lapis.gq Open in urlscan Pro
185.29.11.37 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://lapis.gq/excel/5/oauth2/authorize/files
Effective URL:
http://lapis.gq/excel/5/oauth2/authorize/files/ec699345e56e9aed9b39542056a6.php?client_id=77Inboxaspxn825a90c9c2...
Submission: On November 23 via automatic, source openphish (November 23rd 2020, 1:33:20 pm UTC)

Summary HTTP 17 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 17 HTTP transactions. The main IP is 185.29.11.37, located in Meppel, Netherlands and belongs to DATACLUB-, NL. The main domain is lapis.gq.

This is the only time lapis.gq was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer) Excel / PDF download (Online)

Domain & IP information

	IP Address		AS Autonomous System
2 19	185.29.11.37 185.29.11.37		203557 (DATACLUB-) (DATACLUB-)
17	1

19 185.29.11.37 (Meppel, Netherlands) 2 redirects

ASN203557 (DATACLUB-, NL)
PTR: ip-11-37.dataclub.eu

lapis.gq	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	lapis.gq 2 redirects lapis.gq	421 KB
17	1

	Domain	Requested by
19	lapis.gq	2 redirects lapis.gq
17	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 2 frames:

Primary Page: http://lapis.gq/excel/5/oauth2/authorize/files/ec699345e56e9aed9b39542056a6.php?client_id=77Inboxaspxn825a90c9c2d664a8527532d7d225&Id825a90c9c2d664a8527532d7d225&doc5478217ed1730bb57386ee548f41&login=&jiv5478217ed1730bb57386ee548f41&xls1d&id=fav&doc
Frame ID: E6C070B66389ADC8B9724DCD9E6599E2
Requests: 8 HTTP requests in this frame

Frame: http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/login.php?login=&sfm_from_iframe=1
Frame ID: 4F07DE0835DD71F04FFE9EE6F78099E6
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://lapis.gq/excel/5/oauth2/authorize/files HTTP 301
http://lapis.gq/excel/5/oauth2/authorize/files/ HTTP 302
http://lapis.gq/excel/5/oauth2/authorize/files/ec699345e56e9aed9b39542056a6.php?client_id=77... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Win32|Win64/i
html /<input[^>]+name="__VIEWSTATE/i

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<input[^>]+name="__VIEWSTATE/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

IIS (Web Servers) Expand

Overall confidence: 50%
Detected patterns

html /<input[^>]+name="__VIEWSTATE/i

Page Statistics

17
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

420 kB
Transfer

415 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://lapis.gq/excel/5/oauth2/authorize/files HTTP 301
http://lapis.gq/excel/5/oauth2/authorize/files/ HTTP 302
http://lapis.gq/excel/5/oauth2/authorize/files/ec699345e56e9aed9b39542056a6.php?client_id=77Inboxaspxn825a90c9c2d664a8527532d7d225&Id825a90c9c2d664a8527532d7d225&doc5478217ed1730bb57386ee548f41&login=&jiv5478217ed1730bb57386ee548f41&xls1d&id=fav&doc Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request ec699345e56e9aed9b39542056a6.php Show response lapis.gq/excel/5/oauth2/authorize/files/ Redirect Chain http://lapis.gq/excel/5/oauth2/authorize/files http://lapis.gq/excel/5/oauth2/authorize/files/ http://lapis.gq/excel/5/oauth2/authorize/files/ec699345e56e9aed9b39542056a6.php?client_id=77Inboxaspxn825a90c9c2d664a8527532d7d225&Id825a90c9c2d664a8527532d7d225&doc5478217ed1730bb57386ee548f41&log...	40 KB 40 KB	18ms 18ms	Document text/html	185.29.11.37 DATACLUB-
General Check archive.org Show headers Download Go to Full URL http://lapis.gq/excel/5/oauth2/authorize/files/ec699345e56e9aed9b39542056a6.php?client_id=77Inboxaspxn825a90c9c2d664a8527532d7d225&Id825a90c9c2d664a8527532d7d225&doc5478217ed1730bb57386ee548f41&login=&jiv5478217ed1730bb57386ee548f41&xls1d&id=fav&doc Protocol HTTP/1.1 Server 185.29.11.37 Meppel, Netherlands, ASN203557 (DATACLUB-, NL), Reverse DNS ip-11-37.dataclub.eu Software Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 / PHP/7.4.11 Resource Hash `e415b0a145ada29079ab18ceded80d4e597742c74f78cee816012412c825b85d` Request headers Host lapis.gq Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 13:33:02 GMT Server Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 X-Powered-By PHP/7.4.11 Keep-Alive timeout=5, max=98 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Redirect headers Date Mon, 23 Nov 2020 13:33:02 GMT Server Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 X-Powered-By PHP/7.4.11 Location ec699345e56e9aed9b39542056a6.php?client_id=77Inboxaspxn825a90c9c2d664a8527532d7d225&Id825a90c9c2d664a8527532d7d225&doc5478217ed1730bb57386ee548f41&login=&jiv5478217ed1730bb57386ee548f41&xls1d&id=fav&doc Content-Length 0 Keep-Alive timeout=5, max=99 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	index_1.css lapis.gq/excel/5/oauth2/authorize/files/	45 KB 45 KB	34ms 21ms	Stylesheet text/css	185.29.11.37 DATACLUB-
General Check archive.org Show headers Download Go to Full URL http://lapis.gq/excel/5/oauth2/authorize/files/index_1.css Requested by Host: lapis.gq URL: http://lapis.gq/excel/5/oauth2/authorize/files/ec699345e56e9aed9b39542056a6.php?client_id=77Inboxaspxn825a90c9c2d664a8527532d7d225&Id825a90c9c2d664a8527532d7d225&doc5478217ed1730bb57386ee548f41&login=&jiv5478217ed1730bb57386ee548f41&xls1d&id=fav&doc Protocol HTTP/1.1 Server 185.29.11.37 Meppel, Netherlands, ASN203557 (DATACLUB-, NL), Reverse DNS ip-11-37.dataclub.eu Software Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 / Resource Hash `a6bba9179a5ec451dc6f4c93ab99525f4fb5918ad1f65e201a03f54ad7f6c8c3` Request headers Referer http://lapis.gq/excel/5/oauth2/authorize/files/ec699345e56e9aed9b39542056a6.php?client_id=77Inboxaspxn825a90c9c2d664a8527532d7d225&Id825a90c9c2d664a8527532d7d225&doc5478217ed1730bb57386ee548f41&login=&jiv5478217ed1730bb57386ee548f41&xls1d&id=fav&doc User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 13:33:02 GMT Last-Modified Thu, 22 Oct 2020 14:44:56 GMT Server Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 ETag "b301-5b24381f8dba9" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 45825
GET H/1.1	200 OK	ewaother.png lapis.gq/excel/5/oauth2/authorize/files/	9 KB 9 KB	36ms 23ms	Image image/png	185.29.11.37 DATACLUB-
General Check archive.org Show headers Download Go to Show image Full URL http://lapis.gq/excel/5/oauth2/authorize/files/ewaother.png Requested by Host: lapis.gq URL: http://lapis.gq/excel/5/oauth2/authorize/files/ec699345e56e9aed9b39542056a6.php?client_id=77Inboxaspxn825a90c9c2d664a8527532d7d225&Id825a90c9c2d664a8527532d7d225&doc5478217ed1730bb57386ee548f41&login=&jiv5478217ed1730bb57386ee548f41&xls1d&id=fav&doc Protocol HTTP/1.1 Server 185.29.11.37 Meppel, Netherlands, ASN203557 (DATACLUB-, NL), Reverse DNS ip-11-37.dataclub.eu Software Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 / Resource Hash `bb87e9c96059f20821e4fe13900f60b7394752324574d38569381b98adc84196` Request headers Referer http://lapis.gq/excel/5/oauth2/authorize/files/ec699345e56e9aed9b39542056a6.php?client_id=77Inboxaspxn825a90c9c2d664a8527532d7d225&Id825a90c9c2d664a8527532d7d225&doc5478217ed1730bb57386ee548f41&login=&jiv5478217ed1730bb57386ee548f41&xls1d&id=fav&doc User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 13:33:02 GMT Last-Modified Thu, 22 Oct 2020 14:44:56 GMT Server Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 ETag "2293-5b24381f86198" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 8851
GET H/1.1	200 OK	ewacommon.png lapis.gq/excel/5/oauth2/authorize/files/	16 KB 16 KB	36ms 23ms	Image image/png	185.29.11.37 DATACLUB-
General Check archive.org Show headers Download Go to Show image Full URL http://lapis.gq/excel/5/oauth2/authorize/files/ewacommon.png Requested by Host: lapis.gq URL: http://lapis.gq/excel/5/oauth2/authorize/files/ec699345e56e9aed9b39542056a6.php?client_id=77Inboxaspxn825a90c9c2d664a8527532d7d225&Id825a90c9c2d664a8527532d7d225&doc5478217ed1730bb57386ee548f41&login=&jiv5478217ed1730bb57386ee548f41&xls1d&id=fav&doc Protocol HTTP/1.1 Server 185.29.11.37 Meppel, Netherlands, ASN203557 (DATACLUB-, NL), Reverse DNS ip-11-37.dataclub.eu Software Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 / Resource Hash `e65540513cb2a3e47e1d83f002ec50edb09a1b5572be0c0847cbc668569ade24` Request headers Referer http://lapis.gq/excel/5/oauth2/authorize/files/ec699345e56e9aed9b39542056a6.php?client_id=77Inboxaspxn825a90c9c2d664a8527532d7d225&Id825a90c9c2d664a8527532d7d225&doc5478217ed1730bb57386ee548f41&login=&jiv5478217ed1730bb57386ee548f41&xls1d&id=fav&doc User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 13:33:02 GMT Last-Modified Thu, 22 Oct 2020 14:44:56 GMT Server Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 ETag "402a-5b24381f8248c" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 16426
GET H/1.1	200 OK	ewaedit.png lapis.gq/excel/5/oauth2/authorize/files/	12 KB 13 KB	37ms 24ms	Image image/png	185.29.11.37 DATACLUB-
General Check archive.org Show headers Download Go to Show image Full URL http://lapis.gq/excel/5/oauth2/authorize/files/ewaedit.png Requested by Host: lapis.gq URL: http://lapis.gq/excel/5/oauth2/authorize/files/ec699345e56e9aed9b39542056a6.php?client_id=77Inboxaspxn825a90c9c2d664a8527532d7d225&Id825a90c9c2d664a8527532d7d225&doc5478217ed1730bb57386ee548f41&login=&jiv5478217ed1730bb57386ee548f41&xls1d&id=fav&doc Protocol HTTP/1.1 Server 185.29.11.37 Meppel, Netherlands, ASN203557 (DATACLUB-, NL), Reverse DNS ip-11-37.dataclub.eu Software Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 / Resource Hash `baa641ac1e002d1f34211836f31e81832c05ac2c8545078488c07b5e2d58df03` Request headers Referer http://lapis.gq/excel/5/oauth2/authorize/files/ec699345e56e9aed9b39542056a6.php?client_id=77Inboxaspxn825a90c9c2d664a8527532d7d225&Id825a90c9c2d664a8527532d7d225&doc5478217ed1730bb57386ee548f41&login=&jiv5478217ed1730bb57386ee548f41&xls1d&id=fav&doc User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 13:33:02 GMT Last-Modified Thu, 22 Oct 2020 14:44:56 GMT Server Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 ETag "30f6-5b24381f86198" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 12534
GET H/1.1	200 OK	jquery-1.7.2.min.js Show response lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/	93 KB 93 KB	21ms 20ms	Script application/javascript	185.29.11.37 DATACLUB-
General Check archive.org Show headers Download Go to Full URL http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/jquery-1.7.2.min.js Requested by Host: lapis.gq URL: http://lapis.gq/excel/5/oauth2/authorize/files/ec699345e56e9aed9b39542056a6.php?client_id=77Inboxaspxn825a90c9c2d664a8527532d7d225&Id825a90c9c2d664a8527532d7d225&doc5478217ed1730bb57386ee548f41&login=&jiv5478217ed1730bb57386ee548f41&xls1d&id=fav&doc Protocol HTTP/1.1 Server 185.29.11.37 Meppel, Netherlands, ASN203557 (DATACLUB-, NL), Reverse DNS ip-11-37.dataclub.eu Software Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 / Resource Hash `a14334cecd2ff3eab027a8cfa5c3632f7b630a9b4e4a7bc5804c6bdd027efb73` Request headers Referer http://lapis.gq/excel/5/oauth2/authorize/files/ec699345e56e9aed9b39542056a6.php?client_id=77Inboxaspxn825a90c9c2d664a8527532d7d225&Id825a90c9c2d664a8527532d7d225&doc5478217ed1730bb57386ee548f41&login=&jiv5478217ed1730bb57386ee548f41&xls1d&id=fav&doc User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 13:33:02 GMT Last-Modified Thu, 22 Oct 2020 14:44:57 GMT Server Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 ETag "1727b-5b24381fe9483" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 94843
GET H/1.1	200 OK	jquery.sim.utils.js Show response lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/	13 KB 14 KB	36ms 23ms	Script application/javascript	185.29.11.37 DATACLUB-
General Check archive.org Show headers Download Go to Full URL http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/jquery.sim.utils.js Requested by Host: lapis.gq URL: http://lapis.gq/excel/5/oauth2/authorize/files/ec699345e56e9aed9b39542056a6.php?client_id=77Inboxaspxn825a90c9c2d664a8527532d7d225&Id825a90c9c2d664a8527532d7d225&doc5478217ed1730bb57386ee548f41&login=&jiv5478217ed1730bb57386ee548f41&xls1d&id=fav&doc Protocol HTTP/1.1 Server 185.29.11.37 Meppel, Netherlands, ASN203557 (DATACLUB-, NL), Reverse DNS ip-11-37.dataclub.eu Software Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 / Resource Hash `a379adb1028e345f0c739e3401ff7ff60c8663e898ca0e746f140aba329f74c0` Request headers Referer http://lapis.gq/excel/5/oauth2/authorize/files/ec699345e56e9aed9b39542056a6.php?client_id=77Inboxaspxn825a90c9c2d664a8527532d7d225&Id825a90c9c2d664a8527532d7d225&doc5478217ed1730bb57386ee548f41&login=&jiv5478217ed1730bb57386ee548f41&xls1d&id=fav&doc User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 13:33:02 GMT Last-Modified Thu, 22 Oct 2020 14:44:57 GMT Server Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 ETag "3561-5b24381fe9483" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 13665
GET H/1.1	200 OK	index.jpg lapis.gq/excel/5/oauth2/authorize/files/	48 KB 48 KB	17ms 17ms	Image image/jpeg	185.29.11.37 DATACLUB-
General Check archive.org Show headers Download Go to Show image Full URL http://lapis.gq/excel/5/oauth2/authorize/files/index.jpg Requested by Host: lapis.gq URL: http://lapis.gq/excel/5/oauth2/authorize/files/ec699345e56e9aed9b39542056a6.php?client_id=77Inboxaspxn825a90c9c2d664a8527532d7d225&Id825a90c9c2d664a8527532d7d225&doc5478217ed1730bb57386ee548f41&login=&jiv5478217ed1730bb57386ee548f41&xls1d&id=fav&doc Protocol HTTP/1.1 Server 185.29.11.37 Meppel, Netherlands, ASN203557 (DATACLUB-, NL), Reverse DNS ip-11-37.dataclub.eu Software Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 / Resource Hash `b017df1defe56bb74395e69cf291beea481d7f97cdbe2cd50e9ea9f86f5570ca` Request headers Referer http://lapis.gq/excel/5/oauth2/authorize/files/ec699345e56e9aed9b39542056a6.php?client_id=77Inboxaspxn825a90c9c2d664a8527532d7d225&Id825a90c9c2d664a8527532d7d225&doc5478217ed1730bb57386ee548f41&login=&jiv5478217ed1730bb57386ee548f41&xls1d&id=fav&doc User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 13:33:02 GMT Last-Modified Thu, 22 Oct 2020 14:44:56 GMT Server Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 ETag "bedd-5b24381f8dba9" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 48861
GET H/1.1	200 OK	login.php Show response lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/ Frame 4F07	2 KB 3 KB	22ms 21ms	Document text/html	185.29.11.37 DATACLUB-
General Check archive.org Show headers Download Go to Full URL http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/login.php?login=&sfm_from_iframe=1 Requested by Host: lapis.gq URL: http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/jquery-1.7.2.min.js Protocol HTTP/1.1 Server 185.29.11.37 Meppel, Netherlands, ASN203557 (DATACLUB-, NL), Reverse DNS ip-11-37.dataclub.eu Software Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 / PHP/7.4.11 Resource Hash `9880c1bf4b33d130d7b977f068ddf6b566dc23453007fea4bab13de42fe40b55` Request headers Host lapis.gq Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://lapis.gq/excel/5/oauth2/authorize/files/ec699345e56e9aed9b39542056a6.php?client_id=77Inboxaspxn825a90c9c2d664a8527532d7d225&Id825a90c9c2d664a8527532d7d225&doc5478217ed1730bb57386ee548f41&login=&jiv5478217ed1730bb57386ee548f41&xls1d&id=fav&doc Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer http://lapis.gq/excel/5/oauth2/authorize/files/ec699345e56e9aed9b39542056a6.php?client_id=77Inboxaspxn825a90c9c2d664a8527532d7d225&Id825a90c9c2d664a8527532d7d225&doc5478217ed1730bb57386ee548f41&login=&jiv5478217ed1730bb57386ee548f41&xls1d&id=fav&doc Response headers Date Mon, 23 Nov 2020 13:33:02 GMT Server Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 X-Powered-By PHP/7.4.11 Content-Length 2476 Keep-Alive timeout=5, max=98 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	jquery-1.7.2.min.js Show response lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/ Frame 4F07	93 KB 93 KB	21ms 20ms	Script application/javascript	185.29.11.37 DATACLUB-
General Check archive.org Show headers Download Go to Full URL http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/jquery-1.7.2.min.js Requested by Host: lapis.gq URL: http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/login.php?login=&sfm_from_iframe=1 Protocol HTTP/1.1 Server 185.29.11.37 Meppel, Netherlands, ASN203557 (DATACLUB-, NL), Reverse DNS ip-11-37.dataclub.eu Software Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 / Resource Hash `a14334cecd2ff3eab027a8cfa5c3632f7b630a9b4e4a7bc5804c6bdd027efb73` Request headers Referer http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/login.php?login=&sfm_from_iframe=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 13:33:02 GMT Last-Modified Thu, 22 Oct 2020 14:44:57 GMT Server Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 ETag "1727b-5b24381fe9483" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 94843
GET H/1.1	200 OK	jquery.sim.utils.js Show response lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/ Frame 4F07	13 KB 14 KB	23ms 22ms	Script application/javascript	185.29.11.37 DATACLUB-
General Check archive.org Show headers Download Go to Full URL http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/jquery.sim.utils.js Requested by Host: lapis.gq URL: http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/login.php?login=&sfm_from_iframe=1 Protocol HTTP/1.1 Server 185.29.11.37 Meppel, Netherlands, ASN203557 (DATACLUB-, NL), Reverse DNS ip-11-37.dataclub.eu Software Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 / Resource Hash `a379adb1028e345f0c739e3401ff7ff60c8663e898ca0e746f140aba329f74c0` Request headers Referer http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/login.php?login=&sfm_from_iframe=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 13:33:02 GMT Last-Modified Thu, 22 Oct 2020 14:44:57 GMT Server Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 ETag "3561-5b24381fe9483" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 13665
GET H/1.1	200 OK	sfm-png-fix.js Show response lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/ Frame 4F07	2 KB 2 KB	27ms 26ms	Script application/javascript	185.29.11.37 DATACLUB-
General Check archive.org Show headers Download Go to Full URL http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/sfm-png-fix.js Requested by Host: lapis.gq URL: http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/login.php?login=&sfm_from_iframe=1 Protocol HTTP/1.1 Server 185.29.11.37 Meppel, Netherlands, ASN203557 (DATACLUB-, NL), Reverse DNS ip-11-37.dataclub.eu Software Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 / Resource Hash `a1d3a4b5db9a1dae0dde8d18e7edc94ed4253290ea2e3a8ba43203657311022b` Request headers Referer http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/login.php?login=&sfm_from_iframe=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 13:33:02 GMT Last-Modified Thu, 22 Oct 2020 14:44:57 GMT Server Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 ETag "648-5b24381ffc5ad" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 1608
GET H/1.1	200 OK	excel.css lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/ Frame 4F07	4 KB 4 KB	26ms 26ms	Stylesheet text/css	185.29.11.37 DATACLUB-
General Check archive.org Show headers Download Go to Full URL http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/excel.css Requested by Host: lapis.gq URL: http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/login.php?login=&sfm_from_iframe=1 Protocol HTTP/1.1 Server 185.29.11.37 Meppel, Netherlands, ASN203557 (DATACLUB-, NL), Reverse DNS ip-11-37.dataclub.eu Software Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 / Resource Hash `9d16c77980e69cd796fbac3ab5b828fc707867303c991eebf2c5c14112ea655c` Request headers Referer http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/login.php?login=&sfm_from_iframe=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 13:33:02 GMT Last-Modified Thu, 22 Oct 2020 14:44:56 GMT Server Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 ETag "ea5-5b24381fd6355" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 3749
GET H/1.1	200 OK	294.GIF lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/ Frame 4F07	7 KB 7 KB	18ms 18ms	Image image/gif	185.29.11.37 DATACLUB-
General Check archive.org Show headers Download Go to Show image Full URL http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/294.GIF Requested by Host: lapis.gq URL: http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/login.php?login=&sfm_from_iframe=1 Protocol HTTP/1.1 Server 185.29.11.37 Meppel, Netherlands, ASN203557 (DATACLUB-, NL), Reverse DNS ip-11-37.dataclub.eu Software Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 / Resource Hash `fef58f4d384c2763c7be72b7df1180f9e4a0c64f128659fb3d16a44fd5c0ef06` Request headers Referer http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/login.php?login=&sfm_from_iframe=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 13:33:02 GMT Last-Modified Thu, 22 Oct 2020 14:44:56 GMT Server Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 ETag "1ba5-5b24381fcac39" Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 7077
GET H/1.1	200 OK	excel-Submit-0.png lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/ Frame 4F07	549 B 858 B	18ms 18ms	Image image/png	185.29.11.37 DATACLUB-
General Check archive.org Show headers Download Go to Show image Full URL http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/excel-Submit-0.png Requested by Host: lapis.gq URL: http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/login.php?login=&sfm_from_iframe=1 Protocol HTTP/1.1 Server 185.29.11.37 Meppel, Netherlands, ASN203557 (DATACLUB-, NL), Reverse DNS ip-11-37.dataclub.eu Software Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 / Resource Hash `3b3ddbd5a8dea7f9743b3d9a9821e219f33c21a91088f27424dba087c208870b` Request headers Referer http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/login.php?login=&sfm_from_iframe=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 13:33:02 GMT Last-Modified Thu, 22 Oct 2020 14:44:56 GMT Server Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 ETag "225-5b24381fd6355" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 549
GET H/1.1	200 OK	excel2013.png lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/ Frame 4F07	18 KB 19 KB	18ms 18ms	Image image/png	185.29.11.37 DATACLUB-
General Check archive.org Show headers Download Go to Show image Full URL http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/excel2013.png Requested by Host: lapis.gq URL: http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/login.php?login=&sfm_from_iframe=1 Protocol HTTP/1.1 Server 185.29.11.37 Meppel, Netherlands, ASN203557 (DATACLUB-, NL), Reverse DNS ip-11-37.dataclub.eu Software Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 / Resource Hash `a9d68907dc3aba1d0be80f20a3f1b5d40dee98469ad512d14225a2712b0fd97c` Request headers Referer http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/login.php?login=&sfm_from_iframe=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 13:33:02 GMT Last-Modified Thu, 22 Oct 2020 14:44:57 GMT Server Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 ETag "4963-5b24381fddd69" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 18787
GET H/1.1	200 OK	loading.gif lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/ Frame 4F07	673 B 982 B	19ms 19ms	Image image/gif	185.29.11.37 DATACLUB-
General Check archive.org Show headers Download Go to Show image Full URL http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/loading.gif Requested by Host: lapis.gq URL: http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/excel.css Protocol HTTP/1.1 Server 185.29.11.37 Meppel, Netherlands, ASN203557 (DATACLUB-, NL), Reverse DNS ip-11-37.dataclub.eu Software Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 / Resource Hash `43a526a07a078d736e5c9d67d8479dd54072b7e5c6ddd2cd466f86a086e49ef5` Request headers Referer http://lapis.gq/excel/5/oauth2/authorize/files/trademanager/excel/excel.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 23 Nov 2020 13:33:02 GMT Last-Modified Thu, 22 Oct 2020 14:44:57 GMT Server Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 ETag "2a1-5b24381fed193" Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=95 Content-Length 673

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer) Excel / PDF download (Online)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| sfm_refresh_captcha function| sfm_hyper_link_popup function| sfm_popup_form function| sfm_window_popup_form function| sfmFormObj function| sfm_show_loading_on_formsubmit function| sfm_clear_form function| sfm_init_special_action_button function| sfm_init_default_text object| $ifr

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

lapis.gq
185.29.11.37
3b3ddbd5a8dea7f9743b3d9a9821e219f33c21a91088f27424dba087c208870b
43a526a07a078d736e5c9d67d8479dd54072b7e5c6ddd2cd466f86a086e49ef5
9880c1bf4b33d130d7b977f068ddf6b566dc23453007fea4bab13de42fe40b55
9d16c77980e69cd796fbac3ab5b828fc707867303c991eebf2c5c14112ea655c
a14334cecd2ff3eab027a8cfa5c3632f7b630a9b4e4a7bc5804c6bdd027efb73
a1d3a4b5db9a1dae0dde8d18e7edc94ed4253290ea2e3a8ba43203657311022b
a379adb1028e345f0c739e3401ff7ff60c8663e898ca0e746f140aba329f74c0
a6bba9179a5ec451dc6f4c93ab99525f4fb5918ad1f65e201a03f54ad7f6c8c3
a9d68907dc3aba1d0be80f20a3f1b5d40dee98469ad512d14225a2712b0fd97c
b017df1defe56bb74395e69cf291beea481d7f97cdbe2cd50e9ea9f86f5570ca
baa641ac1e002d1f34211836f31e81832c05ac2c8545078488c07b5e2d58df03
bb87e9c96059f20821e4fe13900f60b7394752324574d38569381b98adc84196
e415b0a145ada29079ab18ceded80d4e597742c74f78cee816012412c825b85d
e65540513cb2a3e47e1d83f002ec50edb09a1b5572be0c0847cbc668569ade24
fef58f4d384c2763c7be72b7df1180f9e4a0c64f128659fb3d16a44fd5c0ef06