sciencelobby.com.au Open in urlscan Pro
27.121.66.12 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://sciencelobby.com.au/efe/
Submission: On June 22 via manual (June 22nd 2018, 1:44:17 pm UTC) from IN

Summary HTTP 9 Redirects Links 1 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 9 HTTP transactions. The main IP is 27.121.66.12, located in Brisbane, Australia and belongs to NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU. The main domain is sciencelobby.com.au.

This is the only time sciencelobby.com.au was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

	IP Address		AS Autonomous System
8	27.121.66.12 27.121.66.12		24446 (NETREGIST...) (NETREGISTRY-AS-AP NetRegistry Pty Ltd.)
1 1	2a01:111:f100... 2a01:111:f100:8000::4134:941b		8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
1	2620:1ec:4::156 2620:1ec:4::156		8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
9	2

8 27.121.66.12 (Brisbane, Australia)

ASN24446 (NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU)
PTR: cp212.ezyreg.com

sciencelobby.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a01:111:f100:8000::4134:941b (United Kingdom) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

portal.microsoftonline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:4::156 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

portal.office.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	sciencelobby.com.au sciencelobby.com.au	525 KB
1	office.com portal.office.com
1	microsoftonline.com 1 redirects portal.microsoftonline.com	247 B
9	3

	Domain	Requested by
8	sciencelobby.com.au	sciencelobby.com.au
1	portal.office.com	sciencelobby.com.au
1	portal.microsoftonline.com	1 redirects
9	3

This site contains links to these domains. Also see Links.

Domain
login.live.com

Subject Issuer	Validity	Valid
portal.office.com Microsoft IT TLS CA 5	`2017-09-20` - `2019-09-20`	2 years	crt.sh

This page contains 2 frames:

Primary Page: http://sciencelobby.com.au/efe/
Frame ID: FF543CE0F1B937BCAC9FE3F5244AEBFF
Requests: 8 HTTP requests in this frame

Frame: https://portal.office.com/Prefetch/Prefetch.aspx
Frame ID: 3D4F69199E9A14A64C7EE0A1E70D32FA
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_ssl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_ssl(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
headers server /mod_ssl(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js/i
env /^jQuery$/i

Page Statistics

9
Requests

11 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

525 kB
Transfer

523 kB
Size

5
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://login.live.com/login.srf?wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQIIAeNisNLJKCkpKLbS1y_ILypJzNHLzUwuyi_OTyvJz8vJzEvVS87P1csvSs9MAbGKhLgEPN89jV-7VcetzdWnrEXhS_wqRmXCRuhfYGR8wch4i0nQvyjdMyW82C01JbUosSQzP-8RE29ocWqRf15OZUh-dmreLmaV5JQUC8O0VENdy9RUY10TE2Nj3SRzIMvS1DwpzTw5NTnVxPACi8ArFh4DZisODjYBJgkGBYYfLIyLWIEOPCx6eOtZsbP-q9qO3ujco3L6FKu-Y1SFqWeRS56XU1S-d2W4qbmZmbe_WYVXdl6FcaSzk3lAdlS6R1mee6Spr62xleEENqEJbEwHOBkB0&id=&uaid=5fe5ee49b5ad462c86454c768420f45f&pcexp=false&popupui=
Title: Sign in with a Microsoft account

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7

https://portal.microsoftonline.com/Prefetch/Prefetch.aspx HTTP 302
https://portal.office.com/Prefetch/Prefetch.aspx

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
sciencelobby.com.au/efe/ 17 KB
17 KB 614ms
303ms Document
text/html 27.121.66.12
NETREGISTRY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: http://sciencelobby.com.au/efe/
Protocol: HTTP/1.1
Server: 27.121.66.12 Brisbane, Australia, ASN24446 (NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU),
Reverse DNS: cp212.ezyreg.com
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: 7b92492631e438df49e870d96307cc5877a64bbef8bcee17475cdab41de33b23

Request headers

Host: sciencelobby.com.au
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: FF543CE0F1B937BCAC9FE3F5244AEBFF

Response headers

Date: Fri, 22 Jun 2018 13:44:00 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Last-Modified: Mon, 08 May 2017 11:28:30 GMT
ETag: "ec741-4382-54f0189dbd380"
Accept-Ranges: bytes
Content-Length: 17282
Keep-Alive: timeout=3, max=100
Connection: Keep-Alive
Content-Type: text/html

GET
H/1.1 200
OK login.css
sciencelobby.com.au/efe/index_files/ 21 KB
21 KB 552ms
302ms Stylesheet
text/css 27.121.66.12
NETREGISTRY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: http://sciencelobby.com.au/efe/index_files/login.css
Requested by: Host: sciencelobby.com.au
URL: http://sciencelobby.com.au/efe/
Protocol: HTTP/1.1
Server: 27.121.66.12 Brisbane, Australia, ASN24446 (NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU),
Reverse DNS: cp212.ezyreg.com
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: b5ea0ffbe39f577651336a1aba7746881cf235b9f7ccc1c51b151162b3da4feb

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: sciencelobby.com.au
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://sciencelobby.com.au/efe/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://sciencelobby.com.au/efe/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Fri, 22 Jun 2018 13:44:01 GMT
Last-Modified: Sun, 05 Mar 2017 05:12:14 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "ec747-5429-549f4d2616780"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=100
Content-Length: 21545

GET
H/1.1 200
OK login_hover.css
sciencelobby.com.au/efe/index_files/ 89 B
427 B 599ms
302ms Stylesheet
text/css 27.121.66.12
NETREGISTRY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: http://sciencelobby.com.au/efe/index_files/login_hover.css
Requested by: Host: sciencelobby.com.au
URL: http://sciencelobby.com.au/efe/
Protocol: HTTP/1.1
Server: 27.121.66.12 Brisbane, Australia, ASN24446 (NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU),
Reverse DNS: cp212.ezyreg.com
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: 91c2b74542e11d0278e02715a980b39582eae2e3b519ddd2d4f9ca939e58109c

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: sciencelobby.com.au
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://sciencelobby.com.au/efe/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://sciencelobby.com.au/efe/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Fri, 22 Jun 2018 13:44:01 GMT
Last-Modified: Sun, 05 Mar 2017 05:12:14 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "ec748-59-549f4d2616780"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=99
Content-Length: 89

GET
H/1.1 200
OK jquery.js Show response
sciencelobby.com.au/efe/index_files/ 108 KB
108 KB 603ms
302ms Script
application/javascript 27.121.66.12
NETREGISTRY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: http://sciencelobby.com.au/efe/index_files/jquery.js
Requested by: Host: sciencelobby.com.au
URL: http://sciencelobby.com.au/efe/
Protocol: HTTP/1.1
Server: 27.121.66.12 Brisbane, Australia, ASN24446 (NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU),
Reverse DNS: cp212.ezyreg.com
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: d97274b02ba4f21d104a254ddcba70fe1831f8780fdd38a8ff8745db7e9ca2fd

Request headers

Pragma: no-cache
Origin: http://sciencelobby.com.au
Accept-Encoding: gzip, deflate
Host: sciencelobby.com.au
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: */*
Referer: http://sciencelobby.com.au/efe/
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer: http://sciencelobby.com.au/efe/
Origin: http://sciencelobby.com.au

Response headers

Date: Fri, 22 Jun 2018 13:44:01 GMT
Last-Modified: Sun, 05 Mar 2017 05:12:14 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "ec746-1ae50-549f4d2616780"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=100
Content-Length: 110160

GET
H/1.1 200
OK aad.js Show response
sciencelobby.com.au/efe/index_files/ 173 KB
173 KB 603ms
302ms Script
application/javascript 27.121.66.12
NETREGISTRY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: http://sciencelobby.com.au/efe/index_files/aad.js
Requested by: Host: sciencelobby.com.au
URL: http://sciencelobby.com.au/efe/
Protocol: HTTP/1.1
Server: 27.121.66.12 Brisbane, Australia, ASN24446 (NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU),
Reverse DNS: cp212.ezyreg.com
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: 215db880f45aef451f323902b89282098e2745040451bb7dac9a26fcc7ee468d

Request headers

Pragma: no-cache
Origin: http://sciencelobby.com.au
Accept-Encoding: gzip, deflate
Host: sciencelobby.com.au
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: */*
Referer: http://sciencelobby.com.au/efe/
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer: http://sciencelobby.com.au/efe/
Origin: http://sciencelobby.com.au

Response headers

Date: Fri, 22 Jun 2018 13:44:01 GMT
Last-Modified: Sun, 05 Mar 2017 05:12:18 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "ec743-2b3d2-549f4d29e7080"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=100
Content-Length: 177106

GET
H/1.1 200
OK heroillustration.jpg
sciencelobby.com.au/efe/ 199 KB
199 KB 302ms
302ms Image
image/jpeg 27.121.66.12
NETREGISTRY-AS-AP...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://sciencelobby.com.au/efe/heroillustration.jpg
Requested by: Host: sciencelobby.com.au
URL: http://sciencelobby.com.au/efe/
Protocol: HTTP/1.1
Server: 27.121.66.12 Brisbane, Australia, ASN24446 (NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU),
Reverse DNS: cp212.ezyreg.com
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: 7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: sciencelobby.com.au
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://sciencelobby.com.au/efe/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://sciencelobby.com.au/efe/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Fri, 22 Jun 2018 13:44:02 GMT
Last-Modified: Sun, 05 Mar 2017 05:34:54 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "ec73f-31a1e-549f523715b80"
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=99
Content-Length: 203294

GET
H/1.1 200
OK bannerlogo.png
sciencelobby.com.au/efe/index_files/ 4 KB
5 KB 308ms
307ms Image
image/png 27.121.66.12
NETREGISTRY-AS-AP...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://sciencelobby.com.au/efe/index_files/bannerlogo.png
Requested by: Host: sciencelobby.com.au
URL: http://sciencelobby.com.au/efe/
Protocol: HTTP/1.1
Server: 27.121.66.12 Brisbane, Australia, ASN24446 (NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU),
Reverse DNS: cp212.ezyreg.com
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: sciencelobby.com.au
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://sciencelobby.com.au/efe/
Cookie: testcookie=testcookie
Connection: keep-alive
Cache-Control: no-cache
Referer: http://sciencelobby.com.au/efe/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Fri, 22 Jun 2018 13:44:03 GMT
Last-Modified: Sun, 05 Mar 2017 05:12:14 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "ec744-11e9-549f4d2616780"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=99
Content-Length: 4585

GET
H/1.1 200
OK microsoft_logo.png
sciencelobby.com.au/efe/index_files/ 1 KB
1 KB 310ms
310ms Image
image/png 27.121.66.12
NETREGISTRY-AS-AP...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://sciencelobby.com.au/efe/index_files/microsoft_logo.png
Requested by: Host: sciencelobby.com.au
URL: http://sciencelobby.com.au/efe/
Protocol: HTTP/1.1
Server: 27.121.66.12 Brisbane, Australia, ASN24446 (NETREGISTRY-AS-AP NetRegistry Pty Ltd., AU),
Reverse DNS: cp212.ezyreg.com
Software: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: 988e349f2bf4e87154738c7b2c1fa86618713a8cfa0cef60a046f5add89bd9de

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: sciencelobby.com.au
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://sciencelobby.com.au/efe/
Cookie: testcookie=testcookie
Connection: keep-alive
Cache-Control: no-cache
Referer: http://sciencelobby.com.au/efe/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Fri, 22 Jun 2018 13:44:03 GMT
Last-Modified: Sun, 05 Mar 2017 05:12:14 GMT
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "ec749-410-549f4d2616780"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=99
Content-Length: 1040

GET
H2

200

Prefetch.aspx
portal.office.com/Prefetch/ Frame 3D4F
Redirect Chain

https://portal.microsoftonline.com/Prefetch/Prefetch.aspx
https://portal.office.com/Prefetch/Prefetch.aspx

0
0

100ms
44ms

Document
text/html

2620:1ec:4::156
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://portal.office.com/Prefetch/Prefetch.aspx

Requested by

Host: sciencelobby.com.au
URL: http://sciencelobby.com.au/efe/

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:1ec:4::156 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: portal.office.com
:scheme: https
:path: /Prefetch/Prefetch.aspx
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: http://sciencelobby.com.au/efe/
accept-encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: FF543CE0F1B937BCAC9FE3F5244AEBFF
Referer: http://sciencelobby.com.au/efe/

Response headers

status: 200
cache-control: no-store, no-cache,no-store, no-cache
content-length: 3238
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
set-cookie: s.SessID=4d1c2286-3dde-4d6c-b135-c7d471e1f7b1; path=/; secure; HttpOnly s.SessID=4d1c2286-3dde-4d6c-b135-c7d471e1f7b1; path=/; secure; HttpOnly p.PersID=dc57a57f-b726-4257-8339-47d8d27ffbac; expires=Sat, 20-Jul-2019 13:44:03 GMT; path=/; secure; HttpOnly
strict-transport-security: max-age=31536000
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-content-type-options: nosniff
x-ua-compatible: IE=Edge
x-msedge-ref: Ref A: D676EC4DC86C484991A6167832DFC78F Ref B: AMS04EDGE0419 Ref C: 2018-06-22T13:44:03Z
date: Fri, 22 Jun 2018 13:44:02 GMT

Redirect headers

status: 302
cache-control: no-store, no-cache
content-type: text/html; charset=utf-8
location: https://portal.office.com/Prefetch/Prefetch.aspx
server: Microsoft-IIS/10.0
set-cookie: s.SessID=647c4bfe-b01b-4dd1-ab7a-95c92db47e5f; path=/; secure; HttpOnly
x-powered-by: ASP.NET
x-content-type-options: nosniff
x-ua-compatible: IE=Edge
date: Fri, 22 Jun 2018 13:44:02 GMT
content-length: 165

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

33 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| pageOnReady object| MSLogin object| proxy object| ErrorCodes object| Constants object| Context object| Background object| Logo object| Instrument object| User object| tenant_info object| EmailDiscovery function| origHide function| origShow function| origAddClass function| origRemoveClass object| Support object| MSLogout object| ThirdPartyCookieStates object| PostType object| LoginOption object| Post object| TenantBranding object| users object| Tiles object| $Debug object| $Api object| jQuery111206370923703015927 object| StrongAuthCheck object| Util object| WindowsBrowserSso

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			outlook.office365.com/	1970-01-19 01:40:11	Name: ClientId Value: CF2EC7414AE44B6DBA8EC15F00C35CA3
			www.office.com/	1969-12-31 23:59:59	Name: OH.SID Value: ebd4569a-f661-4e06-bf67-5cc304a438dc
			www.office.com/	1969-12-31 23:59:59	Name: OH.DCAffinity Value: OH-weu
			outlook.office365.com/	1970-01-18 21:18:06	Name: OIDC Value: 1
			.office.com/	1970-01-19 02:16:11	Name: MUID Value: 2244688D8359623C06FE649B824763C9

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

portal.microsoftonline.com
portal.office.com
sciencelobby.com.au
2620:1ec:4::156
27.121.66.12
2a01:111:f100:8000::4134:941b
215db880f45aef451f323902b89282098e2745040451bb7dac9a26fcc7ee468d
7b92492631e438df49e870d96307cc5877a64bbef8bcee17475cdab41de33b23
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
91c2b74542e11d0278e02715a980b39582eae2e3b519ddd2d4f9ca939e58109c
988e349f2bf4e87154738c7b2c1fa86618713a8cfa0cef60a046f5add89bd9de
b5ea0ffbe39f577651336a1aba7746881cf235b9f7ccc1c51b151162b3da4feb
d97274b02ba4f21d104a254ddcba70fe1831f8780fdd38a8ff8745db7e9ca2fd
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603