jdnms.com
Open in
urlscan Pro
50.62.251.122
Malicious Activity!
Public Scan
Effective URL: http://jdnms.com/contract/index.php?id=
Submission: On December 16 via automatic, source phishtank
Summary
This is the only time jdnms.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Office 365 (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2801:86:2:128... 2801:86:2:128::20 | 53164 (UNIVERSID...) (UNIVERSIDADE FEDERAL DA BAHIA) | |
1 8 | 50.62.251.122 50.62.251.122 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
3 | 2a02:26f0:11a... 2a02:26f0:11a:394::35c1 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
11 | 3 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-50-62-251-122.ip.secureserver.net
jdnms.com |
ASN20940 (AKAMAI-ASN1, US)
secure.aadcdn.microsoftonline-p.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
jdnms.com
1 redirects
jdnms.com |
84 KB |
3 |
microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com |
203 KB |
1 |
ifba.edu.br
1 redirects
salvador.ifba.edu.br |
495 B |
11 | 3 |
Domain | Requested by | |
---|---|---|
8 | jdnms.com |
1 redirects
jdnms.com
|
3 | secure.aadcdn.microsoftonline-p.com |
jdnms.com
|
1 | salvador.ifba.edu.br | 1 redirects |
11 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
signup.live.com |
account.live.com |
passwordreset.microsoftonline.com |
login.live.com |
login.microsoftonline.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
secure.aadcdn.microsoftonline-p.com Microsoft IT TLS CA 1 |
2017-08-15 - 2019-08-15 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://jdnms.com/contract/index.php?id=
Frame ID: (9AD3ECEEEBDA4C5248DF774A48305BAB)
Requests: 11 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://salvador.ifba.edu.br/config/contract/
HTTP 302
http://jdnms.com/contract/main.php?connect= HTTP 302
http://jdnms.com/contract/index.php?id= Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js/i
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Title: get a new Microsoft account
Search URL Search Domain Scan URL
Title: Personal account
Search URL Search Domain Scan URL
Title: Work or school account
Search URL Search Domain Scan URL
Title: Sign in with a Microsoft account
Search URL Search Domain Scan URL
Title: Terms of use
Search URL Search Domain Scan URL
Title: Privacy & Cookies
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://salvador.ifba.edu.br/config/contract/
HTTP 302
http://jdnms.com/contract/main.php?connect= HTTP 302
http://jdnms.com/contract/index.php?id= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index.php
jdnms.com/contract/ Redirect Chain
|
39 KB 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.css
jdnms.com/contract/Sign%20in%20to%20your%20account_files/ |
21 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_hover.css
jdnms.com/contract/Sign%20in%20to%20your%20account_files/ |
89 B 82 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
jdnms.com/contract/Sign%20in%20to%20your%20account_files/ |
107 KB 37 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aad.js
jdnms.com/contract/Sign%20in%20to%20your%20account_files/ |
162 KB 37 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
heroillustration.jpg
jdnms.com/contract/Sign%20in%20to%20your%20account_files/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bannerlogo.png
jdnms.com/contract/Sign%20in%20to%20your%20account_files/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
microsoft_logo.png
jdnms.com/contract/Sign%20in%20to%20your%20account_files/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_hover.min.css
secure.aadcdn.microsoftonline-p.com/ests/2.1.4370.109/content/cdnbundles/ |
89 B 82 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bannerlogo
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-6ybrougjmflxqw910ieyohr7wb4x4-yvoixrlaidmz4/appbranding/askzfdsqe20i-bcjwporaywega7vbt4acqnn1hiliiw/0/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
heroillustration
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-6ybrougjmflxqw910ieyohr7wb4x4-yvoixrlaidmz4/appbranding/askzfdsqe20i-bcjwporaywega7vbt4acqnn1hiliiw/0/ |
199 KB 199 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- jdnms.com
- URL
- http://jdnms.com/contract/Sign%20in%20to%20your%20account_files/heroillustration.jpg
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Office 365 (Online)52 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onafterprint object| onbeforeprint object| $Config object| $Do function| GetString function| GetErrorString function| GetUrl object| $B object| $WebWatson boolean| isTouch string| cssId object| head object| link undefined| msViewportStyle function| $ function| jQuery function| pageOnReady object| MSLogin object| ErrorCodes object| Constants object| Context object| Background object| Logo object| Instrument object| User object| tenant_info object| EmailDiscovery function| origHide function| origShow function| origAddClass function| origRemoveClass object| Support object| MSLogout object| ThirdPartyCookieStates object| PostType object| LoginOption object| Post object| ProofUp object| StrongAuthCheck object| TenantBranding object| users object| Tiles object| WindowsBrowserSso object| proxy object| $Debug object| $Api object| jQuery111203346126398559526 object| MSStrongAuth object| Util object| body string| alt_logo_image string| alt_background_image7 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
outlook.office365.com/ | Name: ClientId Value: 30CEAAD836674F2882FB1FF6F7ACA918 |
|
www.office.com/ | Name: OH.SID Value: e7944a46-0aa5-4d6c-9a12-f6d57042846e |
|
.office.com/ | Name: MUID Value: 2C0B57D1B68F673B2F3D5C8BB78366C9 |
|
portal.office.com/ | Name: p.PersID Value: 00991509-b366-4b05-a8be-539613bb990c |
|
portal.office.com/ | Name: s.SessID Value: c2382a7c-a8ba-4b30-b92d-f9c35d7d1415 |
|
outlook.office365.com/ | Name: OIDC Value: 1 |
|
jdnms.com/contract | Name: testcookie Value: testcookie |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
jdnms.com
salvador.ifba.edu.br
secure.aadcdn.microsoftonline-p.com
jdnms.com
2801:86:2:128::20
2a02:26f0:11a:394::35c1
50.62.251.122
0247eafeb26e999ecfe8c75e6c5b2bd071a81f441d54dcde89867bd57f6aa3f5
63568451521f6b89382479844d5465b3ddc6576563ce16adfca158a775287140
7bed7d7ef6d5fe30a99e1d4e97d0c565797a296b3bbee72c9627c9a9b24fe2b7
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
91c2b74542e11d0278e02715a980b39582eae2e3b519ddd2d4f9ca939e58109c
988e349f2bf4e87154738c7b2c1fa86618713a8cfa0cef60a046f5add89bd9de
9959181e0508b5f2a2e9bc50d9825a9261614fd0602e955b217b727e16328ab9
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603