sharepointstoragefile.us-south.cf.appdomain.cloud Open in urlscan Pro
169.46.89.154  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://libertyways.com/wp-includes/redirect.htm Page URL
2. https://shareppointfile.us-south.cf.appdomain.cloud/home/ Page URL
3. https://sharepointstoragefile.us-south.cf.appdomain.cloud/owa/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	redirect.htm Show response libertyways.com/wp-includes/	469 B 500 B	1007ms 268ms	Document text/html	118.27.99.88 INTERQ GMO Internet
General Check archive.org Show headers Download Go to Full URL https://libertyways.com/wp-includes/redirect.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 118.27.99.88 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP), Reverse DNS www124.conoha.ne.jp Software nginx / Resource Hash 792a91d835dc3126d69e98727cf369f5ecc25fb0b814f1e16c908d54ccea72f3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority libertyways.com :scheme https :path /wp-includes/redirect.htm pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers server nginx date Mon, 07 Jun 2021 06:45:06 GMT content-type text/html; charset=UTF-8 last-modified Tue, 25 May 2021 05:49:55 GMT etag W/"1d5-5c3211873a8bc" x-xss-protection 1; mode=block x-content-type-options nosniff x-nginx-cache EXPIRED content-encoding gzip
GET H/1.1	200 OK	/ shareppointfile.us-south.cf.appdomain.cloud/home/	455 B 634 B	602ms 150ms	Document text/html	169.47.124.25 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://shareppointfile.us-south.cf.appdomain.cloud/home/ Requested by Host: libertyways.com URL: https://libertyways.com/wp-includes/redirect.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 169.47.124.25 Ashburn, United States, ASN36351 (SOFTLAYER, US), Reverse DNS 19.7c.2fa9.ip4.static.sl-reverse.com Software Apache / Resource Hash Request headers Host shareppointfile.us-south.cf.appdomain.cloud Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://libertyways.com/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Referer https://libertyways.com/ Response headers X-Backside-Transport OK OK Connection Keep-Alive Transfer-Encoding chunked Content-Encoding gzip Content-Type text/html Date Mon, 07 Jun 2021 06:45:07 GMT Etag "1c7-5c3129e2b0380-gzip" Last-Modified Mon, 24 May 2021 12:33:34 GMT Server Apache Vary Accept-Encoding X-Global-Transaction-ID 2a9437b760bdc073915ba0ef
GET H/1.1	200 OK	Primary Request / Show response sharepointstoragefile.us-south.cf.appdomain.cloud/owa/	109 KB 34 KB	634ms 227ms	Document text/html	169.46.89.154 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://sharepointstoragefile.us-south.cf.appdomain.cloud/owa/ Requested by Host: shareppointfile.us-south.cf.appdomain.cloud URL: https://shareppointfile.us-south.cf.appdomain.cloud/home/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 169.46.89.154 Irving, United States, ASN36351 (SOFTLAYER, US), Reverse DNS 9a.59.2ea9.ip4.static.sl-reverse.com Software Apache / Resource Hash 0fec2b9adb443ae3241e7a087f3c0c3bf5cc9db4bf9ac8c68db51c4fa0827966 Request headers Host sharepointstoragefile.us-south.cf.appdomain.cloud Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site same-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://shareppointfile.us-south.cf.appdomain.cloud/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Referer https://shareppointfile.us-south.cf.appdomain.cloud/ Response headers X-Backside-Transport OK OK Connection Keep-Alive Transfer-Encoding chunked Content-Encoding gzip Content-Type text/html Date Mon, 07 Jun 2021 06:45:07 GMT Etag "1b2cf-5c29756ffacc0-gzip" Last-Modified Tue, 18 May 2021 09:28:59 GMT Server Apache Vary Accept-Encoding X-Global-Transaction-ID 0d28ff5e60bdc0737151948f
GET H/1.1	404 Not Found	myscr584876.js.download sharepointstoragefile.us-south.cf.appdomain.cloud/owa/index_files/	0 0	163ms 162ms	Script text/html	169.46.89.154 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://sharepointstoragefile.us-south.cf.appdomain.cloud/owa/index_files/myscr584876.js.download Requested by Host: sharepointstoragefile.us-south.cf.appdomain.cloud URL: https://sharepointstoragefile.us-south.cf.appdomain.cloud/owa/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 169.46.89.154 Irving, United States, ASN36351 (SOFTLAYER, US), Reverse DNS 9a.59.2ea9.ip4.static.sl-reverse.com Software Apache / Resource Hash Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host sharepointstoragefile.us-south.cf.appdomain.cloud Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Sec-Fetch-Mode no-cors Accept */* Cache-Control no-cache Sec-Fetch-Dest script Referer https://sharepointstoragefile.us-south.cf.appdomain.cloud/owa/ Connection keep-alive Referer https://sharepointstoragefile.us-south.cf.appdomain.cloud/owa/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers X-Backside-Transport FAIL FAIL Date Mon, 07 Jun 2021 06:45:08 GMT X-Global-Transaction-ID 0d28ff5e60bdc074369664d7 Server Apache Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=iso-8859-1
GET H2	200	jquery-1.9.1.js Show response code.jquery.com/	262 KB 78 KB	27ms 8ms	Script application/javascript	2001:4de0:ac18::1:a:1a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-1.9.1.js Requested by Host: sharepointstoragefile.us-south.cf.appdomain.cloud URL: https://sharepointstoragefile.us-south.cf.appdomain.cloud/owa/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash 7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40 Request headers Referer https://sharepointstoragefile.us-south.cf.appdomain.cloud/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Mon, 07 Jun 2021 06:45:08 GMT content-encoding gzip last-modified Fri, 24 Oct 2014 00:16:07 GMT server nginx etag W/"54499a47-4185d" vary Accept-Encoding x-hw 1623048308.dop106.fr8.t,1623048308.cds248.fr8.hn,1623048308.cds250.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 79506
GET DATA	200 OK	truncated /	9 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5757e602c5502496be5d7ec17d19cd1d97dc216497dfc6a7654f2b6396e546f4 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	13 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 7f672d39017602a1ef5b484477bb7743904515691c3a0242993934d1dd833ece Request headers Referer User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers Content-Type image/png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sharepoint (Online)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated string| feedUpdateResponse object| feedUpdateSplit number| x string| che function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
libertyways.com
sharepointstoragefile.us-south.cf.appdomain.cloud
shareppointfile.us-south.cf.appdomain.cloud
118.27.99.88
169.46.89.154
169.47.124.25
2001:4de0:ac18::1:a:1a
0fec2b9adb443ae3241e7a087f3c0c3bf5cc9db4bf9ac8c68db51c4fa0827966
5757e602c5502496be5d7ec17d19cd1d97dc216497dfc6a7654f2b6396e546f4
792a91d835dc3126d69e98727cf369f5ecc25fb0b814f1e16c908d54ccea72f3
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40
7f672d39017602a1ef5b484477bb7743904515691c3a0242993934d1dd833ece