urlscan.io logo urlscan.io
SecurityTrails logo

msg-msg-login.qznhxvt.bar Open in urlscan Pro
134.209.209.127  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://msg-msg-login.qznhxvt.bar/common/oauth2/v2.0/authorize
Submission: On October 18 via manual — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 134.209.209.127, located in North Bergen, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is msg-msg-login.qznhxvt.bar.
TLS certificate: Issued by R3 on October 6th 2021. Valid for: 3 months.
This is the only time msg-msg-login.qznhxvt.bar was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
11 134.209.209.127 14061 (DIGITALOC...)
11 1
Domain Requested by
8 5y15eftqgj4bem3uy2854jr.qznhxvt.bar msg-msg-login.qznhxvt.bar
5y15eftqgj4bem3uy2854jr.qznhxvt.bar
2 ochsner-ochsner-login.qznhxvt.bar 5y15eftqgj4bem3uy2854jr.qznhxvt.bar
1 msg-msg-login.qznhxvt.bar
11 3
Subject Issuer Validity Valid
qznhxvt.bar
R3		 2021-10-06 -
2022-01-04		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://msg-msg-login.qznhxvt.bar/common/oauth2/v2.0/authorize
Frame ID: 5C995816414A1FFFCFEBF27306672573
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Bei Ihrem Konto anmelden

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

3
Subdomains

1
IPs

1
Countries

199 kB
Transfer

598 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set authorize
msg-msg-login.qznhxvt.bar/common/oauth2/v2.0/ 		154 KB
39 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://msg-msg-login.qznhxvt.bar/common/oauth2/v2.0/authorize?
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
134.209.209.127 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
b1759ba017997d9c79762f40e35abcaa17d6cf0ceb3713eccfde9a2407194430

Request headers

Host
msg-msg-login.qznhxvt.bar
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store, no-cache
Content-Encoding
gzip
Content-Length
38711
Content-Type
text/html; charset=utf-8
Date
Mon, 18 Oct 2021 16:36:15 GMT
Expires
-1
Link
<https://aadcdn.msauth.net>; rel=preconnect; crossorigin <https://aadcdn.msauth.net>; rel=dns-prefetch <https://aadcdn.msftauth.net>; rel=dns-prefetch
Nel
{"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
P3p
CP="DSP CUR OTPi IND OTRi ONL FIN"
Pragma
no-cache
Report-To
{"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+bno"}]}
Set-Cookie
fpc=An0ps1VAbTFGpFKyPf5eNgw; expires=Wed, 17-Nov-2021 16:36:16 GMT; path=/; secure; HttpOnly; SameSite=None esctx=AQABAAAAAAD--DLA3VO7QrddgJg7WevrRhDPDBjpojW9fZgqlAqQPwigGj-F3-lW30A_EPNC-LxF6iT2fCB7xBbSvKoZgImzqBITzzA-tGVJ0MepgjIW9uuX4IOGvgghDlvsU_4RczkBjLXTos1gVPiuVa9yjmPAF996t-sPN7_dWQc2LgaP5D0yFgRpo4YqBTOJ0d3jKlUgAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly stsservicecookie=estsfd; path=/; secure; samesite=none; httponly
Vary
Accept-Encoding
X-Dns-Prefetch-Control
on
X-Ms-Ests-Server
2.1.12108.10 - EUS ProdSlices
X-Ms-Request-Id
5c68c40c-97ad-49b1-afd4-ed76a0bbfe00
ConvergedError_Core_u1Ib0bvyN0cft5v_900-wQ2.js
5y15eftqgj4bem3uy2854jr.qznhxvt.bar/shared/1.0/content/js/ 		373 KB
103 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://5y15eftqgj4bem3uy2854jr.qznhxvt.bar/shared/1.0/content/js/ConvergedError_Core_u1Ib0bvyN0cft5v_900-wQ2.js
Requested by
Host: msg-msg-login.qznhxvt.bar
URL: https://msg-msg-login.qznhxvt.bar/common/oauth2/v2.0/authorize?
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
134.209.209.127 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
ff53bf827bfd1377d41da10a0a13806edf6daef58b2a4ca4afa9a6ffdb54419d

Request headers

Referer
https://msg-msg-login.qznhxvt.bar/
Origin
https://msg-msg-login.qznhxvt.bar
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

X-Ms-Blob-Type
BlockBlob
Date
Mon, 18 Oct 2021 16:36:17 GMT
Content-Encoding
gzip
X-Azure-Ref-Originshield
08HprYQAAAABis6cNIGSpTIcWosz87on9RVdSMzBFREdFMDYxNwAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
Content-Md5
yaGnzAy2fG9pa/VPrbHiYA==
X-Cache
TCP_HIT
Content-Length
104079
X-Ms-Lease-Status
unlocked
Last-Modified
Fri, 10 Sep 2021 21:01:08 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Etag
0x8D9749E1CF3F155
X-Azure-Ref
0gaJtYQAAAABDkrYPDcvXT7K2NElvADHvRVdSMzExMDAwMTEwMDI1ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
X-Ms-Request-Id
1a1b6683-c01e-000f-78ea-c2be6c000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Cache-Control
public, max-age=31536000
Access-Control-Allow-Credentials
true
X-Ms-Version
2009-09-19
oneDs_005362965f8408780df6.js
5y15eftqgj4bem3uy2854jr.qznhxvt.bar/shared/1.0/content/js/ 		62 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://5y15eftqgj4bem3uy2854jr.qznhxvt.bar/shared/1.0/content/js/oneDs_005362965f8408780df6.js
Requested by
Host: 5y15eftqgj4bem3uy2854jr.qznhxvt.bar
URL: https://5y15eftqgj4bem3uy2854jr.qznhxvt.bar/shared/1.0/content/js/ConvergedError_Core_u1Ib0bvyN0cft5v_900-wQ2.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
134.209.209.127 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
b1be136c1f0416e8dc3819bcb9125a3339314bbc8917f6fdc5d169fcd03ff4f5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://msg-msg-login.qznhxvt.bar/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

X-Ms-Blob-Type
BlockBlob
Date
Mon, 18 Oct 2021 16:36:17 GMT
Content-Encoding
gzip
X-Azure-Ref-Originshield
0N9FrYQAAAACfG57WknFcSapx6VpEKWl/RVdSMzBFREdFMDUxNwAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
Content-Md5
3uhC6s1i3bJlze1D6G2nAg==
X-Cache
TCP_HIT
Content-Length
18876
X-Ms-Lease-Status
unlocked
Last-Modified
Wed, 19 May 2021 21:22:41 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Etag
0x8D91B0C3C423BAB
X-Azure-Ref
0gaJtYQAAAABY/1/LNegwTJIhDC3611JORVdSMzExMDAwMTEwMDE3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
X-Ms-Request-Id
dfa4d8e5-201e-0069-73eb-c20642000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Cache-Control
public, max-age=31536000
X-Ms-Version
2009-09-19
check_small_c36fa14790dfc6ca22068a958373c2ba.svg
5y15eftqgj4bem3uy2854jr.qznhxvt.bar/shared/1.0/content/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://5y15eftqgj4bem3uy2854jr.qznhxvt.bar/shared/1.0/content/images/check_small_c36fa14790dfc6ca22068a958373c2ba.svg
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
134.209.209.127 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
22d511adce8d3498f842b05df7281ce582fdc6817fe27606ecd21e72277857f3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://msg-msg-login.qznhxvt.bar/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

X-Ms-Blob-Type
BlockBlob
Date
Mon, 18 Oct 2021 16:36:17 GMT
Content-Encoding
gzip
X-Azure-Ref-Originshield
0p9BrYQAAAAB5f2hWtcxETKdgBgzfLZV7RVdSMzBFREdFMDUwOQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
Content-Md5
iYTzOJM089b1SPwrN/KdOg==
X-Cache
TCP_HIT
Content-Length
1009
X-Ms-Lease-Status
unlocked
Last-Modified
Fri, 24 Jan 2020 23:50:51 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Etag
0x8D7A1283E3AC14D
X-Azure-Ref
0gaJtYQAAAADRaUAbu2GbT5aqtMgup+/GRVdSMzExMDAwMTEwMDI3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
X-Ms-Request-Id
e3c6b063-a01e-0025-8011-c3214a000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Cache-Control
public, max-age=31536000
X-Ms-Version
2009-09-19
close_40eb39126300b56bf66c20ee75b54093.svg
5y15eftqgj4bem3uy2854jr.qznhxvt.bar/shared/1.0/content/images/ 		270 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://5y15eftqgj4bem3uy2854jr.qznhxvt.bar/shared/1.0/content/images/close_40eb39126300b56bf66c20ee75b54093.svg
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
134.209.209.127 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
765709425a5b9209e875dccf2217d3161429d2d48159fc1df7b253b77c1574f4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://msg-msg-login.qznhxvt.bar/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

X-Ms-Blob-Type
BlockBlob
Date
Mon, 18 Oct 2021 16:36:17 GMT
Content-Encoding
gzip
Content-Md5
rp+/fadJKxLUo+jgFmYTeQ==
X-Cache
TCP_HIT
Content-Length
190
X-Ms-Lease-Status
unlocked
Last-Modified
Fri, 17 Jan 2020 19:28:35 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Etag
0x8D79B8372232B84
X-Azure-Ref
0gaJtYQAAAAD9KZM9BaPkSqIbyEbfNsQWRVdSMzBFREdFMDYwNgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
X-Ms-Request-Id
bd115c0c-b01e-0010-1808-c38751000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Cache-Control
public, max-age=31536000
X-Ms-Version
2009-09-19
converged.v2.login.min_lgjnfq3xbrj5zvj5ionvww2.css
5y15eftqgj4bem3uy2854jr.qznhxvt.bar/ests/2.1/content/cdnbundles/ 		0
20 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://5y15eftqgj4bem3uy2854jr.qznhxvt.bar/ests/2.1/content/cdnbundles/converged.v2.login.min_lgjnfq3xbrj5zvj5ionvww2.css
Requested by
Host: msg-msg-login.qznhxvt.bar
URL: https://msg-msg-login.qznhxvt.bar/common/oauth2/v2.0/authorize?
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
134.209.209.127 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://msg-msg-login.qznhxvt.bar/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

X-Ms-Blob-Type
BlockBlob
Date
Mon, 18 Oct 2021 16:36:17 GMT
Content-Encoding
gzip
Content-Md5
mU+G3bfjPvbbh+JW3ypW1g==
X-Cache
TCP_HIT
Content-Length
19835
X-Ms-Lease-Status
unlocked
Last-Modified
Fri, 04 Jun 2021 23:48:31 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Etag
0x8D927B3427B3935
X-Azure-Ref
0gaJtYQAAAAACJ1kHoQCPSZK/7ziKvQtHRVdSMzBFREdFMDYwNwAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
Content-Type
text/css
Access-Control-Allow-Origin
*
X-Ms-Request-Id
aa057b33-701e-0064-1534-c3d959000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Cache-Control
public, max-age=31536000
X-Ms-Version
2009-09-19
ux.converged.error.strings-de.min_t_irfjrfzwnhghzhovwryg2.js
5y15eftqgj4bem3uy2854jr.qznhxvt.bar/ests/2.1/content/cdnbundles/ 		0
9 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://5y15eftqgj4bem3uy2854jr.qznhxvt.bar/ests/2.1/content/cdnbundles/ux.converged.error.strings-de.min_t_irfjrfzwnhghzhovwryg2.js
Requested by
Host: msg-msg-login.qznhxvt.bar
URL: https://msg-msg-login.qznhxvt.bar/common/oauth2/v2.0/authorize?
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
134.209.209.127 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://msg-msg-login.qznhxvt.bar/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

X-Ms-Blob-Type
BlockBlob
Date
Mon, 18 Oct 2021 16:36:17 GMT
Content-Encoding
gzip
X-Azure-Ref-Originshield
0LGhsYQAAAAArsurhjdppRb3sEHfNu5oJRVdSMzBFREdFMDUwOAAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
Content-Md5
vsc/dCMY9tmQrwTmzg23pA==
X-Cache
TCP_HIT
Content-Length
8527
X-Ms-Lease-Status
unlocked
Last-Modified
Sun, 12 Sep 2021 23:13:51 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Etag
0x8D97642FC19AA0C
X-Azure-Ref
0gaJtYQAAAAACY8bJgR7yTpJLpnqspvswRVdSMzExMDAwMTEwMDI5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
X-Ms-Request-Id
140f42bf-b01e-0000-5f40-c33773000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Cache-Control
public, max-age=31536000
X-Ms-Version
2009-09-19
2_bc3d32a696895f78c19df6c717586a5d.svg
5y15eftqgj4bem3uy2854jr.qznhxvt.bar/shared/1.0/content/images/backgrounds/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://5y15eftqgj4bem3uy2854jr.qznhxvt.bar/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
134.209.209.127 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://msg-msg-login.qznhxvt.bar/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

X-Ms-Blob-Type
BlockBlob
Date
Mon, 18 Oct 2021 16:36:17 GMT
Content-Encoding
gzip
X-Azure-Ref-Originshield
0kGprYQAAAADHtKVZrGsCQ5SKDtKn8hJnRVdSMzBFREdFMDYxNwAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
Content-Md5
DhdidjYrlCeaRJJRG/y9mA==
X-Cache
TCP_HIT
Content-Length
673
X-Ms-Lease-Status
unlocked
Last-Modified
Wed, 12 Feb 2020 22:01:30 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Etag
0x8D7B0071D86E386
X-Azure-Ref
0gaJtYQAAAADj9H8x5qojRrSJm2lLGtX/RVdSMzExMDAwMTEwMDM3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
X-Ms-Request-Id
f47efafb-f01e-0090-02eb-c2d004000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Cache-Control
public, max-age=31536000
X-Ms-Version
2009-09-19
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
5y15eftqgj4bem3uy2854jr.qznhxvt.bar/shared/1.0/content/images/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://5y15eftqgj4bem3uy2854jr.qznhxvt.bar/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
134.209.209.127 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://msg-msg-login.qznhxvt.bar/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

X-Ms-Blob-Type
BlockBlob
Date
Mon, 18 Oct 2021 16:36:16 GMT
Content-Encoding
gzip
X-Azure-Ref-Originshield
0k5ptYQAAAABIoAb+/eroR5QbZEKaOZSzRVdSMzBFREdFMDUwNwAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
Content-Md5
nzaLxFgP7ZB3dfMcaybWzw==
X-Cache
TCP_HIT
Content-Length
1435
X-Ms-Lease-Status
unlocked
Last-Modified
Fri, 17 Jan 2020 19:28:38 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Etag
0x8D79B8373CB2849
X-Azure-Ref
0gaJtYQAAAADIy6cQ6yPnSZBzhfpfxBv4RVdSMzExMDAwMTA5MDExADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
X-Ms-Request-Id
b6b68d77-401e-0043-64dd-c39964000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Cache-Control
public, max-age=31536000
X-Ms-Version
2009-09-19
reportpageload
ochsner-ochsner-login.qznhxvt.bar/common/instrumentation/ 		444 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ochsner-ochsner-login.qznhxvt.bar/common/instrumentation/reportpageload?mkt=de-DE
Requested by
Host: 5y15eftqgj4bem3uy2854jr.qznhxvt.bar
URL: https://5y15eftqgj4bem3uy2854jr.qznhxvt.bar/shared/1.0/content/js/ConvergedError_Core_u1Ib0bvyN0cft5v_900-wQ2.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
134.209.209.127 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
91bf33c5aaf6a1de57d32de868b8554764b589e6f0959d7ab5571ae634d037df

Request headers

hpgrequestid
5c68c40c-97ad-49b1-afd4-ed76a0bbfe00
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
client-request-id
3ace0446-77d4-47bf-9426-140edcbec1f7
canary
AQABAAAAAAD--DLA3VO7QrddgJg7WevrtyoXngTTqDA1MtMmq7kTzA0Ez-QooXVpOL2VFA1HkEPyz8m20uOzuH_Xp3ecaTpeoTzxG3gmzOeWfM6hwo1htY-tsXcYDH6uOThNzURo5MXzsnJTV-VHhkEDvgLTpaVjNk0D2ObpdND-mhca7SBT-BrwbjRIxz40YLz62Wy4hArlrm6S-gitLOhw7N-cjztYtIbdjId5YG9ZMdaA5GKn3iAA
Content-type
application/json; charset=UTF-8
hpgid
1117
Accept
application/json
Referer
https://msg-msg-login.qznhxvt.bar/
hpgact
1800

Response headers

Pragma
no-cache
Date
Mon, 18 Oct 2021 16:36:17 GMT
Nel
{"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
Client-Request-Id
3ace0446-77d4-47bf-9426-140edcbec1f7
Access-Control-Allow-Methods
POST, OPTIONS
P3p
CP="DSP CUR OTPi IND OTRi ONL FIN"
Access-Control-Allow-Origin
https://msg-msg-login.qznhxvt.bar
Report-To
{"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+bno"}]}
Cache-Control
no-store, no-cache
Access-Control-Allow-Credentials
true
X-Ms-Request-Id
26c0687d-4ba1-44d1-8835-8db19a820700
Content-Type
application/json; charset=utf-8
Content-Length
444
X-Ms-Ests-Server
2.1.12108.10 - EUS ProdSlices
Expires
-1
reportpageload
ochsner-ochsner-login.qznhxvt.bar/common/instrumentation/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://ochsner-ochsner-login.qznhxvt.bar/common/instrumentation/reportpageload?mkt=de-DE
Protocol
HTTP/1.1
Server
134.209.209.127 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
canary,client-request-id,content-type,hpgact,hpgid,hpgrequestid
Origin
https://msg-msg-login.qznhxvt.bar
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
canary,client-request-id,content-type,hpgact,hpgid,hpgrequestid
Access-Control-Allow-Methods
POST, OPTIONS
Access-Control-Allow-Origin
https://msg-msg-login.qznhxvt.bar
Cache-Control
no-store, no-cache
Content-Length
0
Date
Mon, 18 Oct 2021 16:36:17 GMT
Expires
-1
Nel
{"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
P3p
CP="DSP CUR OTPi IND OTRi ONL FIN"
Pragma
no-cache
Report-To
{"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+bno"}]}
X-Ms-Ests-Server
2.1.12108.11 - SCUS ProdSlices
X-Ms-Request-Id
c4e849ac-7530-43ee-9dcd-e0393d04f100

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B object| ServerData object| webpackJsonp object| ko object| PROOF object| StringRepository boolean| __ConvergedError_Core boolean| __ function| lp object| Telemetry object| telemetry_webpackJsonp function| __assign function| __extends

3 Cookies

Domain/Path Name / Value
msg-msg-login.qznhxvt.bar/ Name: fpc
Value: An0ps1VAbTFGpFKyPf5eNgw
msg-msg-login.qznhxvt.bar/ Name: x-ms-gateway-slice
Value: estsfd
msg-msg-login.qznhxvt.bar/ Name: stsservicecookie
Value: estsfd