urlscan.io logo urlscan.io
SecurityTrails logo

login.owaconfidential.com Open in urlscan Pro
160.153.209.85  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://cli.re/2Bpor1
Effective URL: https://login.owaconfidential.com/owa/auth/logon/gta=apps&ru=LOWgxklBQ8KvF2_jnFyhiIae5iFs1xpKG1sx4ZEnrG9szDoOG3DJ7iKJI-DcCjDUv1soK...
Submission: On February 05 via manual from AE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 2 HTTP transactions. The main IP is 160.153.209.85, located in Scottsdale, United States and belongs to GODADDY-AMS, DE. The main domain is login.owaconfidential.com.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on February 5th 2020. Valid for: 2 years.
This is the only time login.owaconfidential.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2 160.153.209.85 21501 (GODADDY-AMS)
2 2
Apex Domain
Subdomains		 Transfer
2 owaconfidential.com
login.owaconfidential.com
24 KB
1 cli.re
cli.re
523 B
0 bruker.com Failed
webmail.bruker.com Failed
2 3
Domain Requested by
2 login.owaconfidential.com 1 redirects
1 cli.re 1 redirects
0 webmail.bruker.com Failed login.owaconfidential.com
2 3

This site contains no links.

Subject Issuer Validity Valid
login.owaconfidential.com
Go Daddy Secure Certificate Authority - G2		 2020-02-05 -
2022-02-05		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://login.owaconfidential.com/owa/auth/logon/gta=apps&ru=LOWgxklBQ8KvF2_jnFyhiIae5iFs1xpKG1sx4ZEnrG9szDoOG3DJ7iKJI-DcCjDUv1soKwC6nO5QpsCvUlnh9onEGM0VmMNkiT7baKFsRrY/1fwccbb5h0.aspx?replaceCurrent=1&reason=2&url=https%3a%2f%2fmail.outlookwebapp.com%2fowa
Frame ID: C57070AB2ED83D8930BA28998ABF377F
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://cli.re/2Bpor1 HTTP 301
    https://login.owaconfidential.com/owa/auth/logon/gta=apps&ru=LOWgxklBQ8KvF2_jnFyhiIae5iFs1xpKG1sx4ZEnrG9szDoOG... HTTP 302
    https://login.owaconfidential.com/owa/auth/logon/gta=apps&ru=LOWgxklBQ8KvF2_jnFyhiIae5iFs1xpKG1sx4ZEnrG9szDoOG... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

2
Requests

50 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

24 kB
Transfer

69 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://cli.re/2Bpor1 HTTP 301
    https://login.owaconfidential.com/owa/auth/logon/gta=apps&ru=LOWgxklBQ8KvF2_jnFyhiIae5iFs1xpKG1sx4ZEnrG9szDoOG3DJ7iKJI-DcCjDUv1soKwC6nO5QpsCvUlnh9onEGM0VmMNkiT7baKFsRrY/ HTTP 302
    https://login.owaconfidential.com/owa/auth/logon/gta=apps&ru=LOWgxklBQ8KvF2_jnFyhiIae5iFs1xpKG1sx4ZEnrG9szDoOG3DJ7iKJI-DcCjDUv1soKwC6nO5QpsCvUlnh9onEGM0VmMNkiT7baKFsRrY/1fwccbb5h0.aspx?replaceCurrent=1&reason=2&url=https%3a%2f%2fmail.outlookwebapp.com%2fowa Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 1fwccbb5h0.aspx
login.owaconfidential.com/owa/auth/logon/gta=apps&ru=LOWgxklBQ8KvF2_jnFyhiIae5iFs1xpKG1sx4ZEnrG9szDoOG3DJ7iKJI-DcCjDUv1soKwC6nO5QpsCvUlnh9onEGM0VmMNkiT7baKFsRrY/
Redirect Chain
  • https://cli.re/2Bpor1
  • https://login.owaconfidential.com/owa/auth/logon/gta=apps&ru=LOWgxklBQ8KvF2_jnFyhiIae5iFs1xpKG1sx4ZEnrG9szDoOG3DJ7iKJI-DcCjDUv1soKwC6nO5QpsCvUlnh9onEGM0VmMNkiT7baKFsRrY/
  • https://login.owaconfidential.com/owa/auth/logon/gta=apps&ru=LOWgxklBQ8KvF2_jnFyhiIae5iFs1xpKG1sx4ZEnrG9szDoOG3DJ7iKJI-DcCjDUv1soKwC6nO5QpsCvUlnh9onEGM0VmMNkiT7baKFsRrY/1fwccbb5h0.aspx?replaceCurre...
54 KB
24 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://login.owaconfidential.com/owa/auth/logon/gta=apps&ru=LOWgxklBQ8KvF2_jnFyhiIae5iFs1xpKG1sx4ZEnrG9szDoOG3DJ7iKJI-DcCjDUv1soKwC6nO5QpsCvUlnh9onEGM0VmMNkiT7baKFsRrY/1fwccbb5h0.aspx?replaceCurrent=1&reason=2&url=https%3a%2f%2fmail.outlookwebapp.com%2fowa
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.153.209.85 Scottsdale, United States, ASN21501 (GODADDY-AMS, DE),
Reverse DNS
ip-160-153-209-85.ip.secureserver.net
Software
Apache /
Resource Hash
b4a4c5c4d1503cfce5a745b0729232387e1f9b717c6dd302eff023de43b5f109

Request headers

:method
GET
:authority
login.owaconfidential.com
:scheme
https
:path
/owa/auth/logon/gta=apps&ru=LOWgxklBQ8KvF2_jnFyhiIae5iFs1xpKG1sx4ZEnrG9szDoOG3DJ7iKJI-DcCjDUv1soKwC6nO5QpsCvUlnh9onEGM0VmMNkiT7baKFsRrY/1fwccbb5h0.aspx?replaceCurrent=1&reason=2&url=https%3a%2f%2fmail.outlookwebapp.com%2fowa
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
sec-fetch-mode
navigate
accept-encoding
gzip, deflate, br
cookie
PHPSESSID=0ff4ee58b5ab230f0730d18ed324dd8e
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User
?1

Response headers

status
200
date
Wed, 05 Feb 2020 09:19:13 GMT
server
Apache
last-modified
Wed, 05 Feb 2020 09:19:13 GMT
etag
W/"321658-d9d0-59dd0a664c461-gzip"
accept-ranges
bytes
vary
Accept-Encoding,User-Agent
content-encoding
gzip
content-length
24004

Redirect headers

status
302
date
Wed, 05 Feb 2020 09:19:13 GMT
server
Apache
x-powered-by
PHP/7.3.8
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
set-cookie
PHPSESSID=0ff4ee58b5ab230f0730d18ed324dd8e; path=/
location
1fwccbb5h0.aspx?replaceCurrent=1&reason=2&url=https%3a%2f%2fmail.outlookwebapp.com%2fowa
vary
User-Agent
content-length
0
content-type
text/html; charset=UTF-8
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		6 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type
image/png
segoeui-regular.ttf
webmail.bruker.com/owa/auth/15.0.1497/themes/resources/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
webmail.bruker.com
URL
https://webmail.bruker.com/owa/auth/15.0.1497/themes/resources/segoeui-regular.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| initLogon function| redir function| shw function| hd function| clkSecExp function| kdSecExp function| clkSec function| clkBsc function| checkSubmit function| clkLgn function| clkRtry function| clkReLgn function| gbid function| IsOwaPremiumBrowser function| hres function| LogoffMime function| addPerfMarker number| a_fRC number| g_fFcs number| a_fLOff number| a_fCAC number| a_fEnbSMm function| IsMimeCtlInst function| RndMimeCtl function| RndMimeCtlHlpr object| mainLogonDiv boolean| showPlaceholderText string| mainLogonDivClassName function| setPlaceholderText function| showPasswordClick

2 Cookies

Domain/Path Name / Value
login.owaconfidential.com/ Name: PHPSESSID
Value: 0ff4ee58b5ab230f0730d18ed324dd8e
login.owaconfidential.com/owa/auth/logon/gta=apps&ru=LOWgxklBQ8KvF2_jnFyhiIae5iFs1xpKG1sx4ZEnrG9szDoOG3DJ7iKJI-DcCjDUv1soKwC6nO5QpsCvUlnh9onEGM0VmMNkiT7baKFsRrY Name: cookieTest
Value: 1