spm-so.com Open in urlscan Pro
2606:4700:3031::681b:85cc Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://spm-so.com/dr/op/bo/xed?X1=asdf@asdf.com
Effective URL:
https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
Submission: On October 28 via automatic, source openphish (October 28th 2020, 1:54:58 pm UTC)

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 14 HTTP transactions. The main IP is 2606:4700:3031::681b:85cc, located in United States and belongs to CLOUDFLARENET, US. The main domain is spm-so.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on October 10th 2020. Valid for: a year.

This is the only time spm-so.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Dropbox (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
2 16	2606:4700:303... 2606:4700:3031::681b:85cc		13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	1

16 2606:4700:3031::681b:85cc (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

spm-so.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	spm-so.com 2 redirects spm-so.com	660 KB
14	1

	Domain	Requested by
16	spm-so.com	2 redirects spm-so.com
14	1

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-10-10` - `2021-10-10`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
Frame ID: 58A2F8527D3330A1147CA89E9533B7C3
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://spm-so.com/dr/op/bo/xed?X1=asdf@asdf.com HTTP 301
http://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com HTTP 301
https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

14
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

658 kB
Transfer

927 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://spm-so.com/dr/op/bo/xed?X1=asdf@asdf.com HTTP 301
http://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com HTTP 301
https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
spm-so.com/dr/op/bo/xed/
Redirect Chain

https://spm-so.com/dr/op/bo/xed?X1=asdf@asdf.com
http://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com

7 KB
2 KB

92ms
92ms

Document
text/html

2606:4700:3031::681b:85cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:85cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b194f619a81356f90f864e461924f0ffb3513c261bd14a784fdbb8fddb0fb4bf

Request headers

:method: GET
:authority: spm-so.com
:scheme: https
:path: /dr/op/bo/xed/?X1=asdf@asdf.com
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=db1c7046888812bf01382538b3aac5a2b1603893281
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Wed, 28 Oct 2020 13:54:41 GMT
content-type: text/html; charset=UTF-8
cf-cache-status: DYNAMIC
cf-request-id: 0611165b250000c29a803e9000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=3NydlqxuKnuvIX8f6J4qv1%2F8hDQisK1vMyzM9KRfhAyYgZuruxxRZGhE4g5ZWVIVyunWthTtZfafcjIasCeqd9e6UyVbyWJY4EVTFxHBq%2FotBUUIprfT"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 5e952671d9c2c29a-FRA
content-encoding: br

Redirect headers

Date: Wed, 28 Oct 2020 13:54:41 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Wed, 28 Oct 2020 14:54:41 GMT
Location: https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
cf-request-id: 0611165b0f0000175291ac6000000001
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=dCW8%2F3rLlLh4fHkEBUuSqG6M9Cn4Rsh%2FQnhUJcOfN%2FiT22dqf6uzVnwApu7ihkG7EbdAVGRU5nOEFWPB1hv7oHs5Si5qH5MyMtCeKLKTxpbj2%2BqtnFkR"}],"group":"cf-nel","max_age":604800}
NEL: {"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 5e952671bf231752-FRA

GET
H2 200 css.css
spm-so.com/dr/op/bo/xed/styles/ 5 KB
2 KB 114ms
112ms Stylesheet
text/css 2606:4700:3031::681b:85cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spm-so.com/dr/op/bo/xed/styles/css.css
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:85cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f197d9da74ec12bcfeb42f4ace83d2b31b2dd06c70a60aa8f9d89c8f58efa9e3

Request headers

Referer: https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 28 Oct 2020 13:54:41 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:23 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=6Q7ADQEvoQcJAoq2sLvTOtBC2BUK3P1VgZwFN8c5V9NaWDkLoegLyh54zyB%2FeITyiZHJWwxjXb1MhjE2HzG1%2B35pba2kDIBhGXiw4E3qzubFc69eNZAP"}],"group":"cf-nel","max_age":604800}
content-type: text/css
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 5e9526727b1ac29a-FRA
cf-request-id: 0611165b870000c29a1187d000000001

GET
H2 200 checkbox.css
spm-so.com/dr/op/bo/xed/styles/ 1 KB
756 B 116ms
115ms Stylesheet
text/css 2606:4700:3031::681b:85cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spm-so.com/dr/op/bo/xed/styles/checkbox.css
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:85cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ab96691d78536247ca2ab64aac5af744cf699926fa30d393ae859c9fa803b42c

Request headers

Referer: https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 28 Oct 2020 13:54:41 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:22 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=royttg5B4U3KFQIEurQhEFgXN8O%2BNvzNEybZvFHw7%2F%2FBn%2F0Vgjrnf%2FU6cDaycV64V4TYzx6nttVnkuNqy%2FdBGRZCsLI99KSgIZZBUrLiuaQJUrmoAYPu"}],"group":"cf-nel","max_age":604800}
content-type: text/css
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 5e9526727b21c29a-FRA
cf-request-id: 0611165b880000c29a4b1d1000000001

GET
H2 200 all.css
spm-so.com/dr/op/bo/xed/styles/ 71 KB
13 KB 232ms
231ms Stylesheet
text/css 2606:4700:3031::681b:85cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spm-so.com/dr/op/bo/xed/styles/all.css
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:85cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 530cb4c29b444dc89dd73a4e0812f803be98d3448a48edca8aafdbc55a0b97eb

Request headers

Referer: https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 28 Oct 2020 13:54:41 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:23 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=oCJTUcqqsqOV4jbRY7qRR%2BFTlQEMY65zagXeWslk2YrPoEugdK6dYcC%2FFxGlLAGQMjwfUQIXIuolAeLzOSoB%2BA6yakQHV984TnjGomyCfrWM7naACs%2FM"}],"group":"cf-nel","max_age":604800}
content-type: text/css
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 5e9526727b28c29a-FRA
cf-request-id: 0611165b890000c29a79327000000001

GET
H2 200 jquery.js Show response
spm-so.com/dr/op/bo/xed/js/ 281 KB
79 KB 367ms
367ms Script
application/javascript 2606:4700:3031::681b:85cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spm-so.com/dr/op/bo/xed/js/jquery.js
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:85cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37

Request headers

Referer: https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 28 Oct 2020 13:54:42 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:21 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=AMPidoseXE2DhsBxKW6nTBMsJJF7AFytZ6o6QfL0tfbc1sGoO3MtncwxvGa6UQeR7DhL5C761ex4bsZkHHcGUbE9xbNqHG3hiQE1FRyszoPd5VjgH46u"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 5e9526727b2ec29a-FRA
cf-request-id: 0611165b890000c29a092f8000000001

GET
H2 200 excel.png
spm-so.com/dr/op/bo/xed/images/ 15 KB
15 KB 141ms
140ms Image
image/png 2606:4700:3031::681b:85cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://spm-so.com/dr/op/bo/xed/images/excel.png
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:85cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7253f301aa0fd63fad4935c51eba121f766a630a9f47b25d24cd7b281e3ca943

Request headers

Referer: https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 28 Oct 2020 13:54:42 GMT
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:17 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=eVKjwEXohJVK1WEZt8VD80B4C7l6BmKtKcGQT5KoJNCPpEzbBMsbvliQb2WzUCLxTKmT7%2FL2M5JHdKgvrRR6D%2BfYiDzJP8Xaq%2BHw%2FhUaEdJW0poYgTEA"}],"group":"cf-nel","max_age":604800}
content-type: image/png
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 5e9526749f66c29a-FRA
content-length: 14950
cf-request-id: 0611165ce10000c29a9aab3000000001

GET
H2 200 pdf.png
spm-so.com/dr/op/bo/xed/images/ 8 KB
8 KB 100ms
100ms Image
image/png 2606:4700:3031::681b:85cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://spm-so.com/dr/op/bo/xed/images/pdf.png
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:85cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5eedb987a0d26a60527854460e67bb0762de152f45b5be580de5aa21e524d309

Request headers

Referer: https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 28 Oct 2020 13:54:42 GMT
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:18 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Gh1C0VNyOENl%2FEcj%2FvLnMC%2BoDu8krZTHfLmklqZCc5NVf%2FRJ4ljFVsosUuZVgArkENwJkuHSsSvX3AxEeQ8rNnFGZ3fKrCtUVqfLYMcTi3NQJbLLqU6Q"}],"group":"cf-nel","max_age":604800}
content-type: image/png
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 5e952674cfc9c29a-FRA
content-length: 8183
cf-request-id: 0611165cfe0000c29a06b59000000001

GET
H2 200 log.png
spm-so.com/dr/op/bo/xed/images/ 19 KB
19 KB 142ms
141ms Image
image/png 2606:4700:3031::681b:85cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://spm-so.com/dr/op/bo/xed/images/log.png
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:85cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b6a4e4eb69c0c7601ff58f4546567810128008e2cb99dc08c22bba4093b4a722

Request headers

Referer: https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 28 Oct 2020 13:54:42 GMT
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:18 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=GpYf7eu0X3wYb1pkTly2oF5cLFbz2%2FMKl5ZszLd2FKaAMFf8f%2BZXMJaVFGOzVIO10s7IbkDD4M9Og8vGEooivR8YFri4e0bP5Bo6eSrFoN5IxA%2FAmg7H"}],"group":"cf-nel","max_age":604800}
content-type: image/png
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 5e952674e809c29a-FRA
content-length: 18990
cf-request-id: 0611165d0e0000c29ae58e3000000001

GET
H2 200 spinner.gif
spm-so.com/dr/op/bo/xed/images/ 350 KB
350 KB 254ms
254ms Image
image/gif 2606:4700:3031::681b:85cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://spm-so.com/dr/op/bo/xed/images/spinner.gif
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:85cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 73257fb51b4e9c849a46820ae181173030b1a15d1c5a597f5840e353b438b33a

Request headers

Referer: https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 28 Oct 2020 13:54:42 GMT
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:19 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=IOzfpqhrQzav1UPffRu9U66J2N5wJaPQmKqFsL2XJZqYPc8lj6zfoVB%2B5Wi%2Bl5uSBRTsqc8ijhGD1ml%2BBIvkiXFlj9pJtudGScKaWSAGpCMLqetePNIU"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 5e952674e80cc29a-FRA
content-length: 357935
cf-request-id: 0611165d0e0000c29ab5be8000000001

GET
H2 200 email-decode.min.js Show response
spm-so.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 10ms
10ms Script
application/javascript 2606:4700:3031::681b:85cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://spm-so.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::681b:85cc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 28 Oct 2020 13:54:41 GMT
content-encoding: gzip
vary: Accept-Encoding
nel: {"report_to":"cf-nel","max_age":604800}
status: 200
cf-request-id: 0611165c720000c29a440b4000000001
last-modified: Wed, 21 Oct 2020 15:36:27 GMT
server: cloudflare
etag: W/"5f90557b-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=bPv17E42WAazugLIE9J82U7ItQEwc0%2B112E1YZcgAf3yzQPB4FBFk4joHpfgS04JhqPCSE5HXMVd620RoXU0o4FVWE7vAwxJd13bt5QlSHVjUdNrawr%2F"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 5e952673ede1c29a-FRA
expires: Fri, 30 Oct 2020 13:54:41 GMT

GET
H2 200 main.js Show response
spm-so.com/dr/op/bo/xed/js/ 2 KB
778 B 100ms
99ms Script
application/javascript 2606:4700:3031::681b:85cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spm-so.com/dr/op/bo/xed/js/main.js
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:85cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d89a90eccb388e8a5ef0fa69eda8cc1333a24312fb7fb9b00ed72063d0d71965

Request headers

Referer: https://spm-so.com/dr/op/bo/xed/?X1=asdf@asdf.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 28 Oct 2020 13:54:42 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:20 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=sg4aSvYJjdENlSxJInJXMqHtAK0W%2FAPYT1GAK%2Bqvv%2B1sW7t8wyggpuXLBtW%2Bg11Ujvxv6OjMI9vGXRQIBEPHcjgseL0C%2F09Zwri42UIUCLppGVj%2FuqVo"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 5e952673fe07c29a-FRA
cf-request-id: 0611165c7b0000c29a62ba9000000001

GET
H2 200 fa-brands-400.woff2
spm-so.com/dr/op/bo/xed/webfonts/ 76 KB
76 KB 214ms
213ms Font
font/woff2 2606:4700:3031::681b:85cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spm-so.com/dr/op/bo/xed/webfonts/fa-brands-400.woff2
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/styles/all.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:85cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e98ae3ff936b4723cd8a2377d2c549a667ce87e81201ec4995cc01bd374c1288

Request headers

Origin: https://spm-so.com
Referer: https://spm-so.com/dr/op/bo/xed/styles/all.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 28 Oct 2020 13:54:42 GMT
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:26 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=rupywirx0Ld%2BM1M9muSi77%2F5xySaoGme6Mkdrg8N3iR7VyEMCshSTxzrLyHW7TXjh4aBk8OZk48V7piiGEcuK66te6ErqwQiQcPiwV%2FyMff%2BpzEsFXZ4"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 5e952674f824c29a-FRA
content-length: 77444
cf-request-id: 0611165d160000c29a97b04000000001

GET
H2 200 fa-regular-400.woff2
spm-so.com/dr/op/bo/xed/webfonts/ 13 KB
14 KB 111ms
111ms Font
font/woff2 2606:4700:3031::681b:85cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spm-so.com/dr/op/bo/xed/webfonts/fa-regular-400.woff2
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/styles/all.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:85cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: de5fb40e0689f154902213527781c2fb83cddcbf8f622a1384f1e2a7e7693b21

Request headers

Origin: https://spm-so.com
Referer: https://spm-so.com/dr/op/bo/xed/styles/all.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 28 Oct 2020 13:54:42 GMT
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:27 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=K%2BCkjpd6b%2B7JRBkqdAFDoDHQojk%2F3ViQCdzyPe8kEFxWc0qiXtlWB0L2On8eVAJRnveUuu0gxy%2F74r7a2eEALKL1U16yTeC1UTkiFufyiZ3Qvawsg6Zc"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 5e952674f827c29a-FRA
content-length: 13596
cf-request-id: 0611165d170000c29a32886000000001

GET
H2 200 fa-solid-900.woff2
spm-so.com/dr/op/bo/xed/webfonts/ 78 KB
79 KB 243ms
243ms Font
font/woff2 2606:4700:3031::681b:85cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spm-so.com/dr/op/bo/xed/webfonts/fa-solid-900.woff2
Requested by: Host: spm-so.com
URL: https://spm-so.com/dr/op/bo/xed/styles/all.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:85cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0bf1b8d8ac1b4ef0caea0db8cbe1b6a35f8a84a2f5fffa2421936cc11a1a91fc

Request headers

Origin: https://spm-so.com
Referer: https://spm-so.com/dr/op/bo/xed/styles/all.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 28 Oct 2020 13:54:42 GMT
cf-cache-status: MISS
last-modified: Sun, 16 Aug 2020 17:16:29 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=7fHIpxzdW7lBEDPLwc02SgELlCJPE7ERuMfnuuOD1qiESB9nwN8HEGMJ1yGMBvese6a3MFv%2F2xHpUk9s%2FsyC8Wq7a84fKSTW9D6oJoQUDqJ3bfG4en%2Bp"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
status: 200
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 5e952674f82ac29a-FRA
content-length: 80328
cf-request-id: 0611165d250000c29a69910000000001

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Dropbox (Consumer)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.spm-so.com/	1970-01-19 14:14:45	Name: __cfduid Value: db1c7046888812bf01382538b3aac5a2b1603893281

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

spm-so.com
2606:4700:3031::681b:85cc
0bf1b8d8ac1b4ef0caea0db8cbe1b6a35f8a84a2f5fffa2421936cc11a1a91fc
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37
530cb4c29b444dc89dd73a4e0812f803be98d3448a48edca8aafdbc55a0b97eb
5eedb987a0d26a60527854460e67bb0762de152f45b5be580de5aa21e524d309
7253f301aa0fd63fad4935c51eba121f766a630a9f47b25d24cd7b281e3ca943
73257fb51b4e9c849a46820ae181173030b1a15d1c5a597f5840e353b438b33a
ab96691d78536247ca2ab64aac5af744cf699926fa30d393ae859c9fa803b42c
b194f619a81356f90f864e461924f0ffb3513c261bd14a784fdbb8fddb0fb4bf
b6a4e4eb69c0c7601ff58f4546567810128008e2cb99dc08c22bba4093b4a722
d89a90eccb388e8a5ef0fa69eda8cc1333a24312fb7fb9b00ed72063d0d71965
de5fb40e0689f154902213527781c2fb83cddcbf8f622a1384f1e2a7e7693b21
e98ae3ff936b4723cd8a2377d2c549a667ce87e81201ec4995cc01bd374c1288
f197d9da74ec12bcfeb42f4ace83d2b31b2dd06c70a60aa8f9d89c8f58efa9e3

spm-so.com Open in urlscan Pro 2606:4700:3031::681b:85cc Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

658 kBTransfer

927 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

1 Cookies

Indicators

spm-so.com Open in urlscan Pro
2606:4700:3031::681b:85cc Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

658 kB
Transfer

927 kB
Size

1
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!