Share-Online.biz was redirected to phishing site

Do your remember share-online.biz?

Share-Online.biz was a provider of online services specializing in the storage, management and simple exchange of larger files in particular (a so-called share hoster). It financed itself through paid premium access. Alongside Rapidshare and Uploaded.net, Share-Online.biz was one of the world’s largest file hosters.

Until the shutdown, the operators had been renting steadily increasing server capacities for the operation of the platform since 2010 at the latest, most recently in the double-digit petabyte range.

The website was shut down on October 16, 2019.

If anyone is still nostalgic and wants to take a look at the page, they will find themselves on a Microsoft page.

You immediately get a flashing window with a message from the Microsoft Defender Security Center that you should call Microsoft Support immediately using the number provided.

Let’s take a look at the screenshot provided by a German user.

As you can see, it all looks like a Microsoft branded website. The URL under the domain web.core.windows.net looks trustworthy, doesn’t it?

And yes, this is an official domain from Microsoft! The domain web.core.windows.net is part of the Microsoft Azure cloud platform. It is used to provide statically hosted content via Azure Blob Storage, especially if an Azure Blob Storage account is configured for static website hosting.

If someone uploads a website as static files (e.g. HTML, CSS, JS) in an Azure Blob Storage and activates the “Static website hosting” function, the page will be hosted via a URL such as:

https://myapp.z12.web.core.windows.net/

The phone number is written in an unusual notation, but when put together it results in a mobile phone number of the German provider Telekom.

That’s a total scam move — stay sharp and don’t even think about calling back.

Take care!

Identifying features have been removed.