departameno-de-educac.s3.us-east-005.backblazeb2.com Open in urlscan Pro
149.137.141.9  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200	Primary Request documefyoip.htm Show response departameno-de-educac.s3.us-east-005.backblazeb2.com/SHearpion-microsof-g667d67hYFT66789/	223 KB 224 KB	89ms 60ms	Document text/html	149.137.141.9 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://departameno-de-educac.s3.us-east-005.backblazeb2.com/SHearpion-microsof-g667d67hYFT66789/documefyoip.htm Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 149.137.141.9 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS s3.us-east-005.backblazeb2.com Software nginx / Resource Hash 3ced6fda870079a39ef37fa024164802ad3e7ed92c88f80ac373fd5f9faba236 Security Headers Name Value Strict-Transport-Security max-age=63072000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Accept-Ranges bytes Connection keep-alive Content-Length 228659 Content-Type text/html Date Sat, 07 Sep 2024 16:04:20 GMT ETag "dac5452462349813ff436e562be5e5c2" Last-Modified Mon, 02 Sep 2024 12:43:33 GMT Server nginx Strict-Transport-Security max-age=63072000 x-amz-id-2 aNSRm2mQrOFE3jDLdYjQ2bjY+MjkwnjGy x-amz-meta-src_last_modified_millis 1725280813976 x-amz-request-id 1660b423b9c03594 x-amz-server-side-encryption AES256 x-amz-version-id 4_z65ef5d18c712bb2696120011_f115f33867a93fb08_d20240902_m124333_c005_v0501024_t0015_u01725281013402
GET H2	200	w3.css www.w3schools.com/w3css/4/	23 KB 5 KB	43ms 4ms	Stylesheet text/css	192.229.173.207 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://www.w3schools.com/w3css/4/w3.css Requested by Host: departameno-de-educac.s3.us-east-005.backblazeb2.com URL: https://departameno-de-educac.s3.us-east-005.backblazeb2.com/SHearpion-microsof-g667d67hYFT66789/documefyoip.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.173.207 New York, United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (nyd/D164) / ASP.NET Resource Hash c4f2aba13970ecf8303fb9329f97c8824861569273b0aa27acce48abc61d04f5 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://mycourses.w3schools.com https://pathfinder.w3schools.com; X-Content-Security-Policy frame-ancestors 'self' https://mycourses.w3schools.com https://pathfinder.w3schools.com; Request headers Referer https://departameno-de-educac.s3.us-east-005.backblazeb2.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers content-security-policy frame-ancestors 'self' https://mycourses.w3schools.com https://pathfinder.w3schools.com; content-encoding gzip date Sat, 07 Sep 2024 16:04:20 GMT last-modified Fri, 06 Sep 2024 10:45:10 GMT server ECS (nyd/D164) age 100540 etag "0bf5ad8490db1:0" x-powered-by ASP.NET vary Accept-Encoding x-cache HIT content-type text/css cache-control public,max-age=31536000,public accept-ranges bytes content-length 5250 x-content-security-policy frame-ancestors 'self' https://mycourses.w3schools.com https://pathfinder.w3schools.com;
GET H2	200	2_bc3d32a696895f78c19df6c717586a5d.svg logincdn.msftauth.net/shared/1.0/content/images/backgrounds/	2 KB 1 KB	63ms 11ms	Image image/svg+xml	2606:2800:11f:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://logincdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg Requested by Host: departameno-de-educac.s3.us-east-005.backblazeb2.com URL: https://departameno-de-educac.s3.us-east-005.backblazeb2.com/SHearpion-microsof-g667d67hYFT66789/documefyoip.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (nyd/D156) / Resource Hash 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68 Request headers Referer https://departameno-de-educac.s3.us-east-005.backblazeb2.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sat, 07 Sep 2024 16:04:20 GMT content-encoding gzip content-md5 DhdidjYrlCeaRJJRG/y9mA== age 14351683 x-cache HIT content-length 673 x-ms-lease-status unlocked last-modified Wed, 12 Feb 2020 22:01:42 GMT server ECAcc (nyd/D156) etag 0x8D7B00724D9E930 vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 0cd24801-301e-00ac-1ab8-7e6859000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET DATA	200 OK	truncated /	86 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 001cc1e2db225566c62abb1c6c3d184586db6d66ec3e9ca641aee4079118a428 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	8 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b49dd2b6a031c9cf4dc1041c8a0a02cf894552868a13c145384e8a1360cbb1b5 Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET H2	200	documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg logincdn.msauth.net/shared/1.0/content/images/	2 KB 1 KB	137ms 4ms	Image image/svg+xml	2620:1ec:bdf::40 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://logincdn.msauth.net/shared/1.0/content/images/documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg Requested by Host: departameno-de-educac.s3.us-east-005.backblazeb2.com URL: https://departameno-de-educac.s3.us-east-005.backblazeb2.com/SHearpion-microsof-g667d67hYFT66789/documefyoip.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash a76c08e9cdc3bb87bfb57627ad8f6b46f0e5ef826cc7f046dfbaf25d7b7958ea Request headers Referer https://departameno-de-educac.s3.us-east-005.backblazeb2.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sat, 07 Sep 2024 16:04:20 GMT content-encoding gzip x-cache TCP_HIT x-fd-int-roxy-purgeid 67912908 content-length 606 x-ms-lease-status unlocked last-modified Wed, 22 Jan 2020 00:38:04 GMT etag 0x8D79ED3581609DD x-azure-ref 20240907T160420Z-16579567576cn8jdyhfng4vp3800000003g00000000014aq content-type image/svg+xml access-control-allow-origin * x-ms-request-id 4de027da-301e-0002-79a1-fb7dee000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg logincdn.msauth.net/shared/1.0/content/images/	513 B 822 B	137ms 5ms	Image image/svg+xml	2620:1ec:bdf::40 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg Requested by Host: departameno-de-educac.s3.us-east-005.backblazeb2.com URL: https://departameno-de-educac.s3.us-east-005.backblazeb2.com/SHearpion-microsof-g667d67hYFT66789/documefyoip.htm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58 Request headers Referer https://departameno-de-educac.s3.us-east-005.backblazeb2.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sat, 07 Sep 2024 16:04:20 GMT content-encoding gzip x-cache TCP_HIT x-fd-int-roxy-purgeid 67912908 content-length 276 x-ms-lease-status unlocked last-modified Wed, 22 Jan 2020 00:38:00 GMT etag 0x8D79ED35591CF44 x-azure-ref 20240907T160420Z-16579567576cn8jdyhfng4vp3800000003g00000000014ar content-type image/svg+xml access-control-allow-origin * x-ms-request-id 686be74e-001e-0054-3998-ff8c01000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H/1.1	200 OK	favicon.ico p.sfx.ms/images/	8 KB 8 KB	138ms 12ms	Other image/x-icon	40.76.161.136 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://p.sfx.ms/images/favicon.ico Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 40.76.161.136 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / Resource Hash 24638331466a52bb66f912090e7a9cc9e3df2236e39c187c9409104526b472b0 Request headers Referer https://departameno-de-educac.s3.us-east-005.backblazeb2.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Date Sat, 07 Sep 2024 16:04:20 GMT X-MSNServer 546c7c6d68-wpkvf Last-Modified Mon, 04 Mar 2024 19:02:48 GMT Server Microsoft-IIS/10.0 ETag "07c468c666eda1:0" X-ODWebServer nameastus7813713-odwebp Content-Type image/x-icon Cache-Control public,max-age=86400 Accept-Ranges bytes Content-Length 7886
GET H2	200	Background-blurryGradient.svg odc.officeapps.live.com/odc/stat/images/hrd/	2 KB 3 KB	197ms 19ms	Image image/svg+xml	2603:1036:2405::7 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://odc.officeapps.live.com/odc/stat/images/hrd/Background-blurryGradient.svg Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2603:1036:2405::7 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash 16c60cd6aff6a6febabbc48e9b7692a9c3b369d12d31749f8117d6d0851d5296 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://departameno-de-educac.s3.us-east-005.backblazeb2.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Sat, 07 Sep 2024 16:04:22 GMT x-content-type-options nosniff x-officeversion 16.0.18030.30552 x-powered-by ASP.NET x-officefe OdcFE_IN_55 p3p CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" content-length 2267 last-modified Fri, 30 Aug 2024 21:00:10 GMT server Microsoft-IIS/10.0 x-usersessionid e3538877-80b7-46de-b625-6be39423a37b x-correlationid e3538877-80b7-46de-b625-6be39423a37b x-officecluster eus2-000.odc.officeapps.live.com etag "0a993991ffbda1:0" content-type image/svg+xml cache-control private, max-age=2592000 accept-ranges bytes

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| ValidateEmail function| _0x24fc function| _0x4676 function| redirrectPage function| hasNull number| counter function| onChangeFunction

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://departameno-de-educac.s3.us-east-005.backblazeb2.com/SHearpion-microsof-g667d67hYFT66789/documefyoip.htm Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

departameno-de-educac.s3.us-east-005.backblazeb2.com
logincdn.msauth.net
logincdn.msftauth.net
odc.officeapps.live.com
p.sfx.ms
www.w3schools.com
149.137.141.9
192.229.173.207
2603:1036:2405::7
2606:2800:11f:1cb7:261b:1f9c:2074:3c
2620:1ec:bdf::40
40.76.161.136
001cc1e2db225566c62abb1c6c3d184586db6d66ec3e9ca641aee4079118a428
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
16c60cd6aff6a6febabbc48e9b7692a9c3b369d12d31749f8117d6d0851d5296
24638331466a52bb66f912090e7a9cc9e3df2236e39c187c9409104526b472b0
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
3ced6fda870079a39ef37fa024164802ad3e7ed92c88f80ac373fd5f9faba236
a76c08e9cdc3bb87bfb57627ad8f6b46f0e5ef826cc7f046dfbaf25d7b7958ea
b49dd2b6a031c9cf4dc1041c8a0a02cf894552868a13c145384e8a1360cbb1b5
c4f2aba13970ecf8303fb9329f97c8824861569273b0aa27acce48abc61d04f5