confirm-your-accounts-531.ml Open in urlscan Pro
159.69.13.246  Malicious Activity! Public Scan

4 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request reprocesse5fe.html Show response confirm-your-accounts-531.ml/House/office/login.microsoftonline.com/common/	48 KB 48 KB	4ms 4ms	Document text/html	159.69.13.246 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL http://confirm-your-accounts-531.ml/House/office/login.microsoftonline.com/common/reprocesse5fe.html Protocol HTTP/1.1 Server 159.69.13.246 Jacksonville, United States, ASN24940 (HETZNER-AS, DE), Reverse DNS static.246.13.69.159.clients.your-server.de Software Apache / Resource Hash 255f9206d3751ce3815555101838cdb3d09f986f9e6e8e3e5be0fe29a37df77f Request headers Host confirm-your-accounts-531.ml Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 X-DevTools-Emulate-Network-Conditions-Client-Id FDB5AF2E0AE5B2580D5594542B7039D3 Response headers Date Fri, 22 Jun 2018 05:27:04 GMT Server Apache Last-Modified Tue, 14 Nov 2017 14:50:38 GMT Accept-Ranges bytes Content-Length 49288 Keep-Alive timeout=5, max=99 Connection Keep-Alive Content-Type text/html
GET H/1.1	200 OK	login.min.css secure.aadcdn.microsoftonline-p.com/ests/2.1.6832.14/content/cdnbundles/	23 KB 5 KB	27ms 6ms	Stylesheet text/css	2a02:26f0:6c00:2bf::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6832.14/content/cdnbundles/login.min.css Requested by Host: confirm-your-accounts-531.ml URL: http://confirm-your-accounts-531.ml/House/office/login.microsoftonline.com/common/reprocesse5fe.html Protocol HTTP/1.1 Server 2a02:26f0:6c00:2bf::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash 794a3e7ac5b0b61344702fd93fef4eb4cd794df080d909a90a05d62efdd21957 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer http://confirm-your-accounts-531.ml/House/office/login.microsoftonline.com/common/reprocesse5fe.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Response headers Date Fri, 22 Jun 2018 05:27:04 GMT Content-Encoding gzip Last-Modified Fri, 10 Nov 2017 23:19:37 GMT Content-MD5 gEbF+HJAoFe7UHLivU1AVQ== Vary Accept-Encoding Connection keep-alive Content-Type text/css Access-Control-Allow-Origin * Cache-Control public, max-age=602570 Strict-Transport-Security max-age=31536000 Content-Length 5187
GET H/1.1	200 OK	jquery.1.11.min.js Show response secure.aadcdn.microsoftonline-p.com/ests/2.1.6832.14/content/cdnbundles/	108 KB 38 KB	27ms 6ms	Script application/x-javascript	2a02:26f0:6c00:2bf::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6832.14/content/cdnbundles/jquery.1.11.min.js Requested by Host: confirm-your-accounts-531.ml URL: http://confirm-your-accounts-531.ml/House/office/login.microsoftonline.com/common/reprocesse5fe.html Protocol HTTP/1.1 Server 2a02:26f0:6c00:2bf::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash 080ff245615e719959bc5537e164ac4495c4b8036462dfee2076dd92f22c8491 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Referer http://confirm-your-accounts-531.ml/House/office/login.microsoftonline.com/common/reprocesse5fe.html Origin http://confirm-your-accounts-531.ml Response headers Date Fri, 22 Jun 2018 05:27:04 GMT Content-Encoding gzip Last-Modified Fri, 10 Nov 2017 23:19:37 GMT Content-MD5 uh+HH+n7/grQTOu2+tsxCg== Vary Accept-Encoding Connection keep-alive Content-Type application/x-javascript Access-Control-Allow-Origin * Cache-Control public, max-age=602570 Strict-Transport-Security max-age=31536000 Content-Length 38473
GET H/1.1	200 OK	aad.login.min.js Show response secure.aadcdn.microsoftonline-p.com/ests/2.1.6832.14/content/cdnbundles/	173 KB 42 KB	27ms 6ms	Script application/x-javascript	2a02:26f0:6c00:2bf::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6832.14/content/cdnbundles/aad.login.min.js Requested by Host: confirm-your-accounts-531.ml URL: http://confirm-your-accounts-531.ml/House/office/login.microsoftonline.com/common/reprocesse5fe.html Protocol HTTP/1.1 Server 2a02:26f0:6c00:2bf::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash 95e1d4f316481b6f3c59aa3d2497f093392bf7c979efb527c7eaae6dbd3dc001 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Referer http://confirm-your-accounts-531.ml/House/office/login.microsoftonline.com/common/reprocesse5fe.html Origin http://confirm-your-accounts-531.ml Response headers Date Fri, 22 Jun 2018 05:27:04 GMT Content-Encoding gzip Last-Modified Fri, 10 Nov 2017 23:18:37 GMT Content-MD5 4mIHU9fsgjR4gM/UGyhiKw== Vary Accept-Encoding Connection keep-alive Content-Type application/x-javascript Access-Control-Allow-Origin * Cache-Control public, max-age=602570 Strict-Transport-Security max-age=31536000 Content-Length 43124
GET H/1.1	200 OK	close.png secure.aadcdn.microsoftonline-p.com/ests/2.1.6832.14/content/images/	190 B 517 B	12ms 5ms	Image image/png	2a02:26f0:6c00:2bf::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6832.14/content/images/close.png Requested by Host: confirm-your-accounts-531.ml URL: http://confirm-your-accounts-531.ml/House/office/login.microsoftonline.com/common/reprocesse5fe.html Protocol HTTP/1.1 Server 2a02:26f0:6c00:2bf::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash 9e444d6e8e9247aa4f8fb0025995c7867fc1d63c182774f4524a3cf8588c10c5 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer http://confirm-your-accounts-531.ml/House/office/login.microsoftonline.com/common/reprocesse5fe.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Response headers Date Fri, 22 Jun 2018 05:27:04 GMT Last-Modified Fri, 10 Nov 2017 23:19:57 GMT Content-MD5 YnjsCsEWoilRLuXESGWLFg== Strict-Transport-Security max-age=31536000 Content-Type image/png Access-Control-Allow-Origin * Cache-Control public, max-age=602570 Connection keep-alive Content-Length 190
GET H/1.1	200 OK	microsoft_logo.png secure.aadcdn.microsoftonline-p.com/ests/2.1.6832.14/content/images/	1 KB 1 KB	6ms 5ms	Image image/png	2a02:26f0:6c00:2bf::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6832.14/content/images/microsoft_logo.png Requested by Host: confirm-your-accounts-531.ml URL: http://confirm-your-accounts-531.ml/House/office/login.microsoftonline.com/common/reprocesse5fe.html Protocol HTTP/1.1 Server 2a02:26f0:6c00:2bf::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer http://confirm-your-accounts-531.ml/House/office/login.microsoftonline.com/common/reprocesse5fe.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Response headers Date Fri, 22 Jun 2018 05:27:04 GMT Last-Modified Fri, 10 Nov 2017 23:19:59 GMT Content-MD5 7ZyesNzhfXUr7eprWs2m2Q== Strict-Transport-Security max-age=31536000 Content-Type image/png Access-Control-Allow-Origin * Cache-Control public, max-age=602570 Connection keep-alive Content-Length 1057
GET H/1.1	200 OK	login_hover.min.css secure.aadcdn.microsoftonline-p.com/ests/2.1.6832.14/content/cdnbundles/	89 B 454 B	7ms 6ms	Stylesheet text/css	2a02:26f0:6c00:2bf::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6832.14/content/cdnbundles/login_hover.min.css Requested by Host: confirm-your-accounts-531.ml URL: http://confirm-your-accounts-531.ml/House/office/login.microsoftonline.com/common/reprocesse5fe.html Protocol HTTP/1.1 Server 2a02:26f0:6c00:2bf::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash 91c2b74542e11d0278e02715a980b39582eae2e3b519ddd2d4f9ca939e58109c Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer http://confirm-your-accounts-531.ml/House/office/login.microsoftonline.com/common/reprocesse5fe.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Response headers Date Fri, 22 Jun 2018 05:27:04 GMT Content-Encoding gzip Last-Modified Fri, 10 Nov 2017 23:19:37 GMT Content-MD5 k+LdzPr5J17LuCAOBMVTBQ== Vary Accept-Encoding Connection keep-alive Content-Type text/css Access-Control-Allow-Origin * Cache-Control public, max-age=602570 Strict-Transport-Security max-age=31536000 Content-Length 82
GET H/1.1	200 OK	bannerlogo secure.aadcdn.microsoftonline-p.com/dbd5a2dd-uymyxxfhpwrbckvwvlxle8radh6vkzaj7cwkqpqixg/appbranding/npdp3ivuhlrwvd1ynsq0x-mjc7zhvnj0i7k676ppafa/0/	4 KB 5 KB	6ms 5ms	Image image/png	2a02:26f0:6c00:2bf::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://secure.aadcdn.microsoftonline-p.com/dbd5a2dd-uymyxxfhpwrbckvwvlxle8radh6vkzaj7cwkqpqixg/appbranding/npdp3ivuhlrwvd1ynsq0x-mjc7zhvnj0i7k676ppafa/0/bannerlogo?ts=635538653042733860 Requested by Host: confirm-your-accounts-531.ml URL: http://confirm-your-accounts-531.ml/House/office/login.microsoftonline.com/common/reprocesse5fe.html Protocol HTTP/1.1 Server 2a02:26f0:6c00:2bf::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer http://confirm-your-accounts-531.ml/House/office/login.microsoftonline.com/common/reprocesse5fe.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Response headers Date Fri, 22 Jun 2018 05:27:04 GMT Last-Modified Thu, 11 Dec 2014 03:28:24 GMT Content-MD5 nwmifU9ps1V8dDNXSinXJg== Strict-Transport-Security max-age=31536000 Content-Type image\jpeg Access-Control-Allow-Origin * Cache-Control public, max-age=84922 Connection keep-alive Content-Length 4585
GET H/1.1	200 OK	heroillustration secure.aadcdn.microsoftonline-p.com/dbd5a2dd-uymyxxfhpwrbckvwvlxle8radh6vkzaj7cwkqpqixg/appbranding/npdp3ivuhlrwvd1ynsq0x-mjc7zhvnj0i7k676ppafa/0/	199 KB 199 KB	6ms 6ms	Image image/jpeg	2a02:26f0:6c00:283::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://secure.aadcdn.microsoftonline-p.com/dbd5a2dd-uymyxxfhpwrbckvwvlxle8radh6vkzaj7cwkqpqixg/appbranding/npdp3ivuhlrwvd1ynsq0x-mjc7zhvnj0i7k676ppafa/0/heroillustration?ts=635538653045233940 Requested by Host: confirm-your-accounts-531.ml URL: http://confirm-your-accounts-531.ml/House/office/login.microsoftonline.com/common/reprocesse5fe.html Protocol HTTP/1.1 Server 2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash 7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer http://confirm-your-accounts-531.ml/House/office/login.microsoftonline.com/common/reprocesse5fe.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Response headers Date Fri, 22 Jun 2018 05:27:04 GMT Last-Modified Thu, 11 Dec 2014 03:28:24 GMT Content-MD5 ZSg7Ej6yNeYXaumMAqxbHA== Strict-Transport-Security max-age=31536000 Content-Type image\jpeg Access-Control-Allow-Origin * Cache-Control public, max-age=28447 Connection keep-alive Content-Length 203294
GET H/1.1	200 OK	Cookie set prefetch.aspx outlook.office365.com/owa/ Frame 1354	0 0	142ms 60ms	Document text/html	2603:1026:c03:2814::2 Microsoft Corpora...
General Check archive.org Show headers Download Go to Full URL https://outlook.office365.com/owa/prefetch.aspx Requested by Host: secure.aadcdn.microsoftonline-p.com URL: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6832.14/content/cdnbundles/jquery.1.11.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2603:1026:c03:2814::2 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Host outlook.office365.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Referer http://confirm-your-accounts-531.ml/House/office/login.microsoftonline.com/common/reprocesse5fe.html Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 X-DevTools-Emulate-Network-Conditions-Client-Id FDB5AF2E0AE5B2580D5594542B7039D3 Referer http://confirm-your-accounts-531.ml/House/office/login.microsoftonline.com/common/reprocesse5fe.html Response headers Cache-Control private, no-store Content-Type text/html Server Microsoft-IIS/10.0 request-id 62636075-d1ff-4c66-be3f-6314ba984c9a X-CalculatedFETarget DB6PR06CU001.internal.outlook.com X-BackEndHttpStatus 200 200 Set-Cookie ClientId=42D3B7EF38DA42829926EFD86732F412; expires=Sat, 22-Jun-2019 05:27:05 GMT; path=/; secure ClientId=42D3B7EF38DA42829926EFD86732F412; expires=Sat, 22-Jun-2019 05:27:05 GMT; path=/; secure OIDC=1; expires=Sat, 22-Dec-2018 05:27:05 GMT; path=/; secure; HttpOnly X-FEProxyInfo DB6PR06CA0010.EURPRD06.PROD.OUTLOOK.COM X-CalculatedBETarget DB4PR06MB458.eurprd06.prod.outlook.com X-RUM-Validated 1 X-Content-Type-Options nosniff X-OWA-Version 15.20.863.20 X-OWA-DiagnosticsInfo 3;0;0 X-BackEnd-Begin 2018-06-22T05:27:05.606 X-BackEnd-End 2018-06-22T05:27:05.609 X-DiagInfo DB4PR06MB458 X-BEServer DB4PR06MB458 X-UA-Compatible IE=EmulateIE7 Strict-Transport-Security max-age=31536000; includeSubDomains max-age=31536000; includeSubDomains X-FEServer DB6PR06CA0010 AM6PR06CA0022 X-Powered-By ASP.NET Date Fri, 22 Jun 2018 05:27:05 GMT Content-Length 0

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer) Office 365 (Online)

41 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B boolean| isTouch string| cssId object| head object| link undefined| msViewportStyle function| $ function| jQuery object| jQuery111203563606562131185 object| MSLogin object| proxy object| ErrorCodes object| Constants object| Context object| Background object| Logo object| Instrument object| User object| tenant_info object| MSLogout object| ThirdPartyCookieStates object| PostType object| LoginOption object| TenantBranding object| users object| Tiles object| $Api object| EmailDiscovery object| Support object| Post object| StrongAuthCheck object| Util object| WindowsBrowserSso

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			confirm-your-accounts-531.ml/House/office/login.microsoftonline.com/common	1969-12-31 23:59:59	Name: testcookie Value: testcookie

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

confirm-your-accounts-531.ml
outlook.office365.com
secure.aadcdn.microsoftonline-p.com
159.69.13.246
2603:1026:c03:2814::2
2a02:26f0:6c00:283::35c1
2a02:26f0:6c00:2bf::35c1
080ff245615e719959bc5537e164ac4495c4b8036462dfee2076dd92f22c8491
255f9206d3751ce3815555101838cdb3d09f986f9e6e8e3e5be0fe29a37df77f
794a3e7ac5b0b61344702fd93fef4eb4cd794df080d909a90a05d62efdd21957
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
91c2b74542e11d0278e02715a980b39582eae2e3b519ddd2d4f9ca939e58109c
95e1d4f316481b6f3c59aa3d2497f093392bf7c979efb527c7eaae6dbd3dc001
9e444d6e8e9247aa4f8fb0025995c7867fc1d63c182774f4524a3cf8588c10c5
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603