rnylfqcutofrmcen-dot-motast.nw.r.appspot.com

Summary

This website contacted 4 IPs in 4 countries across 4 domains to perform 5 HTTP transactions. The main IP is 2a00:1450:4001:819::2014, located in Frankfurt am Main, Germany and belongs to GOOGLE, US. The main domain is rnylfqcutofrmcen-dot-motast.nw.r.appspot.com.
TLS certificate: Issued by GTS CA 1O1 on November 10th 2020. Valid for: 3 months.

This is the only time rnylfqcutofrmcen-dot-motast.nw.r.appspot.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 2	2a00:1450:400... 2a00:1450:4001:819::2014	15169 (GOOGLE) (GOOGLE)
2	192.229.221.185 192.229.221.185	15133 (EDGECAST) (EDGECAST)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:3b	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a02:26f0:2b0... 2a02:26f0:2b00:999::35c1	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
5	4

2 2a00:1450:4001:819::2014 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

rnylfqcutofrmcen-dot-motast.nw.r.appspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.229.221.185 (United States)

ASN15133 (EDGECAST, US)

logincdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:3b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:2b00:999::35c1 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

secure.aadcdn.microsoftonline-p.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	msauth.net logincdn.msauth.net	2 KB
2	appspot.com 1 redirects rnylfqcutofrmcen-dot-motast.nw.r.appspot.com	3 KB
1	microsoftonline-p.com secure.aadcdn.microsoftonline-p.com	277 KB
1	jquery.com code.jquery.com	83 KB
5	4

	Domain	Requested by
2	logincdn.msauth.net	rnylfqcutofrmcen-dot-motast.nw.r.appspot.com
2	rnylfqcutofrmcen-dot-motast.nw.r.appspot.com	1 redirects
1	secure.aadcdn.microsoftonline-p.com	rnylfqcutofrmcen-dot-motast.nw.r.appspot.com
1	code.jquery.com	rnylfqcutofrmcen-dot-motast.nw.r.appspot.com
5	4

This site contains links to these domains. Also see Links.

Domain
account.live.com
signup.live.com

Subject Issuer	Validity	Valid
*.appspot.com GTS CA 1O1	`2020-11-10` - `2021-02-02`	3 months	crt.sh
identitycdn.msauth.net DigiCert SHA2 Secure Server CA	`2020-07-20` - `2021-07-20`	a year	crt.sh
jquery.org Sectigo RSA Domain Validation Secure Server CA	`2020-10-06` - `2021-10-16`	a year	crt.sh
secure.aadcdn.microsoftonline-p.com Microsoft IT TLS CA 4	`2019-07-17` - `2021-07-17`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://rnylfqcutofrmcen-dot-motast.nw.r.appspot.com/
Frame ID: 0A015A79CC87186A84168914643BF594
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://rnylfqcutofrmcen-dot-motast.nw.r.appspot.com/ HTTP 302
https://rnylfqcutofrmcen-dot-motast.nw.r.appspot.com/ Page URL

Detected technologies

Google App Engine (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /Google Frontend/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

5
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

4
Countries

365 kB
Transfer

568 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fcontextid%3dE33D9695174B450D%26pid%3d0%26uaid%3d6f1c239f361c467998c61e96f650d4f1%26pid%3d0%26contextid%3dE33D9695174B450D%26bk%3d1600506140&id=38936&uiflavor=web&uaid=6f1c239f361c467998c61e96f650d4f1&mkt=EN-US&lc=1033&bk=1600506140
Title: reset it now.

Search URL Search Domain Scan URL

URL: https://signup.live.com/signup?contextid=25D92D3487CB5763&bk=1600444581&ru=https://login.live.com/login.srf%3fcontextid%3d25D92D3487CB5763%26uiflavor%3dweb%26mkt%3dEN-US%26lc%3d1033%26bk%3d1600444581%26uaid%3d034567f485e440c3b68aa18077cd53c4&uiflavor=web&lic=1&mkt=EN-US&lc=1033&uaid=034567f485e440c3b68aa18077cd53c4
Title: Create one!

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://rnylfqcutofrmcen-dot-motast.nw.r.appspot.com/ HTTP 302
https://rnylfqcutofrmcen-dot-motast.nw.r.appspot.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
rnylfqcutofrmcen-dot-motast.nw.r.appspot.com/
Redirect Chain

http://rnylfqcutofrmcen-dot-motast.nw.r.appspot.com/
https://rnylfqcutofrmcen-dot-motast.nw.r.appspot.com/

6 KB
3 KB

44ms
25ms

Document
text/html

2a00:1450:4001:819::2014
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rnylfqcutofrmcen-dot-motast.nw.r.appspot.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:819::2014 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 5a605bd12eb1eb340d173bdb6d689077bcb445347e010f92d01993883b686965

Request headers

:method: GET
:authority: rnylfqcutofrmcen-dot-motast.nw.r.appspot.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-type: text/html
content-encoding: gzip
x-cloud-trace-context: 85fc05bb4513112fce638d61a82be29f
vary: Accept-Encoding
date: Wed, 16 Dec 2020 02:07:48 GMT
server: Google Frontend
cache-control: private
content-length: 2285
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

Location: https://rnylfqcutofrmcen-dot-motast.nw.r.appspot.com/
X-Cloud-Trace-Context: 9baa5707a53d814ff99900a1113ebd57
Date: Wed, 16 Dec 2020 02:07:48 GMT
Content-Type: text/html
Server: Google Frontend
Content-Length: 0

GET
H2 200 microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
logincdn.msauth.net/shared/1.0/content/images/ 4 KB
2 KB 113ms
28ms Image
image/svg+xml 192.229.221.185
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://logincdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Requested by: Host: rnylfqcutofrmcen-dot-motast.nw.r.appspot.com
URL: https://rnylfqcutofrmcen-dot-motast.nw.r.appspot.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.221.185 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ska/F7B5) /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Referer: https://rnylfqcutofrmcen-dot-motast.nw.r.appspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 16 Dec 2020 02:07:48 GMT
content-encoding: gzip
content-md5: nzaLxFgP7ZB3dfMcaybWzw==
age: 16284900
x-cache: HIT
content-length: 1435
x-ms-lease-status: unlocked
last-modified: Wed, 22 Jan 2020 00:32:50 GMT
server: ECAcc (ska/F7B5)
etag: 0x8D79ED29CF0C29A
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: f2a757ca-801e-004d-2c34-3f10a9000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
logincdn.msauth.net/shared/1.0/content/images/ 513 B
428 B 113ms
28ms Image
image/svg+xml 192.229.221.185
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
Requested by: Host: rnylfqcutofrmcen-dot-motast.nw.r.appspot.com
URL: https://rnylfqcutofrmcen-dot-motast.nw.r.appspot.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.221.185 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ska/F7A3) /
Resource Hash: 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

Request headers

Referer: https://rnylfqcutofrmcen-dot-motast.nw.r.appspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 16 Dec 2020 02:07:48 GMT
content-encoding: gzip
content-md5: TjUQkZ0p0Y7rbj6LJofS9Q==
age: 16284899
x-cache: HIT
content-length: 276
x-ms-lease-status: unlocked
last-modified: Wed, 22 Jan 2020 00:32:44 GMT
server: ECAcc (ska/F7A3)
etag: 0x8D79ED2994A7074
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 1e325c23-401e-004c-4734-3feea4000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 jquery-3.5.1.js Show response
code.jquery.com/ 281 KB
83 KB 25ms
9ms Script
application/javascript 2001:4de0:ac19::1:b:3b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.5.1.js
Requested by: Host: rnylfqcutofrmcen-dot-motast.nw.r.appspot.com
URL: https://rnylfqcutofrmcen-dot-motast.nw.r.appspot.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac19::1:b:3b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37

Request headers

Origin: https://rnylfqcutofrmcen-dot-motast.nw.r.appspot.com
Referer: https://rnylfqcutofrmcen-dot-motast.nw.r.appspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 16 Dec 2020 02:07:48 GMT
content-encoding: gzip
last-modified: Mon, 04 May 2020 23:02:39 GMT
server: nginx
etag: W/"5eb09f0f-4638e"
vary: Accept-Encoding
x-hw: 1608084468.dop243.fr8.t,1608084468.cds214.fr8.hc,1608084468.cds234.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 84374

GET
H/1.1 200
OK 0_a5dbd4393ff6a725c7e62b61df7e72f0.jpg
secure.aadcdn.microsoftonline-p.com/ests/2.1.8576.13/content/images/backgrounds/ 277 KB
277 KB 54ms
16ms Image
image/jpeg 2a02:26f0:2b00:999::35c1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8576.13/content/images/backgrounds/0_a5dbd4393ff6a725c7e62b61df7e72f0.jpg

Requested by

Host: rnylfqcutofrmcen-dot-motast.nw.r.appspot.com
URL: https://rnylfqcutofrmcen-dot-motast.nw.r.appspot.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:2b00:999::35c1 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

/

Resource Hash

211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://rnylfqcutofrmcen-dot-motast.nw.r.appspot.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 16 Dec 2020 02:07:48 GMT
Last-Modified: Sun, 19 May 2019 07:54:25 GMT
Content-MD5: pdvUOT/2pyXH5ith335y8A==
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=26740334
Connection: keep-alive
Content-Length: 283351

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
logincdn.msauth.net
rnylfqcutofrmcen-dot-motast.nw.r.appspot.com
secure.aadcdn.microsoftonline-p.com
192.229.221.185
2001:4de0:ac19::1:b:3b
2a00:1450:4001:819::2014
2a02:26f0:2b00:999::35c1
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37
5a605bd12eb1eb340d173bdb6d689077bcb445347e010f92d01993883b686965

rnylfqcutofrmcen-dot-motast.nw.r.appspot.com Open in urlscan Pro 2a00:1450:4001:819::2014 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

4 IPs

4 Countries

365 kBTransfer

568 kBSize

0 Cookies

2 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

0 Cookies

Indicators

rnylfqcutofrmcen-dot-motast.nw.r.appspot.com Open in urlscan Pro
2a00:1450:4001:819::2014 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

4
Countries

365 kB
Transfer

568 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!