https-login-rnicrosotfonline-corn-accounts.underamourageinc.com
Open in
urlscan Pro
107.180.1.236
Malicious Activity!
Public Scan
URL:
http://https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/secured=865rgfewiukjgfdkjvcugiu932t29r93t7gdtoqiudiuA879E123FEDYFR87RYFY787fr87r87iygfe79rt7iudt...
Submission: On May 03 via automatic, source openphish
Submission: On May 03 via automatic, source openphish
Summary
This website contacted 8 IPs
in 4 countries
across 8 domains to perform 60 HTTP transactions.
The main IP is 107.180.1.236, located in
Scottsdale, United States and
belongs to AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US.
The main domain is https-login-rnicrosotfonline-corn-accounts.underamourageinc.com.
This is the only time https-login-rnicrosotfonline-corn-accounts.underamourageinc.com was scanned on urlscan.io!
This is the only time https-login-rnicrosotfonline-corn-accounts.underamourageinc.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 25 | 107.180.1.236 107.180.1.236 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
| 4 | 184.25.158.226 184.25.158.226 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 2 | 2.20.23.219 2.20.23.219 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 12 | 184.30.211.228 184.30.211.228 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 5 | 2.16.186.25 2.16.186.25 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 1 | 40.127.129.109 40.127.129.109 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
| 7 | 2.18.232.137 2.18.232.137 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
| 4 | 45.40.130.22 45.40.130.22 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
| 60 | 8 |
25
107.180.1.236
(Scottsdale, United States)
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-107-180-1-236.ip.secureserver.net
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-107-180-1-236.ip.secureserver.net
| https-login-rnicrosotfonline-corn-accounts.underamourageinc.com |
4
184.25.158.226
(Amsterdam, Netherlands)
ASN20940 (AKAMAI-ASN1, US)
PTR: a184-25-158-226.deploy.static.akamaitechnologies.com
ASN20940 (AKAMAI-ASN1, US)
PTR: a184-25-158-226.deploy.static.akamaitechnologies.com
| img1.wsimg.com |
12
184.30.211.228
(Amsterdam, Netherlands)
ASN20940 (AKAMAI-ASN1, US)
PTR: a184-30-211-228.deploy.static.akamaitechnologies.com
ASN20940 (AKAMAI-ASN1, US)
PTR: a184-30-211-228.deploy.static.akamaitechnologies.com
| eusofficehome.msocdn.com |
5
2.16.186.25
(European Union)
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-25.deploy.akamaitechnologies.com
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-25.deploy.akamaitechnologies.com
| spoprod-a.akamaihd.net |
1
40.127.129.109
(Dublin, Ireland)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
| browser.pipe.aria.microsoft.com |
7
2.18.232.137
(European Union)
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
| r4.res.office365.com |
4
45.40.130.22
(Scottsdale, United States)
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-45-40-130-22.ip.secureserver.net
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-45-40-130-22.ip.secureserver.net
| img.secureserver.net |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 25 |
underamourageinc.com
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com |
1 MB |
| 12 |
msocdn.com
eusofficehome.msocdn.com |
618 KB |
| 7 |
office365.com
r4.res.office365.com |
703 KB |
| 5 |
akamaihd.net
spoprod-a.akamaihd.net |
383 KB |
| 4 |
secureserver.net
img.secureserver.net |
2 KB |
| 4 |
wsimg.com
img1.wsimg.com |
5 KB |
| 2 |
microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com |
280 KB |
| 1 |
microsoft.com
browser.pipe.aria.microsoft.com |
396 B |
| 60 | 8 |
| Domain | Requested by | |
|---|---|---|
| 25 | https-login-rnicrosotfonline-corn-accounts.underamourageinc.com |
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com
|
| 12 | eusofficehome.msocdn.com |
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com
|
| 7 | r4.res.office365.com |
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com
|
| 5 | spoprod-a.akamaihd.net |
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com
|
| 4 | img.secureserver.net | |
| 4 | img1.wsimg.com |
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com
|
| 2 | secure.aadcdn.microsoftonline-p.com |
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com
|
| 1 | browser.pipe.aria.microsoft.com |
spoprod-a.akamaihd.net
|
| 60 | 8 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| passwordreset.microsoftonline.com |
| www.microsoft.com |
| privacy.microsoft.com |
| login.microsoftonline.com |
| Subject Issuer | Validity | Valid |
|---|
This page contains 4 frames:
Primary Page:
http://https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/secured=865rgfewiukjgfdkjvcugiu932t29r93t7gdtoqiudiuA879E123FEDYFR87RYFY787fr87r87iygfe79rt7iudtiustr879tri3gd87t738gg8787cf87fr387r38f78cfr87r28728re8fxf8cf8r289re827f87fc8r32ffcifasia/index8.php?login=eleccompeng@uab.edu
Frame ID: 43E1C4F5C0BA12AB4ED72E2FFB3A0373
Requests: 12 HTTP requests in this frame
Frame:
http://https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/prefetch.html
Frame ID: BE482C896E858275E3F617D55F0EC302
Requests: 17 HTTP requests in this frame
Frame:
http://https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/prefetch(1).html
Frame ID: 8877E408135FB44086B5E37E997403B0
Requests: 17 HTTP requests in this frame
Frame:
http://https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/share.html
Frame ID: 568542F60A6E963A948EEA405305DAD2
Requests: 14 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
webpack
(Miscellaneous)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- env /^webpackJsonp$/i
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
URL: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQIIAXWRO2_TUACF47yUIlQqFhg7MCE5uX7mIVUozcNxEzu248S1Jajc5Dp2iH0d56YmGfgNhQkqsbAgZUCICSohMQchdWZmQEyIATGS_gCWMx19Ojrf_RSVpyr3WIbl7OJpmSzbPEOyZQqQNkvzJMMxPEMDasQBJrp9Y-8r-PTw6nO99uxp7vvzzduXa-KOi3E4rxQKcRznkeN4Q5gfIr_wgSCuCOIHQVwkMzAg-711cs4zPA_KHMXyPFvaUosgLxsqLenuRKb7WDLUWF4CIK9EqqOPWUvvY2tiPZZ1eSoZJmsZEtXVTcZcNX2prmJJ0CbdHgCSIPsdowEk38SmIU-6eoOVdZXa8thvyVvd6gK79HWgyFvB38kdB0X-SYjm-CL1huiGMBBHNRQEcIjz1zUYYG9oYw8FSoRCGGEPzg8cJYaDo1gIpeHZQlUGhl8timhYpElNOFxFfEMxq4rkK3bPaKkUd6JbdA8MSjScIq7daZvTMFbKA3dOU8tB19FkoYg9UmvaTieCSxO48ThkbHs2do9F1YuU2RNajNqlIj9jlcCFsfA-ld3e6qNgk9rdjgq80X4YIcebwqs08TN9E6QquVx2j7ib2E_8TROvM1tbf6C-fvHukfjx8sEX9Go3sckUzpoSFiTHmkxOj1Ylr6fVAq01Wwh1a9Eam-NDR-N0sR0Gx_X-AVWhzrPEeTb7K5u43Pmf6H81&mkt=en-US&hosted=0&device_platform=Windows+7
Title: Forgot my password
Title: Forgot my password
Search URL Search Domain Scan URL
URL: https://www.microsoft.com/en-US/servicesagreement/
Title: Terms of use
Title: Terms of use
Search URL Search Domain Scan URL
URL: https://privacy.microsoft.com/en-US/privacystatement
Title: Privacy & cookies
Title: Privacy & cookies
Search URL Search Domain Scan URL
URL: https://login.microsoftonline.com/common/oauth2/authorize?client_id=4345a7b9-9a63-4910-a426-35363201d503&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%3dfPweVJwGpMcvuQPVWmA7Ioc72-RGBzr6EPYAPMmPaSWHQ15_TZ2S0V82elo5KLKYlpwP9Vhs21yVOfRNG7ti-RFafLreyY0hwgp3aaqghXIQirPqx2IrK876q4PnhewG&nonce=636609514664820170.NWQ2MThjN2UtMWQwNy00NzI1LTg4ZTUtZjZkNTNlMWY4ZWM1OTY3YzFmMDQtMGRjOS00MGNmLWE0MmYtYWNjOTE4NTQ1MWQ4&redirect_uri=https%3a%2f%2fwww.office.com%2f&ui_locales=en-US&mkt=en-US&client-request-id=5dbd30cd-c0d0-4344-917e-08e492caae99
Title:
Title:
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
60 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
index8.php
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/secured=865rgfewiukjgfdkjvcugiu932t29r93t7gdtoqiudiuA879E123FEDYFR87RYFY787fr87r87iygfe79rt7iudtiustr879tri3gd87t738gg8787cf87fr387r3... |
34 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
converged.login.min.css
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ |
87 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
convergedlogin_pcore.min.js.download
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ |
447 KB 120 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
convergedloginpaginatedstrings-en.min.js.download
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ |
15 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
microsoft_logo.svg
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
picker_account_aad.svg
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ |
756 B 729 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ellipsis_white.svg
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ |
915 B 598 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ellipsis_grey.svg
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ |
915 B 598 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
tcc_l.combined.1.0.6.min.js
img1.wsimg.com/tcc/ |
12 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
0.jpg
secure.aadcdn.microsoftonline-p.com/ests/2.1.7527.10/content/images/backgrounds/ |
277 KB 277 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
0-small.jpg
secure.aadcdn.microsoftonline-p.com/ests/2.1.7527.10/content/images/backgrounds/ |
3 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
prefetch.html
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ Frame BE48 |
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sharedFontStyles.css
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ Frame BE48 |
79 KB 58 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
staticStylesFluent.css
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ Frame BE48 |
43 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
tcc_l.combined.1.0.6.min.js
img1.wsimg.com/tcc/ Frame BE48 |
12 KB 0 |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headersResponse headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
polyfills-bundle.js
eusofficehome.msocdn.com/s/f5628679/Areas/Home/Content/js/build/bundles/ Frame BE48 |
117 KB 36 KB |
Other
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
vendor-bundle.js
eusofficehome.msocdn.com/s/93d09df5/Areas/Home/Content/js/build/bundles/ Frame BE48 |
1 MB 283 KB |
Other
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
staticScripts.js
eusofficehome.msocdn.com/s/60786b99/Areas/Home/Content/js/build/bundles/ Frame BE48 |
4 KB 2 KB |
Other
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
sharedScripts.js
eusofficehome.msocdn.com/s/6be72975/Areas/Home/Content/js/build/bundles/ Frame BE48 |
3 KB 1 KB |
Other
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
app-bundle.js
eusofficehome.msocdn.com/s/f88c48fd/Areas/Home/Content/js/build/bundles/ Frame BE48 |
837 KB 185 KB |
Other
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
react-bundle.js
eusofficehome.msocdn.com/s/7c18fcc8/Areas/Home/Content/js/build/bundles/ Frame BE48 |
141 KB 44 KB |
Other
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
favicon-word.ico
eusofficehome.msocdn.com/s/9471c196/Areas/Home/Content/images/favicons/ Frame BE48 |
9 KB 9 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
favicon-excel.ico
eusofficehome.msocdn.com/s/746cbc9f/Areas/Home/Content/images/favicons/ Frame BE48 |
9 KB 9 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
favicon-powerpoint.ico
eusofficehome.msocdn.com/s/b39fe91f/Areas/Home/Content/images/favicons/ Frame BE48 |
9 KB 9 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
header-default-desktop.svg
eusofficehome.msocdn.com/s/c3caee40/Areas/Home/Content/images/fluent-background-sources/ Frame BE48 |
8 KB 2 KB |
Other
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
document-sprite.png
eusofficehome.msocdn.com/s/fab5fe9a/Areas/Home/Content/images/ Frame BE48 |
18 KB 19 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
zero-docs-sprite.png
eusofficehome.msocdn.com/s/398b5c2a/Areas/Home/Content/images/ Frame BE48 |
18 KB 18 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
prefetch(1).html
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ Frame 8877 |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
share.html
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ Frame 5685 |
235 KB 37 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
boot.worldwide.0.mouse.js.download
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ Frame 8877 |
646 KB 176 KB |
Stylesheet
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
boot.worldwide.1.mouse.js.download
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ Frame 8877 |
641 KB 159 KB |
Stylesheet
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
boot.worldwide.2.mouse.js.download
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ Frame 8877 |
644 KB 165 KB |
Stylesheet
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
boot.worldwide.3.mouse.js.download
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ Frame 8877 |
640 KB 142 KB |
Stylesheet
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sprite1.mouse.png
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ Frame 8877 |
16 KB 17 KB |
Stylesheet
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sprite1.mouse.css
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ Frame 8877 |
7 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
boot.worldwide.mouse.css
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ Frame 8877 |
227 KB 44 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
tcc_l.combined.1.0.6.min.js
img1.wsimg.com/tcc/ Frame 8877 |
12 KB 0 |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headersResponse headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
odbshare-cc37ac6d.js.download
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ Frame 5685 |
1 MB 301 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
knockout-a15d5510.js.download
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ Frame 5685 |
64 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
odbshare.resx-b3f9085d.js.download
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ Frame 5685 |
55 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
react-dd469c13.js.download
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ Frame 5685 |
96 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
aria-0125b877.js.download
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/files/ Frame 5685 |
51 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
tcc_l.combined.1.0.6.min.js
img1.wsimg.com/tcc/ Frame 5685 |
12 KB 0 |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headersResponse headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
odbshare-cc37ac6d.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-04-27_20180430.002/ Frame 5685 |
1 MB 302 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
knockout-a15d5510.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-04-27_20180430.002/ Frame 5685 |
64 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
odbshare.resx-b3f9085d.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-04-27_20180430.002/en-us/ Frame 5685 |
55 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
react-dd469c13.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-04-27_20180430.002/ Frame 5685 |
96 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
aria-0125b877.js
spoprod-a.akamaihd.net/files/odsp-next-prod_2018-04-27_20180430.002/ Frame 5685 |
51 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
/
browser.pipe.aria.microsoft.com/Collector/3.0/ Frame 5685 |
0 396 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
boot.worldwide.0.mouse.js
r4.res.office365.com/owa/prem/16.2279.14.2549832/scripts/ Frame 8877 |
646 KB 176 KB |
Stylesheet
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
boot.worldwide.1.mouse.js
r4.res.office365.com/owa/prem/16.2279.14.2549832/scripts/ Frame 8877 |
641 KB 158 KB |
Stylesheet
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
boot.worldwide.2.mouse.js
r4.res.office365.com/owa/prem/16.2279.14.2549832/scripts/ Frame 8877 |
644 KB 165 KB |
Stylesheet
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
event
img.secureserver.net/t/1/tl/ Frame 8877 |
43 B 634 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
boot.worldwide.3.mouse.js
r4.res.office365.com/owa/prem/16.2279.14.2549832/scripts/ Frame 8877 |
640 KB 142 KB |
Stylesheet
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
sprite1.mouse.png
r4.res.office365.com/owa/prem/16.2279.14.2549832/resources/images/0/ Frame 8877 |
16 KB 16 KB |
Stylesheet
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
sprite1.mouse.css
r4.res.office365.com/owa/prem/16.2279.14.2549832/resources/images/0/ Frame 8877 |
7 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
boot.worldwide.mouse.css
r4.res.office365.com/owa/prem/16.2279.14.2549832/resources/styles/0/ Frame 8877 |
227 KB 44 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
event
img.secureserver.net/t/1/tl/ Frame 5685 |
43 B 634 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
event
img.secureserver.net/t/1/tl/ Frame BE48 |
43 B 634 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
event
img.secureserver.net/t/1/tl/ |
43 B 634 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| webpackJsonp object| StringRepository boolean| __ boolean| __TestHooks object| _trfd function| tcg function| tcp object| perfhandler object| TCCTracker object| _trfq object| true3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/ | Name: OWAPF Value: p:undefined11111111& |
|
| https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/ | Name: _tccl_visit Value: 1f50b548-4084-4846-a099-0d7a3bdb6925 |
|
| https-login-rnicrosotfonline-corn-accounts.underamourageinc.com/ | Name: _tccl_visitor Value: 1f50b548-4084-4846-a099-0d7a3bdb6925 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
browser.pipe.aria.microsoft.com
eusofficehome.msocdn.com
https-login-rnicrosotfonline-corn-accounts.underamourageinc.com
img.secureserver.net
img1.wsimg.com
r4.res.office365.com
secure.aadcdn.microsoftonline-p.com
spoprod-a.akamaihd.net
107.180.1.236
184.25.158.226
184.30.211.228
2.16.186.25
2.18.232.137
2.20.23.219
40.127.129.109
45.40.130.22
0365a3907c20a89c185786deb53076a06d0c823926153a46d534359e05b3fd94
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
086bb6270c0383ecd13185ba48c9056f6a3aacb13d0709cf61a50a19b2271802
0aa2143c948bb947dcac8b1c47bc0f16a4bec32825fa313070d8e0e2a20a26e9
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6
1d1f9c2b8dcddc64a768b20bdec8217a044c3f14681fc80f79f5f9ad581a9e44
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
2674fdad0880a62489486ad861286a0be279ea8bac9940dc1f761714d021e70b
30746f2e901cf1253e4aeb54d99ccbba59fa6b1a13b41b8366bfee4f8184d064
3b6f9c8ea122edb64e0edfff5ce48706168ded7595c1391e58b4e3a13e058e3a
461f87e55bba34c4d9248d1b45685ea832eba56c15ebf6cccf75d49f1547b502
4c1ff822a902896e29ac61dee0cf044764666f4720663087922385a09d70feaa
536454cc5700583ce7d02dbf3ac02427311323c27ee5921ce9b6029980c1101f
5abb9a01b65115dbaa94818b9300ce5e5f138d39dcecd226fec7a88ff3906ecd
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
5fe58a0dd27f7dee8bace062c7dc10f08b6ae2cd24441abe30aee2f8f6458dfa
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
62897252377f666f1db89c07e97584913fb9c5af886068a84fc510fc61f7a55e
7c056a14f61b34f20579e2fbd2a5e7577bbbccfac8cef1f41d7e67a66333c82a
7c2003a0efba58160fc1da74440a34d9e400feefb580009b737103faad7ac7df
86cd2e6ffc623449cfcb93fdb4a4fd26149421261bbc2f5e7241d9383a874b52
8a07afe2a10b42a0bb217aa9adacd398ab405c0b58378a82ef73b65e114e3a89
8edb5bf48694095076cab2e06983cbafb2c89b3ad61cc62d4a1f24ae4a7a40fa
91bee57ccffd4cac0c2546ad46dc50506d3b5f8d88c7c0d997cc8efa528b25ec
969aeeac43273cf108f02e6a54aaf99d351acd586e762e3d8be373e5786bede7
97e5647b650796446770ec9d89bbc494df876f43738d8100239a7d2d6558f1c0
99190cfe65f919edb8071d84eee7096ec27561bc9b9fa396e55e0eb5e2cd0194
9ed15518f9a5f3fffe3971f82ff00ab32f8802c814d8f1f39509dcf540388f16
9f8b2178ac79760c6635892bb381e6e497f4214453d9ad20c27b38e3eb81f7b4
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a82f0d2e3ef0e9024e52d101923698a6d1f062d33ad2b86669e588af6eed5fac
aa5c1ec4d2ea00eb517eadeb3b65e55b577b7a5ed42d7c2611d15d9050c18350
af4ba533e37c3dcf4b631432e8aba48550d7581a9e1836cad9d4c2f71c6d9de0
b9dcae41c6bc9c5ce3aa93a1802433c73dfc63bc9b4a7441d2e9bf60abebef81
c1cf4335a4db11c80dc2dd5e8b470dc9d816176d8a8550ffe35d999f44d6e3a6
e2d8feba95501becf7c7cc3c8b5b37d5cdda7e679077fa2bb3faec0a6019313c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e492a3840772310773cdc98580be724c1a4028051dbeb8cc821f603a33e59f7c
f83b004ae88521cb7542a6dbf9ae959e5b25832760780e5641ec5388ed68e411
f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea
fb27159dcd171ff7f4897350b69d9acfea592969783922a1882b82862073c16e
ff153606f4760571a97cd5d9f87f93d51a747400e4e9c1eb0495e50229100b23