nelleinletapt.buzz Open in urlscan Pro
2606:4700:3030::681f:588a  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request office365.htm Show response nelleinletapt.buzz/CD/	3 KB 2 KB	244ms 211ms	Document text/html	2606:4700:3030::681f:588a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://nelleinletapt.buzz/CD/office365.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::681f:588a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 541779a95a5c00f1a9ee4868685233b7c271494dd838a8ee67efc195f174c0cf Request headers :method GET :authority nelleinletapt.buzz :scheme https :path /CD/office365.htm pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 11 Dec 2020 23:19:21 GMT content-type text/html set-cookie __cfduid=d10946bf09520d8c9233bb5a2d101a0251607728761; expires=Sun, 10-Jan-21 23:19:21 GMT; path=/; domain=.nelleinletapt.buzz; HttpOnly; SameSite=Lax; Secure last-modified Tue, 17 Sep 2019 03:57:42 GMT cf-cache-status DYNAMIC cf-request-id 06f5b3239200003250a8835000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=PwCcl8wJC52Hv%2F0F4g7Dz5JA6KxeWJENc35UQ05uDKS8yqTDPT0O1zhXJgo3SQ%2BXqweJsGnidUJvV87UQgR0UEXAz38jTvyj9n9VV8zdcxGWlXHlTDXYYSx4KPxCPa4%3D"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 6002ee18eeae3250-FRA content-encoding br
GET H2	200	1g0f0h.css d1di2lzuh97fh2.cloudfront.net/files/1g/1g0/	486 KB 49 KB	125ms 45ms	Stylesheet text/css	65.9.76.22 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d1di2lzuh97fh2.cloudfront.net/files/1g/1g0/1g0f0h.css?ph=7d9bff33bd Requested by Host: nelleinletapt.buzz URL: https://nelleinletapt.buzz/CD/office365.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.76.22 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 2aab7eceb12d61aac26a9dde36be343896e4f44ba8001d308136ce1506247df6 Request headers Referer https://nelleinletapt.buzz/CD/office365.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 20 Nov 2020 01:58:01 GMT content-encoding gzip last-modified Wed, 23 Sep 2020 06:55:57 GMT server AmazonS3 age 1891282 etag "a0e95bead30d865e0568e839bea91130" x-cache Hit from cloudfront content-type text/css via 1.1 8e4700eb43d0f5579f360cfc02e71fad.cloudfront.net (CloudFront) cache-control max-age=31536000 x-amz-cf-pop AMS1-C1 accept-ranges bytes content-length 50226 x-amz-cf-id P1d6lnYvn2K-_LuSgpSpK03xp44-X6yHVmCSBhfJ7Em7wiPEbYO1vQ==
GET H2	200	Gary-blog-pic-4.jpg www.silversands.co.uk/wp-content/uploads/	282 KB 283 KB	211ms 62ms	Image image/jpeg	139.59.164.69 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://www.silversands.co.uk/wp-content/uploads/Gary-blog-pic-4.jpg Requested by Host: nelleinletapt.buzz URL: https://nelleinletapt.buzz/CD/office365.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 139.59.164.69 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS 85851-69010.cloudwaysapps.com Software nginx / Resource Hash e79ea45960041eb3fb8ac3a29d8f0a77b19f7231d1869bc78d248d9252797090 Request headers Referer https://nelleinletapt.buzz/CD/office365.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 11 Dec 2020 23:19:22 GMT last-modified Fri, 18 Aug 2017 14:15:12 GMT server nginx etag "5996f670-46968" content-type image/jpeg cache-control max-age=2592000 accept-ranges bytes content-length 289128 expires Sun, 10 Jan 2021 23:19:22 GMT
GET H2	200	office_365_business_plans-1.jpg www.itrw.net/wp-content/uploads/2017/06/	63 KB 64 KB	404ms 128ms	Image image/jpeg	108.163.237.178 SINGLEHOP-LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.itrw.net/wp-content/uploads/2017/06/office_365_business_plans-1.jpg Requested by Host: nelleinletapt.buzz URL: https://nelleinletapt.buzz/CD/office365.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.163.237.178 Chicago, United States, ASN32475 (SINGLEHOP-LLC, US), Reverse DNS chi-node69.websitehostserver.net Software / Resource Hash 99608f173de31d768ddf688c20eaf197384e31b12c686921845c6ca0d3bd466d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://nelleinletapt.buzz/CD/office365.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 11 Dec 2020 23:19:21 GMT x-content-type-options nosniff last-modified Mon, 26 Jun 2017 14:42:57 GMT etag "fd6a-59511d71-0;;;" x-frame-options SAMEORIGIN content-type image/jpeg vary User-Agent cache-control max-age=31536000, public strict-transport-security max-age=31536000; includeSubDomains; preload accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000 content-length 64874 expires Sat, 11 Dec 2021 23:19:21 GMT
GET H2	404	MS365.jpg nelleinletapt.buzz/CD/url(https:/pjcourses.com/wp-content/uploads/2019/05/	315 B 315 B	218ms 217ms	Image text/html	2606:4700:3030::681f:588a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://nelleinletapt.buzz/CD/url(https:/pjcourses.com/wp-content/uploads/2019/05/MS365.jpg Requested by Host: nelleinletapt.buzz URL: https://nelleinletapt.buzz/CD/office365.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::681f:588a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3 Request headers Referer https://nelleinletapt.buzz/CD/office365.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 11 Dec 2020 23:19:22 GMT content-encoding br cf-cache-status EXPIRED nel {"report_to":"cf-nel","max_age":604800} server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=m6L48N%2Fbrx7PwRhek9RROZjG9OOBNCdVqeuESoaZGKVodYNGVE6Mm4kjUyqdId69h1M1Fvba1Fqq%2Fnt4C%2Bk%2F6RrseRSqt1JSN43ragaNYF8nUZ7nee80NI7QiEw2rbI%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=iso-8859-1 cache-control max-age=14400 cf-ray 6002ee1a59463250-FRA cf-request-id 06f5b3247700003250e30fd000000001
GET H2	200	3ncu8u.woff2 d1di2lzuh97fh2.cloudfront.net/files/3n/3nc/	63 KB 63 KB	105ms 40ms	Font application/font-woff2	65.9.76.22 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d1di2lzuh97fh2.cloudfront.net/files/3n/3nc/3ncu8u.woff2 Requested by Host: d1di2lzuh97fh2.cloudfront.net URL: https://d1di2lzuh97fh2.cloudfront.net/files/1g/1g0/1g0f0h.css?ph=7d9bff33bd Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.76.22 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 1d8f5280afb7f4fa0db5cdfcb751e180788b0f0da1488309c4243ebff11a9591 Request headers Origin https://nelleinletapt.buzz Referer https://d1di2lzuh97fh2.cloudfront.net/files/1g/1g0/1g0f0h.css?ph=7d9bff33bd User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 11 Dec 2020 20:26:49 GMT via 1.1 bdba42cf1410fb617eeb4ffd3e0b9cb7.cloudfront.net (CloudFront) age 10354 x-cache Hit from cloudfront content-length 64320 last-modified Wed, 23 Sep 2020 07:20:33 GMT server AmazonS3 etag "d26871e8149b5759f814fd3c7a4f784b" vary Origin,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods GET content-type application/font-woff2 access-control-allow-origin * cache-control max-age=31536000 x-amz-cf-pop AMS1-C1 accept-ranges bytes x-amz-cf-id yNYpGLFcbDMxz40SEBss-9MkhxQQhhzeULiReaJiroIkJw7dXbvS8w==

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.nelleinletapt.buzz/	1970-01-19 15:18:40	Name: __cfduid Value: d10946bf09520d8c9233bb5a2d101a0251607728761

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

d1di2lzuh97fh2.cloudfront.net
nelleinletapt.buzz
www.itrw.net
www.silversands.co.uk
108.163.237.178
139.59.164.69
2606:4700:3030::681f:588a
65.9.76.22
1d8f5280afb7f4fa0db5cdfcb751e180788b0f0da1488309c4243ebff11a9591
2aab7eceb12d61aac26a9dde36be343896e4f44ba8001d308136ce1506247df6
541779a95a5c00f1a9ee4868685233b7c271494dd838a8ee67efc195f174c0cf
99608f173de31d768ddf688c20eaf197384e31b12c686921845c6ca0d3bd466d
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e79ea45960041eb3fb8ac3a29d8f0a77b19f7231d1869bc78d248d9252797090