sharepoint.share.begoodi.xyz Open in urlscan Pro
51.132.246.241 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://40.78.46.70/owa/base.php?newadd=ODIuMTAyLjE5LjEzNg==&email=peter.altabef%20@%20unisys.com&you=cGV0ZXIuYWx0YW...
Effective URL:
http://sharepoint.share.begoodi.xyz/owa/30d08754e4f3992443f26b65c9c8af07/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatche...
Submission: On October 20 via api (October 20th 2020, 3:09:06 pm UTC) from US

Summary HTTP 3 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 2 countries across 1 domains to perform 3 HTTP transactions. The main IP is 51.132.246.241, located in United Kingdom and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is sharepoint.share.begoodi.xyz.

This is the only time sharepoint.share.begoodi.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

	IP Address		AS Autonomous System
1	40.78.46.70 40.78.46.70		8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3 5	51.132.246.241 51.132.246.241		8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	3

1 40.78.46.70 (San Jose, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

40.78.46.70	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 51.132.246.241 (United Kingdom) 3 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

sharepoint.share.begoodi.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	begoodi.xyz 3 redirects sharepoint.share.begoodi.xyz	101 KB
3	1

	Domain	Requested by
5	sharepoint.share.begoodi.xyz	3 redirects 40.78.46.70 sharepoint.share.begoodi.xyz
3	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://sharepoint.share.begoodi.xyz/owa/30d08754e4f3992443f26b65c9c8af07/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=61&ip1=82.102.20.235%20Belgium.email?auth=2&id=9342062191&email=peter.altabef@unisys.com
Frame ID: 34DCE07A60222D76EE91D6A1697813CC
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://40.78.46.70/owa/base.php?newadd=ODIuMTAyLjE5LjEzNg==&email=peter.altabef%20@%20unisys.co... Page URL
http://sharepoint.share.begoodi.xyz/owa/index.php?wa=wsignin1.0&rpsnv=13&ct=1539585327&rver=7.0.6737.0&newaddODI... HTTP 302
http://sharepoint.share.begoodi.xyz/owa/30d08754e4f3992443f26b65c9c8af07?email=peter.altabef@unisys.com&ip1=82.1... HTTP 301
http://sharepoint.share.begoodi.xyz/owa/30d08754e4f3992443f26b65c9c8af07/?email=peter.altabef@unisys.com&ip1=82.... HTTP 302
http://sharepoint.share.begoodi.xyz/owa/30d08754e4f3992443f26b65c9c8af07/Login.php?websrc=59c275dc2e97dd3b896ed4... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i
headers server /php\/?([\d.]+)?/i

Perl (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /\bPerl\b(?: ?\/?v?([\d.]+))?/i
headers server /mod_perl(?:\/([\d\.]+))?/i

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_perl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_perl(?:\/([\d\.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
headers server /mod_perl(?:\/([\d\.]+))?/i

Page Statistics

3
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

3
IPs

2
Countries

99 kB
Transfer

120 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://40.78.46.70/owa/base.php?newadd=ODIuMTAyLjE5LjEzNg==&email=peter.altabef%20@%20unisys.com&you=cGV0ZXIuYWx0YWJlZiBAIHVuaXN5cy5jb20= Page URL
http://sharepoint.share.begoodi.xyz/owa/index.php?wa=wsignin1.0&rpsnv=13&ct=1539585327&rver=7.0.6737.0&newaddODIuMTAyLjE5LjEzNg==&obodo=QmVsZ2l1bQ==&ip1=82.102.20.235+Belgium&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d715d44a2-2f11-4282-f625-a066679e96e2&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&email=peter.altabef@unisys.com HTTP 302
http://sharepoint.share.begoodi.xyz/owa/30d08754e4f3992443f26b65c9c8af07?email=peter.altabef@unisys.com&ip1=82.102.20.235%20Belgium.email?auth=2&home=1&from=TrackingUpdate&product-request-id=bec7c79d-ad78-43ec-9c71-d12e379905d20cDovL3d3dy5he@ HTTP 301
http://sharepoint.share.begoodi.xyz/owa/30d08754e4f3992443f26b65c9c8af07/?email=peter.altabef@unisys.com&ip1=82.102.20.235%20Belgium.email?auth=2&home=1&from=TrackingUpdate&product-request-id=bec7c79d-ad78-43ec-9c71-d12e379905d20cDovL3d3dy5he@ HTTP 302
http://sharepoint.share.begoodi.xyz/owa/30d08754e4f3992443f26b65c9c8af07/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=61&ip1=82.102.20.235%20Belgium.email?auth=2&id=9342062191&email=peter.altabef@unisys.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	base.php Show response 40.78.46.70/owa/	428 B 715 B	376ms 359ms	Document text/html	40.78.46.70 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL http://40.78.46.70/owa/base.php?newadd=ODIuMTAyLjE5LjEzNg==&email=peter.altabef%20@%20unisys.com&you=cGV0ZXIuYWx0YWJlZiBAIHVuaXN5cy5jb20= Protocol HTTP/1.1 Server 40.78.46.70 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.28 (Unix) OpenSSL/1.0.2l PHP/7.1.10 mod_perl/2.0.8-dev Perl/v5.16.3 / PHP/7.1.10 Resource Hash `b8b484925c58b07b8525f0ddf41b62d3c5519bc843c878d4390b02a7f086cf5e` Request headers Host 40.78.46.70 Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 20 Oct 2020 15:08:46 GMT Server Apache/2.4.28 (Unix) OpenSSL/1.0.2l PHP/7.1.10 mod_perl/2.0.8-dev Perl/v5.16.3 X-Powered-By PHP/7.1.10 Content-Length 428 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	Primary Request Login.php Show response sharepoint.share.begoodi.xyz/owa/30d08754e4f3992443f26b65c9c8af07/ Redirect Chain http://sharepoint.share.begoodi.xyz/owa/index.php?wa=wsignin1.0&rpsnv=13&ct=1539585327&rver=7.0.6737.0&newaddODIuMTAyLjE5LjEzNg==&obodo=QmVsZ2l1bQ==&ip1=82.102.20.235+Belgium&wp=MBI_SSL&wreply=http... http://sharepoint.share.begoodi.xyz/owa/30d08754e4f3992443f26b65c9c8af07?email=peter.altabef@unisys.com&ip1=82.102.20.235%20Belgium.email?auth=2&home=1&from=TrackingUpdate&product-request-id=bec7c7... http://sharepoint.share.begoodi.xyz/owa/30d08754e4f3992443f26b65c9c8af07/?email=peter.altabef@unisys.com&ip1=82.102.20.235%20Belgium.email?auth=2&home=1&from=TrackingUpdate&product-request-id=bec7c... http://sharepoint.share.begoodi.xyz/owa/30d08754e4f3992443f26b65c9c8af07/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=61&ip1=82.102.20.235%20Belgium.email?auth=2&id=9342062191&email...	43 KB 43 KB	411ms 410ms	Document text/html	51.132.246.241 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL http://sharepoint.share.begoodi.xyz/owa/30d08754e4f3992443f26b65c9c8af07/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=61&ip1=82.102.20.235%20Belgium.email?auth=2&id=9342062191&email=peter.altabef@unisys.com Requested by Host: 40.78.46.70 URL: http://40.78.46.70/owa/base.php?newadd=ODIuMTAyLjE5LjEzNg==&email=peter.altabef%20@%20unisys.com&you=cGV0ZXIuYWx0YWJlZiBAIHVuaXN5cy5jb20= Protocol HTTP/1.1 Server 51.132.246.241 , United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.2.33 / PHP/7.2.33 Resource Hash `8a29dde7aca4c28775fa2eeacd49a8e2e324319ff01692082578a24fc714475b` Request headers Host sharepoint.share.begoodi.xyz Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://40.78.46.70/owa/base.php?newadd=ODIuMTAyLjE5LjEzNg==&email=peter.altabef%20@%20unisys.com&you=cGV0ZXIuYWx0YWJlZiBAIHVuaXN5cy5jb20= Accept-Encoding gzip, deflate Accept-Language en-US Cookie PHPSESSID=a758k6p2fpme201gba56mkgofp Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer http://40.78.46.70/owa/base.php?newadd=ODIuMTAyLjE5LjEzNg==&email=peter.altabef%20@%20unisys.com&you=cGV0ZXIuYWx0YWJlZiBAIHVuaXN5cy5jb20= Response headers Date Tue, 20 Oct 2020 15:08:48 GMT Server Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.2.33 X-Powered-By PHP/7.2.33 Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Keep-Alive timeout=5, max=97 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Redirect headers Date Tue, 20 Oct 2020 15:08:47 GMT Server Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.2.33 X-Powered-By PHP/7.2.33 Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Location Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=61&ip1=82.102.20.235 Belgium.email?auth=2&id=9342062191&email=peter.altabef@unisys.com Content-Length 3 Keep-Alive timeout=5, max=98 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b` Request headers Referer http://sharepoint.share.begoodi.xyz/owa/30d08754e4f3992443f26b65c9c8af07/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=61&ip1=82.102.20.235%20Belgium.email?auth=2&id=9342062191&email=peter.altabef@unisys.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a` Request headers Referer http://sharepoint.share.begoodi.xyz/owa/30d08754e4f3992443f26b65c9c8af07/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=61&ip1=82.102.20.235%20Belgium.email?auth=2&id=9342062191&email=peter.altabef@unisys.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	8 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6` Request headers Referer http://sharepoint.share.begoodi.xyz/owa/30d08754e4f3992443f26b65c9c8af07/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=61&ip1=82.102.20.235%20Belgium.email?auth=2&id=9342062191&email=peter.altabef@unisys.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a` Request headers Referer http://sharepoint.share.begoodi.xyz/owa/30d08754e4f3992443f26b65c9c8af07/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=61&ip1=82.102.20.235%20Belgium.email?auth=2&id=9342062191&email=peter.altabef@unisys.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	segoeui-regular.ttf sharepoint.share.begoodi.xyz/owa/30d08754e4f3992443f26b65c9c8af07/images/	55 KB 56 KB	381ms 381ms	Font font/ttf	51.132.246.241 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL http://sharepoint.share.begoodi.xyz/owa/30d08754e4f3992443f26b65c9c8af07/images/segoeui-regular.ttf Requested by Host: sharepoint.share.begoodi.xyz URL: http://sharepoint.share.begoodi.xyz/owa/30d08754e4f3992443f26b65c9c8af07/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=61&ip1=82.102.20.235%20Belgium.email?auth=2&id=9342062191&email=peter.altabef@unisys.com Protocol HTTP/1.1 Server 51.132.246.241 , United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.2.33 / Resource Hash `c147c2ec76a8ab8bd5082f1f4d3f80a43c689165cb164cdd812e44048fe38708` Request headers Origin http://sharepoint.share.begoodi.xyz Referer http://sharepoint.share.begoodi.xyz/owa/30d08754e4f3992443f26b65c9c8af07/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=61&ip1=82.102.20.235%20Belgium.email?auth=2&id=9342062191&email=peter.altabef@unisys.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 20 Oct 2020 15:08:48 GMT Last-Modified Tue, 20 Oct 2020 15:08:46 GMT Server Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.2.33 ETag "ddb8-5b21b9b84e0ca" Content-Type font/ttf Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 56760
GET DATA	200 OK	truncated /	7 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `257526b3e18469edef0487caa12d08b4ba2a9daffebc3ece45de636762471dbe` Request headers Referer http://sharepoint.share.begoodi.xyz/owa/30d08754e4f3992443f26b65c9c8af07/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=61&ip1=82.102.20.235%20Belgium.email?auth=2&id=9342062191&email=peter.altabef@unisys.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| validateForm

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

sharepoint.share.begoodi.xyz
40.78.46.70
51.132.246.241
257526b3e18469edef0487caa12d08b4ba2a9daffebc3ece45de636762471dbe
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a
8a29dde7aca4c28775fa2eeacd49a8e2e324319ff01692082578a24fc714475b
a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6
b8b484925c58b07b8525f0ddf41b62d3c5519bc843c878d4390b02a7f086cf5e
c147c2ec76a8ab8bd5082f1f4d3f80a43c689165cb164cdd812e44048fe38708
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b