login-live.com-s02.info
Open in
urlscan Pro
78.47.159.0
Malicious Activity!
Public Scan
URL:
https://login-live.com-s02.info/pt/?code=04462db0c6818ea325d1c2529d4165fc
Submission: On June 30 via manual from US
Submission: On June 30 via manual from US
Summary
This website contacted 2 IPs
in 1 countries
across 2 domains to perform 14 HTTP transactions.
The main IP is 78.47.159.0, located in
Germany and
belongs to HETZNER-AS, DE.
The main domain is login-live.com-s02.info.
TLS certificate: Issued by Let's Encrypt Authority X3 on May 3rd 2020. Valid for: 3 months.
This is the only time login-live.com-s02.info was scanned on urlscan.io!
TLS certificate: Issued by Let's Encrypt Authority X3 on May 3rd 2020. Valid for: 3 months.
This is the only time login-live.com-s02.info was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 13 | 78.47.159.0 78.47.159.0 | 24940 (HETZNER-AS) (HETZNER-AS) | |
| 1 | 116.203.22.29 116.203.22.29 | 24940 (HETZNER-AS) (HETZNER-AS) | |
| 14 | 2 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 13 |
com-s02.info
login-live.com-s02.info |
1007 KB |
| 1 |
sosafe.de
api.sosafe.de |
51 KB |
| 14 | 2 |
| Domain | Requested by | |
|---|---|---|
| 13 | login-live.com-s02.info |
login-live.com-s02.info
|
| 1 | api.sosafe.de |
login-live.com-s02.info
|
| 14 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| login-live.com-s02.info Let's Encrypt Authority X3 |
2020-05-03 - 2020-08-01 |
3 months | crt.sh |
| api.sosafe.de Let's Encrypt Authority X3 |
2020-05-10 - 2020-08-08 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://login-live.com-s02.info/pt/?code=04462db0c6818ea325d1c2529d4165fc
Frame ID: 0C5645BB23BFAE109102132D8F4FEEDA
Requests: 14 HTTP requests in this frame
Screenshot
Detected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
- script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i
Nginx
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
login-live.com-s02.info/pt/ |
4 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.css
login-live.com-s02.info/assets/bootstrap/css/ |
138 KB 138 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fontawesome-all.min.css
login-live.com-s02.info/assets/fonts/ |
40 KB 40 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
material-icons.min.css
login-live.com-s02.info/assets/fonts/ |
667 B 897 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
typicons.min.css
login-live.com-s02.info/assets/fonts/ |
15 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
styles.min.css
login-live.com-s02.info/assets/css/ |
4 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
main.js
login-live.com-s02.info/assets/js/ |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
info.svg
login-live.com-s02.info/assets/img/ |
338 B 573 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
question.svg
login-live.com-s02.info/assets/img/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.min.js
login-live.com-s02.info/assets/js/ |
85 KB 85 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.js
login-live.com-s02.info/assets/bootstrap/js/ |
69 KB 69 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
report
api.sosafe.de/v1/ |
50 KB 51 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
microsoft_logo.svg
login-live.com-s02.info/assets/img/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
1.png
login-live.com-s02.info/assets/img/ |
642 KB 642 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| findGetParameter object| Http object| elements function| $ function| jQuery object| bootstrap0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.sosafe.de
login-live.com-s02.info
116.203.22.29
78.47.159.0
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
39646863a414e0a84920b3a8639c0f3e8c94535e8dc051b42b485a068dc2902f
3b1570b5ff9ff35087c117c63a418199a11c6eeaf6954846b297b7bf95496129
46b4721c80749cc5e1ec6cf4c5fec78a2c51fdfc4ee9c94f2223cdaf4fbd8ced
81c4f50096d17e8cdfe9c95d5996af25efba6d081462ddd068a1014fd7cd28d4
8660ed12799916f277ccbb1fa1ba74dc2483dffa91089998ddfed5a9feb32200
928f97f310d8f768c5e3d521e3b1ce2cff156f9cc60c5d09fad772f4a2c43f52
a76c08e9cdc3bb87bfb57627ad8f6b46f0e5ef826cc7f046dfbaf25d7b7958ea
c5bc258638ab24f2e8cd5fbe97491eb114f9d1f55201a92e9143d2061e97f9cd
d87a180305021ddf6213539dd35065599a1afde007a4705b86b51c80c5332f35
dd3bfb00b7273590ca408b03823bf86903ead0c497de2f7b5f6934d1473c20e2
e78098c9d55fcd196acc23bb905e94881fbe157504e9c179f23ae85399e28682
f2517c0fd2c399137ca619b0c560e7f9471040cb41e70064306585c0f207978a
fd702d8d6882cc47c74308ec46b1476035492c3d887741b279bb830c49b9b2bf