sentinellandscape.com Open in urlscan Pro
192.185.187.120  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request PDF.html Show response sentinellandscape.com/	6 KB 3 KB	251ms 237ms	Document text/html	192.185.187.120 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://sentinellandscape.com/PDF.html Protocol HTTP/1.1 Server 192.185.187.120 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS ns1520.websitewelcome.com Software Apache / Resource Hash a1321c683eb9dd988ae6895af5755489233c40366cfdf267683ebdf60eb5592f Request headers Host sentinellandscape.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 01 Dec 2020 14:56:00 GMT Server Apache Upgrade h2,h2c Connection Upgrade, Keep-Alive Last-Modified Mon, 30 Nov 2020 13:49:03 GMT Accept-Ranges bytes Vary Accept-Encoding Content-Encoding gzip Content-Length 2291 Keep-Alive timeout=5, max=75 Content-Type text/html
GET H2	200	folder-security.jpg www.firmex.com/wp-content/uploads/2012/09/	29 KB 29 KB	473ms 167ms	Image image/jpeg	104.196.242.45 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.firmex.com/wp-content/uploads/2012/09/folder-security.jpg Requested by Host: sentinellandscape.com URL: http://sentinellandscape.com/PDF.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.196.242.45 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS 45.242.196.104.bc.googleusercontent.com Software nginx / Resource Hash 616e6889f9c47edcff6a0a3e08893dc45b1b47b4646fa219ff4a4755671fab5c Request headers Referer http://sentinellandscape.com/PDF.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 01 Dec 2020 14:56:00 GMT last-modified Tue, 31 Jan 2017 03:02:36 GMT server nginx etag "588ffe4c-72a8" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 29352
GET H2	200	Microsoft_logo_525x525.png www.zubairalexander.com/blog/wp-content/uploads/2019/06/	34 KB 34 KB	9672ms 170ms	Image image/png	173.247.240.5 INMOTION
General Check archive.org Show headers Download Go to Show image Full URL https://www.zubairalexander.com/blog/wp-content/uploads/2019/06/Microsoft_logo_525x525.png Requested by Host: sentinellandscape.com URL: http://sentinellandscape.com/PDF.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 173.247.240.5 Santa Monica, United States, ASN22611 (INMOTION, US), Reverse DNS secure265.inmotionhosting.com Software Apache / Resource Hash 064a849a6e7926151ed7c977867d663516329ee8ec6333c89e61b52847af3076 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN, SAMEORIGIN, SAMEORIGIN Request headers Referer http://sentinellandscape.com/PDF.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 01 Dec 2020 14:56:09 GMT x-content-type-options nosniff last-modified Wed, 12 Jun 2019 18:14:20 GMT server Apache x-frame-options SAMEORIGIN, SAMEORIGIN, SAMEORIGIN content-type image/png accept-ranges bytes content-length 34716
GET H2	200	pdf-logo-100025338-large.jpg giftraining.files.wordpress.com/2017/10/	10 KB 10 KB	55ms 15ms	Image image/webp	192.0.72.21 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://giftraining.files.wordpress.com/2017/10/pdf-logo-100025338-large.jpg?w=640 Requested by Host: sentinellandscape.com URL: http://sentinellandscape.com/PDF.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.72.21 San Francisco, United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 9435d12592be67694114757c437ba4191b99d76a26a7f281aa388a4515fb604b Security Headers Name Value X-Content-Type-Options nosniff, nosniff, nosniff Request headers Referer http://sentinellandscape.com/PDF.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-nc HIT ams 21 np date Tue, 01 Dec 2020 14:56:00 GMT x-content-type-options nosniff, nosniff, nosniff last-modified Wed, 11 Oct 2017 10:53:35 GMT server nginx vary Accept, Origin content-type image/webp access-control-allow-origin https://giftraining.wordpress.com x-orig-src 0_imageresize accept-ranges bytes content-length 9924 access-control-allow-credentials true expires Fri, 25 Dec 2020 13:54:42 GMT
GET H2	200	outlook.png www.techielass.com/wp-content/uploads/2020/07/	60 KB 61 KB	100ms 32ms	Image image/png	2606:4700:3034::ac43:a476 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.techielass.com/wp-content/uploads/2020/07/outlook.png Requested by Host: sentinellandscape.com URL: http://sentinellandscape.com/PDF.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:a476 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 14c210b7105de73c67547f72274c75bac01caf06976b1cad1687a1c6c66a46c2 Request headers Referer http://sentinellandscape.com/PDF.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 01 Dec 2020 14:56:00 GMT cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 14342 content-length 61343 cf-request-id 06c066b5150000dfb7cd926000000001 last-modified Mon, 23 Nov 2020 07:57:12 GMT server cloudflare etag "ef9f-5b4c18aaf8600" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=mj6qlJTWHdYfv1ZP%2BZ70iDYHyck1wo6SRxtpe6yzu4HQooLgiQXp4FxSFdBM1nC2lkWF7u3mbu4FTx3aUAkfh9XrBrTBukuhEVxefQTp9aA6hGAzrPBFTv49KXb9zJA%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 5fada701adc7dfb7-FRA cf-bgj csam-hash
GET H2	200	Office-365-Logo.jpg discover.alpenacc.edu/images/	58 KB 58 KB	480ms 226ms	Image image/jpeg	50.28.0.27 LIQUIDWEB
General Check archive.org Show headers Download Go to Show image Full URL https://discover.alpenacc.edu/images/Office-365-Logo.jpg Requested by Host: sentinellandscape.com URL: http://sentinellandscape.com/PDF.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 50.28.0.27 Lansing, United States, ASN32244 (LIQUIDWEB, US), Reverse DNS slb01.revize1.com Software Microsoft-IIS/10.0 / ASP.NET Resource Hash 64907bac65b3d6080557dbc26e2cc1ec94433cce8a4b7ad63dcf7ba4b959f948 Request headers Referer http://sentinellandscape.com/PDF.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 01 Dec 2020 14:55:59 GMT last-modified Wed, 01 Apr 2020 16:12:22 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET etag "a3fb4a53408d61:0" content-type image/jpeg accept-ranges bytes content-length 59082

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

discover.alpenacc.edu
giftraining.files.wordpress.com
sentinellandscape.com
www.firmex.com
www.techielass.com
www.zubairalexander.com
104.196.242.45
173.247.240.5
192.0.72.21
192.185.187.120
2606:4700:3034::ac43:a476
50.28.0.27
064a849a6e7926151ed7c977867d663516329ee8ec6333c89e61b52847af3076
14c210b7105de73c67547f72274c75bac01caf06976b1cad1687a1c6c66a46c2
616e6889f9c47edcff6a0a3e08893dc45b1b47b4646fa219ff4a4755671fab5c
64907bac65b3d6080557dbc26e2cc1ec94433cce8a4b7ad63dcf7ba4b959f948
9435d12592be67694114757c437ba4191b99d76a26a7f281aa388a4515fb604b
a1321c683eb9dd988ae6895af5755489233c40366cfdf267683ebdf60eb5592f