urlscan.io logo urlscan.io
SecurityTrails logo

7skf0ex65u.live Open in urlscan Pro
178.128.246.40  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://hotel-chruez.ch/wp-content/themes/twentytwentytwo/styles
Effective URL: https://7skf0ex65u.live/v7am2/dc/index.php?246CAC1DA7170193271443=p4YVNFEJZUX&bin=
Submission Tags: falconsandbox
Submission: On October 06 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 9 HTTP transactions. The main IP is 178.128.246.40, located in Amsterdam, Netherlands and belongs to DIGITALOCEAN-ASN, US. The main domain is 7skf0ex65u.live.
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 27th 2022. Valid for: 3 months.
This is the only time 7skf0ex65u.live was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sharepoint (Online)

Domain & IP information

IP Address AS Autonomous System
1 2 185.178.195.52 207143 (HOSTTECH-AS)
3 8 178.128.246.40 14061 (DIGITALOC...)
1 13.225.78.39 16509 (AMAZON-02)
2 18.235.188.227 14618 (AMAZON-AES)
9 5
Apex Domain
Subdomains		 Transfer
8 7skf0ex65u.live
7skf0ex65u.live
3 MB
2 fpapi.io
botd.fpapi.io — Cisco Umbrella Rank: 262028
1 KB
2 hotel-chruez.ch
hotel-chruez.ch
614 B
1 openfpcdn.io
openfpcdn.io — Cisco Umbrella Rank: 35383
7 KB
9 4
Domain Requested by
8 7skf0ex65u.live 3 redirects hotel-chruez.ch
7skf0ex65u.live
2 botd.fpapi.io openfpcdn.io
7skf0ex65u.live
2 hotel-chruez.ch 1 redirects
1 openfpcdn.io 7skf0ex65u.live
9 4

This site contains no links.

Subject Issuer Validity Valid
hotel-chruez.ch
cPanel, Inc. Certification Authority		 2022-09-01 -
2022-11-30		 3 months crt.sh
7skf0ex65u.live
cPanel, Inc. Certification Authority		 2022-09-27 -
2022-12-26		 3 months crt.sh
openfpcdn.io
Amazon		 2022-02-24 -
2023-03-25		 a year crt.sh
botd.fpapi.io
Amazon		 2022-03-16 -
2023-04-14		 a year crt.sh

This page contains 1 frames:

Primary Page: https://7skf0ex65u.live/v7am2/dc/index.php?246CAC1DA7170193271443=p4YVNFEJZUX&bin=
Frame ID: D46E1897EA98E521BB4C6A8864ADC869
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Shαred Docυment Cloυd

Page URL History Show full URLs

  1. https://hotel-chruez.ch/wp-content/themes/twentytwentytwo/styles HTTP 301
    https://hotel-chruez.ch/wp-content/themes/twentytwentytwo/styles/ Page URL
  2. https://7skf0ex65u.live/v7am2 HTTP 301
    https://7skf0ex65u.live/v7am2/ HTTP 302
    https://7skf0ex65u.live/v7am2/MBLJIWEX/RHKDMWZQAWCOGI/?bin= Page URL
  3. https://7skf0ex65u.live/v7am2/MBLJIWEX/RHKDMWZQAWCOGI/79DD94398E9448B/Rbe2aa7fe2e390595caad71dabBE2A... HTTP 302
    https://7skf0ex65u.live/v7am2/dc/index.php?246CAC1DA7170193271443=p4YVNFEJZUX&bin= Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

3015 kB
Transfer

3197 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://hotel-chruez.ch/wp-content/themes/twentytwentytwo/styles HTTP 301
    https://hotel-chruez.ch/wp-content/themes/twentytwentytwo/styles/ Page URL
  2. https://7skf0ex65u.live/v7am2 HTTP 301
    https://7skf0ex65u.live/v7am2/ HTTP 302
    https://7skf0ex65u.live/v7am2/MBLJIWEX/RHKDMWZQAWCOGI/?bin= Page URL
  3. https://7skf0ex65u.live/v7am2/MBLJIWEX/RHKDMWZQAWCOGI/79DD94398E9448B/Rbe2aa7fe2e390595caad71dabBE2AA7FE2E390595CAAD71DAB?FCF7C05BE3193271443=FCF7C05BE3193271443-12a5778f5656289ae57338fe2c907da77b339425&bin= HTTP 302
    https://7skf0ex65u.live/v7am2/dc/index.php?246CAC1DA7170193271443=p4YVNFEJZUX&bin= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://hotel-chruez.ch/wp-content/themes/twentytwentytwo/styles HTTP 301
  • https://hotel-chruez.ch/wp-content/themes/twentytwentytwo/styles/
Request Chain 1
  • https://7skf0ex65u.live/v7am2 HTTP 301
  • https://7skf0ex65u.live/v7am2/ HTTP 302
  • https://7skf0ex65u.live/v7am2/MBLJIWEX/RHKDMWZQAWCOGI/?bin=

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
hotel-chruez.ch/wp-content/themes/twentytwentytwo/styles/
Redirect Chain
  • https://hotel-chruez.ch/wp-content/themes/twentytwentytwo/styles
  • https://hotel-chruez.ch/wp-content/themes/twentytwentytwo/styles/
231 B
391 B 		Document
General
Check archive.org
Download Go to
Full URL
https://hotel-chruez.ch/wp-content/themes/twentytwentytwo/styles/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.178.195.52 , Germany, ASN207143 (HOSTTECH-AS, CH),
Reverse DNS
mx32585.mail.hostserv.eu
Software
nginx /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Thu, 06 Oct 2022 12:21:41 GMT
server
nginx
vary
Accept-Encoding
x-content-type-options
nosniff
x-nginx-upstream-cache-status
EXPIRED
x-server-powered-by
Engintron
x-xss-protection
1; mode=block

Redirect headers

content-length
273
content-type
text/html; charset=iso-8859-1
date
Thu, 06 Oct 2022 12:21:41 GMT
location
https://hotel-chruez.ch/wp-content/themes/twentytwentytwo/styles/
server
nginx
x-content-type-options
nosniff
x-nginx-upstream-cache-status
MISS
x-server-powered-by
Engintron
x-xss-protection
1; mode=block
/
7skf0ex65u.live/v7am2/MBLJIWEX/RHKDMWZQAWCOGI/
Redirect Chain
  • https://7skf0ex65u.live/v7am2
  • https://7skf0ex65u.live/v7am2/
  • https://7skf0ex65u.live/v7am2/MBLJIWEX/RHKDMWZQAWCOGI/?bin=
2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://7skf0ex65u.live/v7am2/MBLJIWEX/RHKDMWZQAWCOGI/?bin=
Requested by
Host: hotel-chruez.ch
URL: https://hotel-chruez.ch/wp-content/themes/twentytwentytwo/styles/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
178.128.246.40 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache /
Resource Hash
29b6253baceb831782a81492d709e42ec5348483a147b62c579a31c014247e9f

Request headers

Referer
https://hotel-chruez.ch/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Access-Control-Allow-Headers
X-Requested-With
Access-Control-Allow-Methods
GET, POST
Access-Control-Allow-Origin
*
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Thu, 06 Oct 2022 12:21:42 GMT
Keep-Alive
timeout=5, max=98
Server
Apache
Transfer-Encoding
chunked

Redirect headers

Accept-CH
Sec-CH-UA-Platform-Version
Access-Control-Allow-Headers
X-Requested-With
Access-Control-Allow-Methods
GET, POST
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Thu, 06 Oct 2022 12:21:42 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=99
Location
MBLJIWEX/RHKDMWZQAWCOGI/?bin=
Pragma
no-cache
Server
Apache
Transfer-Encoding
chunked
v0.1
openfpcdn.io/botd/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://openfpcdn.io/botd/v0.1
Requested by
Host: 7skf0ex65u.live
URL: https://7skf0ex65u.live/v7am2/MBLJIWEX/RHKDMWZQAWCOGI/?bin=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.78.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-78-39.fra2.r.cloudfront.net
Software
CloudFront /
Resource Hash
d661db00e3bbb388796ff77a4020d8dca3ec169fda5bcd35025b6a63e6d26347
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://7skf0ex65u.live/
Origin
https://7skf0ex65u.live
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 06 Oct 2022 09:25:57 GMT
via
1.1 96c1c36adc76f99239fd3220e5be7e6a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
age
10577
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
server
CloudFront
etag
W/"5KqoidcxiD9rCNQJsghpkCGPfjg"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=582399, s-maxage=10685
x-amz-cf-id
HM63XGUe538k5rUzL54UTuc-4cS4u63uY8f1bnRbgG6bQ-8sVHgwuA==
detect
botd.fpapi.io/api/v1/ 		44 B
384 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://botd.fpapi.io/api/v1/detect?version=0.1.24
Requested by
Host: openfpcdn.io
URL: https://openfpcdn.io/botd/v0.1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.235.188.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-235-188-227.compute-1.amazonaws.com
Software
nginx /
Resource Hash
c4f6c2937628c00785397816762b40d3f31c28506a26420461344f494ccf6f6c

Request headers

Referer
https://7skf0ex65u.live/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 06 Oct 2022 12:21:42 GMT
server
nginx
x-amzn-trace-id
Root=1-633ec856-1ae985954723dcbc6f7cd81b
access-control-allow-methods
POST, GET, OPTIONS
content-type
application/octet-stream
access-control-allow-origin
https://7skf0ex65u.live
access-control-allow-credentials
true
access-control-allow-headers
Accept, Content-Type, Origin, Content-Length, Accept-Encoding, Authorization, Auth-Subscriptions, Botd-Password
content-length
44
verify
botd.fpapi.io/api/v1/ 		326 B
672 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://botd.fpapi.io/api/v1/verify
Requested by
Host: 7skf0ex65u.live
URL: https://7skf0ex65u.live/v7am2/MBLJIWEX/RHKDMWZQAWCOGI/?bin=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.235.188.227 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-235-188-227.compute-1.amazonaws.com
Software
nginx /
Resource Hash
cee88c372892a8fcbeb2ae6375deb5df5785bbf2d37f218fd1e105d38c598b3f

Request headers

Referer
https://7skf0ex65u.live/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Thu, 06 Oct 2022 12:21:42 GMT
server
nginx
x-amzn-trace-id
Root=1-633ec856-5e9388a93cdfa898162ec369
access-control-allow-methods
POST, GET, OPTIONS
content-type
application/json; charset=utf-8
access-control-allow-origin
https://7skf0ex65u.live
access-control-allow-credentials
true
access-control-allow-headers
Accept, Content-Type, Origin, Content-Length, Accept-Encoding, Authorization, Auth-Subscriptions, Botd-Password
content-length
326
Primary Request index.php
7skf0ex65u.live/v7am2/dc/
Redirect Chain
  • https://7skf0ex65u.live/v7am2/MBLJIWEX/RHKDMWZQAWCOGI/79DD94398E9448B/Rbe2aa7fe2e390595caad71dabBE2AA7FE2E390595CAAD71DAB?FCF7C05BE3193271443=FCF7C05BE3193271443-12a5778f5656289ae57338fe2c907da77b3...
  • https://7skf0ex65u.live/v7am2/dc/index.php?246CAC1DA7170193271443=p4YVNFEJZUX&bin=
396 KB
398 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://7skf0ex65u.live/v7am2/dc/index.php?246CAC1DA7170193271443=p4YVNFEJZUX&bin=
Requested by
Host: 7skf0ex65u.live
URL: https://7skf0ex65u.live/v7am2/MBLJIWEX/RHKDMWZQAWCOGI/?bin=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
178.128.246.40 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache /
Resource Hash
6af7969cfa8c937f996ba86876c4c8732af86745f10c64349913ed2335e2030d

Request headers

Referer
https://7skf0ex65u.live/v7am2/MBLJIWEX/RHKDMWZQAWCOGI/?bin=
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Access-Control-Allow-Headers
X-Requested-With
Access-Control-Allow-Methods
GET, POST
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Thu, 06 Oct 2022 12:21:42 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=100
Pragma
no-cache
Server
Apache
Transfer-Encoding
chunked

Redirect headers

Access-Control-Allow-Headers
X-Requested-With
Access-Control-Allow-Methods
GET, POST
Access-Control-Allow-Origin
*
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Thu, 06 Oct 2022 12:21:42 GMT
Keep-Alive
timeout=5, max=97
Server
Apache
Transfer-Encoding
chunked
location
../../../dc/index.php?246CAC1DA7170193271443=p4YVNFEJZUX&bin=
sto.css
7skf0ex65u.live/v7am2/dc/core/ 		115 KB
115 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://7skf0ex65u.live/v7am2/dc/core/sto.css
Requested by
Host: 7skf0ex65u.live
URL: https://7skf0ex65u.live/v7am2/dc/index.php?246CAC1DA7170193271443=p4YVNFEJZUX&bin=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
178.128.246.40 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache /
Resource Hash
67bf296b8b663328cc8438add32ab0a912da13bed22d0ff3e670f36136bbc942

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://7skf0ex65u.live/v7am2/dc/index.php?246CAC1DA7170193271443=p4YVNFEJZUX&bin=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date
Thu, 06 Oct 2022 12:21:43 GMT
Last-Modified
Sun, 17 Jan 2021 13:42:18 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
117748
upos.png
7skf0ex65u.live/v7am2/dc/assets/img/ 		371 KB
371 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://7skf0ex65u.live/v7am2/dc/assets/img/upos.png
Requested by
Host: 7skf0ex65u.live
URL: https://7skf0ex65u.live/v7am2/dc/index.php?246CAC1DA7170193271443=p4YVNFEJZUX&bin=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
178.128.246.40 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache /
Resource Hash
46459d47077a3bb651b6c6789eefeae6b200c5f135bcc4f56c26c00738f6fd78

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://7skf0ex65u.live/v7am2/dc/index.php?246CAC1DA7170193271443=p4YVNFEJZUX&bin=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date
Thu, 06 Oct 2022 12:21:43 GMT
Last-Modified
Sat, 02 Jan 2021 00:28:32 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
379754
otto.mp4
7skf0ex65u.live/v7am2/dc/assets/img/ 		2 MB
2 MB 		Media
General
Check archive.org
Download Go to
Full URL
https://7skf0ex65u.live/v7am2/dc/assets/img/otto.mp4
Requested by
Host: 7skf0ex65u.live
URL: https://7skf0ex65u.live/v7am2/dc/shared=geaxWYOIfr5vu2n3i9N6dygRsFJPUhlGDTwcMQo4mzHDGEWXUJOBPLYSQRZNCMkE8Z7qLbVSjt0KXpCAB1&select=geaxWYOIfr5vu2n3i9N6dygRsFJPUhlSDmtOAfuExpsJZGDTwcMQo4mzHkE8Z7qLbVSjt0KXpCAB1XBTJAKEZSWCRU
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
178.128.246.40 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache /
Resource Hash
7c5db3b485ea59e82668a069b198b2ace17e93e647a3c1193460962642e9da71

Request headers

Referer
https://7skf0ex65u.live/v7am2/dc/shared=geaxWYOIfr5vu2n3i9N6dygRsFJPUhlGDTwcMQo4mzHDGEWXUJOBPLYSQRZNCMkE8Z7qLbVSjt0KXpCAB1&select=geaxWYOIfr5vu2n3i9N6dygRsFJPUhlSDmtOAfuExpsJZGDTwcMQo4mzHkE8Z7qLbVSjt0KXpCAB1XBTJAKEZSWCRU
Accept-Encoding
identity;q=1, *;q=0
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Range
bytes=0-

Response headers

Date
Thu, 06 Oct 2022 12:21:43 GMT
Last-Modified
Fri, 01 Jan 2021 23:53:16 GMT
Server
Apache
Content-Type
video/mp4
Content-Range
bytes 0-2170632/2170633
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=95
Content-Length
2170633
truncated
/ 		97 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
adaf3053ce0a6e8660848cda230b2011ea97c3be1c624007aa41c848060058a0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		186 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
45db266dfd1410936dd7354ddaadfdb959e411bd5a83cc5bec2ae277287fb227

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		12 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7714ed2a6ea8f89723bbf00ff763dd01a671464a75987a92cc7b9e74c10489e7

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		6 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1fb6fbcba9e3968b37ef9715e8cddb9ff3f909307226612e1dc328c4bbfc652c

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		10 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
aa663481109570f23c44f8015f82bf0b7bdcdacaf659af9fb1e89f55a3442266

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		7 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
db307fcef7f95139689007d7a623b340ec21282bd421c4e4b2ba09078f230545

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		44 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ba67f5cbb26d1c913527475815f0c8d4c4519b092a7544f015cc021360240275

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type
image/gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sharepoint (Online)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| lazyLoad function| delete_cookie function| startTimer

3 Cookies

Domain/Path Name / Value
7skf0ex65u.live/v7am2/MBLJIWEX/RHKDMWZQAWCOGI Name: botd-request-id
Value: 01GEPKX4KZEQ4QWFWRTWGR7ZCB
7skf0ex65u.live/ Name: PHPSESSID
Value: 96430ee1a3cd47fbb9a8fd42cc2a8b35
7skf0ex65u.live/ Name: session_token
Value: tok

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block