heih.ml Open in urlscan Pro
2606:4700:3035::681f:4b40 Malicious Activity! Public Scan

URL:
https://heih.ml/ronh/sharepoint/
Submission: On April 30 via api (April 30th 2020, 4:23:20 am UTC) from CA

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 14 HTTP transactions. The main IP is 2606:4700:3035::681f:4b40, located in United States and belongs to CLOUDFLARENET, US. The main domain is heih.ml.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on April 8th 2020. Valid for: 6 months.

This is the only time heih.ml was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sharepoint (Online)

Domain & IP information

	IP Address	AS Autonomous System
12	2606:4700:303... 2606:4700:3035::681f:4b40	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:818::200a	15169 (GOOGLE) (GOOGLE)
14	2

12 2606:4700:3035::681f:4b40 (United States)

ASN13335 (CLOUDFLARENET, US)

heih.ml	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:818::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	heih.ml heih.ml	316 KB
2	googleapis.com ajax.googleapis.com	60 KB
14	2

	Domain	Requested by
12	heih.ml	ajax.googleapis.com
2	ajax.googleapis.com	heih.ml ajax.googleapis.com
14	2

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-04-08` - `2020-10-09`	6 months	crt.sh
upload.video.google.com GTS CA 1O1	`2020-04-07` - `2020-06-30`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://heih.ml/ronh/sharepoint/
Frame ID: 187EBA7CC068C97AB61BA24454AE60A6
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

14
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

375 kB
Transfer

588 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
heih.ml/ronh/sharepoint/ 2 KB
1 KB 564ms
541ms Document
text/html 2606:4700:3035::681f:4b40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://heih.ml/ronh/sharepoint/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681f:4b40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8d03026a0f9ca0c11d3dd23a5a0171b449c07cd107d6cb40a915c27be96170e0

Request headers

:method: GET
:authority: heih.ml
:scheme: https
:path: /ronh/sharepoint/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Thu, 30 Apr 2020 04:22:39 GMT
content-type: text/html
set-cookie: __cfduid=dda181bfa9eb715a81dcbe22d86267ab01588220559; expires=Sat, 30-May-20 04:22:39 GMT; path=/; domain=.heih.ml; HttpOnly; SameSite=Lax
last-modified: Wed, 08 Apr 2020 20:06:12 GMT
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 58be7ba01b273233-FRA
content-encoding: br
cf-request-id: 026aeb980f00003233cda8e200000001

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 85 KB
30 KB 12ms
10ms Script
text/javascript 2a00:1450:4001:818::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js

Requested by

Host: heih.ml
URL: https://heih.ml/ronh/sharepoint/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://heih.ml/ronh/sharepoint/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 04 Apr 2020 07:48:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2234057
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30399
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 04 Apr 2021 07:48:22 GMT

GET
H2 200 index-home.html Show response
heih.ml/ronh/sharepoint/ 3 KB
1 KB 508ms
508ms XHR
text/html 2606:4700:3035::681f:4b40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://heih.ml/ronh/sharepoint/index-home.html
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681f:4b40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8d9e3dc7db44427b9fda24019f54d36c14a6383ff7de1b01d6b11c7f87bfa4c2

Request headers

Accept: */*
Referer: https://heih.ml/ronh/sharepoint/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 04:22:40 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Wed, 08 Apr 2020 20:06:12 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: text/html
status: 200
cf-ray: 58be7ba55b733233-FRA
cf-request-id: 026aeb9b5500003233cdaac200000001

GET
H2 200 bootstrap.min.css
heih.ml/ronh/sharepoint/css/ 118 KB
18 KB 924ms
923ms Stylesheet
text/css 2606:4700:3035::681f:4b40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://heih.ml/ronh/sharepoint/css/bootstrap.min.css
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681f:4b40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Request headers

Referer: https://heih.ml/ronh/sharepoint/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 04:22:41 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 08 Apr 2020 20:06:12 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 58be7ba889913233-FRA
cf-request-id: 026aeb9d5700003233cdac9200000001

GET
H2 200 style.css
heih.ml/ronh/sharepoint/css/ 1 KB
522 B 521ms
521ms Stylesheet
text/css 2606:4700:3035::681f:4b40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://heih.ml/ronh/sharepoint/css/style.css
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681f:4b40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3be4f58ea8b886668b97d8ed6f9c02489c5496dd890af4ee2ff7c112a2fd3122

Request headers

Referer: https://heih.ml/ronh/sharepoint/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 04:22:41 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 08 Apr 2020 20:06:12 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 58be7ba889943233-FRA
cf-request-id: 026aeb9d5700003233cdaca200000001

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 85 KB
30 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:818::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://heih.ml/ronh/sharepoint/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 04 Apr 2020 07:48:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2234058
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30399
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 04 Apr 2021 07:48:22 GMT

GET
H2 200 2.png
heih.ml/ronh/sharepoint/images/ 16 KB
16 KB 644ms
643ms Image
image/png 2606:4700:3035::681f:4b40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heih.ml/ronh/sharepoint/images/2.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681f:4b40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 03e701250890224c377b2c747ba9aef46b970682d5e5aca72f9dd037d5c89440

Request headers

Referer: https://heih.ml/ronh/sharepoint/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 04:22:41 GMT
cf-cache-status: MISS
last-modified: Wed, 08 Apr 2020 20:06:12 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 58be7ba8999f3233-FRA
content-length: 15885
cf-request-id: 026aeb9d5b00003233cdacc200000001

GET
H2 200 3.png
heih.ml/ronh/sharepoint/images/ 13 KB
13 KB 535ms
534ms Image
image/png 2606:4700:3035::681f:4b40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heih.ml/ronh/sharepoint/images/3.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681f:4b40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d9996d1cd780f411e637694c103886f81d2cef3acb58552e5674d285516ac52c

Request headers

Referer: https://heih.ml/ronh/sharepoint/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 04:22:41 GMT
cf-cache-status: MISS
last-modified: Wed, 08 Apr 2020 20:06:12 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 58be7ba899a13233-FRA
content-length: 13250
cf-request-id: 026aeb9d5b00003233cdacd200000001

GET
H2 200 4.png
heih.ml/ronh/sharepoint/images/ 16 KB
16 KB 672ms
671ms Image
image/png 2606:4700:3035::681f:4b40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heih.ml/ronh/sharepoint/images/4.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681f:4b40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9bc072bee8f8653393501d1246e9ec6f47c317879594cc557b19e47270b3a3dc

Request headers

Referer: https://heih.ml/ronh/sharepoint/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 04:22:41 GMT
cf-cache-status: MISS
last-modified: Wed, 08 Apr 2020 20:06:12 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 58be7ba899a23233-FRA
content-length: 15998
cf-request-id: 026aeb9d5b00003233cdace200000001

GET
H2 200 5.png
heih.ml/ronh/sharepoint/images/ 10 KB
10 KB 535ms
534ms Image
image/png 2606:4700:3035::681f:4b40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heih.ml/ronh/sharepoint/images/5.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681f:4b40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3d28b1647011555b322ca6d78cda43aa12094e7ea3bb3adc2651edffd410132b

Request headers

Referer: https://heih.ml/ronh/sharepoint/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 04:22:41 GMT
cf-cache-status: MISS
last-modified: Wed, 08 Apr 2020 20:06:12 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 58be7ba899a33233-FRA
content-length: 10594
cf-request-id: 026aeb9d5b00003233cdacf200000001

GET
H2 200 6.png
heih.ml/ronh/sharepoint/images/ 14 KB
14 KB 651ms
651ms Image
image/png 2606:4700:3035::681f:4b40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heih.ml/ronh/sharepoint/images/6.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681f:4b40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d2668c50a423f55b36262bfd4bbd068261e9f06e86d226f0b42ab91dc11973c3

Request headers

Referer: https://heih.ml/ronh/sharepoint/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 04:22:41 GMT
cf-cache-status: MISS
last-modified: Wed, 08 Apr 2020 20:06:12 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 58be7ba8ba023233-FRA
content-length: 14640
cf-request-id: 026aeb9d7500003233cdad4200000001

GET
H2 200 7.png
heih.ml/ronh/sharepoint/images/ 15 KB
15 KB 710ms
709ms Image
image/png 2606:4700:3035::681f:4b40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heih.ml/ronh/sharepoint/images/7.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681f:4b40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c4c803337c3a62a637f8946d4a0f23fcf26de1276bdb5a1ca6b24690e09a0117

Request headers

Referer: https://heih.ml/ronh/sharepoint/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 04:22:41 GMT
cf-cache-status: MISS
last-modified: Wed, 08 Apr 2020 20:06:12 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 58be7ba8b9ff3233-FRA
content-length: 15431
cf-request-id: 026aeb9d7400003233cdad2200000001

GET
H2 200 8.png
heih.ml/ronh/sharepoint/images/ 14 KB
14 KB 634ms
634ms Image
image/png 2606:4700:3035::681f:4b40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heih.ml/ronh/sharepoint/images/8.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681f:4b40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 670b9398865900d230eb044384791cdb5ba6bc1d5f16bca4111e908fd571cec7

Request headers

Referer: https://heih.ml/ronh/sharepoint/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 04:22:41 GMT
cf-cache-status: MISS
last-modified: Wed, 08 Apr 2020 20:06:12 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 58be7ba8ba003233-FRA
content-length: 14586
cf-request-id: 026aeb9d7400003233cdad3200000001

GET
H2 200 1.png
heih.ml/ronh/sharepoint/images/ 196 KB
196 KB 1402ms
1397ms Image
image/png 2606:4700:3035::681f:4b40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://heih.ml/ronh/sharepoint/images/1.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::681f:4b40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c09ec09a65cc1ab90220cae2a3e585c7d2c6c29e754ee577edb587b0fb3f927

Request headers

Referer: https://heih.ml/ronh/sharepoint/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 04:22:42 GMT
cf-cache-status: MISS
last-modified: Wed, 08 Apr 2020 20:06:12 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 58be7bac0f9e3233-FRA
content-length: 200605
cf-request-id: 026aeb9f8800003233cdafb200000001

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sharepoint (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.heih.ml/	1970-01-19 09:53:32	Name: __cfduid Value: dda181bfa9eb715a81dcbe22d86267ab01588220559

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
heih.ml
2606:4700:3035::681f:4b40
2a00:1450:4001:818::200a
03e701250890224c377b2c747ba9aef46b970682d5e5aca72f9dd037d5c89440
0c09ec09a65cc1ab90220cae2a3e585c7d2c6c29e754ee577edb587b0fb3f927
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
3be4f58ea8b886668b97d8ed6f9c02489c5496dd890af4ee2ff7c112a2fd3122
3d28b1647011555b322ca6d78cda43aa12094e7ea3bb3adc2651edffd410132b
670b9398865900d230eb044384791cdb5ba6bc1d5f16bca4111e908fd571cec7
8d03026a0f9ca0c11d3dd23a5a0171b449c07cd107d6cb40a915c27be96170e0
8d9e3dc7db44427b9fda24019f54d36c14a6383ff7de1b01d6b11c7f87bfa4c2
9bc072bee8f8653393501d1246e9ec6f47c317879594cc557b19e47270b3a3dc
c4c803337c3a62a637f8946d4a0f23fcf26de1276bdb5a1ca6b24690e09a0117
d2668c50a423f55b36262bfd4bbd068261e9f06e86d226f0b42ab91dc11973c3
d9996d1cd780f411e637694c103886f81d2cef3acb58552e5674d285516ac52c
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

heih.ml Open in urlscan Pro 2606:4700:3035::681f:4b40 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

375 kBTransfer

588 kBSize

1 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

1 Cookies

Indicators

heih.ml Open in urlscan Pro
2606:4700:3035::681f:4b40 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

375 kB
Transfer

588 kB
Size

1
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!