Submitted URL: http://r.actum.pt/tr/cl/3_TCbhK8XK6-vvlmUyFtwT7aPDo6ipfKXOTgAonu6hAYUipV_UcYhjsLuBiCUd9_ItFf9GQj20oIsQ_BKSJD3KymKw...
Effective URL: http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/
Submission: On March 01 via manual from GB

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 11 HTTP transactions. The main IP is 176.126.200.11, located in Romania and belongs to CHML-AS, RO. The main domain is totemteam.ro.
This is the only time totemteam.ro was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OneDrive (Online)

Domain & IP information

IP Address AS Autonomous System
1 104.16.234.163 13335 (CLOUDFLAR...)
1 2606:4700:30:... 13335 (CLOUDFLAR...)
1 7 176.126.200.11 40975 (CHML-AS)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
11 5
Domain Requested by
7 totemteam.ro 1 redirects r.actum.pt
totemteam.ro
2 fonts.googleapis.com totemteam.ro
1 fonts.gstatic.com totemteam.ro
1 sibautomation.com r.actum.pt
1 r.actum.pt
11 5

This site contains no links.

Subject Issuer Validity Valid
sni117763.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-02-09 -
2019-08-18
6 months crt.sh
*.googleapis.com
Google Internet Authority G3
2019-02-13 -
2019-05-08
3 months crt.sh
*.google.com
Google Internet Authority G3
2019-02-13 -
2019-05-08
3 months crt.sh

This page contains 2 frames:

Primary Page: http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/
Frame ID: F5E2A6795A6B575AC12B7CC13B7BEDDE
Requests: 10 HTTP requests in this frame

Frame: https://sibautomation.com/cm.html?id=2203292
Frame ID: 01D87BAD7D65C4E940FBB0862AE9A565
Requests: 1 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://r.actum.pt/tr/cl/3_TCbhK8XK6-vvlmUyFtwT7aPDo6ipfKXOTgAonu6hAYUipV_UcYhjsLuBiCUd9_ItFf9G... Page URL
  2. http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one... HTTP 301
    http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /cloudflare/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

11
Requests

36 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

228 kB
Transfer

234 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://r.actum.pt/tr/cl/3_TCbhK8XK6-vvlmUyFtwT7aPDo6ipfKXOTgAonu6hAYUipV_UcYhjsLuBiCUd9_ItFf9GQj20oIsQ_BKSJD3KymKwjGmTsuu46VEZAAEHPTc5DUiGESC8zgEKqG6BYo1C75eVJdIH_5QNO2VqfMMzgw9G5BHrw5lvIo4dIvuL2nk8c4jsE7mIK1932Vtt2cJQhWf8j6ssxJhRoxQKlw8lQ1OwfWpOlxbotNbH0UA_vRXSgNM7NKuMTqyC6iv0BS9JKVz7MU6_ejtWfGb2R9ij8aXsJx-ht3ng Page URL
  2. http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs HTTP 301
    http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Cookie set 3_TCbhK8XK6-vvlmUyFtwT7aPDo6ipfKXOTgAonu6hAYUipV_UcYhjsLuBiCUd9_ItFf9GQj20oIsQ_BKSJD3KymKwjGmTsuu46VEZAAEHPTc5DUiGESC8zgEKqG6BYo1C75eVJdIH_5QNO2VqfMMzgw9G5BHrw5lvIo4dIvuL2nk8c4jsE7mIK1932Vtt2cJQhWf...
r.actum.pt/tr/cl/
753 B
942 B
Document
General
Full URL
http://r.actum.pt/tr/cl/3_TCbhK8XK6-vvlmUyFtwT7aPDo6ipfKXOTgAonu6hAYUipV_UcYhjsLuBiCUd9_ItFf9GQj20oIsQ_BKSJD3KymKwjGmTsuu46VEZAAEHPTc5DUiGESC8zgEKqG6BYo1C75eVJdIH_5QNO2VqfMMzgw9G5BHrw5lvIo4dIvuL2nk8c4jsE7mIK1932Vtt2cJQhWf8j6ssxJhRoxQKlw8lQ1OwfWpOlxbotNbH0UA_vRXSgNM7NKuMTqyC6iv0BS9JKVz7MU6_ejtWfGb2R9ij8aXsJx-ht3ng
Protocol
HTTP/1.1
Server
104.16.234.163 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8dced0dbcf1fc4f426bddde5d6223ddfb669663bb1cda9c67c49a4ad07e86862
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1

Request headers

Host
r.actum.pt
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 01 Mar 2019 12:47:41 GMT
Content-Type
text/html; charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
__cfduid=dcf8a7bfafa3cf68cf3c8514e470a932c1551444461; expires=Sat, 29-Feb-20 12:47:41 GMT; path=/; domain=.r.actum.pt; HttpOnly
X-Sib-Server
SENDINBLUE-red2-2
X-Content-Type-Options
nosniff
X-XSS-Protection
1
Server
cloudflare
CF-RAY
4b0b3dae4c6bc83d-AMS
Content-Encoding
gzip
cm.html
sibautomation.com/ Frame 01D8
0
0
Document
General
Full URL
https://sibautomation.com/cm.html?id=2203292
Requested by
Host: r.actum.pt
URL: http://r.actum.pt/tr/cl/3_TCbhK8XK6-vvlmUyFtwT7aPDo6ipfKXOTgAonu6hAYUipV_UcYhjsLuBiCUd9_ItFf9GQj20oIsQ_BKSJD3KymKwjGmTsuu46VEZAAEHPTc5DUiGESC8zgEKqG6BYo1C75eVJdIH_5QNO2VqfMMzgw9G5BHrw5lvIo4dIvuL2nk8c4jsE7mIK1932Vtt2cJQhWf8j6ssxJhRoxQKlw8lQ1OwfWpOlxbotNbH0UA_vRXSgNM7NKuMTqyC6iv0BS9JKVz7MU6_ejtWfGb2R9ij8aXsJx-ht3ng
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681f:5183 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Sails <sailsjs.org>
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1

Request headers

:method
GET
:authority
sibautomation.com
:scheme
https
:path
/cm.html?id=2203292
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
http://r.actum.pt/tr/cl/3_TCbhK8XK6-vvlmUyFtwT7aPDo6ipfKXOTgAonu6hAYUipV_UcYhjsLuBiCUd9_ItFf9GQj20oIsQ_BKSJD3KymKwjGmTsuu46VEZAAEHPTc5DUiGESC8zgEKqG6BYo1C75eVJdIH_5QNO2VqfMMzgw9G5BHrw5lvIo4dIvuL2nk8c4jsE7mIK1932Vtt2cJQhWf8j6ssxJhRoxQKlw8lQ1OwfWpOlxbotNbH0UA_vRXSgNM7NKuMTqyC6iv0BS9JKVz7MU6_ejtWfGb2R9ij8aXsJx-ht3ng
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://r.actum.pt/tr/cl/3_TCbhK8XK6-vvlmUyFtwT7aPDo6ipfKXOTgAonu6hAYUipV_UcYhjsLuBiCUd9_ItFf9GQj20oIsQ_BKSJD3KymKwjGmTsuu46VEZAAEHPTc5DUiGESC8zgEKqG6BYo1C75eVJdIH_5QNO2VqfMMzgw9G5BHrw5lvIo4dIvuL2nk8c4jsE7mIK1932Vtt2cJQhWf8j6ssxJhRoxQKlw8lQ1OwfWpOlxbotNbH0UA_vRXSgNM7NKuMTqyC6iv0BS9JKVz7MU6_ejtWfGb2R9ij8aXsJx-ht3ng

Response headers

status
200
date
Fri, 01 Mar 2019 12:47:41 GMT
content-type
text/html; charset=utf-8
set-cookie
__cfduid=da9265411bafca5b8f7105dd9c56820ad1551444461; expires=Sat, 29-Feb-20 12:47:41 GMT; path=/; domain=.sibautomation.com; HttpOnly
x-powered-by
Sails <sailsjs.org>
access-control-allow-origin
*
access-control-allow-credentials
access-control-allow-methods
access-control-allow-headers
access-control-expose-headers
vary
Accept-Encoding
x-sib-server
SENDINBLUE-web1-2
x-content-type-options
nosniff
x-xss-protection
1
cf-cache-status
HIT
expires
Fri, 01 Mar 2019 14:47:41 GMT
cache-control
public, max-age=7200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
4b0b3daee831c297-FRA
content-encoding
br
Primary Request /
totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/
Redirect Chain
  • http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs
  • http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/
2 KB
1 KB
Document
General
Full URL
http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/
Requested by
Host: r.actum.pt
URL: http://r.actum.pt/tr/cl/3_TCbhK8XK6-vvlmUyFtwT7aPDo6ipfKXOTgAonu6hAYUipV_UcYhjsLuBiCUd9_ItFf9GQj20oIsQ_BKSJD3KymKwjGmTsuu46VEZAAEHPTc5DUiGESC8zgEKqG6BYo1C75eVJdIH_5QNO2VqfMMzgw9G5BHrw5lvIo4dIvuL2nk8c4jsE7mIK1932Vtt2cJQhWf8j6ssxJhRoxQKlw8lQ1OwfWpOlxbotNbH0UA_vRXSgNM7NKuMTqyC6iv0BS9JKVz7MU6_ejtWfGb2R9ij8aXsJx-ht3ng
Protocol
HTTP/1.1
Server
176.126.200.11 , Romania, ASN40975 (CHML-AS, RO),
Reverse DNS
entry01.octosquid.com
Software
LiteSpeed /
Resource Hash
f8aa8442ce1b68091ed7e6281d0b6f60660a4fdc1e77a9243eccba9a65879f7c

Request headers

Host
totemteam.ro
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://r.actum.pt/tr/cl/3_TCbhK8XK6-vvlmUyFtwT7aPDo6ipfKXOTgAonu6hAYUipV_UcYhjsLuBiCUd9_ItFf9GQj20oIsQ_BKSJD3KymKwjGmTsuu46VEZAAEHPTc5DUiGESC8zgEKqG6BYo1C75eVJdIH_5QNO2VqfMMzgw9G5BHrw5lvIo4dIvuL2nk8c4jsE7mIK1932Vtt2cJQhWf8j6ssxJhRoxQKlw8lQ1OwfWpOlxbotNbH0UA_vRXSgNM7NKuMTqyC6iv0BS9JKVz7MU6_ejtWfGb2R9ij8aXsJx-ht3ng
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://r.actum.pt/tr/cl/3_TCbhK8XK6-vvlmUyFtwT7aPDo6ipfKXOTgAonu6hAYUipV_UcYhjsLuBiCUd9_ItFf9GQj20oIsQ_BKSJD3KymKwjGmTsuu46VEZAAEHPTc5DUiGESC8zgEKqG6BYo1C75eVJdIH_5QNO2VqfMMzgw9G5BHrw5lvIo4dIvuL2nk8c4jsE7mIK1932Vtt2cJQhWf8j6ssxJhRoxQKlw8lQ1OwfWpOlxbotNbH0UA_vRXSgNM7NKuMTqyC6iv0BS9JKVz7MU6_ejtWfGb2R9ij8aXsJx-ht3ng

Response headers

Content-Type
text/html; charset=UTF-8
Content-Length
906
Content-Encoding
gzip
Vary
Accept-Encoding
Date
Fri, 01 Mar 2019 12:47:42 GMT
Server
LiteSpeed
Connection
Keep-Alive

Redirect headers

Content-Type
text/html
Content-Length
617
Date
Fri, 01 Mar 2019 12:47:42 GMT
Server
LiteSpeed
Location
http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/
Connection
Keep-Alive
css
fonts.googleapis.com/
2 KB
616 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:600
Requested by
Host: totemteam.ro
URL: http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:819::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
1e3dbaf62562c1f6b3dc33fc018fe550b786f82a6502a3d2c4a9d1aaa32a6a68
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Fri, 01 Mar 2019 12:47:42 GMT
server
ESF
access-control-allow-origin
*
date
Fri, 01 Mar 2019 12:47:42 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection
1; mode=block
expires
Fri, 01 Mar 2019 12:47:42 GMT
style.css
totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/css/
7 KB
2 KB
Stylesheet
General
Full URL
http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/css/style.css
Requested by
Host: totemteam.ro
URL: http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/
Protocol
HTTP/1.1
Server
176.126.200.11 , Romania, ASN40975 (CHML-AS, RO),
Reverse DNS
entry01.octosquid.com
Software
LiteSpeed /
Resource Hash
697c5c68eff0ac91a4bff701f334f82c45ce9712b9db549e7e04242dc7ff39fa

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
totemteam.ro
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 01 Mar 2019 12:47:42 GMT
Content-Encoding
gzip
Last-Modified
Thu, 05 Oct 2017 11:19:20 GMT
Server
LiteSpeed
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
1807
Expires
Fri, 08 Mar 2019 12:47:42 GMT
css
fonts.googleapis.com/
0
570 B
Other
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:600
Requested by
Host: totemteam.ro
URL: http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:819::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Purpose
prefetch
Referer
http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Fri, 01 Mar 2019 12:47:42 GMT
server
ESF
access-control-allow-origin
*
date
Fri, 01 Mar 2019 12:47:42 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection
1; mode=block
expires
Fri, 01 Mar 2019 12:47:42 GMT
landing-devices-bg.jpg
totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/images/
195 KB
195 KB
Image
General
Full URL
http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/images/landing-devices-bg.jpg
Requested by
Host: totemteam.ro
URL: http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/
Protocol
HTTP/1.1
Server
176.126.200.11 , Romania, ASN40975 (CHML-AS, RO),
Reverse DNS
entry01.octosquid.com
Software
LiteSpeed /
Resource Hash
e8f80990badd44fd6d05b66b116d0ae7cba88ccaeae01805035263ce272937b7

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
totemteam.ro
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/css/style.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/css/style.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 01 Mar 2019 12:47:42 GMT
Last-Modified
Thu, 05 Oct 2017 11:20:12 GMT
Server
LiteSpeed
Content-Type
image/jpeg
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
199882
Expires
Fri, 08 Mar 2019 12:47:42 GMT
oneDrive.png
totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/images/
15 KB
15 KB
Image
General
Full URL
http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/images/oneDrive.png
Requested by
Host: totemteam.ro
URL: http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/
Protocol
HTTP/1.1
Server
176.126.200.11 , Romania, ASN40975 (CHML-AS, RO),
Reverse DNS
entry01.octosquid.com
Software
LiteSpeed /
Resource Hash
c010eda9ab4ad066a43d0b7fd4fe7f2be2e849af38db2e0b4af109ea7bcd5593

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
totemteam.ro
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/css/style.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/css/style.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 01 Mar 2019 12:47:42 GMT
Last-Modified
Thu, 05 Oct 2017 11:21:26 GMT
Server
LiteSpeed
Content-Type
image/png
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
14981
Expires
Fri, 08 Mar 2019 12:47:42 GMT
outlook.png
totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/images/
2 KB
2 KB
Image
General
Full URL
http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/images/outlook.png
Requested by
Host: totemteam.ro
URL: http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/
Protocol
HTTP/1.1
Server
176.126.200.11 , Romania, ASN40975 (CHML-AS, RO),
Reverse DNS
entry01.octosquid.com
Software
LiteSpeed /
Resource Hash
f5abe79538714148a390de1c7d7d568746510a32e14b37feacc4812155825558

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
totemteam.ro
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/css/style.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/css/style.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 01 Mar 2019 12:47:42 GMT
Last-Modified
Thu, 05 Oct 2017 11:21:30 GMT
Server
LiteSpeed
Content-Type
image/png
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
2103
Expires
Fri, 08 Mar 2019 12:47:42 GMT
office.png
totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/images/
1 KB
2 KB
Image
General
Full URL
http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/images/office.png
Requested by
Host: totemteam.ro
URL: http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/
Protocol
HTTP/1.1
Server
176.126.200.11 , Romania, ASN40975 (CHML-AS, RO),
Reverse DNS
entry01.octosquid.com
Software
LiteSpeed /
Resource Hash
685f77342ca77f562bb319cf666966ebd283ba9ad568148bf4d6f66d5fa08eb5

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
totemteam.ro
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/css/style.css
Connection
keep-alive
Cache-Control
no-cache
Referer
http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/css/style.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 01 Mar 2019 12:47:42 GMT
Last-Modified
Thu, 05 Oct 2017 11:21:22 GMT
Server
LiteSpeed
Content-Type
image/png
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
1421
Expires
Fri, 08 Mar 2019 12:47:42 GMT
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v15/
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v15/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
Requested by
Host: totemteam.ro
URL: http://totemteam.ro/SW8332one-drive3930nvofpdpdopoIAOCNSPA/asoivneiunviuniuevauernver/secure/one/drive/docs/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
50dda9aac0fcea362bdda27ae7833240485ad5a20ccc105c1cd13ea26802a8bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Open+Sans:600
Origin
http://totemteam.ro

Response headers

date
Fri, 08 Feb 2019 15:38:00 GMT
x-content-type-options
nosniff
last-modified
Wed, 11 Oct 2017 21:49:48 GMT
server
sffe
age
1804182
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
8916
x-xss-protection
1; mode=block
expires
Sat, 08 Feb 2020 15:38:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| popupwnd

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1