login.rappel.group-efs.fr Open in urlscan Pro
134.209.194.124  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request QaXxmOGw Show response login.rappel.group-efs.fr/	70 KB 70 KB	178ms 27ms	Document text/html	134.209.194.124 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://login.rappel.group-efs.fr/QaXxmOGw?erj=bCnIsQqsOZWdXprcPHXTMPcDgwob8iKQcJuFFU7FBC1zT7PELMgshEL0oJgHy43rEXI Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 134.209.194.124 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash 213f83c91ca99be681e26c989213990be282f46bcbc5a09c751a97d359414ba7 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 accept-language fr-FR,fr;q=0.9 Response headers Cache-Control no-cache, no-store Connection close Content-Type text/html Transfer-Encoding chunked
GET H2	200	bootstrap.min.css stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/	157 KB 25 KB	79ms 38ms	Stylesheet text/css	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css Requested by Host: login.rappel.group-efs.fr URL: https://login.rappel.group-efs.fr/QaXxmOGw?erj=bCnIsQqsOZWdXprcPHXTMPcDgwob8iKQcJuFFU7FBC1zT7PELMgshEL0oJgHy43rEXI Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://login.rappel.group-efs.fr/ Origin https://login.rappel.group-efs.fr accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 12:34:59 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 1187 age 1979 cdn-cachedat 11/26/2023 18:54:48 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:11 GMT cdn-proxyver 1.04 cdn-requestpullcode 200 server cloudflare etag W/"816af0eddd3b4822c2756227c7e7b7ee" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid e7f292965432b331cf5174656b9c6968 timing-allow-origin * cdn-requestcountrycode FR cdn-status 200 cf-ray 843d32704dcb2a7b-CDG cdn-requestpullsuccess True
GET H2	200	spoguestaccess.js Show response res-1.cdn.office.net/files/odsp-web-prod_2023-09-08.004/spoguestaccesswebpack/	44 KB 15 KB	103ms 22ms	Script application/javascript	2a02:26f0:7100::687e:25e8 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://res-1.cdn.office.net/files/odsp-web-prod_2023-09-08.004/spoguestaccesswebpack/spoguestaccess.js Requested by Host: login.rappel.group-efs.fr URL: https://login.rappel.group-efs.fr/QaXxmOGw?erj=bCnIsQqsOZWdXprcPHXTMPcDgwob8iKQcJuFFU7FBC1zT7PELMgshEL0oJgHy43rEXI Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:7100::687e:25e8 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash c6c71d4036add9be9a38c33ff9d4c5c8c243af4871ffda2a195af51a81fcda46 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Referer https://login.rappel.group-efs.fr/ Origin https://login.rappel.group-efs.fr accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 12:34:59 GMT content-encoding br x-content-type-options nosniff akamai-cache-status Hit from child nel {"report_to":"NelM365CDNUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} strict-transport-security max-age=31536000; includeSubDomains x-ms-meta-sourceid 905EBE41AF451C1C6A61EA663D00F8E341E0AB8B7D5BE2A3C237E5319ADF1AB500 server-timing clientrtt; dur=21, clienttt; dur=, origin; dur=0 , cdntime; dur=0 alt-svc h3=":443"; ma=93600 content-length 14363 last-modified Sat, 09 Sep 2023 18:54:57 GMT x-cdn-provider Akamai report-to {"group":"NelM365CDNUpload1","max_age":604800,"endpoints":[{"url":"https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=FRANKFURT&ASN=20940&Country=DE&Region=HE&RequestIdentifier=0.e4257e68.1704976499.1377a730&TotalRTCDNTime=21&CompressionType=br&FileSize=14363"}],"include_subdomains ":true} content-type application/javascript access-control-allow-origin * x-ms-request-id 1f21311b-c01e-004e-6385-44d11f000000 access-control-expose-headers date,Akamai-Request-BC,X-Cdn-Provider,X-Ms-Request-Id cache-control public, max-age=630720000 x-ms-meta-sourcebuild odsp-web-prod_2023-09-08.004 akamai-request-bc [a=104.126.37.228,b=326608688,c=g,n=DE_HE_FRANKFURT,o=20940] timing-allow-origin *
GET		dom.js njgehaondchbmjmajphnhlojfnbfokng/js/contentScripts/	0 0
GET H2	404	initializeFileTypeIcons.js res-1.cdn.office.net/files/odsp-web-prod_2023-09-08.004/@uifabric/file-type-icons/lib/	0 0	423ms 423ms	Script application/javascript	2a02:26f0:7100::687e:25e8 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://res-1.cdn.office.net/files/odsp-web-prod_2023-09-08.004/@uifabric/file-type-icons/lib/initializeFileTypeIcons.js Requested by Host: login.rappel.group-efs.fr URL: https://login.rappel.group-efs.fr/QaXxmOGw?erj=bCnIsQqsOZWdXprcPHXTMPcDgwob8iKQcJuFFU7FBC1zT7PELMgshEL0oJgHy43rEXI Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:7100::687e:25e8 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Referer https://login.rappel.group-efs.fr/ Origin https://login.rappel.group-efs.fr accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 12:34:59 GMT akamai-cache-status Miss from child, Miss from parent x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains nel {"report_to":"NelM365CDNUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} x-cdn-provider Akamai report-to {"group":"NelM365CDNUpload1","max_age":604800,"endpoints":[{"url":"https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=FRANKFURT&ASN=20940&Country=DE&Region=HE&RequestIdentifier=0.e4257e68.1704976499.1377a734&TotalRTCDNTime=23&CompressionType=&FileSize=215"}],"include_subdomains ":true} content-type application/javascript access-control-allow-origin * x-ms-request-id 529569cf-401e-003f-228a-440262000000 access-control-expose-headers date,Akamai-Request-BC,X-Cdn-Provider,X-Ms-Request-Id server-timing clientrtt; dur=23, clienttt; dur=187, origin; dur=0 , cdntime; dur=187 akamai-request-bc [a=104.126.37.228,b=326608692,c=g,n=DE_HE_FRANKFURT,o=20940],[c=c,n=DE_HE_FRANKFURT,o=20940],[a=52.239.228.196,c=o] timing-allow-origin * content-length 215
GET H/1.1	404 Not Found	WebResource.axd login.rappel.group-efs.fr/	0 0	127ms 82ms	Script text/plain	134.209.194.124 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://login.rappel.group-efs.fr/WebResource.axd?d=1LhYAReGtrycnn7UDjgpmzbNGfeNrgZicI2kltoRBzeZcgILJzrfy37Zb4Bnv-BicloJTyw1DCmHabtvrktCWWBqOYU61a4IXmKCci3-mz81&t=638266273346882838 Requested by Host: login.rappel.group-efs.fr URL: https://login.rappel.group-efs.fr/QaXxmOGw?erj=bCnIsQqsOZWdXprcPHXTMPcDgwob8iKQcJuFFU7FBC1zT7PELMgshEL0oJgHy43rEXI Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 134.209.194.124 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash Request headers accept-language fr-FR,fr;q=0.9 Referer https://login.rappel.group-efs.fr/QaXxmOGw?erj=bCnIsQqsOZWdXprcPHXTMPcDgwob8iKQcJuFFU7FBC1zT7PELMgshEL0oJgHy43rEXI User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers Date Thu, 11 Jan 2024 12:34:58 GMT Referrer-Policy strict-origin-when-cross-origin Nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} Transfer-Encoding chunked Report-To {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]} P3p CP="DSP CUR OTPi IND OTRi ONL FIN" X-Ms-Request-Id b4c88f32-42d8-4f2d-9637-0217999a520c Cache-Control private Connection close X-Ms-Ests-Server 2.1.16942.4 - FRC ProdSlices
GET H2	200	require.js Show response res-1.cdn.office.net/bld/_layouts/15/16.0.24030.12011/	17 KB 7 KB	87ms 23ms	Script application/javascript	2a02:26f0:7100::687e:25e8 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://res-1.cdn.office.net/bld/_layouts/15/16.0.24030.12011/require.js Requested by Host: login.rappel.group-efs.fr URL: https://login.rappel.group-efs.fr/QaXxmOGw?erj=bCnIsQqsOZWdXprcPHXTMPcDgwob8iKQcJuFFU7FBC1zT7PELMgshEL0oJgHy43rEXI Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:7100::687e:25e8 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 2d92f0ce8491d2f9a27ea16d261a15089c4a9be879d1eedcb6f4a3859e7f1999 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language fr-FR,fr;q=0.9 Referer https://login.rappel.group-efs.fr/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 12:34:59 GMT content-encoding gzip x-content-type-options nosniff akamai-cache-status Hit from child nel {"report_to":"NelM365CDNUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} strict-transport-security max-age=31536000; includeSubDomains server-timing clientrtt; dur=21, clienttt; dur=, origin; dur=0 , cdntime; dur=0 alt-svc h3=":443"; ma=93600 content-length 6643 last-modified Sat, 16 Sep 2023 02:42:45 GMT x-cdn-provider Akamai vary Accept-Encoding report-to {"group":"NelM365CDNUpload1","max_age":604800,"endpoints":[{"url":"https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=FRANKFURT&ASN=20940&Country=DE&Region=HE&RequestIdentifier=0.e4257e68.1704976499.1377a738&TotalRTCDNTime=21&CompressionType=gzip&FileSize=6643"}],"include_subdomains ":true} content-type application/javascript access-control-allow-origin * x-ms-request-id e491b3c7-f01e-0018-1857-2720f0000000 access-control-expose-headers date,Akamai-Request-BC,X-Cdn-Provider,X-Ms-Request-Id cache-control max-age=630720000 akamai-request-bc [a=104.126.37.228,b=326608696,c=g,n=DE_HE_FRANKFURT,o=20940] timing-allow-origin *
GET H/1.1	404 Not Found	ScriptResource.axd login.rappel.group-efs.fr/	0 0	168ms 123ms	Script text/plain	134.209.194.124 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://login.rappel.group-efs.fr/ScriptResource.axd?d=wXpR0qiPcg9zfhOw18w4_-ocs2h8rRPK4c2Vb4My8Te8NTyXfgnbTCjZHn8a8dvxK6Rbh52rmTlzU8ijucEl1DiYXs4lWowcfqqiETPWGnBxvnmILcEidtIdhdkcZLlyv-kR3-xhwokWbCo4vMA0fsjehp-bTtkTjOjv-mmyaWIKoSLkEfcG60Z8NWlU2l6Z0&t=96346c8 Requested by Host: login.rappel.group-efs.fr URL: https://login.rappel.group-efs.fr/QaXxmOGw?erj=bCnIsQqsOZWdXprcPHXTMPcDgwob8iKQcJuFFU7FBC1zT7PELMgshEL0oJgHy43rEXI Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 134.209.194.124 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash Request headers accept-language fr-FR,fr;q=0.9 Referer https://login.rappel.group-efs.fr/QaXxmOGw?erj=bCnIsQqsOZWdXprcPHXTMPcDgwob8iKQcJuFFU7FBC1zT7PELMgshEL0oJgHy43rEXI User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers Date Thu, 11 Jan 2024 12:34:59 GMT Referrer-Policy strict-origin-when-cross-origin Nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} Transfer-Encoding chunked Report-To {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]} P3p CP="DSP CUR OTPi IND OTRi ONL FIN" X-Ms-Request-Id 878fc6ec-7c1e-4f53-a300-b7369a0f2f00 Cache-Control private Connection close X-Ms-Ests-Server 2.1.16986.9 - WEULR1 ProdSlices
GET H/1.1	404 Not Found	ScriptResource.axd login.rappel.group-efs.fr/	0 0	163ms 117ms	Script text/plain	134.209.194.124 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://login.rappel.group-efs.fr/ScriptResource.axd?d=4E3QTeMkF6L-vvDs0ilxGKikLIOIHZrQ7OBz2D-Ie2s3YTNSwIsSJHLD8zmkWJoyku-9ifCL_NOEmW8blLH9E_BEPnMB_X3d3y4Dj6H0pdPk3KF1ky8tz6h4ZXWS37lV32Ji0_2A9Yu7JEKxe9GBfoTSEmd6iOMhj0vPzrAGu8YKXmry4XMmePd6Lh4ZHais0&t=96346c8 Requested by Host: login.rappel.group-efs.fr URL: https://login.rappel.group-efs.fr/QaXxmOGw?erj=bCnIsQqsOZWdXprcPHXTMPcDgwob8iKQcJuFFU7FBC1zT7PELMgshEL0oJgHy43rEXI Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 134.209.194.124 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash Request headers accept-language fr-FR,fr;q=0.9 Referer https://login.rappel.group-efs.fr/QaXxmOGw?erj=bCnIsQqsOZWdXprcPHXTMPcDgwob8iKQcJuFFU7FBC1zT7PELMgshEL0oJgHy43rEXI User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers Date Thu, 11 Jan 2024 12:34:58 GMT Referrer-Policy strict-origin-when-cross-origin Nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} Transfer-Encoding chunked Report-To {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]} P3p CP="DSP CUR OTPi IND OTRi ONL FIN" X-Ms-Request-Id 67cf1afb-bbdf-401c-8ea1-fe35c1095600 Cache-Control private Connection close X-Ms-Ests-Server 2.1.16986.9 - FRC ProdSlices
GET H2	200	jquery-3.5.1.slim.min.js Show response code.jquery.com/	71 KB 24 KB	57ms 18ms	Script application/javascript	2a04:4e42:400::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.5.1.slim.min.js Requested by Host: login.rappel.group-efs.fr URL: https://login.rappel.group-efs.fr/QaXxmOGw?erj=bCnIsQqsOZWdXprcPHXTMPcDgwob8iKQcJuFFU7FBC1zT7PELMgshEL0oJgHy43rEXI Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db Request headers Referer https://login.rappel.group-efs.fr/ Origin https://login.rappel.group-efs.fr accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 12:34:59 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 7448088 x-cache HIT, HIT content-length 24606 x-served-by cache-lga21954-LGA, cache-lcy-eglc8600065-LCY last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1704976499.267920,VS0,VE0 etag W/"28feccc0-11abc" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 43, 94770
GET H2	200	popper.min.js Show response cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/	21 KB 8 KB	67ms 28ms	Script application/javascript	2606:4700::6810:5514 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js Requested by Host: login.rappel.group-efs.fr URL: https://login.rappel.group-efs.fr/QaXxmOGw?erj=bCnIsQqsOZWdXprcPHXTMPcDgwob8iKQcJuFFU7FBC1zT7PELMgshEL0oJgHy43rEXI Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fe28dc38bc057f6eb11180235bbe458b3295a39b674d889075d3d9a0b5071d9f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://login.rappel.group-efs.fr/ Origin https://login.rappel.group-efs.fr accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 12:34:59 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 5568382 x-jsd-version 1.16.1 content-encoding br x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-served-by cache-fra-etou8220021-FRA, cache-mrs10523-MRS x-jsd-version-type version server cloudflare etag W/"52f1-MTeJyg4xtlR4TbuosPg/Nk+Gg7Q" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kkixUORLbycIPenIi0xahLdWQhmL5RUoM2SWLwdTZ6URP6SIXjWGIO2cXhYVNgEbn44gQF3FHiVjeRRsEwqpJfAxA70RChb2r3SPROA5X%2Ft5KxqEUzl2ivrSTmnVeA5y4se8ZQLz6yBHDYYwXTM%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cf-ray 843d32706b1c035c-CDG
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/	59 KB 16 KB	53ms 36ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js Requested by Host: login.rappel.group-efs.fr URL: https://login.rappel.group-efs.fr/QaXxmOGw?erj=bCnIsQqsOZWdXprcPHXTMPcDgwob8iKQcJuFFU7FBC1zT7PELMgshEL0oJgHy43rEXI Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://login.rappel.group-efs.fr/ Origin https://login.rappel.group-efs.fr accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Thu, 11 Jan 2024 12:34:59 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 947 age 1958 cdn-cachedat 11/07/2023 20:04:46 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:11 GMT cdn-proxyver 1.04 cdn-requestpullcode 200 server cloudflare etag W/"02d223393e00c273efdcb1ade8f4f8b1" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid 35bb1fb6e839f805d75bc2423bad693f timing-allow-origin * cdn-requestcountrycode FR cdn-status 200 cf-ray 843d32704dcf2a7b-CDG cdn-requestpullsuccess True
GET H/1.1	404 Not Found	microsoft-logo.png login.rappel.group-efs.fr/_layouts/15/images/	0 668 B	128ms 82ms	Image text/plain	134.209.194.124 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://login.rappel.group-efs.fr/_layouts/15/images/microsoft-logo.png Requested by Host: login.rappel.group-efs.fr URL: https://login.rappel.group-efs.fr/QaXxmOGw?erj=bCnIsQqsOZWdXprcPHXTMPcDgwob8iKQcJuFFU7FBC1zT7PELMgshEL0oJgHy43rEXI Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 134.209.194.124 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language fr-FR,fr;q=0.9 Referer https://login.rappel.group-efs.fr/QaXxmOGw?erj=bCnIsQqsOZWdXprcPHXTMPcDgwob8iKQcJuFFU7FBC1zT7PELMgshEL0oJgHy43rEXI User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers Date Thu, 11 Jan 2024 12:34:58 GMT Referrer-Policy strict-origin-when-cross-origin Nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} Transfer-Encoding chunked Report-To {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]} P3p CP="DSP CUR OTPi IND OTRi ONL FIN" X-Ms-Request-Id 23607195-e078-4cc9-a311-d1a80d5e6500 Cache-Control private Connection close X-Ms-Ests-Server 2.1.16986.9 - WEULR1 ProdSlices
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 825de044d5ac6442a094ff95099f9f67e9249a8110a2fbd57128285776632adb Request headers accept-language fr-FR,fr;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers Content-Type image/png
GET H2	200	256_icdocx.png parmentieridf-my.sharepoint.com/personal/snemmar172_etu_parmentieridf_fr/_layouts/15/images/	3 KB 5 KB	386ms 48ms	Image image/png	2620:1ec:8fa::10 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://parmentieridf-my.sharepoint.com/personal/snemmar172_etu_parmentieridf_fr/_layouts/15/images/256_icdocx.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:8fa::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / ASP.NET Resource Hash 91a9480ae7804be674ddaecc3bc8621ff1711ba54e591f9ab39ebc4b23d88df2 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.powerapps.com *.yammer.com engage.cloud.microsoft *.officeapps.live.com *.office.com *.microsoft365.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com securebroker.sharepointonline.com; Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers accept-language fr-FR,fr;q=0.9 Referer https://login.rappel.group-efs.fr/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-security-policy frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.powerapps.com *.yammer.com engage.cloud.microsoft *.officeapps.live.com *.office.com *.microsoft365.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com securebroker.sharepointonline.com; x-content-type-options nosniff date Thu, 11 Jan 2024 12:34:59 GMT nel {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} x-networkstatistics 0,1051136,0,51,5025,0,491758 x-powered-by ASP.NET x-cache CONFIG_NOCACHE p3p CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" x-sharepointhealthscore 0 x-databoundary EU request-id 19ab00a1-10d6-7000-fe73-a2df315e7195 ms-cv oQCrGdYQAHD+c6LfMV5xlQ.0 content-length 3496 microsoftsharepointteamservices 16.0.0.24406 x-ms-invokeapp 1; RequireReadOnly sprequestduration 7 last-modified Sun, 31 Dec 2023 04:03:08 GMT sprequestguid 19ab00a1-10d6-7000-fe73-a2df315e7195 x-msedge-ref Ref A: 9913E3F0361C4BED94D5D3E22C7C0BC9 Ref B: LON21EDGE1113 Ref C: 2024-01-11T12:35:00Z etag "02640439e3bda1:0" x-frame-options SAMEORIGIN report-to {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=Edge-Prod-LON21r5e&frontEnd=AFD&remoteIp=2001:41d0:8:d154::"}]} content-type image/png x-1dscollectorurl https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ x-ariacollectorurl https://eu-mobile.events.data.microsoft.com/Collector/3.0 accept-ranges bytes spiislatency 1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

njgehaondchbmjmajphnhlojfnbfokng

URL

chrome-extension://njgehaondchbmjmajphnhlojfnbfokng/js/contentScripts/dom.js

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sharepoint (Online) Microsoft (Consumer) OneDrive (Online)

44 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| __tti number| g_responseEnd object| FabricConfig string| __odsp_culture object| __odspSriHashes object| __odsp_libraryScripts object| _spModuleLink function| requirejs function| require function| define function| es6-symbol function| ES6Promise object| __odsp_cdnConfig string| __backupBaseUrl object| __cdnFailOverState function| setImageUrl function| _spBodyOnLoad object| theForm function| __doPostBack object| __globalSettings__ object| __stylesheet__ object| __packages__ object| __themeState__ string| MSOWebPartPageFormName function| clickedDownload function| $ function| jQuery function| _spFormOnSubmitWrapper function| onFormSubmit object| checkboxes function| onInputChange function| showToastNotification object| dismiss function| dismissNotification undefined| validateFunction function| ValidateCode boolean| _fV4UI number| g_duration number| g_iisLatency number| g_cpuDuration number| g_queryCount number| g_queryDuration number| g_requireJSDone

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.group-efs.fr/	1970-01-20 17:36:20	Name: e65e-5955 Value: 24acdee9b91fd14df425a680e790c7310433293ef5b0fe7ec9a8962a406e28c8
			login.rappel.group-efs.fr/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: chrome-extension://njgehaondchbmjmajphnhlojfnbfokng/js/contentScripts/dom.js Message: Failed to load resource: net::ERR_UNKNOWN_URL_SCHEME
network	error	URL: https://login.rappel.group-efs.fr/WebResource.axd?d=1LhYAReGtrycnn7UDjgpmzbNGfeNrgZicI2kltoRBzeZcgILJzrfy37Zb4Bnv-BicloJTyw1DCmHabtvrktCWWBqOYU61a4IXmKCci3-mz81&t=638266273346882838 Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://login.rappel.group-efs.fr/_layouts/15/images/microsoft-logo.png Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://login.rappel.group-efs.fr/ScriptResource.axd?d=4E3QTeMkF6L-vvDs0ilxGKikLIOIHZrQ7OBz2D-Ie2s3YTNSwIsSJHLD8zmkWJoyku-9ifCL_NOEmW8blLH9E_BEPnMB_X3d3y4Dj6H0pdPk3KF1ky8tz6h4ZXWS37lV32Ji0_2A9Yu7JEKxe9GBfoTSEmd6iOMhj0vPzrAGu8YKXmry4XMmePd6Lh4ZHais0&t=96346c8 Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://login.rappel.group-efs.fr/ScriptResource.axd?d=wXpR0qiPcg9zfhOw18w4_-ocs2h8rRPK4c2Vb4My8Te8NTyXfgnbTCjZHn8a8dvxK6Rbh52rmTlzU8ijucEl1DiYXs4lWowcfqqiETPWGnBxvnmILcEidtIdhdkcZLlyv-kR3-xhwokWbCo4vMA0fsjehp-bTtkTjOjv-mmyaWIKoSLkEfcG60Z8NWlU2l6Z0&t=96346c8 Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://res-1.cdn.office.net/files/odsp-web-prod_2023-09-08.004/@uifabric/file-type-icons/lib/initializeFileTypeIcons.js Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
code.jquery.com
login.rappel.group-efs.fr
njgehaondchbmjmajphnhlojfnbfokng
parmentieridf-my.sharepoint.com
res-1.cdn.office.net
stackpath.bootstrapcdn.com
njgehaondchbmjmajphnhlojfnbfokng
134.209.194.124
2606:4700::6810:5514
2606:4700::6812:bcf
2620:1ec:8fa::10
2a02:26f0:7100::687e:25e8
2a04:4e42:400::649
213f83c91ca99be681e26c989213990be282f46bcbc5a09c751a97d359414ba7
2d92f0ce8491d2f9a27ea16d261a15089c4a9be879d1eedcb6f4a3859e7f1999
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
825de044d5ac6442a094ff95099f9f67e9249a8110a2fbd57128285776632adb
91a9480ae7804be674ddaecc3bc8621ff1711ba54e591f9ab39ebc4b23d88df2
c6c71d4036add9be9a38c33ff9d4c5c8c243af4871ffda2a195af51a81fcda46
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db
fe28dc38bc057f6eb11180235bbe458b3295a39b674d889075d3d9a0b5071d9f