twdedition.com Open in urlscan Pro
188.165.207.30 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/home.php?reason=d...
Submission: On October 26 via automatic, source openphish (October 26th 2022, 2:19:02 pm UTC) — Scanned from FR

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 15 HTTP transactions. The main IP is 188.165.207.30, located in France and belongs to OVH, FR. The main domain is twdedition.com.

This is the only time twdedition.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
14	188.165.207.30 188.165.207.30	16276 (OVH) (OVH)
1	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
15	2

14 188.165.207.30 (France)

ASN16276 (OVH, FR)
PTR: ks.vslconceptshost.com

twdedition.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	twdedition.com twdedition.com	347 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 306	30 KB
15	2

	Domain	Requested by
14	twdedition.com	twdedition.com
1	ajax.googleapis.com	twdedition.com
15	2

This site contains no links.

Subject Issuer	Validity	Valid
upload.video.google.com GTS CA 1C3	`2022-09-26` - `2022-12-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/home.php?reason=d02032286070b4dd9d8fbd985a7bdca8af8edf52b89ff177db3bfcb2c8a9c43d
Frame ID: 7ABC4C9878DAAD3985D444C726E7145D
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

SharePoint Online

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

7 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

377 kB
Transfer

826 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request home.php Show response
twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/ 5 KB
2 KB 5300ms
5093ms Document
text/html 188.165.207.30
OVH

General

Check archive.org

Show headers Download Go to

Full URL

http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/home.php?reason=d02032286070b4dd9d8fbd985a7bdca8af8edf52b89ff177db3bfcb2c8a9c43d

Protocol

HTTP/1.1

Server

188.165.207.30 , France, ASN16276 (OVH, FR),

Reverse DNS

ks.vslconceptshost.com

Software

nginx /

Resource Hash

7e022471a9833c7ecae959f3577331716a8fefbc5922ad28b999c0b871791f17

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Wed, 26 Oct 2022 14:18:57 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Nginx-Upstream-Cache-Status: EXPIRED
X-Server-Powered-By: Engintron
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK api.css
twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/css/ 2 KB
1 KB 14ms
14ms Stylesheet
text/css 188.165.207.30
OVH

General

Check archive.org

Show headers Download Go to

Full URL

http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/css/api.css

Requested by

Host: twdedition.com
URL: http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/home.php?reason=d02032286070b4dd9d8fbd985a7bdca8af8edf52b89ff177db3bfcb2c8a9c43d

Protocol

HTTP/1.1

Server

188.165.207.30 , France, ASN16276 (OVH, FR),

Reverse DNS

ks.vslconceptshost.com

Software

nginx /

Resource Hash

63a602d76f364623cb6477ff9237f60df0bd2c5948658207974864c1c2275793

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/home.php?reason=d02032286070b4dd9d8fbd985a7bdca8af8edf52b89ff177db3bfcb2c8a9c43d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Expires: Fri, 25 Nov 2022 14:18:57 GMT
Date: Wed, 26 Oct 2022 14:18:57 GMT
X-Server-Powered-By: Engintron
X-Content-Type-Options: nosniff
Last-Modified: Fri, 27 Mar 2020 22:35:34 GMT
Server: nginx
Content-Encoding: gzip
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=2592000
Connection: keep-alive
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H/1.1 200
OK config.js Show response
twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/js/ 43 B
472 B 38ms
23ms Script
application/javascript 188.165.207.30
OVH

General

Check archive.org

Show headers Download Go to

Full URL

http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/js/config.js

Requested by

Protocol

HTTP/1.1

Server

188.165.207.30 , France, ASN16276 (OVH, FR),

Reverse DNS

ks.vslconceptshost.com

Software

nginx /

Resource Hash

e530ef443c682ca02cab15d939402ead8c7c060fcf676164efd4078508e510e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/home.php?reason=d02032286070b4dd9d8fbd985a7bdca8af8edf52b89ff177db3bfcb2c8a9c43d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Expires: Fri, 25 Nov 2022 14:18:57 GMT
Date: Wed, 26 Oct 2022 14:18:57 GMT
X-Server-Powered-By: Engintron
X-Content-Type-Options: nosniff
Last-Modified: Sat, 28 Mar 2020 00:57:14 GMT
Server: nginx
Content-Type: application/javascript
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H/1.1 200
OK style.css
twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/css/ 46 KB
9 KB 29ms
14ms Stylesheet
text/css 188.165.207.30
OVH

General

Check archive.org

Show headers Download Go to

Full URL

http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/css/style.css

Requested by

Protocol

HTTP/1.1

Server

188.165.207.30 , France, ASN16276 (OVH, FR),

Reverse DNS

ks.vslconceptshost.com

Software

nginx /

Resource Hash

b40eea5338ffb4de44b8ced4bb257cf7ca0296537f8ce4772323c38c961eea80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/home.php?reason=d02032286070b4dd9d8fbd985a7bdca8af8edf52b89ff177db3bfcb2c8a9c43d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Expires: Fri, 25 Nov 2022 14:18:57 GMT
Date: Wed, 26 Oct 2022 14:18:57 GMT
X-Server-Powered-By: Engintron
X-Content-Type-Options: nosniff
Last-Modified: Fri, 27 Mar 2020 23:24:16 GMT
Server: nginx
Content-Encoding: gzip
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=2592000
Connection: keep-alive
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H/1.1 200
OK pikaday.css
twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/css/ 3 KB
2 KB 28ms
13ms Stylesheet
text/css 188.165.207.30
OVH

General

Check archive.org

Show headers Download Go to

Full URL

http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/css/pikaday.css

Requested by

Protocol

HTTP/1.1

Server

188.165.207.30 , France, ASN16276 (OVH, FR),

Reverse DNS

ks.vslconceptshost.com

Software

nginx /

Resource Hash

0bf6bc6e7e66c9cfacaf824c257a091e908f00a134213c5c433e024729eddb3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/home.php?reason=d02032286070b4dd9d8fbd985a7bdca8af8edf52b89ff177db3bfcb2c8a9c43d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Expires: Fri, 25 Nov 2022 14:18:57 GMT
Date: Wed, 26 Oct 2022 14:18:57 GMT
X-Server-Powered-By: Engintron
X-Content-Type-Options: nosniff
Last-Modified: Fri, 27 Mar 2020 22:37:38 GMT
Server: nginx
Content-Encoding: gzip
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=2592000
Connection: keep-alive
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.1.1/ 82 KB
30 KB 82ms
25ms Script
text/javascript 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://twdedition.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 12:11:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7635
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29671
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 26 Oct 2023 12:11:42 GMT

GET
H/1.1 200
OK logo--w.svg
twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/images/icons/ 58 KB
43 KB 15ms
15ms Image
image/svg+xml 188.165.207.30
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/images/icons/logo--w.svg

Requested by

Protocol

HTTP/1.1

Server

188.165.207.30 , France, ASN16276 (OVH, FR),

Reverse DNS

ks.vslconceptshost.com

Software

nginx /

Resource Hash

4f02e6570138680dea790d57afd58dcd47818818dab591eeeabeb076edac0c36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/home.php?reason=d02032286070b4dd9d8fbd985a7bdca8af8edf52b89ff177db3bfcb2c8a9c43d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Expires: Sun, 25 Dec 2022 14:18:57 GMT
Date: Wed, 26 Oct 2022 14:18:57 GMT
X-Server-Powered-By: Engintron
X-Content-Type-Options: nosniff
Last-Modified: Tue, 21 Jun 2022 15:30:14 GMT
Server: nginx
Content-Encoding: gzip
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: max-age=5184000
Connection: keep-alive
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H/1.1 200
OK logow.svg
twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/images/icons/ 4 KB
2 KB 14ms
14ms Image
image/svg+xml 188.165.207.30
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/images/icons/logow.svg

Requested by

Protocol

HTTP/1.1

Server

188.165.207.30 , France, ASN16276 (OVH, FR),

Reverse DNS

ks.vslconceptshost.com

Software

nginx /

Resource Hash

04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/home.php?reason=d02032286070b4dd9d8fbd985a7bdca8af8edf52b89ff177db3bfcb2c8a9c43d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Expires: Sun, 25 Dec 2022 14:18:57 GMT
Date: Wed, 26 Oct 2022 14:18:57 GMT
X-Server-Powered-By: Engintron
X-Content-Type-Options: nosniff
Last-Modified: Tue, 28 Jul 2020 15:31:32 GMT
Server: nginx
Content-Encoding: gzip
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: max-age=5184000
Connection: keep-alive
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H/1.1 200
OK framework.min.js Show response
twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/js/ 33 KB
10 KB 15ms
14ms Script
application/javascript 188.165.207.30
OVH

General

Check archive.org

Show headers Download Go to

Full URL

http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/js/framework.min.js

Requested by

Protocol

HTTP/1.1

Server

188.165.207.30 , France, ASN16276 (OVH, FR),

Reverse DNS

ks.vslconceptshost.com

Software

nginx /

Resource Hash

687c54662b84844c54be2a5a39421290e7ccc05bc8298983d304f28af7e11083

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/home.php?reason=d02032286070b4dd9d8fbd985a7bdca8af8edf52b89ff177db3bfcb2c8a9c43d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Expires: Fri, 25 Nov 2022 14:18:57 GMT
Date: Wed, 26 Oct 2022 14:18:57 GMT
X-Server-Powered-By: Engintron
X-Content-Type-Options: nosniff
Last-Modified: Sat, 28 Mar 2020 00:56:36 GMT
Server: nginx
Content-Encoding: gzip
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000
Connection: keep-alive
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H/1.1 200
OK bundle.min.js Show response
twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/js/ 402 KB
100 KB 17ms
17ms Script
application/javascript 188.165.207.30
OVH

General

Check archive.org

Show headers Download Go to

Full URL

http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/js/bundle.min.js

Requested by

Protocol

HTTP/1.1

Server

188.165.207.30 , France, ASN16276 (OVH, FR),

Reverse DNS

ks.vslconceptshost.com

Software

nginx /

Resource Hash

43c812e91778bed6e73a73a0fde5fda61b793930ada817126abc015587f53a50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/home.php?reason=d02032286070b4dd9d8fbd985a7bdca8af8edf52b89ff177db3bfcb2c8a9c43d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Expires: Fri, 25 Nov 2022 14:18:57 GMT
Date: Wed, 26 Oct 2022 14:18:57 GMT
X-Server-Powered-By: Engintron
X-Content-Type-Options: nosniff
Last-Modified: Sat, 28 Mar 2020 00:56:54 GMT
Server: nginx
Content-Encoding: gzip
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000
Connection: keep-alive
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H/1.1 200
OK logo--w.svg
twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/images/icons/ 58 KB
43 KB 15ms
14ms Other
image/svg+xml 188.165.207.30
OVH

General

Check archive.org

Show headers Download Go to

Full URL

http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/images/icons/logo--w.svg

Requested by

Protocol

HTTP/1.1

Server

188.165.207.30 , France, ASN16276 (OVH, FR),

Reverse DNS

ks.vslconceptshost.com

Software

nginx /

Resource Hash

4f02e6570138680dea790d57afd58dcd47818818dab591eeeabeb076edac0c36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/home.php?reason=d02032286070b4dd9d8fbd985a7bdca8af8edf52b89ff177db3bfcb2c8a9c43d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Expires: Sun, 25 Dec 2022 14:18:57 GMT
Date: Wed, 26 Oct 2022 14:18:57 GMT
X-Server-Powered-By: Engintron
X-Content-Type-Options: nosniff
Last-Modified: Tue, 21 Jun 2022 15:30:14 GMT
Server: nginx
Content-Encoding: gzip
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: max-age=5184000
Connection: keep-alive
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: HIT

POST
H/1.1 404
Not Found / Show response
twdedition.com/icewarpapi/ 0
227 B 24ms
23ms XHR
text/html 188.165.207.30
OVH

General

Check archive.org

Show headers Download Go to

Full URL

http://twdedition.com/icewarpapi/

Requested by

Host: twdedition.com
URL: http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/js/framework.min.js

Protocol

HTTP/1.1

Server

188.165.207.30 , France, ASN16276 (OVH, FR),

Reverse DNS

ks.vslconceptshost.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/home.php?reason=d02032286070b4dd9d8fbd985a7bdca8af8edf52b89ff177db3bfcb2c8a9c43d
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Wed, 26 Oct 2022 14:18:57 GMT
X-Content-Type-Options: nosniff
Server: nginx
Connection: keep-alive
Content-Length: 0
X-XSS-Protection: 1; mode=block
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK background.jpg
twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/images/ 10 KB
10 KB 14ms
14ms Image
image/jpeg 188.165.207.30
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/images/background.jpg

Requested by

Protocol

HTTP/1.1

Server

188.165.207.30 , France, ASN16276 (OVH, FR),

Reverse DNS

ks.vslconceptshost.com

Software

nginx /

Resource Hash

f3e7ed3c975516588c06cd9d11ff81db2940e4536888a0c61b7dc5efc13eb698

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/home.php?reason=d02032286070b4dd9d8fbd985a7bdca8af8edf52b89ff177db3bfcb2c8a9c43d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Expires: Sun, 25 Dec 2022 14:18:57 GMT
Date: Wed, 26 Oct 2022 14:18:57 GMT
X-Server-Powered-By: Engintron
X-Content-Type-Options: nosniff
Last-Modified: Thu, 14 Apr 2022 01:28:06 GMT
Server: nginx
Content-Type: image/jpeg
Cache-Control: max-age=5184000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 9757
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H/1.1 200
OK Roboto-Medium.woff2
twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/fonts/ 62 KB
63 KB 14ms
14ms Font
font/woff2 188.165.207.30
OVH

General

Check archive.org

Show headers Download Go to

Full URL

http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/fonts/Roboto-Medium.woff2

Requested by

Host: twdedition.com
URL: http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/css/style.css

Protocol

HTTP/1.1

Server

188.165.207.30 , France, ASN16276 (OVH, FR),

Reverse DNS

ks.vslconceptshost.com

Software

nginx /

Resource Hash

2fea2f2aa913b7aa163f45c897a463ba47a00fba670f747ead3d73c44c0d61bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/css/style.css
Origin: http://twdedition.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Expires: Sun, 25 Dec 2022 14:18:57 GMT
Date: Wed, 26 Oct 2022 14:18:57 GMT
X-Server-Powered-By: Engintron
X-Content-Type-Options: nosniff
Last-Modified: Sat, 28 Mar 2020 01:13:52 GMT
Server: nginx
Content-Type: font/woff2
Cache-Control: max-age=5184000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 63800
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H/1.1 200
OK Roboto-Regular.woff2
twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/fonts/ 62 KB
62 KB 14ms
13ms Font
font/woff2 188.165.207.30
OVH

General

Check archive.org

Show headers Download Go to

Full URL

http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/fonts/Roboto-Regular.woff2

Requested by

Host: twdedition.com
URL: http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/css/style.css

Protocol

HTTP/1.1

Server

188.165.207.30 , France, ASN16276 (OVH, FR),

Reverse DNS

ks.vslconceptshost.com

Software

nginx /

Resource Hash

65de8a3e5c4e0307b538ebe97df4dbcae0303b7a7afc5753aba95c218ae33a8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://twdedition.com/shared/netorgsharepointa8fefbc5922ad28b999c0b871791f1ffd71a9833c7ecae9/webmail/css/style.css
Origin: http://twdedition.com
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Expires: Sun, 25 Dec 2022 14:18:57 GMT
Date: Wed, 26 Oct 2022 14:18:57 GMT
X-Server-Powered-By: Engintron
X-Content-Type-Options: nosniff
Last-Modified: Sat, 28 Mar 2020 01:12:40 GMT
Server: nginx
Content-Type: font/woff2
Cache-Control: max-age=5184000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 63156
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://twdedition.com/icewarpapi/ Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
twdedition.com
188.165.207.30
2a00:1450:4001:80b::200a
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0bf6bc6e7e66c9cfacaf824c257a091e908f00a134213c5c433e024729eddb3a
2fea2f2aa913b7aa163f45c897a463ba47a00fba670f747ead3d73c44c0d61bd
43c812e91778bed6e73a73a0fde5fda61b793930ada817126abc015587f53a50
4f02e6570138680dea790d57afd58dcd47818818dab591eeeabeb076edac0c36
63a602d76f364623cb6477ff9237f60df0bd2c5948658207974864c1c2275793
65de8a3e5c4e0307b538ebe97df4dbcae0303b7a7afc5753aba95c218ae33a8e
687c54662b84844c54be2a5a39421290e7ccc05bc8298983d304f28af7e11083
7e022471a9833c7ecae959f3577331716a8fefbc5922ad28b999c0b871791f17
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4
b40eea5338ffb4de44b8ced4bb257cf7ca0296537f8ce4772323c38c961eea80
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e530ef443c682ca02cab15d939402ead8c7c060fcf676164efd4078508e510e6
f3e7ed3c975516588c06cd9d11ff81db2940e4536888a0c61b7dc5efc13eb698

twdedition.com Open in urlscan Pro 188.165.207.30 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

15 Requests

7 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

377 kBTransfer

826 kBSize

0 Cookies

0 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

twdedition.com Open in urlscan Pro
188.165.207.30 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

7 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

377 kB
Transfer

826 kB
Size

0
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!