URL: http://compense.eu/?rid=YCbUQal
Submission: On October 18 via api from CA — Scanned from CA

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 8 HTTP transactions. The main IP is 92.62.128.197, located in Utena, Lithuania and belongs to BALTNETA Customers AS, LT. The main domain is compense.eu.
This is the only time compense.eu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

IP Address AS Autonomous System
1 92.62.128.197 15440 (BALTNETA ...)
4 13.107.253.40 8075 (MICROSOFT...)
2 207.241.237.3 7941 (INTERNET-...)
1 57.153.167.86 8075 (MICROSOFT...)
8 4
Apex Domain
Subdomains
Transfer
4 microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com — Cisco Umbrella Rank: 14051
66 KB
2 archive.org
web.archive.org — Cisco Umbrella Rank: 38283
19 KB
1 ozas.lt
www.ozas.lt
32 KB
1 compense.eu
compense.eu
2 KB
8 4
Domain Requested by
4 secure.aadcdn.microsoftonline-p.com compense.eu
2 web.archive.org compense.eu
1 www.ozas.lt compense.eu
1 compense.eu
8 4

This site contains no links.

Subject Issuer Validity Valid
secure.aadcdn.microsoftonline-p.com
Microsoft Azure RSA TLS Issuing CA 08
2024-09-10 -
2025-09-05
a year crt.sh
*.archive.org
Go Daddy Secure Certificate Authority - G2
2023-12-23 -
2025-01-23
a year crt.sh
ozas.lt
R11
2024-10-14 -
2025-01-12
3 months crt.sh

This page contains 1 frames:

Primary Page: http://compense.eu/?rid=YCbUQal
Frame ID: 51BCE3ADA4F8A20FD9E0A52839E29E28
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

Sign in to Microsoft Online Services

Page URL History Show full URLs

  1. http://compense.eu/?rid=YCbUQal HTTP 307
    https://compense.eu/?rid=YCbUQal HTTP 307
    http://compense.eu/?rid=YCbUQal Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

88 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

120 kB
Transfer

299 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://compense.eu/?rid=YCbUQal HTTP 307
    https://compense.eu/?rid=YCbUQal HTTP 307
    http://compense.eu/?rid=YCbUQal Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
compense.eu/
Redirect Chain
  • http://compense.eu/?rid=YCbUQal
  • https://compense.eu/?rid=YCbUQal
  • http://compense.eu/?rid=YCbUQal
6 KB
2 KB
Document
General
Full URL
http://compense.eu/?rid=YCbUQal
Protocol
HTTP/1.1
Server
92.62.128.197 Utena, Lithuania, ASN15440 (BALTNETA Customers AS, LT),
Reverse DNS
Software
/
Resource Hash
c7c5718911a8ccf73bf4b1b46aaf09352dddf703868b401e1409844bced19512

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Content-Encoding
gzip
Content-Length
2043
Content-Type
text/html; charset=utf-8
Date
Fri, 18 Oct 2024 02:18:01 GMT
Vary
Accept-Encoding
X-Server
gophish

Redirect headers

Location
http://compense.eu/?rid=YCbUQal
Non-Authoritative-Reason
HttpsUpgrades
login.ltr.css
secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/css/
27 KB
5 KB
Stylesheet
General
Full URL
https://secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/css/login.ltr.css
Requested by
Host: compense.eu
URL: http://compense.eu/?rid=YCbUQal
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
13.107.253.40 Redmond, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
f902d8b3484872d0bb6fdb71084823e6363905e3f0ebaeeafa6cb373acd28350
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
http://compense.eu/

Response headers

x-cache-info
L1_T2
content-encoding
gzip
x-ms-version
2009-09-19
etag
0x8D6D8B583EB9BF4
x-ms-lease-status
unlocked
x-fd-int-roxy-purgeid
50755578
x-content-type-options
nosniff
x-cache
TCP_HIT
date
Fri, 18 Oct 2024 02:18:01 GMT
content-type
text/css
last-modified
Tue, 14 May 2019 21:45:43 GMT
cache-control
public, max-age=604800
x-ms-request-id
8581a4d5-a01e-0097-4f71-1dc7b6000000
accept-ranges
bytes
content-length
4712
x-azure-ref
20241018T021801Z-159587bfd64gjzmj52agntk8r400000007ag0000000033xa
x-ms-blob-type
BlockBlob
jquery.1.5.1.min.js
secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/js/
85 KB
30 KB
Script
General
Full URL
https://secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/js/jquery.1.5.1.min.js
Requested by
Host: compense.eu
URL: http://compense.eu/?rid=YCbUQal
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
13.107.253.40 Redmond, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
f0ecc5a8e657458720f3d97ab079570ce1f954f951fddc306cde4bc03151d590
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
http://compense.eu/

Response headers

x-cache-info
L1_T2
content-encoding
gzip
x-ms-version
2009-09-19
etag
0x8D6D8B58642FBE8
x-ms-lease-status
unlocked
x-fd-int-roxy-purgeid
50755578
x-content-type-options
nosniff
x-cache
TCP_HIT
date
Fri, 18 Oct 2024 02:18:01 GMT
content-type
application/x-javascript
last-modified
Tue, 14 May 2019 21:45:47 GMT
cache-control
public, max-age=604800
x-ms-request-id
78e5e61c-901e-0078-0778-1d3243000000
accept-ranges
bytes
content-length
30587
x-azure-ref
20241018T021801Z-159587bfd64gjzmj52agntk8r400000007ag0000000033xc
x-ms-blob-type
BlockBlob
aad.login.js
secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/js/
126 KB
28 KB
Script
General
Full URL
https://secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/js/aad.login.js
Requested by
Host: compense.eu
URL: http://compense.eu/?rid=YCbUQal
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
13.107.253.40 Redmond, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
0764cd74693cbf231ec1841cea80d3308cb39892dacdf906044ad6c0622cada2
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
http://compense.eu/

Response headers

x-cache-info
L2_T2
content-encoding
gzip
x-ms-version
2009-09-19
etag
0x8D6D8B586412715
x-ms-lease-status
unlocked
x-fd-int-roxy-purgeid
50755578
x-content-type-options
nosniff
x-cache
TCP_REMOTE_HIT
date
Fri, 18 Oct 2024 02:18:01 GMT
content-type
application/x-javascript
last-modified
Tue, 14 May 2019 21:45:47 GMT
cache-control
public, max-age=604800
x-ms-request-id
5c8d8a20-101e-00df-67f2-20da81000000
accept-ranges
bytes
content-length
28486
x-azure-ref
20241018T021801Z-159587bfd64gjzmj52agntk8r400000007ag0000000033xb
x-ms-blob-type
BlockBlob
jquery.easing.1.3.js
secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/js/
9 KB
3 KB
Script
General
Full URL
https://secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/js/jquery.easing.1.3.js
Requested by
Host: compense.eu
URL: http://compense.eu/?rid=YCbUQal
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
13.107.253.40 Redmond, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e9f76a23a17184eec1ee54b5fa9d25ae90439b9f8edf31391ee19332010fb698
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
http://compense.eu/

Response headers

x-cache-info
L1_T2
content-encoding
gzip
x-ms-version
2009-09-19
etag
0x8D6D8B58646305E
x-ms-lease-status
unlocked
x-fd-int-roxy-purgeid
50755578
x-content-type-options
nosniff
x-cache
TCP_HIT
date
Fri, 18 Oct 2024 02:18:01 GMT
content-type
application/x-javascript
last-modified
Tue, 14 May 2019 21:45:47 GMT
cache-control
public, max-age=604800
x-ms-request-id
6e8725ff-101e-00bd-68d9-1b18a6000000
accept-ranges
bytes
content-length
2264
x-azure-ref
20241018T021801Z-159587bfd64gjzmj52agntk8r400000007ag0000000033xd
x-ms-blob-type
BlockBlob
logo.png
web.archive.org/web/20201012165953/https://secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/office365/
4 KB
7 KB
Image
General
Full URL
https://web.archive.org/web/20201012165953/https://secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/office365/logo.png
Requested by
Host: compense.eu
URL: http://compense.eu/?rid=YCbUQal
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
207.241.237.3 , United States, ASN7941 (INTERNET-ARCHIVE, US),
Reverse DNS
Software
nginx /
Resource Hash
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' 'unsafe-inline' data: blob: archive.org web.archive.org web-static.archive.org wayback-api.archive.org athena.archive.org analytics.archive.org pragma.archivelab.org

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
http://compense.eu/

Response headers

x-archive-guessed-content-type
image/png
x-archive-orig-connection
keep-alive
x-na
0
x-archive-orig-last-modified
Tue, 14 May 2019 21:52:11 GMT
memento-datetime
Mon, 12 Oct 2020 16:59:53 GMT
x-archive-orig-strict-transport-security
max-age=31536000
server-timing
captures_list;dur=0.541470, exclusion.robots;dur=0.025463, exclusion.robots.policy;dur=0.015472, esindex;dur=0.011045, cdx.remote;dur=22.069965, LoadShardBlock;dur=158.076988, PetaboxLoader3.datanode;dur=88.921796, PetaboxLoader3.resolve;dur=135.699663, load_resource;dur=85.706483, loaddict;dur=13.362431, TR;dur=0,Tw;dur=0,Tc;dur=1, MISS
x-archive-src
archiveteam_googlesites_20201012170110_dca7913d/googlesites_20201012170110_dca7913d.1602464829.megawarc.warc.zst
x-location
All
date
Fri, 18 Oct 2024 02:18:02 GMT
x-rl
0
content-type
image/png
x-archive-orig-cache-control
public, max-age=509449
link
<https://secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/office365/logo.png>; rel="original", <https://web.archive.org/web/timemap/link/https://secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/office365/logo.png>; rel="timemap"; type="application/link-format", <https://web.archive.org/web/https://secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/office365/logo.png>; rel="timegate", <https://web.archive.org/web/20131023134645/https://secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/Office365/logo.png>; rel="first memento"; datetime="Wed, 23 Oct 2013 13:46:45 GMT", <https://web.archive.org/web/20200605032531/https://secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/Office365/logo.png>; rel="prev memento"; datetime="Fri, 05 Jun 2020 03:25:31 GMT", <https://web.archive.org/web/20201012165953/https://secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/office365/logo.png>; rel="memento"; datetime="Mon, 12 Oct 2020 16:59:53 GMT", <https://web.archive.org/web/20211031120832/https://secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/office365/logo.png>; rel="next memento"; datetime="Sun, 31 Oct 2021 12:08:32 GMT", <https://web.archive.org/web/20241008164235/https://secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/office365/logo.png>; rel="last memento"; datetime="Tue, 08 Oct 2024 16:42:35 GMT"
x-ts
200
content-security-policy
default-src 'self' 'unsafe-eval' 'unsafe-inline' data: blob: archive.org web.archive.org web-static.archive.org wayback-api.archive.org athena.archive.org analytics.archive.org pragma.archivelab.org
cache-control
max-age=1800
x-tr
299
x-archive-orig-access-control-allow-origin
*
x-nid
-
x-app-server
wwwb-app219
referrer-policy
no-referrer-when-downgrade
permissions-policy
interest-cohort=()
x-archive-orig-date
Mon, 12 Oct 2020 16:59:53 GMT
accept-ranges
bytes
content-length
4585
x-archive-orig-content-length
4585
server
nginx
x-page-cache
MISS
OZAS_compensa_c890f5974b.jpg
www.ozas.lt/uploads/
31 KB
32 KB
Image
General
Full URL
https://www.ozas.lt/uploads/OZAS_compensa_c890f5974b.jpg
Requested by
Host: compense.eu
URL: http://compense.eu/?rid=YCbUQal
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
57.153.167.86 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
03d71d0d252efa323395c467999b52d6734da51678096f8e51a73ec415106154
Security Headers
Name Value
Content-Security-Policy script-src 'self' editor.unlayer.com;frame-src 'self' editor.unlayer.com;img-src 'self' data: cdn.jsdelivr.net dl.airtable.com strapi.io s3.amazonaws.com;connect-src 'self' https:;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
http://compense.eu/

Response headers

content-md5
3Tnp7Hc1W0+25hSQ/0zXmQ==
etag
"3Tnp7Hc1W0+25hSQ/0zXmQ=="
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
date
Fri, 18 Oct 2024 02:18:03 GMT
content-type
image/jpeg
vary
Origin, Accept-Encoding
last-modified
Sat, 18 Mar 2023 21:57:45 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000; includeSubDomains
content-security-policy
script-src 'self' editor.unlayer.com;frame-src 'self' editor.unlayer.com;img-src 'self' data: cdn.jsdelivr.net dl.airtable.com strapi.io s3.amazonaws.com;connect-src 'self' https:;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline'
cache-control
public, max-age=1209600
x-dns-prefetch-control
off
referrer-policy
no-referrer
x-download-options
noopen
accept-ranges
bytes
content-length
31712
x-xss-protection
1
server
nginx
favicon_a.ico
web.archive.org/web/20211124193620/https://secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/images/
11 KB
13 KB
Other
General
Full URL
https://web.archive.org/web/20211124193620/https://secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/images/favicon_a.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
207.241.237.3 , United States, ASN7941 (INTERNET-ARCHIVE, US),
Reverse DNS
Software
nginx /
Resource Hash
ab40e2c4c2163172c7f5285238114a54ede2ce8a3497c10049988e4515b9a608
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' 'unsafe-inline' data: blob: archive.org web.archive.org web-static.archive.org wayback-api.archive.org athena.archive.org analytics.archive.org pragma.archivelab.org

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
http://compense.eu/

Response headers

x-archive-guessed-content-type
application/octet-stream
x-archive-orig-connection
close
x-na
0
x-archive-orig-last-modified
Tue, 14 May 2019 21:45:46 GMT
memento-datetime
Wed, 24 Nov 2021 19:36:20 GMT
x-archive-orig-strict-transport-security
max-age=31536000
server-timing
captures_list;dur=0.451732, exclusion.robots;dur=0.019775, exclusion.robots.policy;dur=0.012545, esindex;dur=0.009488, cdx.remote;dur=7.631737, LoadShardBlock;dur=81.010257, PetaboxLoader3.datanode;dur=83.297221, PetaboxLoader3.resolve;dur=67.094550, load_resource;dur=74.224718, TR;dur=0,Tw;dur=0,Tc;dur=1, MISS
x-archive-src
MEGA001-20211122211646-crawl420/MEGA001-20211124135033-00081.warc.gz
x-location
All
date
Fri, 18 Oct 2024 02:18:03 GMT
x-rl
0
content-type
image/x-icon
x-archive-orig-cache-control
public, max-age=600147
link
<https://secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/images/favicon_a.ico>; rel="original", <https://web.archive.org/web/timemap/link/https://secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/images/favicon_a.ico>; rel="timemap"; type="application/link-format", <https://web.archive.org/web/https://secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/images/favicon_a.ico>; rel="timegate", <https://web.archive.org/web/20141003110016/https://secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/images/favicon_a.ico>; rel="first memento"; datetime="Fri, 03 Oct 2014 11:00:16 GMT", <https://web.archive.org/web/20201117174409/https://secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/images/favicon_a.ico>; rel="prev memento"; datetime="Tue, 17 Nov 2020 17:44:09 GMT", <https://web.archive.org/web/20211124193620/https://secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/images/favicon_a.ico>; rel="memento"; datetime="Wed, 24 Nov 2021 19:36:20 GMT", <https://web.archive.org/web/20220520125113/https://secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/images/favicon_a.ico>; rel="next memento"; datetime="Fri, 20 May 2022 12:51:13 GMT", <https://web.archive.org/web/20231010213324/https://secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/images/favicon_a.ico>; rel="last memento"; datetime="Tue, 10 Oct 2023 21:33:24 GMT"
x-ts
200
content-security-policy
default-src 'self' 'unsafe-eval' 'unsafe-inline' data: blob: archive.org web.archive.org web-static.archive.org wayback-api.archive.org athena.archive.org analytics.archive.org pragma.archivelab.org
cache-control
max-age=1800
x-tr
189
x-archive-orig-access-control-allow-origin
*
x-nid
-
x-app-server
wwwb-app217
referrer-policy
no-referrer-when-downgrade
permissions-policy
interest-cohort=()
x-archive-orig-date
Wed, 24 Nov 2021 19:36:20 GMT
accept-ranges
bytes
content-length
11078
x-archive-orig-content-length
11078
server
nginx
x-page-cache
MISS

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

35 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| ErrorCodes object| Constants object| Context object| Background object| Logo object| Instrument object| User object| tenant_info function| pageOnReady object| Util object| PostType object| LoginOption object| Post function| origHide function| origShow function| origAddClass function| origRemoveClass object| Support object| Tiles object| HIP object| EmailDiscovery object| ProofUp object| StrongAuthCheck object| ThirdPartyCookieStates object| TenantBranding object| MSLogin object| jQuery15105004235493999736 object| HIP_MODE object| MSStrongAuth object| MSLogout object| body string| alt_logo_image string| alt_background_image

0 Cookies

1 Console Messages

Source Level URL
Text
recommendation verbose URL: http://compense.eu/?rid=YCbUQal
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o