covid19.sharepointsite.be
Open in
urlscan Pro
195.81.120.238
Malicious Activity!
Public Scan
Submission: On May 13 via api from BE — Scanned from DE
Summary
This is the only time covid19.sharepointsite.be was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 195.81.120.238 195.81.120.238 | 3257 (GTT-BACKB...) (GTT-BACKBONE GTT) | |
1 | 2a00:1450:400... 2a00:1450:4001:810::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 93.94.104.95 93.94.104.95 | 44806 (KINAMO-BA...) (KINAMO-BACKBONE) | |
1 | 2a00:1450:400... 2a00:1450:4001:803::2003 | 15169 (GOOGLE) (GOOGLE) | |
5 | 4 |
ASN3257 (GTT-BACKBONE GTT, US)
covid19.sharepointsite.be | |
phishing.responsum.eu |
ASN44806 (KINAMO-BACKBONE, BE)
PTR: 93-94-104-95.ip.poweredby.kinamo.be
gcm.rmnet.be |
Apex Domain Subdomains |
Transfer | |
---|---|---|
1 |
gstatic.com
fonts.gstatic.com |
16 KB |
1 |
responsum.eu
phishing.responsum.eu |
4 KB |
1 |
rmnet.be
gcm.rmnet.be |
164 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 46 |
1 KB |
1 |
sharepointsite.be
covid19.sharepointsite.be |
1 KB |
5 | 5 |
Domain | Requested by | |
---|---|---|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | phishing.responsum.eu |
covid19.sharepointsite.be
|
1 | gcm.rmnet.be |
covid19.sharepointsite.be
|
1 | fonts.googleapis.com |
covid19.sharepointsite.be
|
1 | covid19.sharepointsite.be | |
5 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
upload.video.google.com GTS CA 1C3 |
2022-04-25 - 2022-07-18 |
3 months | crt.sh |
gcm.rmnet.be AlphaSSL CA - SHA256 - G2 |
2021-05-31 - 2022-07-02 |
a year | crt.sh |
phishing.responsum.eu R3 |
2022-04-19 - 2022-07-18 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-04-25 - 2022-07-18 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://covid19.sharepointsite.be/?rid=KnbiRG3
Frame ID: 1B0CFADA54FC5488BBDC5506265D0F6D
Requests: 5 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
covid19.sharepointsite.be/ |
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rusthuis_750.jpg
gcm.rmnet.be/imgcontrol/c750-d511/clients/rmnet/content/medias/ |
163 KB 164 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.svg
phishing.responsum.eu/campaign/microsoft-landingpage/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
covid19.sharepointsite.be
fonts.googleapis.com
fonts.gstatic.com
gcm.rmnet.be
phishing.responsum.eu
195.81.120.238
2a00:1450:4001:803::2003
2a00:1450:4001:810::200a
93.94.104.95
0147ed9da77d277b512774f6fefa1a191e0341205f2bff81436e5891c5e0410f
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
2f2ddd14ea56cdac8518a24d72cdc885110cd40fea99c3aa774d8cd4e3a347db
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
fc15fd1c680a730613ad1e58f0277f280d5c3cc94a3659a511496fb8e5aae789