leighfellowship.co.za
Open in
urlscan Pro
41.78.244.138
Malicious Activity!
Public Scan
Effective URL: https://leighfellowship.co.za/cgibins/$%23$@%23!$@%25%25%23&%5e%5e%25%25%5e%23%5e&@$%5e@%25@%5e%25$@%25$$@@@%25%5e@@%5e@%5e@%5...
Submission: On January 12 via manual from US
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on December 17th 2017. Valid for: 3 months.
This is the only time leighfellowship.co.za was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Office 365 (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 9 | 41.78.244.138 41.78.244.138 | 327987 (Webstorm) (Webstorm) | |
3 | 104.111.248.227 104.111.248.227 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
10 | 2 |
ASN327987 (Webstorm, ZA)
PTR: hades.titanrack.net
loveachieveteach.co.za | |
leighfellowship.co.za |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-248-227.deploy.static.akamaitechnologies.com
secure.aadcdn.microsoftonline-p.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
loveachieveteach.co.za
1 redirects
loveachieveteach.co.za |
556 B |
4 |
leighfellowship.co.za
1 redirects
leighfellowship.co.za |
462 B |
3 |
microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com |
|
10 | 3 |
Domain | Requested by | |
---|---|---|
5 | loveachieveteach.co.za |
1 redirects
loveachieveteach.co.za
|
4 | leighfellowship.co.za |
1 redirects
leighfellowship.co.za
|
3 | secure.aadcdn.microsoftonline-p.com |
leighfellowship.co.za
|
10 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
login.microsoftonline.com |
login.live.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
loveachieveteach.co.za Let's Encrypt Authority X3 |
2017-12-29 - 2018-03-29 |
3 months | crt.sh |
leighfellowship.co.za Let's Encrypt Authority X3 |
2017-12-17 - 2018-03-17 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://leighfellowship.co.za/cgibins/$%23$@%23!$@%25%25%23&%5e%5e%25%25%5e%23%5e&@$%5e@%25@%5e%25$@%25$$@@@%25%5e@@%5e@%5e@%5e@%5e%25@%25%5e@%5e%25@%25%25@%25@%5e@%25$$%25@$%25@!$%25@%25@%5e@%25%5e@%25%25@%25@%25%5e@%25@%5e@%25@%25@%25@%25/
Frame ID: (DBC808B04C99ED88CF8EAD41308E622A)
Requests: 10 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://loveachieveteach.co.za/today/$%23$%23%25%5E%23%25%23%25%25%5E@%5E&&@*%25%23&%5E%23$%23%25@$&&@%5E%2...
HTTP 301
https://loveachieveteach.co.za/today/$%23$%23%25%5e%23%25%23%25%25%5e@%5e&&@*%25%23&%5e%23$%23%25@$&&@%5e%2... Page URL
-
https://leighfellowship.co.za/cgibins/%24%23%24%40%23!%24%40%25%25%23%26%5E%5E%25%25%5E%23%5E%26%40%24%5E%...
HTTP 301
https://leighfellowship.co.za/cgibins/$%23$@%23!$@%25%25%23&%5e%5e%25%25%5e%23%5e&@$%5e@%25@%5e%25$@%25$$@... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: get a new Microsoft account
Search URL Search Domain Scan URL
Title: Sign in with a Microsoft account
Search URL Search Domain Scan URL
Title: Terms of use
Search URL Search Domain Scan URL
Title: Privacy & Cookies
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://loveachieveteach.co.za/today/$%23$%23%25%5E%23%25%23%25%25%5E@%5E&&@*%25%23&%5E%23$%23%25@$&&@%5E%23%25$%25%25%23%5E$%23%5E%25%23@$&%5E@$%23%25%23%5E%23%23$%25@$&%23%25%23$%25%23%23$@&%23%25%23%5E&@$%5E%25@$%23%25%5E$%23@%25%5E&$%23%25%5E%23@$%25%23%5E@%25$%23%25%23&$@%25@$%23%5E%23%25$%23%25$%25%5E%23%5E$%25$%25%5E%23%5E%25
HTTP 301
https://loveachieveteach.co.za/today/$%23$%23%25%5e%23%25%23%25%25%5e@%5e&&@*%25%23&%5e%23$%23%25@$&&@%5e%23%25$%25%25%23%5e$%23%5e%25%23@$&%5e@$%23%25%23%5e%23%23$%25@$&%23%25%23$%25%23%23$@&%23%25%23%5e&@$%5e%25@$%23%25%5e$%23@%25%5e&$%23%25%5e%23@$%25%23%5e@%25$%23%25%23&$@%25@$%23%5e%23%25$%23%25$%25%5e%23%5e$%25$%25%5e%23%5e%25/ Page URL
-
https://leighfellowship.co.za/cgibins/%24%23%24%40%23!%24%40%25%25%23%26%5E%5E%25%25%5E%23%5E%26%40%24%5E%40%25%40%5E%25%24%40%25%24%24%40%40%40%25%5E%40%40%5E%40%5E%40%5E%40%5E%25%40%25%5E%40%5E%25%40%25%25%40%25%40%5E%40%25%24%24%25%40%24%25%40!%24%25%40%25%40%5E%40%25%5E%40%25%25%40%25%40%25%5E%40%25%40%5E%40%25%40%25%40%25%40%25
HTTP 301
https://leighfellowship.co.za/cgibins/$%23$@%23!$@%25%25%23&%5e%5e%25%25%5e%23%5e&@$%5e@%25@%5e%25$@%25$$@@@%25%5e@@%5e@%5e@%5e@%5e%25@%25%5e@%5e%25@%25%25@%25@%5e@%25$$%25@$%25@!$%25@%25@%5e@%25%5e@%25%25@%25@%25%5e@%25@%5e@%25@%25@%25@%25/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://loveachieveteach.co.za/today/$%23$%23%25%5E%23%25%23%25%25%5E@%5E&&@*%25%23&%5E%23$%23%25@$&&@%5E%23%25$%25%25%23%5E$%23%5E%25%23@$&%5E@$%23%25%23%5E%23%23$%25@$&%23%25%23$%25%23%23$@&%23%25%23%5E&@$%5E%25@$%23%25%5E$%23@%25%5E&$%23%25%5E%23@$%25%23%5E@%25$%23%25%23&$@%25@$%23%5E%23%25$%23%25$%25%5E%23%5E$%25$%25%5E%23%5E%25 HTTP 301
- https://loveachieveteach.co.za/today/$%23$%23%25%5e%23%25%23%25%25%5e@%5e&&@*%25%23&%5e%23$%23%25@$&&@%5e%23%25$%25%25%23%5e$%23%5e%25%23@$&%5e@$%23%25%23%5e%23%23$%25@$&%23%25%23$%25%23%23$@&%23%25%23%5e&@$%5e%25@$%23%25%5e$%23@%25%5e&$%23%25%5e%23@$%25%23%5e@%25$%23%25%23&$@%25@$%23%5e%23%25$%23%25$%25%5e%23%5e$%25$%25%5e%23%5e%25/
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
loveachieveteach.co.za/today/$%23$%23%25%5e%23%25%23%25%25%5e@%5e&&@*%25%23&%5e%23$%23%25@$&&@%5e%23%25$%25%25%23%5e$%23%5e%25%23@$&%5e@$%23%25%23%5e%23%23$%25@$&%23%25%23$%25%23%23$@&%23%25%23%5e&... Redirect Chain
|
1 KB 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mvc_content_style.css
loveachieveteach.co.za/today/$%23$%23%25%5e%23%25%23%25%25%5e@%5e&&@*%25%23&%5e%23$%23%25@$&&@%5e%23%25$%25%25%23%5e$%23%5e%25%23@$&%5e@$%23%25%23%5e%23%23$%25@$&%23%25%23$%25%23%23$@&%23%25%23%5e&... |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mvc_header_footer_style.css
loveachieveteach.co.za/today/$%23$%23%25%5e%23%25%23%25%25%5e@%5e&&@*%25%23&%5e%23$%23%25@$&&@%5e%23%25$%25%25%23%5e$%23%5e%25%23@$&%5e@$%23%25%23%5e%23%23$%25@$&%23%25%23$%25%23%23$@&%23%25%23%5e&... |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dot_clear.gif
loveachieveteach.co.za/today/$%23$%23%25%5e%23%25%23%25%25%5e@%5e&&@*%25%23&%5e%23$%23%25@$&&@%5e%23%25$%25%25%23%5e$%23%5e%25%23@$&%5e@$%23%25%23%5e%23%23$%25@$&%23%25%23$%25%23%23$@&%23%25%23%5e&... |
525 B 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
leighfellowship.co.za/cgibins/$%23$@%23!$@%25%25%23&%5e%5e%25%25%5e%23%5e&@$%5e@%25@%5e%25$@%25$$@@@%25%5e@@%5e@%5e@%5e@%5e%25@%25%5e@%5e%25@%25%25@%25@%5e@%25$$%25@$%25@!$%25@%25@%5e@%25%5e@%25%25... Redirect Chain
|
38 KB 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.min.css
leighfellowship.co.za/cgibins/$%23$@%23!$@%25%25%23&%5e%5e%25%25%5e%23%5e&@$%5e@%25@%5e%25$@%25$$@@@%25%5e@@%5e@%5e@%5e@%5e%25@%25%5e@%5e%25@%25%25@%25@%5e@%25$$%25@$%25@!$%25@%25@%5e@%25%5e@%25%25... |
21 KB 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_hover.min.css
leighfellowship.co.za/cgibins/$%23$@%23!$@%25%25%23&%5e%5e%25%25%5e%23%5e&@$%5e@%25@%5e%25$@%25$$@@@%25%5e@@%5e@%5e@%5e@%5e%25@%25%5e@%5e%25@%25%25@%25@%5e@%25$$%25@$%25@!$%25@%25@%5e@%25%5e@%25%25... |
89 B 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
heroillustration
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-uymyxxfhpwrbckvwvlxle8radh6vkzaj7cwkqpqixg/appbranding/4gxvxxtv1vaumat9ftkvh9ewyw-wh4ibokuvhgknx7q/0/ |
199 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bannerlogo
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-uymyxxfhpwrbckvwvlxle8radh6vkzaj7cwkqpqixg/appbranding/4gxvxxtv1vaumat9ftkvh9ewyw-wh4ibokuvhgknx7q/0/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
microsoft_logo.png
secure.aadcdn.microsoftonline-p.com/ests/2.1.4856.11/content/images/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Office 365 (Online)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onafterprint object| onbeforeprint undefined| body object| Constants object| Tiles object| bssoTelemetry object| bssoOptions0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
leighfellowship.co.za
loveachieveteach.co.za
secure.aadcdn.microsoftonline-p.com
104.111.248.227
41.78.244.138
2b86a59ef33b3b69c0dfa3225d0cf8664ad9a5d9fb2126dba04b5e228d60e792
7594c27f0f7da27b75f8c0be96dd93eb27d51d763728033d73827292a16667be
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
91c2b74542e11d0278e02715a980b39582eae2e3b519ddd2d4f9ca939e58109c
988e349f2bf4e87154738c7b2c1fa86618713a8cfa0cef60a046f5add89bd9de
ab944503cb89c5e2e47dd7c27bdcbb1b18258a59c105a1104f5ddaf86f0ad3d2
d91d58398123f96ab551e23689532d2d6b611d86de5b89677ad34f52586bc985
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603