onedrivehome.com Open in urlscan Pro
18.134.64.247  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response onedrivehome.com/	8 KB 3 KB	706ms 653ms	Document text/html	18.134.64.247 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://onedrivehome.com/?em=66add116-61d9-4a4f-9732-23824d19d1b4&id=a64e585b-b4b5-4738-cc35-93a60af4a1cf Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.134.64.247 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-134-64-247.eu-west-2.compute.amazonaws.com Software nginx / Resource Hash 53571f8dd4df1272e4826ceb9a77a7aa2e63170f5db1d59faa057395d15326d6 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority onedrivehome.com :scheme https :path /?em=66add116-61d9-4a4f-9732-23824d19d1b4&id=a64e585b-b4b5-4738-cc35-93a60af4a1cf pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 20 Jan 2021 04:47:50 GMT content-type text/html; charset=UTF-8 set-cookie AWSALB=vXUOReMG6A3FNjn1CS/O3iUJdODkhA//23j93Ye7ZPBrkVP3NzdAU0yZHGNMqGzFpAJqKoNg3cYEvkroDQl83bN+GoG+dNbCQTJ+B1ImRmnFeuOW6lP043eUB0uR; Expires=Wed, 27 Jan 2021 04:47:50 GMT; Path=/ AWSALBCORS=vXUOReMG6A3FNjn1CS/O3iUJdODkhA//23j93Ye7ZPBrkVP3NzdAU0yZHGNMqGzFpAJqKoNg3cYEvkroDQl83bN+GoG+dNbCQTJ+B1ImRmnFeuOW6lP043eUB0uR; Expires=Wed, 27 Jan 2021 04:47:50 GMT; Path=/; SameSite=None; Secure laravel_session=eyJpdiI6InRrMGV0a3BsaUFOT2FcL3dmNlpsSWhBPT0iLCJ2YWx1ZSI6IkxGVXh0anNcL2NyR1lDY0lcLzJVMWZ4N1ZSS2d1Y2N6bXZqYitGcXV6aFNLR3ZpamVQck40Z3VBalF4NTVKeDAwSyIsIm1hYyI6ImI0NTM5YmQ3OTEyMmZhM2E1OGUwZmMyNGJkZWFkMTYwNDhhNzlmMmNjN2QxNDdkMjNlYTA0YmE3Nzk2YzM2MGIifQ%3D%3D; expires=Wed, 20-Jan-2021 06:47:50 GMT; Max-Age=7200; path=/; httponly server nginx vary Accept-Encoding cache-control no-cache, private x-content-type-options nosniff x-frame-options SAMEORIGIN x-xss-protection 1; mode=block content-encoding gzip
GET		style.css onedrivehome.com/	0 0
GET H2	200	css fonts.googleapis.com/	2 KB 529 B	16ms 14ms	Stylesheet text/css	2a00:1450:4001:803::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Lato:400,700,900&display=swap Requested by Host: onedrivehome.com URL: https://onedrivehome.com/?em=66add116-61d9-4a4f-9732-23824d19d1b4&id=a64e585b-b4b5-4738-cc35-93a60af4a1cf Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash ba76edb43d3f178a00aa4f704ad4518599d1338cd10e6d1355fa1ee5c2538227 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://onedrivehome.com/?em=66add116-61d9-4a4f-9732-23824d19d1b4&id=a64e585b-b4b5-4738-cc35-93a60af4a1cf User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 20 Jan 2021 04:47:50 GMT server ESF date Wed, 20 Jan 2021 04:47:50 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 20 Jan 2021 04:47:50 GMT
GET H2	200	png onedrivehome.com/media/officelogo/	19 KB 20 KB	50ms 48ms	Image image/png	18.134.64.247 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://onedrivehome.com/media/officelogo/png Requested by Host: onedrivehome.com URL: https://onedrivehome.com/?em=66add116-61d9-4a4f-9732-23824d19d1b4&id=a64e585b-b4b5-4738-cc35-93a60af4a1cf Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.134.64.247 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-134-64-247.eu-west-2.compute.amazonaws.com Software nginx / Resource Hash 7d9efb8a4223c5a409e3fec8a1e496601acca6ad97af9958904571fc7112c63c Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://onedrivehome.com/?em=66add116-61d9-4a4f-9732-23824d19d1b4&id=a64e585b-b4b5-4738-cc35-93a60af4a1cf User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 20 Jan 2021 04:47:50 GMT x-content-type-options nosniff server nginx x-frame-options SAMEORIGIN content-length 19842 x-xss-protection 1; mode=block content-type image/png
GET H2	200	svg onedrivehome.com/media/arrow/	778 B 1 KB	63ms 62ms	Image image/svg+xml	18.134.64.247 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://onedrivehome.com/media/arrow/svg Requested by Host: onedrivehome.com URL: https://onedrivehome.com/?em=66add116-61d9-4a4f-9732-23824d19d1b4&id=a64e585b-b4b5-4738-cc35-93a60af4a1cf Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.134.64.247 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-134-64-247.eu-west-2.compute.amazonaws.com Software nginx / Resource Hash 7b9549b57de2ab1aafdb799323c9aa144df986d3945afb53628f81e478fcce51 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://onedrivehome.com/?em=66add116-61d9-4a4f-9732-23824d19d1b4&id=a64e585b-b4b5-4738-cc35-93a60af4a1cf User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 20 Jan 2021 04:47:50 GMT x-content-type-options nosniff server nginx x-frame-options SAMEORIGIN content-length 778 x-xss-protection 1; mode=block content-type image/svg+xml
GET H2	200	jpg onedrivehome.com/media/background/	344 KB 345 KB	51ms 50ms	Image image/jpeg	18.134.64.247 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://onedrivehome.com/media/background/jpg Requested by Host: onedrivehome.com URL: https://onedrivehome.com/?em=66add116-61d9-4a4f-9732-23824d19d1b4&id=a64e585b-b4b5-4738-cc35-93a60af4a1cf Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.134.64.247 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-134-64-247.eu-west-2.compute.amazonaws.com Software nginx / Resource Hash a3efa3c84ac6e1ca48798af1a83d6f02078276607f1447d765c3a1da936d9301 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://onedrivehome.com/?em=66add116-61d9-4a4f-9732-23824d19d1b4&id=a64e585b-b4b5-4738-cc35-93a60af4a1cf User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 20 Jan 2021 04:47:50 GMT x-content-type-options nosniff server nginx x-frame-options SAMEORIGIN content-length 352114 x-xss-protection 1; mode=block content-type image/jpeg

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

onedrivehome.com

URL

https://onedrivehome.com/style.css

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			onedrivehome.com/	1970-01-19 15:42:02	Name: AWSALBCORS Value: 2dgfRIBg96J+6fodhe4EFK3D9uI/OC89DlSIxJPZCWuA2gGJvXYYc/d+KP64m7yLVhbN0c+8HypOLUYVr5Vdnkpei0/ZU+NbhQkcHNJR+pMzMHbLXAcGY3+vbPCj
			onedrivehome.com/	1970-01-19 15:42:02	Name: AWSALB Value: 2dgfRIBg96J+6fodhe4EFK3D9uI/OC89DlSIxJPZCWuA2gGJvXYYc/d+KP64m7yLVhbN0c+8HypOLUYVr5Vdnkpei0/ZU+NbhQkcHNJR+pMzMHbLXAcGY3+vbPCj
			onedrivehome.com/	1970-01-19 15:32:05	Name: laravel_session Value: eyJpdiI6Im1GSVJkZVdqcG1RSGZCWSt6Uk1GSXc9PSIsInZhbHVlIjoiQ2JSTnZWSmE0RlphOVwvamQwZXFHQ2dmSFBiOU1ldllDUG03U3BkSTcxQnlpY1JGU0tJMHlTTXpMa0FYbnk2VmUiLCJtYWMiOiI4MGQ1ZTFmZGI1M2UzOGNmYmViY2I2ODc1OTMyOTAxMmNmZDkxYTE1NjFhZmRlNzA5NmRlY2Q0NTI3Y2VhNTkzIn0%3D

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
onedrivehome.com
onedrivehome.com
18.134.64.247
2a00:1450:4001:803::200a
53571f8dd4df1272e4826ceb9a77a7aa2e63170f5db1d59faa057395d15326d6
7b9549b57de2ab1aafdb799323c9aa144df986d3945afb53628f81e478fcce51
7d9efb8a4223c5a409e3fec8a1e496601acca6ad97af9958904571fc7112c63c
a3efa3c84ac6e1ca48798af1a83d6f02078276607f1447d765c3a1da936d9301
ba76edb43d3f178a00aa4f704ad4518599d1338cd10e6d1355fa1ee5c2538227