smoss.co.ke
Open in
urlscan Pro
108.178.42.114
Malicious Activity!
Public Scan
Effective URL: https://smoss.co.ke/DocuSign/
Submission: On March 16 via manual from GB
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on February 4th 2018. Valid for: 3 months.
This is the only time smoss.co.ke was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: OneDrive (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 67.231.146.66 67.231.146.66 | 26211 (PROOFPOIN...) (PROOFPOINT-ASN-US-WEST - Proofpoint) | |
1 5 | 108.178.42.114 108.178.42.114 | 32475 (SINGLEHOP...) (SINGLEHOP-LLC - SingleHop LLC) | |
2 | 94.31.29.16 94.31.29.16 | 54104 (AS-STACKPATH) (AS-STACKPATH - netDNA) | |
1 | 216.58.210.10 216.58.210.10 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2.18.233.186 2.18.233.186 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
23 | 2.21.246.41 2.21.246.41 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
12 | 23.45.97.45 23.45.97.45 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 13.107.21.200 13.107.21.200 | 8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
1 | 54.235.98.20 54.235.98.20 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
1 | 68.232.34.200 68.232.34.200 | 15133 (EDGECAST) (EDGECAST - MCI Communications Services) | |
1 | 13.107.3.128 13.107.3.128 | 8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
1 | 191.233.80.151 191.233.80.151 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
1 | 93.184.221.200 93.184.221.200 | 15133 (EDGECAST) (EDGECAST - MCI Communications Services) | |
1 | 40.77.226.250 40.77.226.250 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
1 | 204.79.197.213 204.79.197.213 | 8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
51 | 14 |
ASN26211 (PROOFPOINT-ASN-US-WEST - Proofpoint, Inc., US)
PTR: urldefense.proofpoint.com
urldefense.proofpoint.com |
ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US)
PTR: lotus.superdnssite.com
smoss.co.ke |
ASN54104 (AS-STACKPATH - netDNA, US)
PTR: 94.31.29.16.IPYX-077437-ZYO.above.net
maxcdn.bootstrapcdn.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s07-in-f10.1e100.net
ajax.googleapis.com |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
cdn.optimizely.com |
ASN20940 (AKAMAI-ASN1, US)
PTR: a23-45-97-45.deploy.static.akamaitechnologies.com
r3.res.outlook.com |
ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
www.bing.com |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-235-98-20.compute-1.amazonaws.com
2523150420.log.optimizely.com |
ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)
swx.cdn.skype.com |
ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
b.config.skype.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
a.config.skype.com |
ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)
az725175.vo.msecnd.net |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
web.vortex.data.microsoft.com |
ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
PTR: a-0011.a-msedge.net
cid-a5792d4d072f42b8.users.storage.live.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
23 |
akamaihd.net
spoprod-a.akamaihd.net |
2 MB |
12 |
outlook.com
r3.res.outlook.com |
513 KB |
5 |
smoss.co.ke
1 redirects
smoss.co.ke |
171 KB |
3 |
skype.com
swx.cdn.skype.com b.config.skype.com a.config.skype.com |
9 KB |
2 |
optimizely.com
cdn.optimizely.com 2523150420.log.optimizely.com |
74 KB |
2 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com |
34 KB |
1 |
live.com
cid-a5792d4d072f42b8.users.storage.live.com |
475 B |
1 |
microsoft.com
web.vortex.data.microsoft.com |
693 B |
1 |
msecnd.net
az725175.vo.msecnd.net |
18 KB |
1 |
bing.com
www.bing.com |
3 KB |
1 |
googleapis.com
ajax.googleapis.com |
30 KB |
1 |
proofpoint.com
1 redirects
urldefense.proofpoint.com |
142 B |
51 | 12 |
Domain | Requested by | |
---|---|---|
23 | spoprod-a.akamaihd.net |
smoss.co.ke
|
12 | r3.res.outlook.com |
smoss.co.ke
|
5 | smoss.co.ke |
1 redirects
smoss.co.ke
|
2 | maxcdn.bootstrapcdn.com |
smoss.co.ke
|
1 | cid-a5792d4d072f42b8.users.storage.live.com |
smoss.co.ke
|
1 | web.vortex.data.microsoft.com |
smoss.co.ke
|
1 | az725175.vo.msecnd.net |
smoss.co.ke
|
1 | a.config.skype.com |
smoss.co.ke
|
1 | b.config.skype.com |
smoss.co.ke
|
1 | swx.cdn.skype.com |
smoss.co.ke
|
1 | 2523150420.log.optimizely.com |
cdn.optimizely.com
|
1 | www.bing.com |
smoss.co.ke
|
1 | cdn.optimizely.com |
smoss.co.ke
|
1 | ajax.googleapis.com |
smoss.co.ke
|
1 | urldefense.proofpoint.com | 1 redirects |
51 | 15 |
This site contains links to these domains. Also see Links.
Domain |
---|
onedrive.live.com |
go.microsoft.com |
onedrive.uservoice.com |
g.live.com |
account.microsoft.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
smoss.co.ke cPanel, Inc. Certification Authority |
2018-02-04 - 2018-05-05 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://smoss.co.ke/DocuSign/
Frame ID: E65C9CA63A7217C9E3AB5A6FA304D0D2
Requests: 51 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://urldefense.proofpoint.com/v2/url?u=https-3A__smoss.co.ke_DocuSign&d=DwMFAw&c=H50I6Bh8SW87d_bXfZP_8g&r=...
HTTP 302
https://smoss.co.ke/DocuSign HTTP 301
https://smoss.co.ke/DocuSign/ Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Optimizely (Analytics) Expand
Detected patterns
- env /^optimizely$/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Twitter Bootstrap () Expand
Detected patterns
- html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i
- script /(?:twitter\.github\.com\/bootstrap|bootstrap(?:\.js|\.min\.js))/i
Page Statistics
9 Outgoing links
These are links going to different origins than the main page.
Title: Office 365 | OneDrive
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Title: Suggest a feature idea
Search URL Search Domain Scan URL
Title: Terms
Search URL Search Domain Scan URL
Title: Privacy & Cookies
Search URL Search Domain Scan URL
Title: Developers
Search URL Search Domain Scan URL
Title: Report abuse
Search URL Search Domain Scan URL
Title: My profile
Search URL Search Domain Scan URL
Title: My account
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://urldefense.proofpoint.com/v2/url?u=https-3A__smoss.co.ke_DocuSign&d=DwMFAw&c=H50I6Bh8SW87d_bXfZP_8g&r=e29YLRbC-1IHr_CjElqDbaw-5jN-fujI3OvCbxAr54M&m=rKGrIF4F18W-gqyB6g1dWBVvyAZeJp7Cg3ZmO9FAjQ0&s=6HUDShUrtZ5ocyr8DMXB-KSNuvdfGayHQYI8IiQM73w&e=
HTTP 302
https://smoss.co.ke/DocuSign HTTP 301
https://smoss.co.ke/DocuSign/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
51 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
smoss.co.ke/DocuSign/ Redirect Chain
|
1 MB 97 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ |
118 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ |
36 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2523150420.js
cdn.optimizely.com/js/ |
210 KB 74 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
odcdeferred-1bdf6a03.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-02-23_20180226.002/ |
959 KB 219 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
odcquota-4ba9dba7.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-02-23_20180226.002/ |
190 KB 40 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
odcpushchannel-b2b93a85.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-02-23_20180226.002/ |
82 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
odrestore-13e6851e.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-02-23_20180226.002/ |
485 KB 123 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
aria-a7a17852.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-02-23_20180226.002/ |
52 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
odcdeferredcontrols-8f92476a.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-02-23_20180226.002/ |
1 MB 227 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
msajax_6fda701a.js
r3.res.outlook.com/o365/versionless/ |
58 KB 16 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shellg2strings_e0546f21.js
r3.res.outlook.com/o365/versionless/ |
32 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shellcoreming2m_b45c90f5.js
r3.res.outlook.com/o365/versionless/ |
77 KB 19 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shellconsumerdata_e381223.js
r3.res.outlook.com/o365/versionless/ |
9 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shellg2coremincss_592985a3.css
r3.res.outlook.com/o365/versionless/ |
70 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
odcdeferred.resx-5ecbc699.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-02-23_20180226.002/en-us/ |
26 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
odcextended-aec6f085.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-02-23_20180226.002/ |
55 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shellg2corecss_a28e41a3.css
r3.res.outlook.com/o365/versionless/ |
101 KB 29 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
init
www.bing.com/as/ |
6 KB 3 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
odcdeferredcontrols.resx-7f34dbef.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-02-23_20180226.002/en-us/ |
15 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
event
2523150420.log.optimizely.com/ |
2 B 677 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
odcfirstrun-46ef0197.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-02-23_20180226.002/ |
116 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shellg2coreminthemecss_fa4e44fb.css
r3.res.outlook.com/o365/versionless/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shellg2pluscss_52fe3c08.css
r3.res.outlook.com/o365/versionless/ |
163 KB 36 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
SkypeBootstrap.min.js
swx.cdn.skype.com/shared/v/1.2.29/ |
6 KB 3 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shellarialogger_3cefa9b2.js
r3.res.outlook.com/o365/versionless/ |
53 KB 14 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
905_1.2.29.0
b.config.skype.com/config/v1/SkypeLyncWebExperience/ |
7 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
905_1.2.29.0
a.config.skype.com/config/v1/SkypeLyncWebExperience/ |
7 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
jsll-4.js
az725175.vo.msecnd.net/scripts/ |
53 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
odcquota.resx-e7cc989a.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-02-23_20180226.002/en-us/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
t.js
web.vortex.data.microsoft.com/collect/v1/ |
45 B 693 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
odcfirstrun.resx-ba99cb83.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-02-23_20180226.002/en-us/ |
22 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
odcextended.resx-a107375c.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-02-23_20180226.002/en-us/ |
209 B 572 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
odcphotos-53821e85.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-02-23_20180226.002/ |
109 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
odcphotos.resx-c82fa0c3.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-02-23_20180226.002/en-us/ |
799 B 773 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
odcnotifications-9dd1c99a.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-02-23_20180226.002/ |
14 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
odcnotifications.resx-2d36a48d.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-02-23_20180226.002/en-us/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
odcexecutors-fbb1a118.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-02-23_20180226.002/ |
828 KB 174 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
odcexecutors.resx-c26e430d.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-02-23_20180226.002/en-us/ |
28 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
odcfilepicker-03a5457b.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-02-23_20180226.002/ |
109 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
MeControlMediumUserTile
cid-a5792d4d072f42b8.users.storage.live.com/users/0xa5792d4d072f42b8/myprofile/expressionprofile/profilephoto:UserTileMedium,UserTileStatic,UserTileSmall/ |
42 B 475 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
curatedfolders.gif
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-02-23_20180226.002/odsp-media/images/newfeatureexperience/v3/ |
621 KB 622 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
officelens.gif
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-02-23_20180226.002/odsp-media/images/newfeatureexperience/v3/ |
98 KB 98 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
photosview.gif
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-02-23_20180226.002/odsp-media/images/newfeatureexperience/v3/ |
451 KB 452 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ccc.JPG
smoss.co.ke/DocuSign/ |
29 KB 29 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mem.jpg
smoss.co.ke/DocuSign/ |
6 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ccc2.jpg
smoss.co.ke/DocuSign/ |
38 KB 38 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shellcoreprimeg2m_5864afef.js
r3.res.outlook.com/o365/versionless/ |
495 KB 116 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shellplusg2m_d781360c.js
r3.res.outlook.com/o365/versionless/ |
1 MB 217 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shellwofficons_ceb492ec.woff
r3.res.outlook.com/o365/versionless/ |
33 KB 33 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: OneDrive (Online)91 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| geolocation object| optly object| optimizely object| clienttelemetry_build object| Microsoft object| sct object| microsoft function| __extends undefined| __assign undefined| __rest function| Sys$Enum$parse function| Sys$Enum$toString function| $addHandler function| $removeHandler function| $get function| Type object| Sys object| Skype object| O365 object| _s1 object| awa string| behaviorKey function| NavBarDataRequest function| ConsumerShellDataGenerator object| _sc1 function| DebugUtils object| scriptsLoaded object| scriptProcessStart object| _o365su object| _o365cl object| _o365sg2cm object| _o365sg2c function| O365Shell object| scriptProcessEnd function| ComponentTypeRecord function| SourceFileRecord function| StyleFileRecord function| _dh function| _dtl function| JsonParser function| $a function| IMeFlexPaneHeaderButtonViewModel object| _j object| _ff object| _fm object| _fc object| _fce object| _fb function| timeEnd function| time function| timeStamp function| endMeasure function| startMeasure object| _o365cp object| O365Shell_Shim object| _w object| _d boolean| sb_ie boolean| sb_i6 function| _ge function| sb_st function| sb_rst function| sb_ct function| sb_gt function| sj_gx boolean| cookieGetAccess object| cookieDesc object| AutoSuggest object| Bing object| _G function| sj_ce object| sj_cook function| sk_merge object| sa_config object| sa_loc function| IPendingGetManager string| msrCryptoVersion object| msrCrypto function| MsrCryptoUtils function| _requestExecutorNative object| _o365SuiteServiceProxy function| SuiteApiInstanceManager object| _no object| _jc object| O365SuiteServiceProxy function| MejQuery object| _o365sa object| _sk object| _o365sg2p12 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.smoss.co.ke/ | Name: optimizelyEndUserId Value: oeu1521200388404r0.6603024345321615 |
|
.bing.com/ | Name: _EDGE_S Value: F=1&SID=0A9723596EF862B3196E28ED6F8A6364 |
|
.bing.com/ | Name: _SS Value: SID=0A9723596EF862B3196E28ED6F8A6364 |
|
.bing.com/ | Name: SRCHD Value: AF=NOFORM |
|
.bing.com/ | Name: MUID Value: 36441C7CBED06AF600FF17C8BFA26BD2 |
|
.bing.com/ | Name: SRCHUID Value: V=2&GUID=888F7E6145594806BAF296968AB9E594&dmnchg=1 |
|
.bing.com/ | Name: SRCHUSR Value: DOB=20180316 |
|
.smoss.co.ke/ | Name: optimizelyBuckets Value: %7B%7D |
|
.bing.com/ | Name: _EDGE_V Value: 1 |
|
.smoss.co.ke/ | Name: optimizelyPendingLogEvents Value: %5B%5D |
|
www.bing.com/ | Name: MUIDB Value: 36441C7CBED06AF600FF17C8BFA26BD2 |
|
.smoss.co.ke/ | Name: optimizelySegments Value: %7B%222494520540%22%3A%22gc%22%2C%222495980660%22%3A%22direct%22%2C%222517180188%22%3A%22false%22%2C%222528250207%22%3A%22none%22%7D |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
2523150420.log.optimizely.com
a.config.skype.com
ajax.googleapis.com
az725175.vo.msecnd.net
b.config.skype.com
cdn.optimizely.com
cid-a5792d4d072f42b8.users.storage.live.com
maxcdn.bootstrapcdn.com
r3.res.outlook.com
smoss.co.ke
spoprod-a.akamaihd.net
swx.cdn.skype.com
urldefense.proofpoint.com
web.vortex.data.microsoft.com
www.bing.com
108.178.42.114
13.107.21.200
13.107.3.128
191.233.80.151
2.18.233.186
2.21.246.41
204.79.197.213
216.58.210.10
23.45.97.45
40.77.226.250
54.235.98.20
67.231.146.66
68.232.34.200
93.184.221.200
94.31.29.16
029e6334920000089e9c8fef273849f64b527b11b3bd885688a1f894532caff5
03edc279e927e0f656470f15884d2b01d083530a219df286b410ef6f1ee798f4
09540b7e192a5313362ddf8648b1ba48919e0fe3473aa03e194be362813896b9
0a57958dac14aea8ed09167919bdfcf06654870e44aca5b4a8eae2b1bc8ea4cf
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1b4246229846001e9459d5216ac74d1ee9435123a7f31f1285a39cf19ac8b0b5
26afe5c517df89ec32c8368652fa5e98aa8d8c869c103f62292c6defeb64cebe
33d94a5fdd75ecf9ce20a8bd90ed22ad026d4b6574df04d5c2894a53fd5263a3
3668bf16b755e969b473a7a384ad52f90135c13bd79b4344e27931d7d7f52cc0
36744e1a30a3684b67601c3970c71f11cedc54b5010ceec8b522154ebe2f8e2c
3958fece1642849af03160b2968908de5d479b5f31bedc606eb13ab7340a3c4c
3d613bffff1f4fe2d353e9325b1c0667da56dd2b9646c26ab806689a4ba81596
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
4cb0daa4a9df7190ad09c5d65e9835d5972fd0b84380f886c706ebf9128d293c
4ed951f87bcd97b6122beae9ed747b74a9355aec5db45db717c88b8cf243533b
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
570bd1821426813c7b33339bebe54aa743588f58bee01575ac49008fc848c356
5a4844b3021d68cf68db77dfce228a229f7b4ea5d39eb2a8511c62b73cf6c34d
5df985d6d6ae5e8d655a6241b8ed8a6ef1511b88adbd2d46ae88718432240b9c
66892b61254163e734654f8f5fb6146218701b1324b3c809304302730e8d75fe
67807f15dc22717f3f7a48aa2b96b3a601cf161560d24a03aa1e654e212e2c0b
67de2769d67ccee0ba0fee0294c2ef4c6a4cb2c3a5f7975af42b9b4809b536fa
68aff1d6b95045615c21ba6ac21c81f604f4cd2e8faef0dd3a320f42f78849c7
693cee4deb8072141c835c0053ae02d7824d8c8f4f21e823d5bf914e4e7b1a47
6cd436c65e346a8f5438c2676640aaf72366e4a78cfce7309a474d019155c164
6e1f5036adf2892066b87af4c687ed4ab3b614b92fe4caa82db680453e888cff
739b901c9da02ede7f993172b2338897c4cd05a2234075f7944d74935b733867
752594c1673ddab65e68e4ef2d2607b6141468660625e62414e53bb711ef0803
75d4a208a56f0e7ad9f738b70cb7783a85e4f3e0380f838c78656097f25f52c2
8014b138022368b006d261fa5b36d1149076e28f42f5669f4a28de544f0142d1
87fd5d2ec44a68e04e85effb1f2c0eb4f391fe7d4f659a3409b3e8fc9cebbbf1
880b1a7c1141c00c7c1c858f508ea57bc02776da8ae5e8dda04dbbc0ab06086b
95777173acad672e08e9d946824900650a445d20a567c77bcd7b13a32084b1d4
957a50e64277da1507d4c581b590f33c43258fe949273f46da9fa197bcf947d3
a123fea0f5eb6a32c3aa436179b184752f61cbe8d0533056b003ee247512a912
a20616bf30707ec860d2773c3e28c186b6b82ea950dc68dfb94763a184f20b90
a5ecfb696a78030872a66cee7e260312ad4e9231bb50bac9667dc3e803cced4e
b463c6509ea53ed19fc402fee8a215dda6c58ad2c588bba1a1074465b1900301
c1560919a3a8dfa05f771c2bdd706bc3a3849d4a6a0c318860acce4bf417bd5b
c37e2c670b28fade6314d69b0c24c6fb702d3c56d5ee7d9bec7677fb7b256134
c9a4dd7b50eeb82a90457cb58ab085c427494828b3c8c8b5649c6c51b3c65175
d0378cae08b13606e0398c8875b1d778b748bdf279e8f8bfba0ef58acb0d8475
d9d7fa18893c67e3c92c8621a64842f8eb1398c43625dce425e1c772ac260ec6
da5f0b5b06ec6d7322e008683434b06daf091c6dcd70059a9e6995c37a01de54
dc6fc38722d92a1856e7ce580bc807a7ee32bf187b087a9895a00b36b995a67a
ddf3c76e34b9f015315e80273fa301cded697df07d9a3080375462aabc282aff
e3f40f2ba08bb05da8d6e8be6a49486892c123461570fb03e070f07580b23d23
f4c7cecc5728079f818e241991b6268fc5c02b9b5b93f02faf5962790912ea10
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c