urlscan.io logo urlscan.io
SecurityTrails logo

kaleidokairi.in Open in urlscan Pro
107.154.173.119  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://kaleidokairi.in/2/mfile/
Submission: On September 22 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 5 HTTP transactions. The main IP is 107.154.173.119, located in United States and belongs to INCAPSULA, US. The main domain is kaleidokairi.in.
TLS certificate: Issued by Let's Encrypt Authority X3 on August 9th 2020. Valid for: 3 months.
This is the only time kaleidokairi.in was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OneDrive (Online) Microsoft (Consumer) Sharepoint (Online)

Domain & IP information

IP Address AS Autonomous System
1 5 107.154.173.119 19551 (INCAPSULA)
1 13.107.136.9 8068 (MICROSOFT...)
5 3
Apex Domain
Subdomains		 Transfer
5 kaleidokairi.in
kaleidokairi.in
31 KB
1 sharepoint.com
vikinggenetics-my.sharepoint.com
7 KB
5 2
Domain Requested by
5 kaleidokairi.in 1 redirects kaleidokairi.in
1 vikinggenetics-my.sharepoint.com
5 2

This site contains links to these domains. Also see Links.

Domain
go.microsoft.com
Subject Issuer Validity Valid
cpanel.kaleidokairi.in
Let's Encrypt Authority X3		 2020-08-09 -
2020-11-07		 3 months crt.sh
*.sharepoint.com
Microsoft IT TLS CA 4		 2020-01-21 -
2022-01-21		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://kaleidokairi.in/2/mfile/
Frame ID: C2F17A2E328C00132D6C4DC1B799A7CF
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://kaleidokairi.in/2/mfile HTTP 301
    https://kaleidokairi.in/2/mfile/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • meta generator /Microsoft SharePoint/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

39 kB
Transfer

160 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://kaleidokairi.in/2/mfile HTTP 301
    https://kaleidokairi.in/2/mfile/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set /
kaleidokairi.in/2/mfile/
Redirect Chain
  • https://kaleidokairi.in/2/mfile
  • https://kaleidokairi.in/2/mfile/
22 KB
10 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://kaleidokairi.in/2/mfile/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
107.154.173.119 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
107.154.173.119.ip.incapdns.net
Software
Apache /
Resource Hash
e2e6daa969211f148fad03c436ac503ccb779d1ebc392c29cfe3ecbf2b6f6aaf

Request headers

Host
kaleidokairi.in
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
visid_incap_2362597=adlhcaHKSR2HDRDbInAuMDt+al8AAAAAQUIPAAAAAAA7AZwULX+mcNRee2QQoAjI; incap_ses_989_2362597=/w95CRzsbz0m/Z6IbKK5DTx+al8AAAAAeTfoQjbTBcLYkhzlOkpnCw==; ___utmvmffuOVcYZ=AMAsyJeGonB; ___utmvbffuOVcYZ=uZj XBfOdalb: Ltw
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 22 Sep 2020 22:44:12 GMT
Server
Apache
Vary
Accept-Encoding
Content-Encoding
gzip
Keep-Alive
timeout=5, max=74
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Set-Cookie
visid_incap_2362597=adlhcaHKSR2HDRDbInAuMDt+al8AAAAAQUIPAAAAAAA7AZwULX+mcNRee2QQoAjI; expires=Wed, 22 Sep 2021 08:42:31 GMT; HttpOnly; path=/; Domain=.kaleidokairi.in incap_ses_989_2362597=/w95CRzsbz0m/Z6IbKK5DTx+al8AAAAAeTfoQjbTBcLYkhzlOkpnCw==; path=/; Domain=.kaleidokairi.in ___utmvbffuOVcYZ=a; Max-Age=0; path=/; expires=Tue, 15 Sep 2020 08:36:59 GMT ___utmvmffuOVcYZ=a; Max-Age=0; path=/; expires=Tue, 15 Sep 2020 08:36:59 GMT
X-CDN
Incapsula
Transfer-Encoding
chunked
X-Iinfo
3-70802142-70802166 SNNN RT(1600814651647 500) q(0 0 0 -1) r(3 3) U12

Redirect headers

Date
Tue, 22 Sep 2020 22:44:12 GMT
Server
Apache
Location
https://kaleidokairi.in/2/mfile/
Content-Length
240
Keep-Alive
timeout=5, max=75
Connection
Keep-Alive
Content-Type
text/html; charset=iso-8859-1
Set-Cookie
visid_incap_2362597=adlhcaHKSR2HDRDbInAuMDt+al8AAAAAQUIPAAAAAAA7AZwULX+mcNRee2QQoAjI; expires=Wed, 22 Sep 2021 08:42:31 GMT; HttpOnly; path=/; Domain=.kaleidokairi.in incap_ses_989_2362597=/w95CRzsbz0m/Z6IbKK5DTx+al8AAAAAeTfoQjbTBcLYkhzlOkpnCw==; path=/; Domain=.kaleidokairi.in ___utmvmffuOVcYZ=AMAsyJeGonB; path=/; Max-Age=900 ___utmvaffuOVcYZ=WRVDYWq; path=/; Max-Age=900 ___utmvbffuOVcYZ=uZj XBfOdalb: Ltw; path=/; Max-Age=900
X-CDN
Incapsula
X-Iinfo
3-70802142-70802166 NNNN CT(36 42 0) RT(1600814651647 131) q(0 0 1 1) r(2 3) U11
microsoft_logo.svg
kaleidokairi.in/2/mfile/naf/inf/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://kaleidokairi.in/2/mfile/naf/inf/microsoft_logo.svg
Requested by
Host: kaleidokairi.in
URL: https://kaleidokairi.in/2/mfile/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
107.154.173.119 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
107.154.173.119.ip.incapdns.net
Software
/
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Referer
https://kaleidokairi.in/2/mfile/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 22 Sep 2020 22:44:12 GMT
Content-Encoding
gzip
Last-Modified
Fri, 18 May 2018 18:17:00 GMT
X-CDN
Incapsula
Etag
"72035e39"
Content-Type
image/svg+xml
X-Iinfo
3-70802142-0 0CNN RT(1600814651647 1008) q(0 -1 -1 -1) r(0 -1)
Content-Length
1435
_Incapsula_Resource
kaleidokairi.in/ 		125 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://kaleidokairi.in/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=2&cb=1791365767
Requested by
Host: kaleidokairi.in
URL: https://kaleidokairi.in/2/mfile/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
107.154.173.119 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
107.154.173.119.ip.incapdns.net
Software
/
Resource Hash
84de589cc7a18a9bcd98d45ffd5e8d1d77bef104c97c298254a787544e8cb7af

Request headers

Referer
https://kaleidokairi.in/2/mfile/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Encoding
gzip
Cache-Control
no-cache, no-store
X-Robots-Tag
noindex
Content-Length
18008
Content-Type
application/javascript
truncated
/ 		2 KB
2 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5

Request headers

Origin
https://kaleidokairi.in
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
application/octet-stream
_Incapsula_Resource
kaleidokairi.in/ 		1 B
123 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://kaleidokairi.in/_Incapsula_Resource?SWKMTFSR=1&e=0.5808641342455789
Requested by
Host: kaleidokairi.in
URL: https://kaleidokairi.in/2/mfile/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
107.154.173.119 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
107.154.173.119.ip.incapdns.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://kaleidokairi.in/2/mfile/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Cache-Control
no-cache, no-store
X-Robots-Tag
noindex
Content-Length
1
Content-Type
text/plain
pdf.png
vikinggenetics-my.sharepoint.com/personal/datho_vikinggenetics_com_au/_layouts/15/images/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://vikinggenetics-my.sharepoint.com/personal/datho_vikinggenetics_com_au/_layouts/15/images/pdf.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.107.136.9 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
db307fcef7f95139689007d7a623b340ec21282bd421c4e4b2ba09078f230545
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://kaleidokairi.in/2/mfile/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
x-content-type-options
nosniff
request-id
9fa27c9f-b099-b000-5064-e1625b55c88c
x-powered-by
ASP.NET
sprequestguid
9fa27c9f-b099-b000-5064-e1625b55c88c
p3p
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
status
200
ms-cv
n3yin5mwALBQZOFiW1XIjA.0
content-length
6830
microsoftsharepointteamservices
16.0.0.20509
x-ms-invokeapp
1; RequireReadOnly
sprequestduration
50
last-modified
Wed, 16 Sep 2020 04:32:27 GMT
x-msedge-ref
Ref A: 8613DA58A87F42AFAF34D94816B731BF Ref B: AMS04EDGE0815 Ref C: 2020-09-22T22:44:13Z
x-frame-options
SAMEORIGIN
date
Tue, 22 Sep 2020 22:44:13 GMT
x-sharepointhealthscore
1
content-type
image/png
etag
"807f9461e28bd61:0"
accept-ranges
bytes
spiislatency
2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online) Microsoft (Consumer) Sharepoint (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes number| g_responseEnd object| FabricConfig function| setImageUrl function| _spBodyOnLoad number| g_duration number| g_iisLatency number| g_requireJSDone

3 Cookies

Domain/Path Name / Value
kaleidokairi.in/ Name: ___utmvc
Value: DKKGPNnWnGE/yTNHfop+5RdGCz6ogVvWkdLK1lYxhBl0i9/vgjBpLy+klfCOB+fOZYrxchjGfN+gG0uvf878Sr68UhbpA8A4yG1z36gPToACEAXvfhmO9OFazdwqHjKbzadzfidBT34k8d7KszbqY+sv+xlMxOJSIv4Xkk6ekiuRWOLWw2oQ6jsz3rmD8XeQ+BAKplz5wq2dwm8S95oTZO8Y9ZmfEO+Ip3MoWnU5llXT/gaMjk8GVh69MpN7/xznXEIiNxgGfadayBJI3KAtnlW7ZyyttImOnmr9CaycErtt7aoSzo2gThVQiPFC7TWDaCJ1IBI/LwU3ayxcz34XL117JZs8EqyOUhgkXkzHE324vtkm3oDOscfXi3aAcOQvhi+ZhgzwPtSDXy9cT6jqbSuuiLDbJ17Kc0U0FZWH/8fthYOSx5g9GEsLL/Ps6HNJ2rHZV1KyEQKppbSE5yrbHaY+n75hOWM/BjbN8oEwnTWeIlR1omPD6d6OiCNUEzKlZ8Od0eSiojeBT+mIbpduXq9ym5pbGTorP7lafLDeCI9lMjDnQfTi73uqYkZMbg+VHChSxRvquqEQZttc/AUwRUh6LP6RoIm4OcFMh4ljLUN4Qz6ZaPOlTU6YXclXSbe9bjZTVhcNICiGjjc6XMRK6F0v4WZD7H6+jvf3/XJGYVyk5HKkmuaThTrVbCk8ScT37AO0EQFPptIxJxgjiTpkjj4nGueFQEfTGJ1shoqg7R/Fo8sBo0qKFkpCXt3TqvhibS3+NQ79mWAPRTXZxrqU4K3V9WPRvM82mRw8JkhuWopzaIXIAlaVoaso3wY8TAy6m7WPtVHQiph3mwh1mRM1D+RIG44iZMcqtKrRQ8v2BAb2fWifnVaZxAmpF/+lcdQLo0zUKLwbNnoJb9FHq4N8VdfbZljZO2c5+X2aT8svbMwT4YgjRXJcJ5QlKh2Bd+9Mdb1RScjIW5s21voBXegMerUSx5JxoO0ppXsCKGvQlBVMJ1kypFHiRnpatY0LK8nKdZzvyju/bpdgS4qiL2NV28xPtgdn7pLnemxKR0tZ3Ej7X7nj46rN9gaoszXjnoiaxuJo9N2n1uqUckKA6qEjdrsFBA5BNfwiAqXYCkiYhB/uKaiWOL0CqKmUj7+HhLVz0P6gQch9+1fjxNEVZBxyKfwJ6/7NNLdQmwExZ0sdSMBzDoep5zsmMhw0TqCfp1KCbhKZuZVtH73Qd4zA3hS68NURfTQONIpRz9vVfHqD13Lz3dP15iic6BdhD/khviWhCwn7lRdbap9ShKlIC5HGmyLpPyebngSGbUnx8Vlu+e7ljrhtk/1w6qCIjnszSoo/QFMWUxOj8w8wku0sQOCSQIIa+ulY4/FMgobiDkwLKuQMq8be2Qd48MnTUInWLzcbcdHoHKMhJ3/ulExBXvACYjL5mFWS6vkq6OR/b/DukLg+1INyHXjIgi2DsGU6ZFX07E1BGkjl2l+hYpchGnPM9S8CJ2/BXXjAm089XwpilIFnmS5IpzBO2DXKNL2ZNLUw9JTbxUDGcGNhMlRYUDImD7E16VXygr4FtOzQunNneNMhvwGu7ACxGZmm0xOC3xDV1s7fVDB8Lg+U0bSegFRQKIOCri+6SKGQerK/bixkaWdlc3Q9MTE0NTQ2LHM9N2Y5YzdjNjY3YzhhYWE2MWFlYWU4MTgxODU5ODhkOWM3OWFjYTc5N2E0YTE2ZGFiOGE5YjhiYTE2YzlhNzU3OTdkN2Y2MzhjN2E5ODcxNzI=
.kaleidokairi.in/ Name: incap_ses_989_2362597
Value: /w95CRzsbz0m/Z6IbKK5DTx+al8AAAAAeTfoQjbTBcLYkhzlOkpnCw==
.kaleidokairi.in/ Name: visid_incap_2362597
Value: adlhcaHKSR2HDRDbInAuMDt+al8AAAAAQUIPAAAAAAA7AZwULX+mcNRee2QQoAjI