controlpanel.msoutlookonline.net
Open in
urlscan Pro
172.64.145.22
Malicious Activity!
Public Scan
Submission: On November 21 via manual from SG — Scanned from SG
Summary
TLS certificate: Issued by WE1 on November 10th 2024. Valid for: 3 months.
This is the only time controlpanel.msoutlookonline.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
12 | 172.64.145.22 172.64.145.22 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 74.125.24.100 74.125.24.100 | 15169 (GOOGLE) (GOOGLE) | |
1 | 117.18.232.200 117.18.232.200 | 15133 (EDGECAST) (EDGECAST) | |
1 | 64.233.170.97 64.233.170.97 | 15169 (GOOGLE) (GOOGLE) | |
1 | 74.125.130.101 74.125.130.101 | 15169 (GOOGLE) (GOOGLE) | |
1 | 74.125.24.156 74.125.24.156 | 15169 (GOOGLE) (GOOGLE) | |
1 | 74.125.68.155 74.125.68.155 | 15169 (GOOGLE) (GOOGLE) | |
1 | 64.233.170.94 64.233.170.94 | 15169 (GOOGLE) (GOOGLE) | |
2 | 20.37.198.118 20.37.198.118 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
23 | 9 |
ASN13335 (CLOUDFLARENET, US)
controlpanel.msoutlookonline.net |
ASN15169 (GOOGLE, US)
PTR: sf-in-f100.1e100.net
www.google-analytics.com |
ASN15169 (GOOGLE, US)
PTR: sg-in-f97.1e100.net
www.googletagmanager.com |
ASN15169 (GOOGLE, US)
PTR: sb-in-f101.1e100.net
analytics.google.com |
ASN15169 (GOOGLE, US)
PTR: sf-in-f156.1e100.net
stats.g.doubleclick.net |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
dc.services.visualstudio.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
msoutlookonline.net
controlpanel.msoutlookonline.net |
130 KB |
3 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 36 |
22 KB |
2 |
visualstudio.com
dc.services.visualstudio.com — Cisco Umbrella Rank: 801 |
200 B |
2 |
doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 135 td.doubleclick.net — Cisco Umbrella Rank: 182 |
565 B |
1 |
google.com.sg
www.google.com.sg — Cisco Umbrella Rank: 15166 |
408 B |
1 |
google.com
analytics.google.com — Cisco Umbrella Rank: 142 |
|
1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39 |
123 KB |
1 |
msecnd.net
az416426.vo.msecnd.net — Cisco Umbrella Rank: 3366 |
22 KB |
23 | 8 |
Domain | Requested by | |
---|---|---|
12 | controlpanel.msoutlookonline.net |
controlpanel.msoutlookonline.net
|
3 | www.google-analytics.com |
controlpanel.msoutlookonline.net
www.google-analytics.com |
2 | dc.services.visualstudio.com |
az416426.vo.msecnd.net
|
1 | www.google.com.sg |
controlpanel.msoutlookonline.net
|
1 | td.doubleclick.net |
www.googletagmanager.com
|
1 | stats.g.doubleclick.net |
www.googletagmanager.com
|
1 | analytics.google.com |
www.googletagmanager.com
|
1 | www.googletagmanager.com |
www.google-analytics.com
|
1 | az416426.vo.msecnd.net |
controlpanel.msoutlookonline.net
|
23 | 9 |
This site contains links to these domains. Also see Links.
Domain |
---|
outdatedbrowser.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
controlpanel.msoutlookonline.net WE1 |
2024-11-10 - 2025-02-08 |
3 months | crt.sh |
*.google-analytics.com WR2 |
2024-10-21 - 2025-01-13 |
3 months | crt.sh |
*.vo.msecnd.net DigiCert SHA2 Secure Server CA |
2024-06-06 - 2025-06-06 |
a year | crt.sh |
*.google.com WR2 |
2024-10-21 - 2025-01-13 |
3 months | crt.sh |
*.g.doubleclick.net WR2 |
2024-10-21 - 2025-01-13 |
3 months | crt.sh |
*.doubleclick.net WR2 |
2024-10-21 - 2025-01-13 |
3 months | crt.sh |
*.google.com.sg WR2 |
2024-10-21 - 2025-01-13 |
3 months | crt.sh |
prod.ai.ingestion.msftcloudes.com Microsoft Azure RSA TLS Issuing CA 04 |
2024-09-07 - 2025-09-02 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://controlpanel.msoutlookonline.net/portal/aduser/login
Frame ID: 921D649CFE681325E6F2000BE22CA229
Requests: 21 HTTP requests in this frame
Frame:
https://td.doubleclick.net/td/ga/rul?tid=G-NLW8TPQ2KC&gacid=110594229.1732182657>m=45je4bk0v9137957146za200&dma=0&gcd=13l3l3l3l2l1&npa=0&pscdl=noapi&_ng=1&aip=1&fledge=1&frm=0&tag_exp=101925629~102067555~102067808~102077855~102081485&z=1470299501
Frame ID: 266602CE47DD791F6CFBC78F1825191F
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Outlook Web AccessDetected technologies
Google Analytics (Analytics) ExpandDetected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtag/js
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Update my browser
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login
controlpanel.msoutlookonline.net/portal/aduser/ |
12 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aduser
controlpanel.msoutlookonline.net/Portal/bundles/styles/login/ |
15 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
form
controlpanel.msoutlookonline.net/Portal/bundles/scripts/login/ |
150 KB 47 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
appInsights.PROD.js
controlpanel.msoutlookonline.net/aspx/scripts/analytics/ |
1 KB 740 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
warning-orange_24.png
controlpanel.msoutlookonline.net/Content/images/icons/24/ |
270 B 413 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aduser
controlpanel.msoutlookonline.net/Portal/bundles/scripts/login/form/ |
1 KB 755 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
52 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aduser.svg
controlpanel.msoutlookonline.net/content/images/icons/custom/ |
1 KB 697 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
info-white_16.svg
controlpanel.msoutlookonline.net/Content/images/icons/16/ |
859 B 602 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dinot-webfont.woff
controlpanel.msoutlookonline.net/content/font/ |
23 KB 23 KB |
Font
font/x-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dinot-medium-webfont.woff
controlpanel.msoutlookonline.net/content/font/ |
25 KB 25 KB |
Font
font/x-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
opensans-regular-webfont.woff
controlpanel.msoutlookonline.net/content/font/ |
24 KB 24 KB |
Font
font/x-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ai.0.js
az416426.vo.msecnd.net/scripts/a/ |
94 KB 22 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/j/ |
15 B 445 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
364 KB 123 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
analytics.google.com/g/ |
0 0 |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/g/ |
0 565 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rul
td.doubleclick.net/td/ga/ Frame 2666 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.com.sg/ads/ |
42 B 408 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
controlpanel.msoutlookonline.net/ |
1 KB 295 B |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
collect
www.google-analytics.com/ |
35 B 58 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
track
dc.services.visualstudio.com/v2/ Frame |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
track
dc.services.visualstudio.com/v2/ |
96 B 200 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online)39 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| getStorageManager function| validateInput function| setInputErrorStyle function| showMixedValidation object| validationRules function| refreshCaptcha function| submitToUrl function| disable function| googleAnalytics function| onLoginSuccess function| onLoginFailed function| showSpinner function| showCaptcha function| GetOwaStsUrl function| GetMyServicesStsUrl function| passwordEyeToggle function| passwordOnKeyUp function| $ function| jQuery object| appInsights string| GoogleAnalyticsObject function| ga function| trackUlpLoginAttempt function| trackUlpLoginFailed function| initClickTracking function| getQueryParameterByName function| getClientTypeFromQuery function| setLoginTab object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| dataLayer object| AI object| Microsoft function| __extends function| _endsWith object| google_tag_manager7 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.msoutlookonline.net/ | Name: _ga Value: GA1.2.110594229.1732182657 |
|
.msoutlookonline.net/ | Name: _gid Value: GA1.2.1483402776.1732182657 |
|
.msoutlookonline.net/ | Name: _gat Value: 1 |
|
controlpanel.msoutlookonline.net/ | Name: ai_user Value: 3xVAW|2024-11-21T09:50:56.723Z |
|
.doubleclick.net/ | Name: test_cookie Value: CheckForPermission |
|
.msoutlookonline.net/ | Name: _ga_NLW8TPQ2KC Value: GS1.2.1732182657.1.0.1732182657.60.0.0 |
|
controlpanel.msoutlookonline.net/ | Name: ai_session Value: G3JFj|1732182657627.3|1732182657627.3 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload |
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
analytics.google.com
az416426.vo.msecnd.net
controlpanel.msoutlookonline.net
dc.services.visualstudio.com
stats.g.doubleclick.net
td.doubleclick.net
www.google-analytics.com
www.google.com.sg
www.googletagmanager.com
117.18.232.200
172.64.145.22
20.37.198.118
64.233.170.94
64.233.170.97
74.125.130.101
74.125.24.100
74.125.24.156
74.125.68.155
021552f50478176acb8b290389a5b4758927f7eea728b66142ca701eaaaa3f1a
198f5a54eb65cf21e9bb2adb40fbaa153d834080b45e9d74cb38eb121ad91649
2529f64ee379f2e813bc5305b8ffc875c1d6c1068b0c30e6d15651f9b28338e0
2f3c28c092416eb4039e5c202e1f4365a509d0a1d6b759686da09b7a239eb4d4
36f53d513f4ade6962ea9b5342113dfb07037c5c22252338ebecc6d20d4dd11e
487dc36e5537f7e42699c013bef119a7934b0c73762fe5314a87f1cc5ad2ace5
4d0ae714a36becfdb44141b5e04f6e7b8869d9f4a778c281fae28bf01a868afa
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e
57c974aad2cdc1bda675aa6d35f062779b98004c115fb25e338879c8a8d2473b
75769c069372a5f8d8da31d6f20c102b919269ef27b876b2a56b3dd381321a26
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8849ec2011305c1348cc0180984fcfa645a484ee9e898fa54d58d89340eed9f1
8cce2770de445408e0fb08d8d74f2cfa19cf76329bacf743f2100ecbe06ec4ae
a211ee0fb8c95d5a45f9e3b207c3b0a054c25b560a2cfe154d357e4c40cce12d
ca510e3ff10ec424392a2e5f5ff640c8059671b92fe8b42ae5911b6dc844e41b
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e954ae1ddb505f8e8fbad2f1bbab6036287633051e969f09cf7b353589c1e3a4
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f8a297ba4a6c85661565f66fe8eacccea0a337211de937d75955041b6b8bb43d