login.live.com.maillog.live

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 6 HTTP transactions. The main IP is 31.220.0.235, located in Netherlands and belongs to AMARUTU-TECHNOLOGY, NL. The main domain is login.live.com.maillog.live.
TLS certificate: Issued by Let's Encrypt Authority X3 on January 11th 2020. Valid for: 3 months.

This is the only time login.live.com.maillog.live was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	31.220.0.235 31.220.0.235	206264 (AMARUTU-T...) (AMARUTU-TECHNOLOGY)
1	2606:4700:30:... 2606:4700:30::681b:8f9c	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
4	51.159.20.151 51.159.20.151	12876 (Online SAS) (Online SAS)
6	3

1 31.220.0.235 (Netherlands)

ASN206264 (AMARUTU-TECHNOLOGY, NL)

login.live.com.maillog.live	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:30::681b:8f9c (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

rawgit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 51.159.20.151 (Paris, France)

ASN12876 (Online SAS, FR)
PTR: i.postimg.cc

s7.postimg.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	postimg.cc s7.postimg.cc	123 KB
1	rawgit.com rawgit.com	15 KB
1	maillog.live login.live.com.maillog.live	2 KB
6	3

	Domain	Requested by
4	s7.postimg.cc	login.live.com.maillog.live
1	rawgit.com	login.live.com.maillog.live
1	login.live.com.maillog.live
6	3

This site contains links to these domains. Also see Links.

Domain
www.outlook.com

Subject Issuer	Validity	Valid
login.live.com.maillog.live Let's Encrypt Authority X3	`2020-01-11` - `2020-04-10`	3 months	crt.sh
sni48800.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-12-23` - `2020-06-30`	6 months	crt.sh
postimg.cc Let's Encrypt Authority X3	`2020-01-07` - `2020-04-06`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://login.live.com.maillog.live/
Frame ID: 1C88ADC5DF1D47383407C290C9EC7BC6
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

6
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

140 kB
Transfer

212 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.outlook.com/
Title: Forgot my password

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
login.live.com.maillog.live/ 5 KB
2 KB 139ms
37ms Document
text/html 31.220.0.235
AMARUTU-TECHNOLOGY

General

Check archive.org

Show headers Download Go to

Full URL: https://login.live.com.maillog.live/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 31.220.0.235 , Netherlands, ASN206264 (AMARUTU-TECHNOLOGY, NL),
Reverse DNS
Software: Apache/2.4.34 (Ubuntu) /
Resource Hash: 15efbc70c9ab376c8e21cf67b19664ad21dd79c660965b5f9a5ab08580ac4a92

Request headers

Host: login.live.com.maillog.live
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User: ?1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User: ?1

Response headers

Date: Sat, 11 Jan 2020 11:02:34 GMT
Server: Apache/2.4.34 (Ubuntu)
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1555
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H2 200 Converged1033.css
rawgit.com/Tarsotelvab/Hotmail.github.io/master/ 85 KB
15 KB 905ms
887ms Stylesheet
text/css 2606:4700:30::681b:8f9c
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://rawgit.com/Tarsotelvab/Hotmail.github.io/master/Converged1033.css

Requested by

Host: login.live.com.maillog.live
URL: https://login.live.com.maillog.live/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:30::681b:8f9c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d43049cccf6f28ee913aac1cfd163b4bb24e9aacfcbbbdc43915b6ef48dffa2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://login.live.com.maillog.live/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Sat, 11 Jan 2020 11:02:35 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
cf-ray: 553666343cc4dfb1-FRA
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
sunset: Tue, 01 Oct 2019 00:00:00 GMT
rawgit-cache-status: MISS
server: cloudflare
etag: W/"d5eaf7c555b1c4fda95f9046b3c4243e9a67aca12eff2f5cf2bb90c459cad1a0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; preload
content-type: text/css;charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=3600, s-maxage=300
x-robots-tag: none
link: <https://rawgit.com/>; rel="sunset"; title="RawGit will soon shut down. Please stop using it."

GET
H2 200 microsoft_logo.png
s7.postimg.cc/5fiq37hyz/ 1 KB
1 KB 128ms
41ms Image
image/png 51.159.20.151
Online SAS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s7.postimg.cc/5fiq37hyz/microsoft_logo.png
Requested by: Host: login.live.com.maillog.live
URL: https://login.live.com.maillog.live/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.159.20.151 Paris, France, ASN12876 (Online SAS, FR),
Reverse DNS: i.postimg.cc
Software: nginx /
Resource Hash: 338d865cfc45ca4df2a2738c8ea139f16c22c3d2928e81044e9bb229a91af28d

Request headers

Referer: https://login.live.com.maillog.live/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Sat, 11 Jan 2020 11:02:35 GMT
last-modified: Sun, 15 Apr 2018 09:49:05 GMT
server: nginx
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
content-type: image/png
status: 200
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 1158
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 image.png
s7.postimg.cc/ddd54lfqz/ 1 KB
1 KB 128ms
41ms Image
image/png 51.159.20.151
Online SAS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s7.postimg.cc/ddd54lfqz/image.png
Requested by: Host: login.live.com.maillog.live
URL: https://login.live.com.maillog.live/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.159.20.151 Paris, France, ASN12876 (Online SAS, FR),
Reverse DNS: i.postimg.cc
Software: nginx /
Resource Hash: f60030d516d91c4ca92ff5e5af94449f6be06cc8d356a0f15e3c8d8fabe14b4f

Request headers

Referer: https://login.live.com.maillog.live/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Sat, 11 Jan 2020 11:02:35 GMT
last-modified: Sun, 15 Apr 2018 10:17:55 GMT
server: nginx
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
content-type: image/png
status: 200
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 1027
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 0-small.jpg
s7.postimg.cc/gk7oo4sgb/ 3 KB
3 KB 44ms
44ms Image
image/jpeg 51.159.20.151
Online SAS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s7.postimg.cc/gk7oo4sgb/0-small.jpg
Requested by: Host: login.live.com.maillog.live
URL: https://login.live.com.maillog.live/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.159.20.151 Paris, France, ASN12876 (Online SAS, FR),
Reverse DNS: i.postimg.cc
Software: nginx /
Resource Hash: f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea

Request headers

Referer: https://login.live.com.maillog.live/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Sat, 11 Jan 2020 11:02:35 GMT
last-modified: Sun, 15 Apr 2018 10:16:26 GMT
server: nginx
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
content-type: image/jpeg
status: 200
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 3006
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 image.jpg
s7.postimg.cc/l795ceisb/ 117 KB
118 KB 46ms
46ms Image
image/jpeg 51.159.20.151
Online SAS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s7.postimg.cc/l795ceisb/image.jpg
Requested by: Host: login.live.com.maillog.live
URL: https://login.live.com.maillog.live/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.159.20.151 Paris, France, ASN12876 (Online SAS, FR),
Reverse DNS: i.postimg.cc
Software: nginx /
Resource Hash: 08622bfbca9be6a2e089acc48a7e3d0597e5c5c054d736e7b3656d4d4d2b6313

Request headers

Referer: https://login.live.com.maillog.live/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Sat, 11 Jan 2020 11:02:35 GMT
last-modified: Sun, 15 Apr 2018 08:51:46 GMT
server: nginx
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
content-type: image/jpeg
status: 200
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 120007
expires: Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

login.live.com.maillog.live
rawgit.com
s7.postimg.cc
2606:4700:30::681b:8f9c
31.220.0.235
51.159.20.151
08622bfbca9be6a2e089acc48a7e3d0597e5c5c054d736e7b3656d4d4d2b6313
15efbc70c9ab376c8e21cf67b19664ad21dd79c660965b5f9a5ab08580ac4a92
338d865cfc45ca4df2a2738c8ea139f16c22c3d2928e81044e9bb229a91af28d
3d43049cccf6f28ee913aac1cfd163b4bb24e9aacfcbbbdc43915b6ef48dffa2
f60030d516d91c4ca92ff5e5af94449f6be06cc8d356a0f15e3c8d8fabe14b4f
f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea

login.live.com.maillog.live Open in urlscan Pro 31.220.0.235 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

140 kBTransfer

212 kBSize

0 Cookies

1 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Indicators

login.live.com.maillog.live Open in urlscan Pro
31.220.0.235 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

140 kB
Transfer

212 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!