my-sharepoint-access.fusionenterprises.ca Open in urlscan Pro
192.254.225.121  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request office.php Show response my-sharepoint-access.fusionenterprises.ca/Office/source/	24 KB 10 KB	2071ms 1906ms	Document text/html	192.254.225.121 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://my-sharepoint-access.fusionenterprises.ca/Office/source/office.php Protocol HTTP/1.1 Server 192.254.225.121 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-254-225-121.unifiedlayer.com Software Apache / Resource Hash b80d523ba9d13514021a8d68f6c41e2e885df79f89d045de80cf2fa41a16381d Request headers Host my-sharepoint-access.fusionenterprises.ca Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 20 May 2021 02:05:56 GMT Server Apache Upgrade h2,h2c Connection Upgrade, Keep-Alive Vary Accept-Encoding Content-Encoding gzip Content-Length 9475 Keep-Alive timeout=5, max=75 Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	converged.login.min.css my-sharepoint-access.fusionenterprises.ca/Office/source/files/	84 KB 23 KB	181ms 180ms	Stylesheet text/css	192.254.225.121 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://my-sharepoint-access.fusionenterprises.ca/Office/source/files/converged.login.min.css Requested by Host: my-sharepoint-access.fusionenterprises.ca URL: http://my-sharepoint-access.fusionenterprises.ca/Office/source/office.php Protocol HTTP/1.1 Server 192.254.225.121 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-254-225-121.unifiedlayer.com Software Apache / Resource Hash 4f962ec8ae085492d496fcbbd74185ab1c8e377438dbcb5ec4f8517b7bd9293f Request headers Pragma no-cache Accept-Encoding gzip, deflate Host my-sharepoint-access.fusionenterprises.ca Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/css,*/*;q=0.1 Referer http://my-sharepoint-access.fusionenterprises.ca/Office/source/office.php Connection keep-alive Cache-Control no-cache Referer http://my-sharepoint-access.fusionenterprises.ca/Office/source/office.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 20 May 2021 02:05:58 GMT Content-Encoding gzip Last-Modified Wed, 02 Aug 2017 09:43:32 GMT Server Apache Vary Accept-Encoding Content-Type text/css Transfer-Encoding chunked Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=74
GET H/1.1	200 OK	convergedlogin_pcore.min.js Show response secure.aadcdn.microsoftonline-p.com/ests/2.1.6348.16/content/cdnbundles/	284 KB 82 KB	583ms 558ms	Script application/x-javascript	2a02:26f0:6c00:2b4::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6348.16/content/cdnbundles/convergedlogin_pcore.min.js Requested by Host: my-sharepoint-access.fusionenterprises.ca URL: http://my-sharepoint-access.fusionenterprises.ca/Office/source/office.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:2b4::35c1 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash bb49aa69e795d9a4e6175a9373bef378615ead2fb7aebe00954c2111db5f5f2d Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Origin http://my-sharepoint-access.fusionenterprises.ca Referer http://my-sharepoint-access.fusionenterprises.ca/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 20 May 2021 02:05:58 GMT Content-Encoding gzip Last-Modified Sat, 18 May 2019 10:34:07 GMT Content-MD5 70JDX0xpFgO/0lUo3MXuxw== Vary Accept-Encoding Connection keep-alive Content-Type application/x-javascript Access-Control-Allow-Origin * Cache-Control public, max-age=604800 Strict-Transport-Security max-age=31536000 Content-Length 83081
GET H/1.1	200 OK	convergedloginpaginatedstrings-en-gb.min.js Show response secure.aadcdn.microsoftonline-p.com/ests/2.1.6348.16/content/cdnbundles/	10 KB 4 KB	505ms 480ms	Script application/x-javascript	2a02:26f0:6c00:2b4::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6348.16/content/cdnbundles/convergedloginpaginatedstrings-en-gb.min.js Requested by Host: my-sharepoint-access.fusionenterprises.ca URL: http://my-sharepoint-access.fusionenterprises.ca/Office/source/office.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:2b4::35c1 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 76a549b7b5bb871680b150cc933d79b0b12a5b6f58d19348ece542f5d7a4af4c Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Origin http://my-sharepoint-access.fusionenterprises.ca Referer http://my-sharepoint-access.fusionenterprises.ca/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 20 May 2021 02:05:58 GMT Content-Encoding gzip Last-Modified Sat, 18 May 2019 10:34:17 GMT Content-MD5 2aonJl133r+/GhKf7Kl2dw== Vary Accept-Encoding Connection keep-alive Content-Type application/x-javascript Access-Control-Allow-Origin * Cache-Control public, max-age=604800 Strict-Transport-Security max-age=31536000 Content-Length 3442
GET H/1.1	200 OK	bannerlogo my-sharepoint-access.fusionenterprises.ca/Office/source/files/	4 KB 5 KB	178ms 177ms	Image image/png	192.254.225.121 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL http://my-sharepoint-access.fusionenterprises.ca/Office/source/files/bannerlogo?ts=635974776182591704 Requested by Host: my-sharepoint-access.fusionenterprises.ca URL: http://my-sharepoint-access.fusionenterprises.ca/Office/source/office.php Protocol HTTP/1.1 Server 192.254.225.121 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-254-225-121.unifiedlayer.com Software Apache / Resource Hash fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host my-sharepoint-access.fusionenterprises.ca Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Referer http://my-sharepoint-access.fusionenterprises.ca/Office/source/office.php Connection keep-alive Cache-Control no-cache Referer http://my-sharepoint-access.fusionenterprises.ca/Office/source/office.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 20 May 2021 02:05:58 GMT Last-Modified Wed, 02 Aug 2017 09:25:26 GMT Server Apache Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=73 Content-Length 4585
GET H/1.1	200 OK	microsoft_logo.svg my-sharepoint-access.fusionenterprises.ca/Office/source/files/	4 KB 4 KB	207ms 207ms	Image image/svg+xml	192.254.225.121 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL http://my-sharepoint-access.fusionenterprises.ca/Office/source/files/microsoft_logo.svg?x=ee5c8d9fb6248c938fd0dc19370e90bd Requested by Host: my-sharepoint-access.fusionenterprises.ca URL: http://my-sharepoint-access.fusionenterprises.ca/Office/source/office.php Protocol HTTP/1.1 Server 192.254.225.121 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-254-225-121.unifiedlayer.com Software Apache / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Pragma no-cache Accept-Encoding gzip, deflate Host my-sharepoint-access.fusionenterprises.ca Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Referer http://my-sharepoint-access.fusionenterprises.ca/Office/source/office.php Connection keep-alive Cache-Control no-cache Referer http://my-sharepoint-access.fusionenterprises.ca/Office/source/office.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 20 May 2021 02:05:59 GMT Last-Modified Wed, 02 Aug 2017 09:32:20 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=72 Content-Length 3651
GET H/1.1	200 OK	picker_account_aad.svg my-sharepoint-access.fusionenterprises.ca/Office/source/files/	756 B 1 KB	360ms 349ms	Image image/svg+xml	192.254.225.121 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL http://my-sharepoint-access.fusionenterprises.ca/Office/source/files/picker_account_aad.svg?x=9de70d1c5191d1852a0d5aac28b44a6c Requested by Host: my-sharepoint-access.fusionenterprises.ca URL: http://my-sharepoint-access.fusionenterprises.ca/Office/source/office.php Protocol HTTP/1.1 Server 192.254.225.121 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-254-225-121.unifiedlayer.com Software Apache / Resource Hash 5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host my-sharepoint-access.fusionenterprises.ca Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Referer http://my-sharepoint-access.fusionenterprises.ca/Office/source/office.php Connection keep-alive Cache-Control no-cache Referer http://my-sharepoint-access.fusionenterprises.ca/Office/source/office.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Thu, 20 May 2021 02:05:59 GMT Last-Modified Wed, 02 Aug 2017 09:37:40 GMT Server Apache Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type image/svg+xml Keep-Alive timeout=5, max=75 Content-Length 756

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online) Microsoft (Consumer)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| $Debug object| $Do undefined| g_iSRSFailed undefined| g_sSRSSuccess function| webpackJsonp object| StringRepository boolean| __

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

my-sharepoint-access.fusionenterprises.ca
secure.aadcdn.microsoftonline-p.com
192.254.225.121
2a02:26f0:6c00:2b4::35c1
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
4f962ec8ae085492d496fcbbd74185ab1c8e377438dbcb5ec4f8517b7bd9293f
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
76a549b7b5bb871680b150cc933d79b0b12a5b6f58d19348ece542f5d7a4af4c
b80d523ba9d13514021a8d68f6c41e2e885df79f89d045de80cf2fa41a16381d
bb49aa69e795d9a4e6175a9373bef378615ead2fb7aebe00954c2111db5f5f2d
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603