mail.vicgroup.su Open in urlscan Pro
79.174.80.75  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response mail.vicgroup.su/	56 KB 26 KB	268ms 98ms	Document text/html	79.174.80.75 AS-REG
General Check archive.org Show headers Download Go to Full URL https://mail.vicgroup.su/?rid=vDjnrqS Protocol H2 Security TLS 1.3, , AES_128_GCM Server 79.174.80.75 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS 79-174-80-75.cloudvps.regruhosting.ru Software / Resource Hash 3628627b4bf75907d2d4f9dc74313684268be09060a5dabb85dcee7c36bb2db1 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers content-encoding gzip content-type text/html; charset=utf-8 date Tue, 12 Nov 2024 22:09:53 GMT vary Accept-Encoding x-server gophish
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET DATA	200 OK	truncated /	8 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET		segoeui-regular.ttf 188.121.118.90/owa/auth/15.2.986/themes/resources/	0 0
GET		segoeui-semilight.ttf 188.121.118.90/owa/auth/15.2.986/themes/resources/	0 0
GET H2	200	favicon.ico 188.121.118.90/owa/auth/15.2.986/themes/resources/	8 KB 8 KB	314ms 115ms	Other image/x-icon	188.121.118.90 ABRARVAN-AS AbrAr...
General Check archive.org Show headers Download Go to Full URL https://188.121.118.90/owa/auth/15.2.986/themes/resources/favicon.ico Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 188.121.118.90 , Iran, Islamic Republic Of, ASN202468 (ABRARVAN-AS AbrArvan CDN and IaaS, IR), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash cf0808a61ec571e0c4975663903b288009d55502ac0445d9948983b339a5cf6e Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://mail.vicgroup.su/ Response headers cache-control public,max-age=2592000 etag "0ed62fb129bd71:0" request-id 8d204653-e324-49b5-816c-0001c5d30244 accept-ranges bytes content-length 7886 date Tue, 12 Nov 2024 18:39:52 GMT content-type image/x-icon last-modified Fri, 27 Aug 2021 07:13:06 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

188.121.118.90

URL

https://188.121.118.90/owa/auth/15.2.986/themes/resources/segoeui-regular.ttf

Domain

188.121.118.90

URL

https://188.121.118.90/owa/auth/15.2.986/themes/resources/segoeui-semilight.ttf

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| initLogon function| redir function| shw function| hd function| clkSecExp function| kdSecExp function| clkSec function| clkBsc function| checkSubmit function| clkLgn function| clkRtry function| clkReLgn function| gbid function| IsOwaPremiumBrowser function| hres function| LogoffMime function| addPerfMarker number| a_fRC number| g_fFcs function| IsMimeCtlInst function| RndMimeCtl function| RndMimeCtlHlpr object| mainLogonDiv string| mainLogonDivClassName function| setPlaceholderText function| showPasswordClick

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			mail.vicgroup.su/	1969-12-31 23:59:59	Name: cookieTest Value: 1

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	warning	URL: https://mail.vicgroup.su/?rid=vDjnrqS Message: [DOM] Found 2 elements with non-unique id #password: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	verbose	URL: https://mail.vicgroup.su/?rid=vDjnrqS Message: [DOM] Input elements should have autocomplete attributes (suggested: "new-password"): (More info: https://goo.gl/9p2vKq) %o
recommendation	verbose	URL: https://mail.vicgroup.su/?rid=vDjnrqS Message: [DOM] Input elements should have autocomplete attributes (suggested: "new-password"): (More info: https://goo.gl/9p2vKq) %o
javascript	error	URL: https://mail.vicgroup.su/?rid=vDjnrqS Message: Access to font at 'https://188.121.118.90/owa/auth/15.2.986/themes/resources/segoeui-semilight.ttf' from origin 'https://mail.vicgroup.su' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://188.121.118.90/owa/auth/15.2.986/themes/resources/segoeui-semilight.ttf Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://mail.vicgroup.su/?rid=vDjnrqS Message: Access to font at 'https://188.121.118.90/owa/auth/15.2.986/themes/resources/segoeui-regular.ttf' from origin 'https://mail.vicgroup.su' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://188.121.118.90/owa/auth/15.2.986/themes/resources/segoeui-regular.ttf Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

188.121.118.90
mail.vicgroup.su
188.121.118.90
188.121.118.90
79.174.80.75
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
3628627b4bf75907d2d4f9dc74313684268be09060a5dabb85dcee7c36bb2db1
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a
a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6
cf0808a61ec571e0c4975663903b288009d55502ac0445d9948983b339a5cf6e
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b