10gin-rnicosotfon1ine.msfs0nln.com Open in urlscan Pro
18.207.204.205 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://10gin-rnicosotfon1ine.msfs0nln.com/y89kYZ
Effective URL:
https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3...
Submission: On September 13 via manual (September 13th 2022, 1:19:31 pm UTC) from GB — Scanned from GB

Summary HTTP 16 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 16 HTTP transactions. The main IP is 18.207.204.205, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is 10gin-rnicosotfon1ine.msfs0nln.com.
TLS certificate: Issued by R3 on September 13th 2022. Valid for: 3 months.

This is the only time 10gin-rnicosotfon1ine.msfs0nln.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
3 7	18.207.204.205 18.207.204.205	14618 (AMAZON-AES) (AMAZON-AES)
12	2620:1ec:46::44 2620:1ec:46::44	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
16	2

7 18.207.204.205 (Ashburn, United States) 3 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-207-204-205.compute-1.amazonaws.com

10gin-rnicosotfon1ine.msfs0nln.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.msfs0nln.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
live.msfs0nln.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2620:1ec:46::44 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	msauth.net aadcdn.msauth.net — Cisco Umbrella Rank: 2607	198 KB
7	msfs0nln.com 3 redirects 10gin-rnicosotfon1ine.msfs0nln.com www.msfs0nln.com live.msfs0nln.com	360 KB
16	2

	Domain	Requested by
12	aadcdn.msauth.net	10gin-rnicosotfon1ine.msfs0nln.com aadcdn.msauth.net
4	10gin-rnicosotfon1ine.msfs0nln.com	2 redirects 10gin-rnicosotfon1ine.msfs0nln.com
2	live.msfs0nln.com	10gin-rnicosotfon1ine.msfs0nln.com aadcdn.msauth.net
1	www.msfs0nln.com	1 redirects
16	4

This site contains links to these domains. Also see Links.

Domain
live.msfs0nln.com
www.microsoft.com
privacy.microsoft.com

Subject Issuer	Validity	Valid
*.msfs0nln.com R3	`2022-09-13` - `2022-12-12`	3 months	crt.sh
aadcdn.msauth.net DigiCert SHA2 Secure Server CA	`2022-08-23` - `2023-08-23`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986719641484635.MzI1ZDg1NjgtYzA3Zi00YTYwLTk2MWItNmMwZDc3Njc1M2Y1Zjc4NzIwZTctNzExNy00ZTljLWJjMTEtMDkyZTk0NzAxY2Q1&ui_locales=en-GB&mkt=en-GB&state=zymmtGQlYn1nNaB9eeWYiIPCg9g9MCVLvTeMEoOOYtbhreBLsOd0osSm7BpJt6-cg86U4HFO1H4RLxYNf5KtYCjdXqzNnGqzf5uFcXJrlcywpvwsXR3wz4V9hmqvrVyqUIPfiBqyDcja4xA89x0RJeydhYZ2xB_XbVuwK3QBJkRRvwkpbsTIsyvgAH8cqwIYKM3b16i7idYdq5WDWreFf9beEJNLOFgMaqTnVT5ZufNuxfglBtVc7v1vIBWb5EpdjLuHtTEOdgH_HAESPwZZWQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0&sso_reload=true
Frame ID: 3C6BCFEA5B34FD8E83517E629EC5367A
Requests: 15 HTTP requests in this frame

Frame: https://live.msfs0nln.com/Me.htm?v=3
Frame ID: FBD1C6CFF104117DDFBB515D48A3A9C4
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your account

Page URL History Show full URLs

https://10gin-rnicosotfon1ine.msfs0nln.com/y89kYZ HTTP 302
https://10gin-rnicosotfon1ine.msfs0nln.com/ HTTP 302
https://www.msfs0nln.com/login HTTP 302
https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&... Page URL
https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&... Page URL

Page Statistics

16
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

4
Subdomains

2
IPs

1
Countries

554 kB
Transfer

877 kB
Size

16
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://live.msfs0nln.com/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2fwww.msfs0nln.com%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2fwww.msfs0nln.com%2flandingv2&response_type=code+id_token&state=zymmtGQlYn1nNaB9eeWYiIPCg9g9MCVLvTeMEoOOYtbhreBLsOd0osSm7BpJt6-cg86U4HFO1H4RLxYNf5KtYCjdXqzNnGqzf5uFcXJrlcywpvwsXR3wz4V9hmqvrVyqUIPfiBqyDcja4xA89x0RJeydhYZ2xB_XbVuwK3QBJkRRvwkpbsTIsyvgAH8cqwIYKM3b16i7idYdq5WDWreFf9beEJNLOFgMaqTnVT5ZufNuxfglBtVc7v1vIBWb5EpdjLuHtTEOdgH_HAESPwZZWQ&response_mode=form_post&nonce=637986719641484635.MzI1ZDg1NjgtYzA3Zi00YTYwLTk2MWItNmMwZDc3Njc1M2Y1Zjc4NzIwZTctNzExNy00ZTljLWJjMTEtMDkyZTk0NzAxY2Q1&x-client-SKU=ID_NETSTANDARD2_0&x-client-Ver=6.16.0.0&uaid=65ca6fb0ea4546cbb4cdadec524e1133&msproxy=1&issuer=mso&tenant=common&ui_locales=en-GB&signup=1&lw=1&fl=easi2&epct=AQABAAAAAAD--DLA3VO7QrddgJg7WevrJO0kSs4Jmgy7XC1z0BcJcsZrE0mskO6-KVFdH8Cu3ZG2JBH-TE4qxB7y78DXeAEiEdwnCk4H0ZvpGB8eHixZOp_b4P8YQ4rs003HVJg2COpAMvDOONlPqOhu3SOCdSDZtUL2LJxQZyK8503t4Whi0Rqzj8n-qkjY1tfKUon_6ea0W3zbFQMj0P3CuRBqgFK1ABbWuYDJlZnDtOprKIkWfiAA&jshs=0
Title: Create one!

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-GB/servicesagreement/
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/en-GB/privacystatement
Title: Privacy & cookies

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://10gin-rnicosotfon1ine.msfs0nln.com/y89kYZ HTTP 302
https://10gin-rnicosotfon1ine.msfs0nln.com/ HTTP 302
https://www.msfs0nln.com/login HTTP 302
https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986719641484635.MzI1ZDg1NjgtYzA3Zi00YTYwLTk2MWItNmMwZDc3Njc1M2Y1Zjc4NzIwZTctNzExNy00ZTljLWJjMTEtMDkyZTk0NzAxY2Q1&ui_locales=en-GB&mkt=en-GB&state=zymmtGQlYn1nNaB9eeWYiIPCg9g9MCVLvTeMEoOOYtbhreBLsOd0osSm7BpJt6-cg86U4HFO1H4RLxYNf5KtYCjdXqzNnGqzf5uFcXJrlcywpvwsXR3wz4V9hmqvrVyqUIPfiBqyDcja4xA89x0RJeydhYZ2xB_XbVuwK3QBJkRRvwkpbsTIsyvgAH8cqwIYKM3b16i7idYdq5WDWreFf9beEJNLOFgMaqTnVT5ZufNuxfglBtVc7v1vIBWb5EpdjLuHtTEOdgH_HAESPwZZWQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0 Page URL
https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986719641484635.MzI1ZDg1NjgtYzA3Zi00YTYwLTk2MWItNmMwZDc3Njc1M2Y1Zjc4NzIwZTctNzExNy00ZTljLWJjMTEtMDkyZTk0NzAxY2Q1&ui_locales=en-GB&mkt=en-GB&state=zymmtGQlYn1nNaB9eeWYiIPCg9g9MCVLvTeMEoOOYtbhreBLsOd0osSm7BpJt6-cg86U4HFO1H4RLxYNf5KtYCjdXqzNnGqzf5uFcXJrlcywpvwsXR3wz4V9hmqvrVyqUIPfiBqyDcja4xA89x0RJeydhYZ2xB_XbVuwK3QBJkRRvwkpbsTIsyvgAH8cqwIYKM3b16i7idYdq5WDWreFf9beEJNLOFgMaqTnVT5ZufNuxfglBtVc7v1vIBWb5EpdjLuHtTEOdgH_HAESPwZZWQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0&sso_reload=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://10gin-rnicosotfon1ine.msfs0nln.com/y89kYZ HTTP 302
https://10gin-rnicosotfon1ine.msfs0nln.com/ HTTP 302
https://www.msfs0nln.com/login HTTP 302
https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986719641484635.MzI1ZDg1NjgtYzA3Zi00YTYwLTk2MWItNmMwZDc3Njc1M2Y1Zjc4NzIwZTctNzExNy00ZTljLWJjMTEtMDkyZTk0NzAxY2Q1&ui_locales=en-GB&mkt=en-GB&state=zymmtGQlYn1nNaB9eeWYiIPCg9g9MCVLvTeMEoOOYtbhreBLsOd0osSm7BpJt6-cg86U4HFO1H4RLxYNf5KtYCjdXqzNnGqzf5uFcXJrlcywpvwsXR3wz4V9hmqvrVyqUIPfiBqyDcja4xA89x0RJeydhYZ2xB_XbVuwK3QBJkRRvwkpbsTIsyvgAH8cqwIYKM3b16i7idYdq5WDWreFf9beEJNLOFgMaqTnVT5ZufNuxfglBtVc7v1vIBWb5EpdjLuHtTEOdgH_HAESPwZZWQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0

16 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	authorize Show response 10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/ Redirect Chain https://10gin-rnicosotfon1ine.msfs0nln.com/y89kYZ https://10gin-rnicosotfon1ine.msfs0nln.com/ https://www.msfs0nln.com/login https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_...	152 KB 153 KB	1474ms 1199ms	Document text/html	18.207.204.205 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986719641484635.MzI1ZDg1NjgtYzA3Zi00YTYwLTk2MWItNmMwZDc3Njc1M2Y1Zjc4NzIwZTctNzExNy00ZTljLWJjMTEtMDkyZTk0NzAxY2Q1&ui_locales=en-GB&mkt=en-GB&state=zymmtGQlYn1nNaB9eeWYiIPCg9g9MCVLvTeMEoOOYtbhreBLsOd0osSm7BpJt6-cg86U4HFO1H4RLxYNf5KtYCjdXqzNnGqzf5uFcXJrlcywpvwsXR3wz4V9hmqvrVyqUIPfiBqyDcja4xA89x0RJeydhYZ2xB_XbVuwK3QBJkRRvwkpbsTIsyvgAH8cqwIYKM3b16i7idYdq5WDWreFf9beEJNLOFgMaqTnVT5ZufNuxfglBtVc7v1vIBWb5EpdjLuHtTEOdgH_HAESPwZZWQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.207.204.205 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-207-204-205.compute-1.amazonaws.com Software / Resource Hash `9eb94d561655bc4524c736a0e16d2567d635cb03a4f62ed71f0e393cd1c9e719` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers Cache-Control no-store, no-cache Connection close Content-Type text/html; charset=utf-8 Date Tue, 13 Sep 2022 13:19:24 GMT Expires -1 Nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} P3p CP="DSP CUR OTPi IND OTRi ONL FIN" Pragma no-cache Referrer-Policy strict-origin-when-cross-origin Report-To {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+chi"}]} Transfer-Encoding chunked Vary Accept-Encoding X-Ms-Clitelem 1,50168,0,, X-Ms-Ests-Server 2.1.13562.12 - SCUS ProdSlices X-Ms-Request-Id da192280-ba0c-4f7d-b8e3-13f5f06f2a00 Redirect headers Connection close Content-Encoding gzip Content-Type text/html; charset=utf-8 Date Tue, 13 Sep 2022 13:19:23 GMT Location https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986719641484635.MzI1ZDg1NjgtYzA3Zi00YTYwLTk2MWItNmMwZDc3Njc1M2Y1Zjc4NzIwZTctNzExNy00ZTljLWJjMTEtMDkyZTk0NzAxY2Q1&ui_locales=en-GB&mkt=en-GB&state=zymmtGQlYn1nNaB9eeWYiIPCg9g9MCVLvTeMEoOOYtbhreBLsOd0osSm7BpJt6-cg86U4HFO1H4RLxYNf5KtYCjdXqzNnGqzf5uFcXJrlcywpvwsXR3wz4V9hmqvrVyqUIPfiBqyDcja4xA89x0RJeydhYZ2xB_XbVuwK3QBJkRRvwkpbsTIsyvgAH8cqwIYKM3b16i7idYdq5WDWreFf9beEJNLOFgMaqTnVT5ZufNuxfglBtVc7v1vIBWb5EpdjLuHtTEOdgH_HAESPwZZWQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0 Referrer-Policy strict-origin-when-cross-origin Request-Context appId= Transfer-Encoding chunked Vary Accept-Encoding X-Cache CONFIG_NOCACHE X-Msedge-Ref Ref A: 9049F0E2993E4D138D798A0A69E5D889 Ref B: LON212050706023 Ref C: 2022-09-13T13:19:24Z X-Ua-Compatible IE=edge,chrome=1
GET H/1.1	200 OK	Primary Request authorize Show response 10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/	199 KB 200 KB	1276ms 1002ms	Document text/html	18.207.204.205 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986719641484635.MzI1ZDg1NjgtYzA3Zi00YTYwLTk2MWItNmMwZDc3Njc1M2Y1Zjc4NzIwZTctNzExNy00ZTljLWJjMTEtMDkyZTk0NzAxY2Q1&ui_locales=en-GB&mkt=en-GB&state=zymmtGQlYn1nNaB9eeWYiIPCg9g9MCVLvTeMEoOOYtbhreBLsOd0osSm7BpJt6-cg86U4HFO1H4RLxYNf5KtYCjdXqzNnGqzf5uFcXJrlcywpvwsXR3wz4V9hmqvrVyqUIPfiBqyDcja4xA89x0RJeydhYZ2xB_XbVuwK3QBJkRRvwkpbsTIsyvgAH8cqwIYKM3b16i7idYdq5WDWreFf9beEJNLOFgMaqTnVT5ZufNuxfglBtVc7v1vIBWb5EpdjLuHtTEOdgH_HAESPwZZWQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0&sso_reload=true Requested by Host: 10gin-rnicosotfon1ine.msfs0nln.com URL: https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986719641484635.MzI1ZDg1NjgtYzA3Zi00YTYwLTk2MWItNmMwZDc3Njc1M2Y1Zjc4NzIwZTctNzExNy00ZTljLWJjMTEtMDkyZTk0NzAxY2Q1&ui_locales=en-GB&mkt=en-GB&state=zymmtGQlYn1nNaB9eeWYiIPCg9g9MCVLvTeMEoOOYtbhreBLsOd0osSm7BpJt6-cg86U4HFO1H4RLxYNf5KtYCjdXqzNnGqzf5uFcXJrlcywpvwsXR3wz4V9hmqvrVyqUIPfiBqyDcja4xA89x0RJeydhYZ2xB_XbVuwK3QBJkRRvwkpbsTIsyvgAH8cqwIYKM3b16i7idYdq5WDWreFf9beEJNLOFgMaqTnVT5ZufNuxfglBtVc7v1vIBWb5EpdjLuHtTEOdgH_HAESPwZZWQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.207.204.205 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-207-204-205.compute-1.amazonaws.com Software / Resource Hash `8531f19b6958dd0d3c29f6525f2b63853eb3913c56bef783672c2b6ea97c7805` Request headers Referer https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986719641484635.MzI1ZDg1NjgtYzA3Zi00YTYwLTk2MWItNmMwZDc3Njc1M2Y1Zjc4NzIwZTctNzExNy00ZTljLWJjMTEtMDkyZTk0NzAxY2Q1&ui_locales=en-GB&mkt=en-GB&state=zymmtGQlYn1nNaB9eeWYiIPCg9g9MCVLvTeMEoOOYtbhreBLsOd0osSm7BpJt6-cg86U4HFO1H4RLxYNf5KtYCjdXqzNnGqzf5uFcXJrlcywpvwsXR3wz4V9hmqvrVyqUIPfiBqyDcja4xA89x0RJeydhYZ2xB_XbVuwK3QBJkRRvwkpbsTIsyvgAH8cqwIYKM3b16i7idYdq5WDWreFf9beEJNLOFgMaqTnVT5ZufNuxfglBtVc7v1vIBWb5EpdjLuHtTEOdgH_HAESPwZZWQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers Cache-Control no-store, no-cache Connection close Content-Type text/html; charset=utf-8 Date Tue, 13 Sep 2022 13:19:26 GMT Expires -1 Link <https://aadcdn.msauth.net>; rel=preconnect; crossorigin <https://aadcdn.msauth.net>; rel=dns-prefetch <https://aadcdn.msftauth.net>; rel=dns-prefetch Nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} P3p CP="DSP CUR OTPi IND OTRi ONL FIN" Pragma no-cache Referrer-Policy strict-origin-when-cross-origin Report-To {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+chi"}]} Transfer-Encoding chunked Vary Accept-Encoding X-Dns-Prefetch-Control on X-Ms-Clitelem 1,0,0,, X-Ms-Ests-Server 2.1.13562.12 - WUS2 ProdSlices X-Ms-Request-Id 4535b664-c9eb-4b0b-ae2c-1ead1ca3cf01
GET H/1.1	200 OK	Me.htm live.msfs0nln.com/	0 0	848ms 515ms	Other text/html	18.207.204.205 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://live.msfs0nln.com/Me.htm?v=3 Requested by Host: 10gin-rnicosotfon1ine.msfs0nln.com URL: https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986719641484635.MzI1ZDg1NjgtYzA3Zi00YTYwLTk2MWItNmMwZDc3Njc1M2Y1Zjc4NzIwZTctNzExNy00ZTljLWJjMTEtMDkyZTk0NzAxY2Q1&ui_locales=en-GB&mkt=en-GB&state=zymmtGQlYn1nNaB9eeWYiIPCg9g9MCVLvTeMEoOOYtbhreBLsOd0osSm7BpJt6-cg86U4HFO1H4RLxYNf5KtYCjdXqzNnGqzf5uFcXJrlcywpvwsXR3wz4V9hmqvrVyqUIPfiBqyDcja4xA89x0RJeydhYZ2xB_XbVuwK3QBJkRRvwkpbsTIsyvgAH8cqwIYKM3b16i7idYdq5WDWreFf9beEJNLOFgMaqTnVT5ZufNuxfglBtVc7v1vIBWb5EpdjLuHtTEOdgH_HAESPwZZWQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0&sso_reload=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.207.204.205 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-207-204-205.compute-1.amazonaws.com Software / Resource Hash Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers
GET H2	200	ConvergedLogin_PCore_rEkixmwXrnf1ZoXlPzTPPA2.js Show response aadcdn.msauth.net/shared/1.0/content/js/	383 KB 109 KB	308ms 60ms	Script application/x-javascript	2620:1ec:46::44 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_rEkixmwXrnf1ZoXlPzTPPA2.js Requested by Host: 10gin-rnicosotfon1ine.msfs0nln.com URL: https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986719641484635.MzI1ZDg1NjgtYzA3Zi00YTYwLTk2MWItNmMwZDc3Njc1M2Y1Zjc4NzIwZTctNzExNy00ZTljLWJjMTEtMDkyZTk0NzAxY2Q1&ui_locales=en-GB&mkt=en-GB&state=zymmtGQlYn1nNaB9eeWYiIPCg9g9MCVLvTeMEoOOYtbhreBLsOd0osSm7BpJt6-cg86U4HFO1H4RLxYNf5KtYCjdXqzNnGqzf5uFcXJrlcywpvwsXR3wz4V9hmqvrVyqUIPfiBqyDcja4xA89x0RJeydhYZ2xB_XbVuwK3QBJkRRvwkpbsTIsyvgAH8cqwIYKM3b16i7idYdq5WDWreFf9beEJNLOFgMaqTnVT5ZufNuxfglBtVc7v1vIBWb5EpdjLuHtTEOdgH_HAESPwZZWQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0&sso_reload=true Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:46::44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `564118b5f28d90632e7ca3487f8a208b0e7b5fe68fcda0c950986107a5ce2c65` Request headers Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ Origin https://10gin-rnicosotfon1ine.msfs0nln.com accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:19:28 GMT content-encoding gzip x-azure-ref-originshield 0DBUgYwAAAAD0lFw0MQVVS6l1P3WnWUgWRlJBMjMxMDUwNDE4MDE3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-md5 fK2AK6jDg6/4KCAAbseoGQ== x-cache TCP_HIT content-length 111291 x-ms-lease-status unlocked last-modified Thu, 04 Aug 2022 19:51:55 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8DA7652C8B9183C x-azure-ref 0YIMgYwAAAAB34xLaevjDTqFMYBhkHNkQRlJBMzFFREdFMDkwNgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-type application/x-javascript access-control-allow-origin * x-ms-request-id 19bbb7da-801e-005f-479b-bedd5f000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	converged.v2.login.min_8owwt4u-33ps0wawi7tmow2.css aadcdn.msauth.net/ests/2.1/content/cdnbundles/	0 20 KB	181ms 62ms	Other text/css	2620:1ec:46::44 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_8owwt4u-33ps0wawi7tmow2.css Requested by Host: 10gin-rnicosotfon1ine.msfs0nln.com URL: https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986719641484635.MzI1ZDg1NjgtYzA3Zi00YTYwLTk2MWItNmMwZDc3Njc1M2Y1Zjc4NzIwZTctNzExNy00ZTljLWJjMTEtMDkyZTk0NzAxY2Q1&ui_locales=en-GB&mkt=en-GB&state=zymmtGQlYn1nNaB9eeWYiIPCg9g9MCVLvTeMEoOOYtbhreBLsOd0osSm7BpJt6-cg86U4HFO1H4RLxYNf5KtYCjdXqzNnGqzf5uFcXJrlcywpvwsXR3wz4V9hmqvrVyqUIPfiBqyDcja4xA89x0RJeydhYZ2xB_XbVuwK3QBJkRRvwkpbsTIsyvgAH8cqwIYKM3b16i7idYdq5WDWreFf9beEJNLOFgMaqTnVT5ZufNuxfglBtVc7v1vIBWb5EpdjLuHtTEOdgH_HAESPwZZWQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0&sso_reload=true Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:46::44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:19:28 GMT content-encoding gzip x-azure-ref-originshield 0tAEeYwAAAABBMOweOgSsQ5eDSTOJS/z5RlJBMjMxMDUwNDE3MDE3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-md5 9K2/nGCj75WAmmAI9nZNCA== x-cache TCP_HIT content-length 19970 x-ms-lease-status unlocked last-modified Thu, 04 Aug 2022 19:37:00 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8DA7650B37ACC3D x-azure-ref 0YIMgYwAAAABAanIu2+iFT4+Z3vMU2JAGRlJBMzFFREdFMDMxNQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-type text/css access-control-allow-origin * x-ms-request-id 080ee4b5-e01e-0021-52e9-c58d42000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	ux.converged.login.strings-en-gb.min_oy15s3rolvbiuqiq4jjeew2.js aadcdn.msauth.net/ests/2.1/content/cdnbundles/	0 14 KB	231ms 120ms	Other application/x-javascript	2620:1ec:46::44 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en-gb.min_oy15s3rolvbiuqiq4jjeew2.js Requested by Host: 10gin-rnicosotfon1ine.msfs0nln.com URL: https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986719641484635.MzI1ZDg1NjgtYzA3Zi00YTYwLTk2MWItNmMwZDc3Njc1M2Y1Zjc4NzIwZTctNzExNy00ZTljLWJjMTEtMDkyZTk0NzAxY2Q1&ui_locales=en-GB&mkt=en-GB&state=zymmtGQlYn1nNaB9eeWYiIPCg9g9MCVLvTeMEoOOYtbhreBLsOd0osSm7BpJt6-cg86U4HFO1H4RLxYNf5KtYCjdXqzNnGqzf5uFcXJrlcywpvwsXR3wz4V9hmqvrVyqUIPfiBqyDcja4xA89x0RJeydhYZ2xB_XbVuwK3QBJkRRvwkpbsTIsyvgAH8cqwIYKM3b16i7idYdq5WDWreFf9beEJNLOFgMaqTnVT5ZufNuxfglBtVc7v1vIBWb5EpdjLuHtTEOdgH_HAESPwZZWQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0&sso_reload=true Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:46::44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:19:28 GMT content-encoding gzip x-azure-ref-originshield 08TscYwAAAACOZ2Ga969wSJlgAfui5qP8RlJBMjMxMDUwNDE3MDExADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-md5 HiI4MeP+AvX+9JWdctPzVQ== x-cache TCP_HIT content-length 13586 x-ms-lease-status unlocked last-modified Fri, 05 Aug 2022 00:54:31 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8DA767D0EBED294 x-azure-ref 0YIMgYwAAAADHkN1yhZiDS7VSqke1/u1RRlJBMzFFREdFMDMxNQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-type application/x-javascript access-control-allow-origin * x-ms-request-id 7b260d6e-101e-0072-3497-be9377000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	convergedlogin_pfetchsessionsprogress_49afc9cacb9cfd40c503.js Show response aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/	15 KB 6 KB	226ms 115ms	Script application/x-javascript	2620:1ec:46::44 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_49afc9cacb9cfd40c503.js Requested by Host: aadcdn.msauth.net URL: https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_rEkixmwXrnf1ZoXlPzTPPA2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:46::44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `f78a659d1f272f9c0aceb7be9ee1c095a2c52e136ba712602520e7a268583b66` Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:19:28 GMT content-encoding gzip x-azure-ref-originshield 0YikfYwAAAAA5rkmXkGoJTodIBvh5x4Y6RlJBMjMxMDUwNDE3MDIxADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-md5 GBMq8b7F7EUzg0oe2bIzrg== x-cache TCP_HIT content-length 5529 x-ms-lease-status unlocked last-modified Tue, 26 Jul 2022 23:52:03 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8DA6F61D6ECB178 x-azure-ref 0YIMgYwAAAAB2iijEJ8ojSqFvnGJL3VEfRlJBMzFFREdFMDMxNQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-type application/x-javascript access-control-allow-origin * x-ms-request-id db6a166a-901e-006a-1551-c57b44000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	marching_ants_white_166de53471265253ab3a456defe6da23.gif aadcdn.msauth.net/shared/1.0/content/images/	3 KB 3 KB	171ms 60ms	Image image/gif	2620:1ec:46::44 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:46::44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13` Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:19:28 GMT x-azure-ref-originshield 0RpUfYwAAAADjZdJ7NmVOQ6TwA9NcGxjlRlJBMjMxMDUwNDE3MDE5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-md5 Fm3lNHEmUlOrOkVt7+baIw== x-cache TCP_HIT content-length 2672 x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:37 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D79B83739984DD x-azure-ref 0YIMgYwAAAAArfAdPYQ7TRqDFB2b7MzY4RlJBMzFFREdFMDMxNQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-type image/gif access-control-allow-origin * x-ms-request-id b37bdcf3-c01e-0077-751f-c5147d000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif aadcdn.msauth.net/shared/1.0/content/images/	4 KB 4 KB	172ms 61ms	Image image/gif	2620:1ec:46::44 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:46::44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d` Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:19:28 GMT x-azure-ref-originshield 0RWkcYwAAAACbRRv92TeyTo3Cw4KDPvJYRlJBMjMxMDUwNDE3MDE5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-md5 tUCo5RgDcZLjLE/li/Lbqw== x-cache TCP_HIT content-length 3620 x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:38 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D79B8373B17F89 x-azure-ref 0YIMgYwAAAADfA2r8ImNjRq8J1CrFu9wZRlJBMzFFREdFMDMxNQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-type image/gif access-control-allow-origin * x-ms-request-id 056a5770-601e-0041-23d1-c3cf60000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	convergedlogin_pcustomizationloader_ce7e28197b4125ce53e0.js Show response aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/	107 KB 32 KB	58ms 58ms	Script application/x-javascript	2620:1ec:46::44 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_ce7e28197b4125ce53e0.js Requested by Host: aadcdn.msauth.net URL: https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_rEkixmwXrnf1ZoXlPzTPPA2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:46::44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `106c7ae6e865f487b4fc75aac19b535d73fa8f13507884259be7393b5c5f5494` Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:19:28 GMT content-encoding gzip x-azure-ref-originshield 0FTAeYwAAAACDzyrogOcxSqIId4FD5vccRlJBMjMxMDUwNDE4MDI3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-md5 uFX3Qhp/F7U6+waIHizpeA== x-cache TCP_HIT content-length 32173 x-ms-lease-status unlocked last-modified Tue, 02 Aug 2022 03:12:40 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8DA7434DBD35CB0 x-azure-ref 0YIMgYwAAAAC9XFrsBsiYRI8+p6gEx9tpRlJBMzFFREdFMDMxNQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-type application/x-javascript access-control-allow-origin * x-ms-request-id d1770457-301e-0060-7b10-c67551000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	2_bc3d32a696895f78c19df6c717586a5d.svg aadcdn.msauth.net/shared/1.0/content/images/backgrounds/	2 KB 1020 B	63ms 62ms	Image image/svg+xml	2620:1ec:46::44 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:46::44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68` Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:19:28 GMT content-encoding gzip x-azure-ref-originshield 0RpUfYwAAAAAzrR/VMvEgQ5sJRBHlbC5wRlJBMjMxMDUwNDE4MDQ3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-md5 DhdidjYrlCeaRJJRG/y9mA== x-cache TCP_HIT content-length 673 x-ms-lease-status unlocked last-modified Wed, 12 Feb 2020 22:01:30 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D7B0071D86E386 x-azure-ref 0YIMgYwAAAACZ6UnN0mofToujFRYfJOufRlJBMzFFREdFMDMxNQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-type image/svg+xml access-control-allow-origin * x-ms-request-id 416171a6-b01e-0078-35fa-c29d62000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg aadcdn.msauth.net/shared/1.0/content/images/	4 KB 2 KB	62ms 62ms	Image image/svg+xml	2620:1ec:46::44 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:46::44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:19:28 GMT content-encoding gzip x-azure-ref-originshield 0uygfYwAAAADnBoQlX1v4SY7da/kb7tvNRlJBMjMxMDUwNDE4MDUxADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-md5 nzaLxFgP7ZB3dfMcaybWzw== x-cache TCP_HIT content-length 1435 x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:38 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D79B8373CB2849 x-azure-ref 0YIMgYwAAAADXBDda1Du9RLhvWSX02t/NRlJBMzFFREdFMDMxNQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-type image/svg+xml access-control-allow-origin * x-ms-request-id d5cfdd26-e01e-000d-4f95-bee868000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	marching_ants_white_166de53471265253ab3a456defe6da23.gif aadcdn.msauth.net/shared/1.0/content/images/	3 KB 3 KB	59ms 58ms	Image image/gif	2620:1ec:46::44 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif Requested by Host: aadcdn.msauth.net URL: https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_rEkixmwXrnf1ZoXlPzTPPA2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:46::44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13` Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:19:28 GMT x-azure-ref-originshield 0RpUfYwAAAADjZdJ7NmVOQ6TwA9NcGxjlRlJBMjMxMDUwNDE3MDE5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-md5 Fm3lNHEmUlOrOkVt7+baIw== x-cache TCP_HIT content-length 2672 x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:37 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D79B83739984DD x-azure-ref 0YIMgYwAAAADQ0zwrVsU0T6Czv/rvJ0HwRlJBMzFFREdFMDMxNQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-type image/gif access-control-allow-origin * x-ms-request-id b37bdcf3-c01e-0077-751f-c5147d000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif aadcdn.msauth.net/shared/1.0/content/images/	4 KB 4 KB	59ms 59ms	Image image/gif	2620:1ec:46::44 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif Requested by Host: aadcdn.msauth.net URL: https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_rEkixmwXrnf1ZoXlPzTPPA2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:46::44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d` Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:19:28 GMT x-azure-ref-originshield 0RWkcYwAAAACbRRv92TeyTo3Cw4KDPvJYRlJBMjMxMDUwNDE3MDE5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-md5 tUCo5RgDcZLjLE/li/Lbqw== x-cache TCP_HIT content-length 3620 x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:38 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D79B8373B17F89 x-azure-ref 0YIMgYwAAAACclqYbfsNxTKSfDkFw4EJIRlJBMzFFREdFMDMxNQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-type image/gif access-control-allow-origin * x-ms-request-id 056a5770-601e-0041-23d1-c3cf60000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H/1.1	200 OK	Me.htm Show response live.msfs0nln.com/ Frame FBD1	2 KB 3 KB	782ms 501ms	Document text/html	18.207.204.205 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://live.msfs0nln.com/Me.htm?v=3 Requested by Host: aadcdn.msauth.net URL: https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_rEkixmwXrnf1ZoXlPzTPPA2.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.207.204.205 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-207-204-205.compute-1.amazonaws.com Software / Resource Hash `5fe2ac5f287973903434a3f9f4a49075ef0a2cd2ca46757aca7f890f31b1cf78` Request headers Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers Cache-Control max-age=315360000 Connection close Content-Type text/html; charset=utf-8 Date Tue, 13 Sep 2022 13:19:28 GMT Expires Fri, 10 Sep 2032 13:19:29 GMT P3p CP="DSP CUR OTPi IND OTRi ONL FIN" Ppserver PPV: 30 H: SN1PEPF000175DB V: 0 Referrer-Policy strict-origin-when-cross-origin Transfer-Encoding chunked Vary Accept-Encoding X-Ms-Request-Id ff5de67a-e578-4e1e-a672-a22152e0b884 X-Ms-Route-Info R3_SN1
GET H2	200	signin-options_4e48046ce74f4b89d45037c90576bfac.svg aadcdn.msauth.net/shared/1.0/content/images/	2 KB 1 KB	59ms 58ms	Image image/svg+xml	2620:1ec:46::44 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:46::44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93` Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:19:29 GMT content-encoding gzip x-azure-ref-originshield 0OH0gYwAAAABVtQqqh89vRL+StoIicNJ7RlJBMjMxMDUwNDE3MDE3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-md5 R2FAVxfpONfnQAuxVxXbHg== x-cache TCP_HIT content-length 621 x-ms-lease-status unlocked last-modified Tue, 10 Nov 2020 03:41:24 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D8852A7FA6B761 x-azure-ref 0YYMgYwAAAADp9s8O/iI2SJspyRvJTpLORlJBMzFFREdFMDMxNQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-type image/svg+xml access-control-allow-origin * x-ms-request-id 23c1a2a7-801e-0073-133f-c5b875000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

16 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.msfs0nln.com/	1970-01-20 05:57:58	Name: wqZd Value: 015600d3a6bf49266ba40608edeca208fdde5d2b94907ba6966213a1c59d82a3
.10gin-rnicosotfon1ine.msfs0nln.com/	1969-12-31 23:59:59	Name: esctx Value: AQABAAAAAAD--DLA3VO7QrddgJg7WevrBaQIr8O9R494RThdu-RY9Vc-Z3MkNcpSi2-H4AamjgFvyWOi9xaJN-riguozaoQyXHsN7hJAhah9qimcebEV9Byb5NpFwyIqhV57BTorPxJmRbjTRCIFsY5bWZ6eoFHhNn-S6ZluAlkO7GWafsNRRf3-DuIQk6SsMoRc7MlZ0I8gAA
10gin-rnicosotfon1ine.msfs0nln.com/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
10gin-rnicosotfon1ine.msfs0nln.com/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd
www.msfs0nln.com/	1970-01-20 05:58:23	Name: OH.DCAffinity Value: OH-suk
www.msfs0nln.com/	1970-01-20 14:43:31	Name: OH.FLID Value: e5c3ac8e-8e59-40e5-83b3-a80e72bc9b17
www.msfs0nln.com/	1970-01-20 05:57:56	Name: .AspNetCore.OpenIdConnect.Nonce.1PucBZ1k2btJY8zuxSMgng1-HqAHva1UoZCadToOueoo1_GD7q6aWmx7Hn9wkXJjaRozIy3AA3HKZRxzSbBMWo9tLBWv4BHPLAyXaa70J75aNvcRUTCD011JQxYHgJ7FW5Nfk51HjDjAzkH6U1da7Tvp83hdXfL7yNxhd0r98qJNb_ZBkov4xBz07L-nc2I5bmh013LYzuoMGRKvkSNQADKwxqmnu3NisT6eGMFX_8kKIWrXFfpOhAbzkOFXVaGJ Value: N
www.msfs0nln.com/	1970-01-20 05:57:56	Name: .AspNetCore.Correlation.OpenIdConnectV2.y_ELVvqXKuE5rSV-ZTb6kP_cSmRMyGZFM6pF_oxyRXI Value: N
.msfs0nln.com/	1970-01-20 15:19:31	Name: MUID Value: 09E0D02F14B665F52C20C23115CF6469
.10gin-rnicosotfon1ine.msfs0nln.com/	1969-12-31 23:59:59	Name: AADSSO Value: NA\|NoExtension
10gin-rnicosotfon1ine.msfs0nln.com/	1970-01-20 05:57:55	Name: SSOCOOKIEPULLED Value: 1
10gin-rnicosotfon1ine.msfs0nln.com/	1970-01-20 06:41:07	Name: buid Value: 0.AQQAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAD--DLA3VO7QrddgJg7WevrM-_usIoQgVXjURDx8OLCmIqvUL12j7KNG3uyjAu--NpdbI8DDu6qLm9hQ-vg6bipzQwsXhvOuI82mzfkRjT1OB02y_bnAUHRmdwpqp2ALbUgAA
10gin-rnicosotfon1ine.msfs0nln.com/	1970-01-20 06:41:07	Name: fpc Value: AsnDhaVEeUtFt5gfJDgvcU-8Ae7AAQAAAF56stoOAAAA
.10gin-rnicosotfon1ine.msfs0nln.com/	1970-01-20 15:19:31	Name: brcap Value: 0
.live.msfs0nln.com/	1969-12-31 23:59:59	Name: uaid Value: 2be6a75b51be4d2f9317013ccaa030c0
.live.msfs0nln.com/	1969-12-31 23:59:59	Name: MSPRequ Value: id=N&lt=1663075169&co=2

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10gin-rnicosotfon1ine.msfs0nln.com
aadcdn.msauth.net
live.msfs0nln.com
www.msfs0nln.com
18.207.204.205
2620:1ec:46::44
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
106c7ae6e865f487b4fc75aac19b535d73fa8f13507884259be7393b5c5f5494
564118b5f28d90632e7ca3487f8a208b0e7b5fe68fcda0c950986107a5ce2c65
5fe2ac5f287973903434a3f9f4a49075ef0a2cd2ca46757aca7f890f31b1cf78
8531f19b6958dd0d3c29f6525f2b63853eb3913c56bef783672c2b6ea97c7805
8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
9eb94d561655bc4524c736a0e16d2567d635cb03a4f62ed71f0e393cd1c9e719
a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f78a659d1f272f9c0aceb7be9ee1c095a2c52e136ba712602520e7a268583b66

10gin-rnicosotfon1ine.msfs0nln.com Open in urlscan Pro 18.207.204.205 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

16 Requests

100 %HTTPS

50 %IPv6

2 Domains

4 Subdomains

2 IPs

1 Countries

554 kBTransfer

877 kBSize

16 Cookies

3 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

30 JavaScript Global Variables

16 Cookies

Indicators

10gin-rnicosotfon1ine.msfs0nln.com Open in urlscan Pro
18.207.204.205 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

4
Subdomains

2
IPs

1
Countries

554 kB
Transfer

877 kB
Size

16
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!