auth-sharepoint-microsoft-365-dtg7uf8sdus7s7gw7s7sd.glitch.me Open in urlscan Pro
54.198.39.102  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response auth-sharepoint-microsoft-365-dtg7uf8sdus7s7gw7s7sd.glitch.me/	66 KB 67 KB	269ms 148ms	Document text/html	54.198.39.102 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL http://auth-sharepoint-microsoft-365-dtg7uf8sdus7s7gw7s7sd.glitch.me/?s7rmn=8pwwpnr4f7gylclwnahqqmd3fo0motoafmxth9j3lbo5o2cbvb=4tjagpkooyxggou88etmfk8gqifew3e5srragsknmggjnw3kgp=emfby2ackyn1msoq1oqcppnhmxyyjvptej7yf38i5gfblquxzv=ugyvd8m4nu8cpcvybnobeivtmtuqdvvoyctabq3bbfsyyypv4c=nbrsf9qciwkesjxytruqapj62xu4epou7archovic1sxud1sok=pv28fsf3zhw8fziywoejdwhpxsxcmwualqdrevgza6jnae5q9k Protocol HTTP/1.1 Server 54.198.39.102 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-198-39-102.compute-1.amazonaws.com Software AmazonS3 / Resource Hash a8367255f0cd2ec59be0ee11fd8e496ea038146c3ed46edd42f231556e84a201 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection keep-alive Content-Length 67642 Content-Type text/html; charset=utf-8 Date Thu, 07 Apr 2022 13:19:43 GMT accept-ranges bytes cache-control no-cache etag "cf9b21f956fa8283fee9562176909302" last-modified Mon, 04 Apr 2022 15:17:31 GMT server AmazonS3 x-amz-id-2 UDV9PSoHx28+mfdYqWXvMTptjMAhAjuobQScnQyrUiEjMYpvQgHYL0qpkuJ505AFNc6fsYzhzGk= x-amz-request-id 4TYQVYQ8CC92857Y x-amz-version-id MvUclrgXXLpG5Msp.m.o.TS18Ou66bv5
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 30 KB	66ms 20ms	Script text/javascript	2a00:1450:4001:80f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: auth-sharepoint-microsoft-365-dtg7uf8sdus7s7gw7s7sd.glitch.me URL: http://auth-sharepoint-microsoft-365-dtg7uf8sdus7s7gw7s7sd.glitch.me/?s7rmn=8pwwpnr4f7gylclwnahqqmd3fo0motoafmxth9j3lbo5o2cbvb=4tjagpkooyxggou88etmfk8gqifew3e5srragsknmggjnw3kgp=emfby2ackyn1msoq1oqcppnhmxyyjvptej7yf38i5gfblquxzv=ugyvd8m4nu8cpcvybnobeivtmtuqdvvoyctabq3bbfsyyypv4c=nbrsf9qciwkesjxytruqapj62xu4epou7archovic1sxud1sok=pv28fsf3zhw8fziywoejdwhpxsxcmwualqdrevgza6jnae5q9k Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://auth-sharepoint-microsoft-365-dtg7uf8sdus7s7gw7s7sd.glitch.me/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 05 Apr 2022 23:12:54 GMT content-encoding gzip x-content-type-options nosniff age 137210 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30028 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 05 Apr 2023 23:12:54 GMT
GET H2	200	smtp.js Show response smtpjs.com/v3/	871 B 1 KB	111ms 31ms	Script application/javascript	109.169.71.112 IOMART-AS
General Check archive.org Show headers Download Go to Full URL https://smtpjs.com/v3/smtp.js Requested by Host: auth-sharepoint-microsoft-365-dtg7uf8sdus7s7gw7s7sd.glitch.me URL: http://auth-sharepoint-microsoft-365-dtg7uf8sdus7s7gw7s7sd.glitch.me/?s7rmn=8pwwpnr4f7gylclwnahqqmd3fo0motoafmxth9j3lbo5o2cbvb=4tjagpkooyxggou88etmfk8gqifew3e5srragsknmggjnw3kgp=emfby2ackyn1msoq1oqcppnhmxyyjvptej7yf38i5gfblquxzv=ugyvd8m4nu8cpcvybnobeivtmtuqdvvoyctabq3bbfsyyypv4c=nbrsf9qciwkesjxytruqapj62xu4epou7archovic1sxud1sok=pv28fsf3zhw8fziywoejdwhpxsxcmwualqdrevgza6jnae5q9k Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 109.169.71.112 Altrincham, United Kingdom, ASN20860 (IOMART-AS, GB), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash 1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776 Request headers Referer http://auth-sharepoint-microsoft-365-dtg7uf8sdus7s7gw7s7sd.glitch.me/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 07 Apr 2022 13:19:43 GMT last-modified Tue, 10 Nov 2020 17:17:51 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET etag "162f436b85b7d61:0" content-type application/javascript access-control-allow-origin * accept-ranges bytes content-length 871
GET H2	200	microsoft-logo.png sherwoodestate.sharepoint.com/_layouts/15/images/	3 KB 4 KB	1753ms 1073ms	Image image/png	13.107.136.9 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://sherwoodestate.sharepoint.com/_layouts/15/images/microsoft-logo.png Requested by Host: auth-sharepoint-microsoft-365-dtg7uf8sdus7s7gw7s7sd.glitch.me URL: http://auth-sharepoint-microsoft-365-dtg7uf8sdus7s7gw7s7sd.glitch.me/?s7rmn=8pwwpnr4f7gylclwnahqqmd3fo0motoafmxth9j3lbo5o2cbvb=4tjagpkooyxggou88etmfk8gqifew3e5srragsknmggjnw3kgp=emfby2ackyn1msoq1oqcppnhmxyyjvptej7yf38i5gfblquxzv=ugyvd8m4nu8cpcvybnobeivtmtuqdvvoyctabq3bbfsyyypv4c=nbrsf9qciwkesjxytruqapj62xu4epou7archovic1sxud1sok=pv28fsf3zhw8fziywoejdwhpxsxcmwualqdrevgza6jnae5q9k Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 13.107.136.9 Redmond, United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / ASP.NET Resource Hash 825de044d5ac6442a094ff95099f9f67e9249a8110a2fbd57128285776632adb Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer http://auth-sharepoint-microsoft-365-dtg7uf8sdus7s7gw7s7sd.glitch.me/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Thu, 07 Apr 2022 13:19:45 GMT x-content-type-options nosniff x-powered-by ASP.NET x-cache CONFIG_NOCACHE p3p CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" content-length 3331 microsoftsharepointteamservices 16.0.0.22323 x-ms-invokeapp 1; RequireReadOnly sprequestduration 7 last-modified Sat, 26 Mar 2022 02:45:47 GMT x-msedge-ref Ref A: D48F1256D4144C3DACAD7D0F4D08E2B7 Ref B: AMS04EDGE3211 Ref C: 2022-04-07T13:19:44Z etag "80ff8e98bb40d81:0" content-type image/png cache-control max-age=31536000 accept-ranges bytes spiislatency 1
GET H2	200	pdf.png firebasestorage.googleapis.com/v0/b/linktopage-c7fd6.appspot.com/o/	2 KB 3 KB	836ms 788ms	Image image/png	2a00:1450:4001:830::200a GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://firebasestorage.googleapis.com/v0/b/linktopage-c7fd6.appspot.com/o/pdf.png?alt=media&token=e38389d8-f2df-4361-b16e-be24fb901ffa Requested by Host: auth-sharepoint-microsoft-365-dtg7uf8sdus7s7gw7s7sd.glitch.me URL: http://auth-sharepoint-microsoft-365-dtg7uf8sdus7s7gw7s7sd.glitch.me/?s7rmn=8pwwpnr4f7gylclwnahqqmd3fo0motoafmxth9j3lbo5o2cbvb=4tjagpkooyxggou88etmfk8gqifew3e5srragsknmggjnw3kgp=emfby2ackyn1msoq1oqcppnhmxyyjvptej7yf38i5gfblquxzv=ugyvd8m4nu8cpcvybnobeivtmtuqdvvoyctabq3bbfsyyypv4c=nbrsf9qciwkesjxytruqapj62xu4epou7archovic1sxud1sok=pv28fsf3zhw8fziywoejdwhpxsxcmwualqdrevgza6jnae5q9k Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software UploadServer / Resource Hash 87088728aa5265bdae51196d599bf7085cd02ba9b21cb9f8539aa8cd17445190 Request headers accept-language de-DE,de;q=0.9 Referer http://auth-sharepoint-microsoft-365-dtg7uf8sdus7s7gw7s7sd.glitch.me/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Thu, 07 Apr 2022 13:19:44 GMT x-guploader-uploadid ADPycdtzYLn8TX1b67lXd3y_9GTqG9zDmT8zrpSnjn6RbjC0n1S9uoBBDE40aPk0E4av3LyAzwXFBnvEpbJ71D3yZyPZCg x-goog-storage-class STANDARD x-goog-metageneration 1 x-goog-stored-content-encoding identity content-disposition inline; filename*=utf-8''pdf.png alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2006 last-modified Wed, 16 Feb 2022 12:00:37 GMT server UploadServer etag "e0908d9dd3ddd13a6a19977b009d05c9" x-goog-hash crc32c=2FkUww==, md5=4JCNndPd0TpqGZd7AJ0FyQ== x-goog-generation 1645012837504007 cache-control private, max-age=0 x-goog-stored-content-length 2006 x-goog-meta-firebasestoragedownloadtokens e38389d8-f2df-4361-b16e-be24fb901ffa accept-ranges bytes content-type image/png expires Thu, 07 Apr 2022 13:19:44 GMT
GET H/1.1	200 OK	/ Show response api.ipify.org/	24 B 301 B	320ms 101ms	XHR application/json	52.20.78.240 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.ipify.org/?format=json Requested by Host: ajax.googleapis.com URL: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 52.20.78.240 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-20-78-240.compute-1.amazonaws.com Software Cowboy / Resource Hash 6f68153f638155eb464c6170752aaef22b5774877b3b74c8d7d0d06189247ed1 Request headers Accept application/json, text/javascript, */*; q=0.01 Referer http://auth-sharepoint-microsoft-365-dtg7uf8sdus7s7gw7s7sd.glitch.me/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Date Thu, 07 Apr 2022 13:19:44 GMT Via 1.1 vegur Server Cowboy Vary Origin Content-Type application/json Access-Control-Allow-Origin http://auth-sharepoint-microsoft-365-dtg7uf8sdus7s7gw7s7sd.glitch.me Connection keep-alive Content-Length 24
GET DATA	200 OK	truncated /	2 KB 2 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5 Request headers Referer http://auth-sharepoint-microsoft-365-dtg7uf8sdus7s7gw7s7sd.glitch.me/ Origin http://auth-sharepoint-microsoft-365-dtg7uf8sdus7s7gw7s7sd.glitch.me accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Content-Type application/octet-stream

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online) Sharepoint (Online) Microsoft (Consumer)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| $ function| jQuery object| Email number| count number| inputCount number| flag undefined| email undefined| password string| ip function| validateEmail function| stopProgress function| errorMsg function| onFormSubmit number| g_duration number| g_iisLatency number| g_cpuDuration number| g_queryCount number| g_queryDuration number| g_requireJSDone

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: http://auth-sharepoint-microsoft-365-dtg7uf8sdus7s7gw7s7sd.glitch.me/?s7rmn=8pwwpnr4f7gylclwnahqqmd3fo0motoafmxth9j3lbo5o2cbvb=4tjagpkooyxggou88etmfk8gqifew3e5srragsknmggjnw3kgp=emfby2ackyn1msoq1oqcppnhmxyyjvptej7yf38i5gfblquxzv=ugyvd8m4nu8cpcvybnobeivtmtuqdvvoyctabq3bbfsyyypv4c=nbrsf9qciwkesjxytruqapj62xu4epou7archovic1sxud1sok=pv28fsf3zhw8fziywoejdwhpxsxcmwualqdrevgza6jnae5q9k(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: http://auth-sharepoint-microsoft-365-dtg7uf8sdus7s7gw7s7sd.glitch.me/?s7rmn=8pwwpnr4f7gylclwnahqqmd3fo0motoafmxth9j3lbo5o2cbvb=4tjagpkooyxggou88etmfk8gqifew3e5srragsknmggjnw3kgp=emfby2ackyn1msoq1oqcppnhmxyyjvptej7yf38i5gfblquxzv=ugyvd8m4nu8cpcvybnobeivtmtuqdvvoyctabq3bbfsyyypv4c=nbrsf9qciwkesjxytruqapj62xu4epou7archovic1sxud1sok=pv28fsf3zhw8fziywoejdwhpxsxcmwualqdrevgza6jnae5q9k(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: http://auth-sharepoint-microsoft-365-dtg7uf8sdus7s7gw7s7sd.glitch.me/?s7rmn=8pwwpnr4f7gylclwnahqqmd3fo0motoafmxth9j3lbo5o2cbvb=4tjagpkooyxggou88etmfk8gqifew3e5srragsknmggjnw3kgp=emfby2ackyn1msoq1oqcppnhmxyyjvptej7yf38i5gfblquxzv=ugyvd8m4nu8cpcvybnobeivtmtuqdvvoyctabq3bbfsyyypv4c=nbrsf9qciwkesjxytruqapj62xu4epou7archovic1sxud1sok=pv28fsf3zhw8fziywoejdwhpxsxcmwualqdrevgza6jnae5q9k(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://smtpjs.com/v3/smtp.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
api.ipify.org
auth-sharepoint-microsoft-365-dtg7uf8sdus7s7gw7s7sd.glitch.me
firebasestorage.googleapis.com
sherwoodestate.sharepoint.com
smtpjs.com
109.169.71.112
13.107.136.9
2a00:1450:4001:80f::200a
2a00:1450:4001:830::200a
52.20.78.240
54.198.39.102
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776
29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5
6f68153f638155eb464c6170752aaef22b5774877b3b74c8d7d0d06189247ed1
825de044d5ac6442a094ff95099f9f67e9249a8110a2fbd57128285776632adb
87088728aa5265bdae51196d599bf7085cd02ba9b21cb9f8539aa8cd17445190
a8367255f0cd2ec59be0ee11fd8e496ea038146c3ed46edd42f231556e84a201