portal.microsftnonline.com Open in urlscan Pro
118.27.81.96  Malicious Activity! Public Scan

Submitted URL: https://portal.microsftnonline.com/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t
Effective URL: https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/co...
Submission: On April 24 via manual from US

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 16 HTTP transactions. The main IP is 118.27.81.96, located in Shibuya, Japan and belongs to INTERQ GMO Internet,Inc, JP. The main domain is portal.microsftnonline.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on April 9th 2019. Valid for: a year.
This is the only time portal.microsftnonline.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OneDrive (Online) Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
2 3 118.27.81.96 7506 (INTERQ GM...)
14 152.199.23.37 15133 (EDGECAST)
1 2603:1026:c02... 8075 (MICROSOFT...)
16 3
Domain Requested by
14 aadcdn.msftauth.net portal.microsftnonline.com
aadcdn.msftauth.net
3 portal.microsftnonline.com 2 redirects
1 outlook.office365.com aadcdn.msftauth.net
16 3

This site contains links to these domains. Also see Links.

Domain
www.microsoft.com
privacy.microsoft.com
Subject Issuer Validity Valid
portal.microsftnonline.com
Sectigo RSA Domain Validation Secure Server CA
2019-04-09 -
2020-04-07
a year crt.sh
aadcdn.msftauth.net
Microsoft IT TLS CA 5
2018-11-07 -
2020-11-07
2 years crt.sh
outlook.com
DigiCert Cloud Services CA-1
2018-11-19 -
2020-11-19
2 years crt.sh

This page contains 2 frames:

Primary Page: https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Frame ID: 050CAF9A27596AC5783273E47013C913
Requests: 15 HTTP requests in this frame

Frame: https://outlook.office365.com/owa/prefetch.aspx
Frame ID: D94CC79D59562706E0742A55BD63D435
Requests: 1 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://portal.microsftnonline.com/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t HTTP 302
    https://portal.microsftnonline.com/changePasswd?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.mic... HTTP 301
    https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.mi... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /IIS(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • headers server /IIS(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • env /^ko$/i

Overall confidence: 100%
Detected patterns
  • env /^webpackJsonp$/i

Page Statistics

16
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

493 kB
Transfer

1002 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://portal.microsftnonline.com/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t HTTP 302
    https://portal.microsftnonline.com/changePasswd?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri= HTTP 301
    https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
portal.microsftnonline.com/changePasswd/
Redirect Chain
  • https://portal.microsftnonline.com/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t
  • https://portal.microsftnonline.com/changePasswd?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-00000000000...
  • https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-0000000000...
29 KB
29 KB
Document
General
Full URL
https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
118.27.81.96 Shibuya, Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS
microsftsoftonline.com
Software
Microsoft-IIS/10.0 / PHP/7.2.14
Resource Hash
70bce9496cb595998fcda1f8333105de1054bc4094991f8fe6d16b11e38e68e7

Request headers

:method
GET
:authority
portal.microsftnonline.com
:scheme
https
:path
/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate, br
cookie
PHPSESSID=ogaq8dqncv4nl0bl4dt45a5fhj
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
content-type
text/html;charset=utf-8
expires
Thu, 19 Nov 1981 08:52:00 GMT
server
Microsoft-IIS/10.0
x-powered-by
PHP/7.2.14
date
Wed, 24 Apr 2019 22:23:09 GMT
content-length
29973

Redirect headers

status
301
content-type
text/html; charset=UTF-8
location
https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
server
Microsoft-IIS/10.0
date
Wed, 24 Apr 2019 22:23:09 GMT
content-length
422
converged.v2.login.min_tbsima5-c7pluzuyz0ftda2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/
99 KB
18 KB
Stylesheet
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_tbsima5-c7pluzuyz0ftda2.css
Requested by
Host: portal.microsftnonline.com
URL: https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F40) /
Resource Hash
10c50b88ebf99fdf813a4cce86ba218a6e2ea3d266146520529f1e1bddc5ebd3

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Origin
https://portal.microsftnonline.com

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 24 Apr 2019 22:23:10 GMT
content-encoding
gzip
content-md5
lq2911TWkRoV0O0xE9QtAg==
x-cache
HIT
status
200
content-length
18705
x-ms-lease-status
unlocked
last-modified
Thu, 28 Mar 2019 22:17:16 GMT
server
ECAcc (frc/8F40)
etag
0x8D6B3CB232D69A4
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
e9115c70-b01e-0037-584e-e60730000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
convergedlogin_pcore.min_9tacpdkgjirszrftw1qtxg2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/
548 KB
143 KB
Script
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/convergedlogin_pcore.min_9tacpdkgjirszrftw1qtxg2.js
Requested by
Host: portal.microsftnonline.com
URL: https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8E8B) /
Resource Hash
bfea5173548f586cfcbb69a0f911cd2add563ca8870b89fdcd1a37cae410495c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Origin
https://portal.microsftnonline.com

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 24 Apr 2019 22:23:10 GMT
content-encoding
gzip
content-md5
UNqmFsWJAPRnCg0od7PUqA==
x-cache
HIT
status
200
content-length
146071
x-ms-lease-status
unlocked
last-modified
Thu, 04 Apr 2019 21:22:21 GMT
server
ECAcc (frc/8E8B)
etag
0x8D6B9439FFD9589
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
c0069656-f01e-0076-25ca-eb059f000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
convergedloginpaginatedstrings-en.min_kxotwlssckntce4-jjxrfw2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/
31 KB
10 KB
Script
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/convergedloginpaginatedstrings-en.min_kxotwlssckntce4-jjxrfw2.js
Requested by
Host: portal.microsftnonline.com
URL: https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FC7) /
Resource Hash
4c0aa35957f5768970ce5569fa59434854a3ad180a9bba1aecc81bc0e0addacc

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Origin
https://portal.microsftnonline.com

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 24 Apr 2019 22:23:10 GMT
content-encoding
gzip
content-md5
2KfbKwF8su50DeB6Mr5RxQ==
x-cache
HIT
status
200
content-length
10106
x-ms-lease-status
unlocked
last-modified
Thu, 04 Apr 2019 21:22:09 GMT
server
ECAcc (frc/8FC7)
etag
0x8D6B94398EB45B4
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
4008556d-001e-0087-716a-ef3e0c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
Cookie set prefetch.aspx
outlook.office365.com/owa/ Frame D94C
0
0
Document
General
Full URL
https://outlook.office365.com/owa/prefetch.aspx
Requested by
Host: aadcdn.msftauth.net
URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/convergedlogin_pcore.min_9tacpdkgjirszrftw1qtxg2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2603:1026:c02:3040::2 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Host
outlook.office365.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=

Response headers

Cache-Control
private, no-store
Content-Length
1241
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Vary
Accept-Encoding
Server
Microsoft-IIS/10.0
request-id
5108a64c-e687-4f90-93c6-5edd6e34ae9f
X-CalculatedFETarget
VI1PR0902CU002.internal.outlook.com
X-BackEndHttpStatus
200 200
Set-Cookie
ClientId=35E36AF1CE39435AB53F1B56FE7082D9; expires=Fri, 24-Apr-2020 22:23:10 GMT; path=/; secure ClientId=35E36AF1CE39435AB53F1B56FE7082D9; expires=Fri, 24-Apr-2020 22:23:10 GMT; path=/; secure OIDC=1; expires=Thu, 24-Oct-2019 22:23:10 GMT; path=/; secure; HttpOnly OWAPF=v:16.3012.3.2690869&l:mouse; path=/
X-FEProxyInfo
VI1PR0902CA0049.EURPRD09.PROD.OUTLOOK.COM
X-CalculatedBETarget
VI1PR06MB5471.eurprd06.prod.outlook.com
X-RUM-Validated
1
X-Content-Type-Options
nosniff
X-BeSku
WCS5
X-OWA-Version
15.20.1835.13
X-OWA-DiagnosticsInfo
1;0;0
X-BackEnd-Begin
2019-04-24T22:23:10.701
X-BackEnd-End
2019-04-24T22:23:10.703
X-DiagInfo
VI1PR06MB5471
X-BEServer
VI1PR06MB5471
X-UA-Compatible
IE=EmulateIE7
Strict-Transport-Security
max-age=31536000; includeSubDomains max-age=31536000; includeSubDomains
X-FEServer
VI1PR0902CA0049 DB8PR06CA0012
Date
Wed, 24 Apr 2019 22:23:09 GMT
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msftauth.net/ests/2.1/content/images/
4 KB
2 KB
Image
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F3A) /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Referer
https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 24 Apr 2019 22:23:10 GMT
content-encoding
gzip
content-md5
nzaLxFgP7ZB3dfMcaybWzw==
x-cache
HIT
status
200
content-length
1435
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:22 GMT
server
ECAcc (frc/8F3A)
etag
0x8D64101507E84BD
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
8d7c6733-401e-0009-5279-f707a7000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes
ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg
aadcdn.msftauth.net/ests/2.1/content/images/
915 B
463 B
Image
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F5C) /
Resource Hash
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea

Request headers

Referer
https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 24 Apr 2019 22:23:10 GMT
content-encoding
gzip
content-md5
HMwsHhNXdtrfirQDkzcqMA==
x-cache
HIT
status
200
content-length
263
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:15 GMT
server
ECAcc (frc/8F5C)
etag
0x8D641014CC1CD9F
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
c66178ae-c01e-0049-25d0-f6fb05000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes
ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg
aadcdn.msftauth.net/ests/2.1/content/images/
915 B
439 B
Image
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F60) /
Resource Hash
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6

Request headers

Referer
https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 24 Apr 2019 22:23:13 GMT
content-encoding
gzip
content-md5
/a3y/mpA+HRaVAiPACrsog==
x-cache
HIT
status
200
content-length
263
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:14 GMT
server
ECAcc (frc/8F60)
etag
0x8D641014C1EFD89
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
f4212875-c01e-006e-2ad0-f69d98000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes
33-small_138bcee624fa04ef9b75e86211a9fe0d.jpg
aadcdn.msftauth.net/ests/2.1/content/images/appbackgrounds/
3 KB
3 KB
Image
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/images/appbackgrounds/33-small_138bcee624fa04ef9b75e86211a9fe0d.jpg
Requested by
Host: aadcdn.msftauth.net
URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/convergedlogin_pcore.min_9tacpdkgjirszrftw1qtxg2.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FCB) /
Resource Hash
f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea

Request headers

Referer
https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 24 Apr 2019 22:23:10 GMT
content-md5
E4vO5iT6BO+bdehiEan+DQ==
x-cache
HIT
status
200
content-length
3006
x-ms-lease-status
unlocked
last-modified
Wed, 13 Mar 2019 20:53:54 GMT
server
ECAcc (frc/8FCB)
etag
0x8D6A7F601085E51
content-type
image/jpeg
access-control-allow-origin
*
x-ms-request-id
05861538-001e-0087-72b8-e83e0c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
33_a5dbd4393ff6a725c7e62b61df7e72f0.jpg
aadcdn.msftauth.net/ests/2.1/content/images/appbackgrounds/
277 KB
277 KB
Image
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/images/appbackgrounds/33_a5dbd4393ff6a725c7e62b61df7e72f0.jpg
Requested by
Host: aadcdn.msftauth.net
URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/convergedlogin_pcore.min_9tacpdkgjirszrftw1qtxg2.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F48) /
Resource Hash
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb

Request headers

Referer
https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 24 Apr 2019 22:23:10 GMT
content-md5
pdvUOT/2pyXH5ith335y8A==
x-cache
HIT
status
200
content-length
283351
x-ms-lease-status
unlocked
last-modified
Wed, 13 Mar 2019 20:53:54 GMT
server
ECAcc (frc/8F48)
etag
0x8D6A7F601085E51
content-type
image/jpeg
access-control-allow-origin
*
x-ms-request-id
22f7bff7-e01e-0092-58b8-e89485000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
37_533e293f0c8947ada653b47c00e394e2.png
aadcdn.msftauth.net/ests/2.1/content/images/applogos/
2 KB
2 KB
Image
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/images/applogos/37_533e293f0c8947ada653b47c00e394e2.png
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8EA7) /
Resource Hash
b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c

Request headers

Referer
https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 24 Apr 2019 22:23:10 GMT
content-md5
Uz4pPwyJR62mU7R8AOOU4g==
x-cache
HIT
status
200
content-length
1750
x-ms-lease-status
unlocked
last-modified
Wed, 13 Mar 2019 20:54:40 GMT
server
ECAcc (frc/8EA7)
etag
0x8D6A7F61CB43A2D
content-type
image/png
access-control-allow-origin
*
x-ms-request-id
f25a386d-e01e-0039-35ba-e8c6de000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
picker_account_aad_9de70d1c5191d1852a0d5aac28b44a6c.svg
aadcdn.msftauth.net/ests/2.1/content/images/
756 B
561 B
Image
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/images/picker_account_aad_9de70d1c5191d1852a0d5aac28b44a6c.svg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FCD) /
Resource Hash
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69

Request headers

Referer
https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 24 Apr 2019 22:23:25 GMT
content-encoding
gzip
content-md5
Sm6wIsHj8wthIZkm/aQWhA==
x-cache
HIT
status
200
content-length
394
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:26 GMT
server
ECAcc (frc/8FCD)
etag
0x8D64101535909BA
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
31d482d6-b01e-0031-7f45-fae1f1000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes
picker_more_7568a43cf440757c55d2e7f51557ae1f.svg
aadcdn.msftauth.net/ests/2.1/content/images/
899 B
400 B
Image
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/images/picker_more_7568a43cf440757c55d2e7f51557ae1f.svg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F96) /
Resource Hash
b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2

Request headers

Referer
https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 24 Apr 2019 22:23:10 GMT
content-encoding
gzip
content-md5
K28EA/F25txr6jQahXym+g==
x-cache
HIT
status
200
content-length
257
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:30 GMT
server
ECAcc (frc/8F96)
etag
0x8D641015563B044
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
05012a8e-301e-0071-1803-f71d53000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes
marching_ants_white_166de53471265253ab3a456defe6da23.gif
aadcdn.msftauth.net/ests/2.1/content/images/
3 KB
3 KB
Image
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FF6) /
Resource Hash
a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13

Request headers

Referer
https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 24 Apr 2019 22:23:10 GMT
content-md5
Fm3lNHEmUlOrOkVt7+baIw==
x-cache
HIT
status
200
content-length
2672
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:20 GMT
server
ECAcc (frc/8FF6)
etag
0x8D641014F7623B9
content-type
image/gif
access-control-allow-origin
*
x-ms-request-id
47a967cf-801e-0029-47d1-f679f6000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes
marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif
aadcdn.msftauth.net/ests/2.1/content/images/
4 KB
4 KB
Image
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F1A) /
Resource Hash
8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d

Request headers

Referer
https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 24 Apr 2019 22:23:10 GMT
content-md5
tUCo5RgDcZLjLE/li/Lbqw==
x-cache
HIT
status
200
content-length
3620
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:19 GMT
server
ECAcc (frc/8F1A)
etag
0x8D641014F382153
content-type
image/gif
access-control-allow-origin
*
x-ms-request-id
866a29c2-f01e-0076-3745-fa059f000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes
picker_account_add_56e73414003cdb676008ff7857343074.svg
aadcdn.msftauth.net/ests/2.1/content/images/
222 B
326 B
Image
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/images/picker_account_add_56e73414003cdb676008ff7857343074.svg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FA7) /
Resource Hash
749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2

Request headers

Referer
https://portal.microsftnonline.com/changePasswd/?mfa=c3RldmUucGhpbGxwb3R0QGhnc3QuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 24 Apr 2019 22:23:10 GMT
content-encoding
gzip
content-md5
ykuOnMaTo0vw2Gx/ZceiPg==
x-cache
HIT
status
200
content-length
184
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:27 GMT
server
ECAcc (frc/8FA7)
etag
0x8D6410153A20B4B
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
5bc27f94-101e-008d-49e0-f6144e000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online) Microsoft (Consumer)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B object| ServerData function| webpackJsonp object| ko object| PROOF object| StringRepository boolean| __ConvergedLogin_PCore boolean| __ object| mydate

3 Cookies

Domain/Path Name / Value
portal.microsftnonline.com/ Name: localdate
Value: Wed Apr 24 2019 22:23:10 GMT+0000 (Coordinated Universal Time)
portal.microsftnonline.com/ Name: PHPSESSID
Value: ogaq8dqncv4nl0bl4dt45a5fhj
portal.microsftnonline.com/changePasswd Name: CkTst
Value: G1556144590476

1 Console Messages

Source Level URL
Text
console-api info URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/convergedlogin_pcore.min_9tacpdkgjirszrftw1qtxg2.js(Line 23)
Message:
BSSO Telemetry: {"result":"Error","error":"bssoNotSupported","type":"TBAuthTelemetry","data":{"BSSO.info":"not-supported"},"traces":["BrowserSSO Initialized","window.navigator.msLaunchUri is not available for _pullBrowserSsoCookie"]}