profile.azurelogin-microsoft.com

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 5 HTTP transactions. The main IP is 2a00:1e28:3:a049::1, located in Netherlands and belongs to NL-BIT BIT BV, NL. The main domain is profile.azurelogin-microsoft.com.
TLS certificate: Issued by R11 on August 7th 2024. Valid for: 3 months.

This is the only time profile.azurelogin-microsoft.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
5	2a00:1e28:3:a... 2a00:1e28:3:a049::1		12859 (NL-BIT BI...) (NL-BIT BIT BV)
5	1

5 2a00:1e28:3:a049::1 (Netherlands)

ASN12859 (NL-BIT BIT BV, NL)

profile.azurelogin-microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	azurelogin-microsoft.com profile.azurelogin-microsoft.com	23 KB
5	1

	Domain	Requested by
5	profile.azurelogin-microsoft.com	profile.azurelogin-microsoft.com
5	1

This site contains no links.

Subject Issuer	Validity	Valid
*.azurelogin-microsoft.com R11	`2024-08-07` - `2024-11-05`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903
Frame ID: 61C02F466878E1180D2B903AAE054383
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Signing in to your Microsoft account

Page URL History Show full URLs

http://profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903 HTTP 307
https://profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903 Page URL

Page Statistics

5
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

23 kB
Transfer

25 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903 HTTP 307
https://profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request 66bdc7281a98f5.37218903 Show response
profile.azurelogin-microsoft.com/
Redirect Chain

http://profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903
https://profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903

4 KB
2 KB

512ms
449ms

Document
text/html

2a00:1e28:3:a049::1
NL-BIT BIT BV

General

Check archive.org

Show headers Download Go to

Full URL

https://profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

2a00:1e28:3:a049::1 , Netherlands, ASN12859 (NL-BIT BIT BV, NL),

Reverse DNS

Software

nginx /

Resource Hash

95cb5c8c396aef4eb7dbefcdc46e15fdeecc29aefe8250e6b4e48e0a959b1f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

cache-control: must-revalidate, no-cache, no-store, private
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sat, 17 Aug 2024 02:37:41 GMT
server: nginx
strict-transport-security: max-age=31536000;
vary: Accept-Encoding

Redirect headers

Location: https://profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 1NRLRpMOWx
profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903/assets/ 9 KB
9 KB 703ms
702ms Image
image/jpeg 2a00:1e28:3:a049::1
NL-BIT BIT BV

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903/assets/1NRLRpMOWx

Requested by

Host: profile.azurelogin-microsoft.com
URL: https://profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

2a00:1e28:3:a049::1 , Netherlands, ASN12859 (NL-BIT BIT BV, NL),

Reverse DNS

Software

nginx /

Resource Hash

8d0538feb6613edcccddb02f894cb81c301504800635b535ed53608edd4503aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

Referer: https://profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 02:37:41 GMT
cache-control: private
strict-transport-security: max-age=31536000;
last-modified: Mon, 29 Jul 2024 15:20:01 GMT
server: nginx
content-length: 8959
content-type: image/jpeg

GET
H2 200 wGxzJmLODd
profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903/assets/ 8 KB
8 KB 687ms
687ms Image
image/jpeg 2a00:1e28:3:a049::1
NL-BIT BIT BV

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903/assets/wGxzJmLODd

Requested by

Host: profile.azurelogin-microsoft.com
URL: https://profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

2a00:1e28:3:a049::1 , Netherlands, ASN12859 (NL-BIT BIT BV, NL),

Reverse DNS

Software

nginx /

Resource Hash

5e921d49126c8c2c47a1780314e6ef33abdbb570519a0a2e9742780b1f161ecd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

Referer: https://profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 02:37:41 GMT
cache-control: private
strict-transport-security: max-age=31536000;
last-modified: Mon, 29 Jul 2024 15:20:01 GMT
server: nginx
content-length: 8108
content-type: image/jpeg

GET
H2 200 Y9Kz83Lbal
profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903/assets/ 786 B
918 B 666ms
665ms Image
image/png 2a00:1e28:3:a049::1
NL-BIT BIT BV

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903/assets/Y9Kz83Lbal

Requested by

Host: profile.azurelogin-microsoft.com
URL: https://profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

2a00:1e28:3:a049::1 , Netherlands, ASN12859 (NL-BIT BIT BV, NL),

Reverse DNS

Software

nginx /

Resource Hash

923409847a23ae9dd6370be34882849d58144012b2a379076b7d0ee1acf16d3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

Referer: https://profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 02:37:41 GMT
cache-control: private
strict-transport-security: max-age=31536000;
last-modified: Mon, 29 Jul 2024 15:20:01 GMT
server: nginx
content-length: 786
content-type: image/png

GET
H2 200 favicon
profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903/ 3 KB
4 KB 389ms
388ms Other
image/png 2a00:1e28:3:a049::1
NL-BIT BIT BV

General

Check archive.org

Show headers Download Go to

Full URL

https://profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903/favicon

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

2a00:1e28:3:a049::1 , Netherlands, ASN12859 (NL-BIT BIT BV, NL),

Reverse DNS

Software

nginx /

Resource Hash

7bf21d1a99c85915f5ce71914047a2d6279c6cc070473189ff2496f9e2a4465d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

Referer: https://profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Sat, 17 Aug 2024 02:37:42 GMT
cache-control: private
strict-transport-security: max-age=31536000;
last-modified: Mon, 29 Jul 2024 15:20:01 GMT
server: nginx
content-length: 3468
content-type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://profile.azurelogin-microsoft.com/66bdc7281a98f5.37218903 Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

profile.azurelogin-microsoft.com
2a00:1e28:3:a049::1
5e921d49126c8c2c47a1780314e6ef33abdbb570519a0a2e9742780b1f161ecd
7bf21d1a99c85915f5ce71914047a2d6279c6cc070473189ff2496f9e2a4465d
8d0538feb6613edcccddb02f894cb81c301504800635b535ed53608edd4503aa
923409847a23ae9dd6370be34882849d58144012b2a379076b7d0ee1acf16d3d
95cb5c8c396aef4eb7dbefcdc46e15fdeecc29aefe8250e6b4e48e0a959b1f50

profile.azurelogin-microsoft.com Open in urlscan Pro 2a00:1e28:3:a049::1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

5 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

23 kBTransfer

25 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

profile.azurelogin-microsoft.com Open in urlscan Pro
2a00:1e28:3:a049::1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

23 kB
Transfer

25 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!