spm-so.com Open in urlscan Pro
2606:4700:3031::681b:84cc Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://spm-so.com/dr/op/bo/xed/?X1=george@g3intl.com
Submission: On November 06 via automatic, source phishtank (November 6th 2020, 7:47:04 am UTC)

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 14 HTTP transactions. The main IP is 2606:4700:3031::681b:84cc, located in United States and belongs to CLOUDFLARENET, US. The main domain is spm-so.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on October 10th 2020. Valid for: a year.

This is the only time spm-so.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Dropbox (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
14	2606:4700:303... 2606:4700:3031::681b:84cc		13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	1

14 2606:4700:3031::681b:84cc (United States)

ASN13335 (CLOUDFLARENET, US)

spm-so.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	spm-so.com spm-so.com	658 KB
14	1

	Domain	Requested by
14	spm-so.com	spm-so.com
14	1

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-10-10` - `2021-10-10`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://spm-so.com/dr/op/bo/xed/?X1=george@g3intl.com
Frame ID: D8496E35FB367E22A7E23C37711AC6E6
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

14
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

658 kB
Transfer

927 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
spm-so.com/dr/op/bo/xed/ 8 KB
2 KB 173ms
141ms Document
text/html 2606:4700:3031::681b:84cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spm-so.com/dr/op/bo/xed/?X1=george@g3intl.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:84cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7073bfb112d0cd34f9790a9d03e4d161afb8efd533cc650d8c3fdd64f0341bc

Request headers

:method: GET
:authority: spm-so.com
:scheme: https
:path: /dr/op/bo/xed/?X1=george@g3intl.com
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Fri, 06 Nov 2020 07:46:48 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=de83f710f78161639ef697eb830e8240c1604648808; expires=Sun, 06-Dec-20 07:46:48 GMT; path=/; domain=.spm-so.com; HttpOnly; SameSite=Lax; Secure
cf-cache-status: DYNAMIC
cf-request-id: 063e1ec6cd0000971e83255000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Y4T1gcQcJHvBCL1SpttgX3wxMTp0z2%2FnBif7kEB0wOX6N4SUfJHuM1lcgxTsYRuN7iKJdmsu8D1eZuViuzk0BNvAoh1tkHgmYZJ282Q34r9i4Id1ifxl"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 5edd33eaebc5971e-FRA
content-encoding: br

GET
H2 200 css.css
spm-so.com/dr/op/bo/xed/styles/ 5 KB
2 KB 90ms
89ms Stylesheet
text/css 2606:4700:3031::681b:84cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spm-so.com/dr/op/bo/xed/styles/css.css
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/?X1=george@g3intl.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:84cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f197d9da74ec12bcfeb42f4ace83d2b31b2dd06c70a60aa8f9d89c8f58efa9e3

Request headers

Referer: https://spm-so.com/dr/op/bo/xed/?X1=george@g3intl.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 06 Nov 2020 07:46:48 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:23 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=gZulViJkudBxh%2Fz5WhCk2WyjHHXdG1RuV6tFgFVSFzsQR0LXwBoRqECvwBiHprQid9WfPkDx7s8UDrjRAPeYDKDupCx0N%2FTPLcBtaPdZAQ2GAIp00U%2Fm"}],"group":"cf-nel","max_age":604800}
content-type: text/css
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 5edd33ebcc03971e-FRA
cf-request-id: 063e1ec75e0000971e7aa68000000001

GET
H2 200 checkbox.css
spm-so.com/dr/op/bo/xed/styles/ 1 KB
750 B 102ms
101ms Stylesheet
text/css 2606:4700:3031::681b:84cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spm-so.com/dr/op/bo/xed/styles/checkbox.css
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/?X1=george@g3intl.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:84cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ab96691d78536247ca2ab64aac5af744cf699926fa30d393ae859c9fa803b42c

Request headers

Referer: https://spm-so.com/dr/op/bo/xed/?X1=george@g3intl.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 06 Nov 2020 07:46:48 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:22 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=NAspoo%2B6LBgyU8kwjPz34OBktpc%2F5Nq4b3h1OaGqLO01BWs%2BuVjJryUqSMnw3drxVIbVWoMjcBJd06vZdEEP6lq7Nb0q8N0aie4XmwlT5n7p3PWnIgjF"}],"group":"cf-nel","max_age":604800}
content-type: text/css
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 5edd33ebcc05971e-FRA
cf-request-id: 063e1ec75f0000971e81802000000001

GET
H2 200 all.css
spm-so.com/dr/op/bo/xed/styles/ 71 KB
13 KB 169ms
168ms Stylesheet
text/css 2606:4700:3031::681b:84cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spm-so.com/dr/op/bo/xed/styles/all.css
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/?X1=george@g3intl.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:84cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 530cb4c29b444dc89dd73a4e0812f803be98d3448a48edca8aafdbc55a0b97eb

Request headers

Referer: https://spm-so.com/dr/op/bo/xed/?X1=george@g3intl.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 06 Nov 2020 07:46:48 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:23 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=B%2Fo3GaCc3V0rkQMlLzNFXxz%2F7gE22hVVu15h4%2F%2BUjhPa5y0lpTOLN18G67V0UuDP9KSFrhDYZiXXqryVVU3ow4pBPjMVZvag9qooSUlzHFDw%2BoPsNVRR"}],"group":"cf-nel","max_age":604800}
content-type: text/css
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 5edd33ebcc06971e-FRA
cf-request-id: 063e1ec75f0000971e8bb85000000001

GET
H2 200 jquery.js Show response
spm-so.com/dr/op/bo/xed/js/ 281 KB
79 KB 325ms
325ms Script
application/javascript 2606:4700:3031::681b:84cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spm-so.com/dr/op/bo/xed/js/jquery.js
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/?X1=george@g3intl.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:84cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37

Request headers

Referer: https://spm-so.com/dr/op/bo/xed/?X1=george@g3intl.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 06 Nov 2020 07:46:48 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:21 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=XPh9RmqfBoiVTt3ekl8B6%2ByKTepDdrwoWHSjSdPf7M3%2BGuvVYn0sJQIqq%2FOgnlBxk0uuRGDUYVHaESCgVzcHxTJe%2FG5YQSHmdDHK1FTiu%2BljzggJvlVb"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 5edd33ebcc07971e-FRA
cf-request-id: 063e1ec75f0000971e9000b000000001

GET
H2 200 excel.png
spm-so.com/dr/op/bo/xed/images/ 15 KB
15 KB 141ms
141ms Image
image/png 2606:4700:3031::681b:84cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://spm-so.com/dr/op/bo/xed/images/excel.png
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/?X1=george@g3intl.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:84cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7253f301aa0fd63fad4935c51eba121f766a630a9f47b25d24cd7b281e3ca943

Request headers

Referer: https://spm-so.com/dr/op/bo/xed/?X1=george@g3intl.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 06 Nov 2020 07:46:48 GMT
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:17 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=05aajQeyL6zJT15ogWwI2Ma%2FI5XnLB%2B2tFhVh87n91QZe6sn8ydBf5ZZ1rDID5rbfKE4x5sdzJKhwLsh4ekcs3De348taMAPPyEEhd1gGKVvRMWLZ6wP"}],"group":"cf-nel","max_age":604800}
content-type: image/png
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 5edd33ed8c93971e-FRA
content-length: 14950
cf-request-id: 063e1ec8780000971e8d37e000000001

GET
H2 200 pdf.png
spm-so.com/dr/op/bo/xed/images/ 8 KB
8 KB 100ms
100ms Image
image/png 2606:4700:3031::681b:84cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://spm-so.com/dr/op/bo/xed/images/pdf.png
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/?X1=george@g3intl.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:84cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5eedb987a0d26a60527854460e67bb0762de152f45b5be580de5aa21e524d309

Request headers

Referer: https://spm-so.com/dr/op/bo/xed/?X1=george@g3intl.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 06 Nov 2020 07:46:48 GMT
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:18 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=eZm5u%2B3JWdd66EwDDu0SF1xGD5F8mS%2BS3JSRPrkLgxGuuaNeK%2FoWAPlF8A1Q1A2HJxV2EY1Y1smvDG2pLhW6qEU05rAaE8niBX1FJvoRX3nZPLwIbiTv"}],"group":"cf-nel","max_age":604800}
content-type: image/png
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 5edd33eddca8971e-FRA
content-length: 8183
cf-request-id: 063e1ec8ab0000971e7883f000000001

GET
H2 200 log.png
spm-so.com/dr/op/bo/xed/images/ 19 KB
19 KB 143ms
142ms Image
image/png 2606:4700:3031::681b:84cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://spm-so.com/dr/op/bo/xed/images/log.png
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/?X1=george@g3intl.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:84cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b6a4e4eb69c0c7601ff58f4546567810128008e2cb99dc08c22bba4093b4a722

Request headers

Referer: https://spm-so.com/dr/op/bo/xed/?X1=george@g3intl.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 06 Nov 2020 07:46:48 GMT
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:18 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4ngoNSjvt2BsZvRQo1SOHdxQuvs9zg5LdPQ02mnQa5M3fru8xiNIMn%2BAsj10RInT8pGp4hnw%2BSCEsi99zd6ErZUqCzYICs2J9FNFSp7hdrNWiMch60FD"}],"group":"cf-nel","max_age":604800}
content-type: image/png
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 5edd33edecad971e-FRA
content-length: 18990
cf-request-id: 063e1ec8b50000971e9121e000000001

GET
H2 200 spinner.gif
spm-so.com/dr/op/bo/xed/images/ 350 KB
350 KB 225ms
224ms Image
image/gif 2606:4700:3031::681b:84cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://spm-so.com/dr/op/bo/xed/images/spinner.gif
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/?X1=george@g3intl.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:84cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 73257fb51b4e9c849a46820ae181173030b1a15d1c5a597f5840e353b438b33a

Request headers

Referer: https://spm-so.com/dr/op/bo/xed/?X1=george@g3intl.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 06 Nov 2020 07:46:48 GMT
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:19 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=VEo%2F67jAvQe2j%2BOwqUOyGfTsQ6DO9zCVuQI%2BMKa8k4oeYHfLI%2BZsn358Lckx7sHqwABtKwQ0V%2BAhCm%2BPdErRLKP%2BtHKzlbR6SX7mZU1wS5XCRnYHkA0s"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 5edd33edecae971e-FRA
content-length: 357935
cf-request-id: 063e1ec8b50000971e8bb8e000000001

GET
H2 200 email-decode.min.js Show response
spm-so.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 8ms
8ms Script
application/javascript 2606:4700:3031::681b:84cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://spm-so.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/?X1=george@g3intl.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::681b:84cc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://spm-so.com/dr/op/bo/xed/?X1=george@g3intl.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 06 Nov 2020 07:46:48 GMT
content-encoding: gzip
vary: Accept-Encoding
nel: {"report_to":"cf-nel","max_age":604800}
status: 200
cf-request-id: 063e1ec8080000971e8d37b000000001
last-modified: Tue, 27 Oct 2020 17:34:18 GMT
server: cloudflare
etag: W/"5f985a1a-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=kam4RkgQOmxKQtNvrofa4nyCgynzM68XDEMoVkpcQQWoF7%2FLNj2TwPecufj%2F1ajlg%2FLcMEz6GvFC6ZSe%2FPdEh1DA9fUY6i5xobzmtIYBGdp4ckG54pPI"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 5edd33ecdc63971e-FRA
expires: Sun, 08 Nov 2020 07:46:48 GMT

GET
H2 200 main.js Show response
spm-so.com/dr/op/bo/xed/js/ 2 KB
750 B 102ms
101ms Script
application/javascript 2606:4700:3031::681b:84cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spm-so.com/dr/op/bo/xed/js/main.js
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/?X1=george@g3intl.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:84cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d89a90eccb388e8a5ef0fa69eda8cc1333a24312fb7fb9b00ed72063d0d71965

Request headers

Referer: https://spm-so.com/dr/op/bo/xed/?X1=george@g3intl.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 06 Nov 2020 07:46:48 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:20 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=EwofiKZfToiTTwNaBNFXRtq4pOCpAecP%2Fu%2B33cNKIgUFqT%2BKBpTCgwKRnqEOAkfMEHCkmjy600LMma%2BpnbQe9LEaWLer3gKJQprkmvBlgXn74Jl2bOb8"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 5edd33ecec6a971e-FRA
cf-request-id: 063e1ec8110000971e7e27c000000001

GET
H2 200 fa-brands-400.woff2
spm-so.com/dr/op/bo/xed/webfonts/ 76 KB
76 KB 207ms
206ms Font
font/woff2 2606:4700:3031::681b:84cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spm-so.com/dr/op/bo/xed/webfonts/fa-brands-400.woff2
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/styles/all.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:84cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e98ae3ff936b4723cd8a2377d2c549a667ce87e81201ec4995cc01bd374c1288

Request headers

Origin: https://spm-so.com
Referer: https://spm-so.com/dr/op/bo/xed/styles/all.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 06 Nov 2020 07:46:48 GMT
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:26 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ZUonmUxpOEOqJ0V1bhdX7U%2BzCTbeAUp0c49O6X8R4fcVGNDCDur%2FkWuYUk9WwLVCGHZwYHt9YNdf97sbTMXXK%2BLpuO%2F2PdrAcncbYybuKJFKyq%2B0EiNr"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 5edd33edfcb3971e-FRA
content-length: 77444
cf-request-id: 063e1ec8bc0000971e7d1ce000000001

GET
H2 200 fa-regular-400.woff2
spm-so.com/dr/op/bo/xed/webfonts/ 13 KB
14 KB 91ms
90ms Font
font/woff2 2606:4700:3031::681b:84cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spm-so.com/dr/op/bo/xed/webfonts/fa-regular-400.woff2
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/styles/all.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:84cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: de5fb40e0689f154902213527781c2fb83cddcbf8f622a1384f1e2a7e7693b21

Request headers

Origin: https://spm-so.com
Referer: https://spm-so.com/dr/op/bo/xed/styles/all.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 06 Nov 2020 07:46:48 GMT
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:27 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=iB4rTjgURkDd%2Bj5xmY4E5t%2BTKol2a1yXamz353PCdbhThhjxeuPEpoBiMObt%2BE%2FW5%2BaiODKjpUy2GeDOwTzDbXVwBFYRsPohmM310gUrH4VvA56HuQFA"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 5edd33edfcb5971e-FRA
content-length: 13596
cf-request-id: 063e1ec8bc0000971e79960000000001

GET
H2 200 fa-solid-900.woff2
spm-so.com/dr/op/bo/xed/webfonts/ 78 KB
79 KB 209ms
209ms Font
font/woff2 2606:4700:3031::681b:84cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spm-so.com/dr/op/bo/xed/webfonts/fa-solid-900.woff2
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/styles/all.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:84cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0bf1b8d8ac1b4ef0caea0db8cbe1b6a35f8a84a2f5fffa2421936cc11a1a91fc

Request headers

Origin: https://spm-so.com
Referer: https://spm-so.com/dr/op/bo/xed/styles/all.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 06 Nov 2020 07:46:48 GMT
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:29 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=gXt6pwmMzB4XZp3x7JxIHzold3NaSoUS5dzoEW2PDoI6wdAVFp92lQDrrUoE3WSRoKP3Uc0Cdd%2FQDPCixerW%2FqUM%2Fuy5SGjIk0OzSzbdCmMDQ1V4RXMR"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 5edd33edfcb6971e-FRA
content-length: 80328
cf-request-id: 063e1ec8bc0000971e8797b000000001

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Dropbox (Consumer)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.spm-so.com/	1970-01-19 14:27:20	Name: __cfduid Value: de83f710f78161639ef697eb830e8240c1604648808

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

spm-so.com
2606:4700:3031::681b:84cc
0bf1b8d8ac1b4ef0caea0db8cbe1b6a35f8a84a2f5fffa2421936cc11a1a91fc
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37
530cb4c29b444dc89dd73a4e0812f803be98d3448a48edca8aafdbc55a0b97eb
5eedb987a0d26a60527854460e67bb0762de152f45b5be580de5aa21e524d309
7253f301aa0fd63fad4935c51eba121f766a630a9f47b25d24cd7b281e3ca943
73257fb51b4e9c849a46820ae181173030b1a15d1c5a597f5840e353b438b33a
ab96691d78536247ca2ab64aac5af744cf699926fa30d393ae859c9fa803b42c
b6a4e4eb69c0c7601ff58f4546567810128008e2cb99dc08c22bba4093b4a722
d89a90eccb388e8a5ef0fa69eda8cc1333a24312fb7fb9b00ed72063d0d71965
de5fb40e0689f154902213527781c2fb83cddcbf8f622a1384f1e2a7e7693b21
e98ae3ff936b4723cd8a2377d2c549a667ce87e81201ec4995cc01bd374c1288
f197d9da74ec12bcfeb42f4ace83d2b31b2dd06c70a60aa8f9d89c8f58efa9e3
f7073bfb112d0cd34f9790a9d03e4d161afb8efd533cc650d8c3fdd64f0341bc

spm-so.com Open in urlscan Pro 2606:4700:3031::681b:84cc Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

658 kBTransfer

927 kBSize

1 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

1 Cookies

Indicators

spm-so.com Open in urlscan Pro
2606:4700:3031::681b:84cc Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

658 kB
Transfer

927 kB
Size

1
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!