce51 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://sophosteam.com/?em=f44f8261-2c66-4fbd-92b9-54d0d786a6cd&id=a64e585b-b4b5-4738-cc35-93a60af4a1cf User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 02 Dec 2020 04:05:24 GMT x-content-type-options nosniff server nginx x-frame-options SAMEORIGIN content-length 778 x-xss-protection 1; mode=block content-type image/svg+xml
GET H2	200	jpg sophosteam.com/media/background/	344 KB 345 KB	56ms 56ms	Image image/jpeg	52.56.69.186 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://sophosteam.com/media/background/jpg Requested by Host: sophosteam.com URL: https://sophosteam.com/?em=f44f8261-2c66-4fbd-92b9-54d0d786a6cd&id=a64e585b-b4b5-4738-cc35-93a60af4a1cf Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.56.69.186 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-56-69-186.eu-west-2.compute.amazonaws.com Software nginx / Resource Hash a3efa3c84ac6e1ca48798af1a83d6f02078276607f1447d765c3a1da936d9301 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://sophosteam.com/?em=f44f8261-2c66-4fbd-92b9-54d0d786a6cd&id=a64e585b-b4b5-4738-cc35-93a60af4a1cf User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 02 Dec 2020 04:05:24 GMT x-content-type-options nosniff server nginx x-frame-options SAMEORIGIN content-length 352114 x-xss-protection 1; mode=block content-type image/jpeg

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

sophosteam.com

URL

https://sophosteam.com/style.css

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			sophosteam.com/	1970-01-19 14:31:26	Name: AWSALBCORS Value: WJvNwONG4qsRl7LAriKfJcHRIRHNYFLAjrjmz9gO93olbX4rumIsDRtiisZeScTq1mWT+wqWLnZmVSmtTYRIwqrrNU7A1AYVRTDhuKsLbk6XuwMYtMv6cWWNKDwf
			sophosteam.com/	1970-01-19 14:31:26	Name: AWSALB Value: WJvNwONG4qsRl7LAriKfJcHRIRHNYFLAjrjmz9gO93olbX4rumIsDRtiisZeScTq1mWT+wqWLnZmVSmtTYRIwqrrNU7A1AYVRTDhuKsLbk6XuwMYtMv6cWWNKDwf
			sophosteam.com/	1970-01-19 14:21:29	Name: laravel_session Value: eyJpdiI6IkNZVVwvRHRFM01lc1h0aGl3OVZcL2xuZz09IiwidmFsdWUiOiJ3U1JaNEtsdm95VTlvUFVRUytuK2ZWTmY0czR6c0tram1raCtwOWo2VHF1N0VFYlJzZHJVTFpjOEhsUndreElcLyIsIm1hYyI6ImFkMGY5YmI0YTM5ZjAyNzgwMGE1NzE1MDg1MjUyM2YxYWY4ZGMxYTk1NWJlYzk5YmM2ZWRhN2IxNmIwZmRlMDQifQ%3D%3D

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
sophosteam.com
sophosteam.com
2a00:1450:4001:814::200a
52.56.69.186
63ba4190b06f8dfc74a363e5ba2fff27c521880a00b3dab8da7429dcdbc6cf9f
7b9549b57de2ab1aafdb799323c9aa144df986d3945afb53628f81e478fcce51
7d9efb8a4223c5a409e3fec8a1e496601acca6ad97af9958904571fc7112c63c
a3efa3c84ac6e1ca48798af1a83d6f02078276607f1447d765c3a1da936d9301
ba76edb43d3f178a00aa4f704ad4518599d1338cd10e6d1355fa1ee5c2538227