microsoft-ondrive-identity-verification-74647487878949.pages.dev Open in urlscan Pro
2606:4700:310c::ac42:2ee2 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://microsoft-ondrive-identity-verification-74647487878949.pages.dev/
Effective URL:
https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/
Submission Tags: threatview.io malwar3ninja rule: suspected phishing scam automated-submission Search All
Submission: On November 18 via api (November 18th 2024, 7:14:47 am UTC) from DE — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 10 HTTP transactions. The main IP is 2606:4700:310c::ac42:2ee2, located in United States and belongs to CLOUDFLARENET, US. The main domain is microsoft-ondrive-identity-verification-74647487878949.pages.dev.
TLS certificate: Issued by WE1 on October 30th 2024. Valid for: 3 months.

This is the only time microsoft-ondrive-identity-verification-74647487878949.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 6	2606:4700:310... 2606:4700:310c::ac42:2ee2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	192.229.133.221 192.229.133.221	15133 (EDGECAST) (EDGECAST)
3	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
10	5

6 2606:4700:310c::ac42:2ee2 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

microsoft-ondrive-identity-verification-74647487878949.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.229.133.221 (United States)

ASN15133 (EDGECAST, US)

www.w3schools.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	pages.dev 1 redirects microsoft-ondrive-identity-verification-74647487878949.pages.dev	65 KB
3	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 225	179 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 415	84 KB
1	w3schools.com www.w3schools.com — Cisco Umbrella Rank: 21781	5 KB
10	4

	Domain	Requested by
6	microsoft-ondrive-identity-verification-74647487878949.pages.dev	1 redirects microsoft-ondrive-identity-verification-74647487878949.pages.dev
3	cdnjs.cloudflare.com	microsoft-ondrive-identity-verification-74647487878949.pages.dev cdnjs.cloudflare.com
1	ajax.googleapis.com	microsoft-ondrive-identity-verification-74647487878949.pages.dev
1	www.w3schools.com	microsoft-ondrive-identity-verification-74647487878949.pages.dev
10	4

This site contains no links.

Subject Issuer	Validity	Valid
microsoft-ondrive-identity-verification-74647487878949.pages.dev WE1	`2024-10-30` - `2025-01-28`	3 months	crt.sh
*.w3schools.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-04-03` - `2025-05-04`	a year	crt.sh
cdnjs.cloudflare.com WE1	`2024-09-28` - `2024-12-27`	3 months	crt.sh
upload.video.google.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/
Frame ID: 3636836631367036B98B0FC5AE0527EE
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://microsoft-ondrive-identity-verification-74647487878949.pages.dev/ HTTP 307
https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/ Page URL
https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/cdn-cgi/phish-bypass?atok=mpzWkUdoYG51OkfbydDKzpZM6u6K5yOi0eSazoT6xkU-173191... HTTP 301
https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/ Page URL

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

334 kB
Transfer

813 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://microsoft-ondrive-identity-verification-74647487878949.pages.dev/ HTTP 307
https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/ Page URL
https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/cdn-cgi/phish-bypass?atok=mpzWkUdoYG51OkfbydDKzpZM6u6K5yOi0eSazoT6xkU-1731914076-0.0.1.1-%2F HTTP 301
https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://microsoft-ondrive-identity-verification-74647487878949.pages.dev/ HTTP 307
https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/

10 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

403

/ Show response
microsoft-ondrive-identity-verification-74647487878949.pages.dev/
Redirect Chain

http://microsoft-ondrive-identity-verification-74647487878949.pages.dev/
https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/

4 KB
2 KB

34ms
11ms

Document
text/html

2606:4700:310c::ac42:2ee2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2ee2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1a6de54786958e53c24b33ac6db593e1da4ca5086f288334bcce3ec46efafeb5

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cf-ray: 8e462a248c938fd4-FRA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 18 Nov 2024 07:14:36 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pSMfybEV5%2FteqSZs3WNKOxsPcCxZ2VoZK7k4M%2Fz2Idq8uvhLXpIColRXSjsuj3iQIi4onfWkfYjr0t5Rf78rAmnPxA9Pk8xDKBMNunQcs6CeMLLSpDLmO5i1cuYnfyb0C2qFZME8SaXhfbIfyrj8e8mvWH5bV9HK%2FohWYDL6JzHsZ%2BYwzEIwgi%2FKxDEgHd3rhvYwyjUdJQ%2Bw2dcVMJAu"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

Redirect headers

Cross-Origin-Resource-Policy: Cross-Origin
Location: https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/
Non-Authoritative-Reason: HSTS

GET
H3 200 cf.errors.css
microsoft-ondrive-identity-verification-74647487878949.pages.dev/cdn-cgi/styles/ 23 KB
5 KB 8ms
8ms Stylesheet
text/css 2606:4700:310c::ac42:2ee2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/cdn-cgi/styles/cf.errors.css

Requested by

Host: microsoft-ondrive-identity-verification-74647487878949.pages.dev
URL: https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2ee2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
content-encoding: gzip
etag: W/"673379a7-5df3"
x-content-type-options: nosniff
cf-ray: 8e462a24aca28fd4-FRA
expires: Mon, 18 Nov 2024 09:14:36 GMT
date: Mon, 18 Nov 2024 07:14:36 GMT
content-type: text/css
last-modified: Tue, 12 Nov 2024 15:52:07 GMT
server: cloudflare
x-frame-options: DENY

GET
H3 200 icon-exclamation.png
microsoft-ondrive-identity-verification-74647487878949.pages.dev/cdn-cgi/images/ 452 B
635 B 8ms
8ms Image
image/png 2606:4700:310c::ac42:2ee2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: microsoft-ondrive-identity-verification-74647487878949.pages.dev
URL: https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/cdn-cgi/styles/cf.errors.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2ee2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/cdn-cgi/styles/cf.errors.css

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
etag: "673379a7-1c4"
x-content-type-options: nosniff
cf-ray: 8e462a24bcaa8fd4-FRA
expires: Mon, 18 Nov 2024 09:14:36 GMT
accept-ranges: bytes
content-length: 452
date: Mon, 18 Nov 2024 07:14:36 GMT
content-type: image/png
last-modified: Tue, 12 Nov 2024 15:52:07 GMT
server: cloudflare
x-frame-options: DENY

GET
H3 403 favicon.ico
microsoft-ondrive-identity-verification-74647487878949.pages.dev/ 4 KB
2 KB 14ms
14ms Other
text/html 2606:4700:310c::ac42:2ee2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2ee2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2be558978f0accb6ed24d00359ea23434e873f9a3ac56feb6632f68bb057007f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: gzip
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xsEkt8UtyBgPw44FnyU8xdT3CGs%2BqNQbQbKRwf8FNTy8rIf6QbLdM7ua%2BXLCZwaRZgjrqptW1TdMG0AJwgS2YKyWe2CuNm8GBobaB2uEPPA8hPr8fp62qLF%2BpP9k390HjJpJ05nPQxvgHZ0bzpSFdxgpxXTd6cn3YlFhPCvxjuNsh4LFDG4VgxfEqCu68Uo13xRPGO5rW9DkyZJqQQdH"}],"group":"cf-nel","max_age":604800}
cf-ray: 8e462a24dcb58fd4-FRA
date: Mon, 18 Nov 2024 07:14:36 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: cloudflare
x-frame-options: SAMEORIGIN

GET
H3

200

Primary Request / Show response
microsoft-ondrive-identity-verification-74647487878949.pages.dev/
Redirect Chain

https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/cdn-cgi/phish-bypass?atok=mpzWkUdoYG51OkfbydDKzpZM6u6K5yOi0eSazoT6xkU-1731914076-0.0.1.1-%2F
https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/

126 KB
56 KB

782ms
782ms

Document
text/html

2606:4700:310c::ac42:2ee2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2ee2 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5d466ba3de8ab2832cd9d464197ea49d008df4e705ad4a5ab74df91260e43007

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-ray: 8e462a43ee228fd4-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Mon, 18 Nov 2024 07:14:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rUsT0NCET2IdhxBpwP6jw%2FaLZe1GZ%2Frp0Ey86j17Gxg2CZ2Gzyj2N44OXdzw9rTy5fSyATTUJ1Rr0hAu%2F%2B5DQaf5yZNOnoleb4xQsWfXAoh3FI%2BJdE6brobLmpZVBTH8pD1FEOnX%2BZrlP1KPJTgPcvITCq34f%2FgxuQxWhBsnoic1t7QqKelev4uLw5V2u92z3NKIO5y%2Bf%2FaUwFFrbXN0"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=6944&sent=28&recv=21&lost=0&retrans=0&sent_bytes=14943&recv_bytes=7039&delivery_rate=929&cwnd=12000&unsent_bytes=0&cid=88bf9b3aafc61577&ts=5811&x=1" cfHdrFlush;dur=0
vary: Accept-Encoding
x-content-type-options: nosniff

Redirect headers

cache-control: private, no-cache
cf-ray: 8e462a43de188fd4-FRA
content-length: 167
content-type: text/html
date: Mon, 18 Nov 2024 07:14:41 GMT
location: https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/
server: cloudflare
x-content-type-options: nosniff
x-frame-options: DENY

GET
H2 200 w3.css
www.w3schools.com/w3css/4/ 23 KB
5 KB 43ms
7ms Stylesheet
text/css 192.229.133.221
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.w3schools.com/w3css/4/w3.css

Requested by

Host: microsoft-ondrive-identity-verification-74647487878949.pages.dev
URL: https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.133.221 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/6796) / ASP.NET

Resource Hash

c4f2aba13970ecf8303fb9329f97c8824861569273b0aa27acce48abc61d04f5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://mycourses.w3schools.com https://pathfinder.w3schools.com;
X-Content-Security-Policy	frame-ancestors 'self' https://mycourses.w3schools.com https://pathfinder.w3schools.com;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/

Response headers

x-powered-by: ASP.NET
content-security-policy: frame-ancestors 'self' https://mycourses.w3schools.com https://pathfinder.w3schools.com;
cache-control: public,max-age=31536000,public
content-encoding: gzip
etag: "0e3c7645937db1:0+gzip"
age: 236038
x-content-security-policy: frame-ancestors 'self' https://mycourses.w3schools.com https://pathfinder.w3schools.com;
accept-ranges: bytes
x-cache: HIT
content-length: 5256
date: Mon, 18 Nov 2024 07:14:42 GMT
content-type: text/css
last-modified: Fri, 15 Nov 2024 12:25:02 GMT
server: ECS (frb/6796)
vary: Accept-Encoding

GET
H3 200 all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/ 98 KB
17 KB 33ms
20ms Stylesheet
text/css 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css

Requested by

Host: microsoft-ondrive-identity-verification-74647487878949.pages.dev
URL: https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0df5a33710e433de1f5415b1d47e4130ca7466aee5b81955f1045c4844bbb3ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "623a082a-4291"
age: 308705
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3piH8GyzQVXssThfGShglwz7CYXXkJI736FeE%2B978vYy9MBQlbL63M2BSYLveh%2BxLpkd5uBJjazpYiwdYuucBL2AofukUSe0XzYg8oDRj%2FnjkAwy7wbWr5wOPb1K7nH%2FEgQN2B5CV8nsDWQ5KbxACDod"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sat, 08 Nov 2025 07:14:42 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 18 Nov 2024 07:14:42 GMT
content-type: text/css; charset=utf-8
last-modified: Tue, 22 Mar 2022 17:32:26 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8e462a48e94fbb38-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 17041
server: cloudflare

GET
H2 200 jquery.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 282 KB
84 KB 31ms
8ms Script
text/javascript 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.js

Requested by

Host: microsoft-ondrive-identity-verification-74647487878949.pages.dev
URL: https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1fe2bb5390a75e5d61e72c107cab528fc3c29a837d69aab7d200e1dbb5dcd239

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/

Response headers

content-encoding: gzip
age: 515614
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Wed, 12 Nov 2025 08:01:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 12 Nov 2024 08:01:08 GMT
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 85110
x-xss-protection: 0
server: sffe

GET
H3 200 all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/ 57 KB
11 KB 28ms
16ms Stylesheet
text/css 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/all.min.css

Requested by

Host: microsoft-ondrive-identity-verification-74647487878949.pages.dev
URL: https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5eb03e60-e4d2"
age: 307627
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uc6sKdgUObXpmfCRdvOr%2BhAyd3GzjY5F5wyjXUKcoEojw5G9dMcqpeBIqJ20MPZBpJhYTjo3%2BTHcD%2B7saag1PIhTBOXD8AkvnnhC9peSmaSqF0e6QNnagvNFRN%2Fs2eolDPN3omddDSiLRQ6f95rX64NV"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sat, 08 Nov 2025 07:14:42 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 18 Nov 2024 07:14:42 GMT
content-type: text/css; charset=utf-8
last-modified: Mon, 04 May 2020 16:10:08 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8e462a48e94ebb38-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 10301
server: cloudflare

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 07cb74d4c4b3a222e3d5810ef0894b695945e8cd122a7e664359079cb5295019

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 8 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cc5f3669073b1564ebe87833d4a8e04609efc6e56676c9b2d60fb004e4c506f6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5d9bed3a14a9d6fd47f12c88ef6c38e2f041eebc4170159e76d74e1d50caf012

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 13 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 525aba7a5303edb674347b9fc2e8faaae82912d563ec435d90a29197fc0e5910

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8b12bcba2dfb0ba85bc2a43fb4fe70461a6354df6ef87dbbbcc739ebacfb3170

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 21252c97ada0d1b83d8028923732f2276a0f90552b64e5823ba041fd2fee273c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 234 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5d05b50382bcb557ef5309b65f6562d890e8c3fea40f70c50103d0a1258eb099

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 200 fa-solid-900.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/webfonts/ 151 KB
151 KB 18ms
17ms Font
application/octet-stream 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/webfonts/fa-solid-900.woff2

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d76fb4e841748a3f6bc63efa23156e02631c283bf41f84efcbdaf339ea3e1b73

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://microsoft-ondrive-identity-verification-74647487878949.pages.dev
Referer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css

Response headers

cf-cdnjs-via: cfworker/kv
cf-cache-status: HIT
etag: "623a082a-25a74"
age: 924847
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zx4n%2F40tHORznfJc%2F1BrfmWM3axhzIBiZUDxosVSCoRW1jdZtMI%2FCFNyDP1zpXE3qh1hwUa8D6T4MyKuA9u8JVyzJnoD1WpLQpC0eJAqdGddJLIzV1t2m1e9mIHkXcTbE%2Baxai3Tlce2Ug%2BJfkDj2OA%2F"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sat, 08 Nov 2025 07:14:42 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 18 Nov 2024 07:14:42 GMT
content-type: application/octet-stream; charset=utf-8
last-modified: Tue, 22 Mar 2022 17:32:26 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8e462a494b79dc8a-FRA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 154228
server: cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

37 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.microsoft-ondrive-identity-verification-74647487878949.pages.dev/	1970-01-21 01:06:40	Name: __cf_mw_byp Value: mpzWkUdoYG51OkfbydDKzpZM6u6K5yOi0eSazoT6xkU-1731914076-0.0.1.1-/

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/ Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()
recommendation	verbose	URL: https://microsoft-ondrive-identity-verification-74647487878949.pages.dev/ Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
microsoft-ondrive-identity-verification-74647487878949.pages.dev
www.w3schools.com
192.229.133.221
2606:4700:310c::ac42:2ee2
2606:4700::6811:180e
2a00:1450:4001:80b::200a
07cb74d4c4b3a222e3d5810ef0894b695945e8cd122a7e664359079cb5295019
0df5a33710e433de1f5415b1d47e4130ca7466aee5b81955f1045c4844bbb3ed
1a6de54786958e53c24b33ac6db593e1da4ca5086f288334bcce3ec46efafeb5
1fe2bb5390a75e5d61e72c107cab528fc3c29a837d69aab7d200e1dbb5dcd239
21252c97ada0d1b83d8028923732f2276a0f90552b64e5823ba041fd2fee273c
2be558978f0accb6ed24d00359ea23434e873f9a3ac56feb6632f68bb057007f
525aba7a5303edb674347b9fc2e8faaae82912d563ec435d90a29197fc0e5910
5d05b50382bcb557ef5309b65f6562d890e8c3fea40f70c50103d0a1258eb099
5d466ba3de8ab2832cd9d464197ea49d008df4e705ad4a5ab74df91260e43007
5d9bed3a14a9d6fd47f12c88ef6c38e2f041eebc4170159e76d74e1d50caf012
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84
8b12bcba2dfb0ba85bc2a43fb4fe70461a6354df6ef87dbbbcc739ebacfb3170
c4f2aba13970ecf8303fb9329f97c8824861569273b0aa27acce48abc61d04f5
cc5f3669073b1564ebe87833d4a8e04609efc6e56676c9b2d60fb004e4c506f6
d76fb4e841748a3f6bc63efa23156e02631c283bf41f84efcbdaf339ea3e1b73
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

microsoft-ondrive-identity-verification-74647487878949.pages.dev Open in urlscan Pro 2606:4700:310c::ac42:2ee2 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

5 IPs

2 Countries

334 kBTransfer

813 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

37 JavaScript Global Variables

1 Cookies

3 Console Messages

Security Headers

Indicators

microsoft-ondrive-identity-verification-74647487878949.pages.dev Open in urlscan Pro
2606:4700:310c::ac42:2ee2 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

334 kB
Transfer

813 kB
Size

1
Cookies

10 HTTP transactions
7 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!