lucyfacade.com - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 4 HTTP transactions. The main IP is 192.185.167.129, located in United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is lucyfacade.com.
TLS certificate: Issued by R3 on February 12th 2024. Valid for: 3 months.

This is the only time lucyfacade.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sharepoint (Online) Microsoft (Consumer) OneDrive (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3031::6815:4322	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	192.185.167.129 192.185.167.129	19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING)
1	2a01:111:f402... 2a01:111:f402:f0b1::27	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	3

1 2606:4700:3031::6815:4322 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

sht.ac	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.185.167.129 (United States)

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 192-185-167-129.unifiedlayer.com

lucyfacade.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a01:111:f402:f0b1::27 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

vikinggenetics-my.sharepoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	lucyfacade.com lucyfacade.com	18 KB
1	sharepoint.com vikinggenetics-my.sharepoint.com	8 KB
1	sht.ac 1 redirects sht.ac	584 B
4	3

	Domain	Requested by
3	lucyfacade.com	lucyfacade.com
1	vikinggenetics-my.sharepoint.com	lucyfacade.com
1	sht.ac	1 redirects
4	3

This site contains links to these domains. Also see Links.

Domain
go.microsoft.com

Subject Issuer	Validity	Valid
*.lucyfacade.com R3	`2024-02-12` - `2024-05-12`	3 months	crt.sh
*.sharepoint.com DigiCert Cloud Services CA-1	`2023-10-11` - `2024-10-10`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://lucyfacade.com/rkg/vlaaderen/
Frame ID: 9DCB62E2CE2D48893A45B6058A2BD5D3
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Green and White

Page URL History Show full URLs

https://sht.ac/JPOWiG HTTP 302
https://lucyfacade.com/rkg/vlaaderen/ Page URL

Detected technologies

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<input[^>]+name="__VIEWSTATE

Page Statistics

4
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

29 kB
Transfer

44 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://go.microsoft.com/fwlink/?linkid=845480
Title: Privacy & Cookies

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://sht.ac/JPOWiG HTTP 302
https://lucyfacade.com/rkg/vlaaderen/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
lucyfacade.com/rkg/vlaaderen/
Redirect Chain

https://sht.ac/JPOWiG
https://lucyfacade.com/rkg/vlaaderen/

19 KB
10 KB

256ms
115ms

Document
text/html

192.185.167.129
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://lucyfacade.com/rkg/vlaaderen/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.167.129 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 192-185-167-129.unifiedlayer.com
Software: Apache /
Resource Hash: b9fbd2efbbf941cec9b8a835d4419fe8afc3d8f60d01bb8bb43173e3af429e4e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: en-US,en;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
content-length: 9794
content-type: text/html; charset=UTF-8
date: Tue, 26 Mar 2024 13:31:35 GMT
server: Apache
vary: Accept-Encoding

Redirect headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 86a78072ab6567e0-MIA
content-type: text/html; charset=UTF-8
date: Tue, 26 Mar 2024 13:31:34 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: https://lucyfacade.com/rkg/vlaaderen/
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=htNQbZ0rn3kG9foZltQ7WK5ZW8qr3lBA0o8b7k8Nyocut1WJYqDfycSri1seYxGbCAkTN3L32XAkR7r4i1MrrIL1hylUmniYySrd%2BBOFnD3saTNoo9NZovAeCW%2F35jRXPMTfCqM%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 microsoft_logo.svg
lucyfacade.com/rkg/vlaaderen/naf/inf/ 4 KB
4 KB 54ms
53ms Image
image/svg+xml 192.185.167.129
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lucyfacade.com/rkg/vlaaderen/naf/inf/microsoft_logo.svg
Requested by: Host: lucyfacade.com
URL: https://lucyfacade.com/rkg/vlaaderen/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.167.129 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 192-185-167-129.unifiedlayer.com
Software: Apache /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://lucyfacade.com/rkg/vlaaderen/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 13:31:35 GMT
last-modified: Fri, 18 May 2018 12:17:00 GMT
server: Apache
accept-ranges: bytes
content-length: 3651
content-type: image/svg+xml

GET
H/1.1 200
OK pdf.png
vikinggenetics-my.sharepoint.com/personal/datho_vikinggenetics_com_au/_layouts/15/images/ 7 KB
8 KB 626ms
146ms Image
image/png 2a01:111:f402:f0b1::27
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://vikinggenetics-my.sharepoint.com/personal/datho_vikinggenetics_com_au/_layouts/15/images/pdf.png

Requested by

Host: lucyfacade.com
URL: https://lucyfacade.com/rkg/vlaaderen/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a01:111:f402:f0b1::27 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

db307fcef7f95139689007d7a623b340ec21282bd421c4e4b2ba09078f230545

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://lucyfacade.com/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000
Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.office365.com *.powerapps.com *.yammer.com engage.cloud.microsoft *.officeapps.live.com *.office.com *.microsoft365.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com securebroker.sharepointonline.com;
X-Content-Type-Options: nosniff
Date: Tue, 26 Mar 2024 13:31:35 GMT
NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0}
X-NetworkStatistics: 0,64896,0,0,388,0,22458
X-Powered-By: ASP.NET
X-DataBoundary: EU
X-SharePointHealthScore: 1
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
request-id: 26d218a1-c019-8000-6d6d-d22805cdbbeb
MS-CV: oRjSJhnAAIBtbdIoBc276w.0
Content-Length: 6830
MicrosoftSharePointTeamServices: 16.0.0.24713
X-MS-InvokeApp: 1; RequireReadOnly
SPRequestDuration: 13
Last-Modified: Sat, 23 Mar 2024 02:57:38 GMT
Server: Microsoft-IIS/10.0
SPRequestGuid: 26d218a1-c019-8000-6d6d-d22805cdbbeb
ETag: "0fd12ddcd7cda1:0"
X-FRAME-OPTIONS: SAMEORIGIN
Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=189041&frontEnd=FarmDirect&remoteIp=2001:550:1d05:1::"}]}
Content-Type: image/png
X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/
X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0
Accept-Ranges: bytes
SPIisLatency: 1

GET
DATA 200
OK truncated
/ 2 KB
2 KB Font
application/octet-stream

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5

Request headers

Referer
Origin: https://lucyfacade.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: application/octet-stream

GET
H2 404 favicon.ico
lucyfacade.com/rkg/vlaaderen/images/ 12 KB
5 KB 56ms
56ms Other
text/html 192.185.167.129
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://lucyfacade.com/rkg/vlaaderen/images/favicon.ico?rev=45
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.167.129 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 192-185-167-129.unifiedlayer.com
Software: Apache /
Resource Hash: bccb23d41c2cc69cf0c7d22c4314ca8181a513c6999b73e45307792830f4e482

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://lucyfacade.com/rkg/vlaaderen/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 13:31:35 GMT
content-encoding: gzip
last-modified: Sat, 01 Oct 2022 13:15:52 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html
accept-ranges: bytes
content-length: 4677

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sharepoint (Online) Microsoft (Consumer) OneDrive (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onpagereveal

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			sht.ac/	1970-01-20 19:27:12	Name: PHPSESSID Value: q43sab3v9dgqpnp0fal4447ghp

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://lucyfacade.com/rkg/vlaaderen/images/favicon.ico?rev=45 Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

lucyfacade.com
sht.ac
vikinggenetics-my.sharepoint.com
192.185.167.129
2606:4700:3031::6815:4322
2a01:111:f402:f0b1::27
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5
b9fbd2efbbf941cec9b8a835d4419fe8afc3d8f60d01bb8bb43173e3af429e4e
bccb23d41c2cc69cf0c7d22c4314ca8181a513c6999b73e45307792830f4e482
db307fcef7f95139689007d7a623b340ec21282bd421c4e4b2ba09078f230545

lucyfacade.com Open in urlscan Pro 192.185.167.129 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

29 kBTransfer

44 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

lucyfacade.com Open in urlscan Pro
192.185.167.129 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

29 kB
Transfer

44 kB
Size

1
Cookies

4 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!