urlscan.io logo urlscan.io
SecurityTrails logo

signin.microsofonilne.com Open in urlscan Pro
35.154.25.20  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://u7623503.ct.sendgrid.net/wf/click?upn=I4gcN7D3FJFHnDA9F8PoSF2LfxnNebgQtzG8S3qdQBCiYCReh7-2FG7fwieygaTBN9078NQzUiYwKlI1zzX...
Effective URL: http://signin.microsofonilne.com/?rid=DDMtw8N
Submission: On March 19 via manual from SG
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 6 domains to perform 7 HTTP transactions. The main IP is 35.154.25.20, located in Mumbai, India and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is signin.microsofonilne.com.
This is the only time signin.microsofonilne.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 167.89.123.16 11377 (SENDGRID)
1 2 35.154.25.20 16509 (AMAZON-02)
2 209.197.3.15 20446 (HIGHWINDS3)
2 169.61.12.124 36351 (SOFTLAYER)
1 205.185.208.52 20446 (HIGHWINDS3)
1 2606:4700::68... 13335 (CLOUDFLAR...)
7 5
1    167.89.123.16 (Denver, United States)

ASN11377 (SENDGRID - SendGrid, Inc., US)
PTR: o16789123x16.outbound-mail.sendgrid.net
u7623503.ct.sendgrid.net
2    35.154.25.20 (Mumbai, India)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-35-154-25-20.ap-south-1.compute.amazonaws.com
signin.microsofonilne.com
2    209.197.3.15 (Phoenix, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip0x00f.map2.ssl.hwcdn.net
stackpath.bootstrapcdn.com
2    169.61.12.124 (United States)

ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US)
PTR: 7c.0c.3da9.ip4.static.sl-reverse.com
awareness.threatcop.ai
1    205.185.208.52 (Phoenix, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip052.ssl.hwcdn.net
code.jquery.com
1    2606:4700::6813:c797 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdnjs.cloudflare.com
Domain Requested by
2 awareness.threatcop.ai signin.microsofonilne.com
2 stackpath.bootstrapcdn.com signin.microsofonilne.com
2 signin.microsofonilne.com 1 redirects
1 cdnjs.cloudflare.com signin.microsofonilne.com
1 code.jquery.com signin.microsofonilne.com
1 u7623503.ct.sendgrid.net 1 redirects
7 6

This site contains no links.

Subject Issuer Validity Valid
*.bootstrapcdn.com
COMODO RSA Domain Validation Secure Server CA		 2018-10-03 -
2019-10-12		 a year crt.sh
awareness.threatcop.ai
Let's Encrypt Authority X3		 2019-01-23 -
2019-04-23		 3 months crt.sh
jquery.org
COMODO RSA Domain Validation Secure Server CA		 2018-10-17 -
2020-10-16		 2 years crt.sh
ssl412106.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-03-02 -
2019-09-08		 6 months crt.sh

This page contains 1 frames:

Primary Page: http://signin.microsofonilne.com/?rid=DDMtw8N
Frame ID: 00D17C40EC047BAB372EABE773052ED2
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://u7623503.ct.sendgrid.net/wf/click?upn=I4gcN7D3FJFHnDA9F8PoSF2LfxnNebgQtzG8S3qdQBCiYCReh7-2FG7fwieygaT... HTTP 302
    http://signin.microsofonilne.com/?rid=DDMtw8N&first=1 HTTP 302
    http://signin.microsofonilne.com/?rid=DDMtw8N Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /Ubuntu/i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
  • script /jquery.*\.js/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i
  • script /(?:twitter\.github\.com\/bootstrap|bootstrap(?:\.js|\.min\.js))/i

Page Statistics

7
Requests

86 %
HTTPS

17 %
IPv6

6
Domains

6
Subdomains

5
IPs

2
Countries

666 kB
Transfer

887 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://u7623503.ct.sendgrid.net/wf/click?upn=I4gcN7D3FJFHnDA9F8PoSF2LfxnNebgQtzG8S3qdQBCiYCReh7-2FG7fwieygaTBN9078NQzUiYwKlI1zzXjHtEw-3D-3D_dEUy66JE6umJK7q2AQXWWc92M7bjovNK1AVTHQbBSFYXEdjkfTXxDB6cH6GtEbu06Y1uj09MdeXhg4Z-2FGzQSRX1E4Dwc89j7KzbKbq8WN8iJvyuIvPUflka5-2BeLsvEyXyjX42SSx2KIkXFxkIeFPKjDndksl1FWZG2I-2BrQTDy5uml6ypaeOQ-2BxG1DcVzFYjQXGH182GyLqdYM6-2FQRsf7-2FqLdgsV0Gz6m-2BqHft4iS9WQ-3D HTTP 302
    http://signin.microsofonilne.com/?rid=DDMtw8N&first=1 HTTP 302
    http://signin.microsofonilne.com/?rid=DDMtw8N Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
signin.microsofonilne.com/
Redirect Chain
  • https://u7623503.ct.sendgrid.net/wf/click?upn=I4gcN7D3FJFHnDA9F8PoSF2LfxnNebgQtzG8S3qdQBCiYCReh7-2FG7fwieygaTBN9078NQzUiYwKlI1zzXjHtEw-3D-3D_dEUy66JE6umJK7q2AQXWWc92M7bjovNK1AVTHQbBSFYXEdjkfTXxDB6c...
  • http://signin.microsofonilne.com/?rid=DDMtw8N&first=1
  • http://signin.microsofonilne.com/?rid=DDMtw8N
3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://signin.microsofonilne.com/?rid=DDMtw8N
Protocol
HTTP/1.1
Server
35.154.25.20 Mumbai, India, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-154-25-20.ap-south-1.compute.amazonaws.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
78fd957f0503e8fcf2b24848b3b7ad693edb0914c12bfe23b587cc73334c22dd
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Host
signin.microsofonilne.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Cookie
connect.sid=s%3ACLLUrf0IweIvOBwU1AoigF5QV1wh5-8Z.7Y2w%2FAt16oMsqQULJYQ7l9YcrKzQHvOqlPvsRPHXvTs
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server
nginx/1.14.0 (Ubuntu)
Date
Tue, 19 Mar 2019 09:00:32 GMT
Content-Type
text/html; charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive
X-DNS-Prefetch-Control
off
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=15552000; includeSubDomains
X-Download-Options
noopen
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
ETag
W/"d3d-KunPprMgd9GZPdLkkRlWJ5o+SjQ"
Content-Encoding
gzip

Redirect headers

Server
nginx/1.14.0 (Ubuntu)
Date
Tue, 19 Mar 2019 09:00:32 GMT
Content-Type
text/html; charset=utf-8
Content-Length
70
Connection
keep-alive
X-DNS-Prefetch-Control
off
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=15552000; includeSubDomains
X-Download-Options
noopen
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Location
/?rid=DDMtw8N
Vary
Accept
set-cookie
connect.sid=s%3ACLLUrf0IweIvOBwU1AoigF5QV1wh5-8Z.7Y2w%2FAt16oMsqQULJYQ7l9YcrKzQHvOqlPvsRPHXvTs; Path=/; HttpOnly
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.1.3/css/ 		138 KB
21 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/css/bootstrap.min.css
Requested by
Host: signin.microsofonilne.com
URL: http://signin.microsofonilne.com/?rid=DDMtw8N
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.197.3.15 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
vip0x00f.map2.ssl.hwcdn.net
Software
/
Resource Hash
7928b5ab63c6e89ee0ee26f5ef201a58c72baf91abb688580a1aa26eb57b3c11

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://signin.microsofonilne.com/?rid=DDMtw8N
Origin
http://signin.microsofonilne.com

Response headers

date
Tue, 19 Mar 2019 09:00:32 GMT
content-encoding
gzip
last-modified
Wed, 12 Dec 2018 18:34:11 GMT
access-control-allow-origin
*
etag
"1544639651"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
status
200
cache-control
public, max-age=31536000
x-hello-human
Say hello back! @getBootstrapCDN on Twitter
accept-ranges
bytes
timing-allow-origin
*
content-length
21050
microsoft_logo.png
awareness.threatcop.ai/ 		67 KB
68 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://awareness.threatcop.ai/microsoft_logo.png
Requested by
Host: signin.microsofonilne.com
URL: http://signin.microsofonilne.com/?rid=DDMtw8N
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.61.12.124 , United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
7c.0c.3da9.ip4.static.sl-reverse.com
Software
Apache /
Resource Hash
ada2c3079a27b5b42ddf0990d076bcfd18e7c171636808429d613cd0d36de743

Request headers

Referer
http://signin.microsofonilne.com/?rid=DDMtw8N
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 19 Mar 2019 09:00:32 GMT
Last-Modified
Sat, 02 Feb 2019 08:44:55 GMT
Server
Apache
ETag
"10d43-580e54612a20a"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
68931
jquery-3.3.1.min.js
code.jquery.com/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.3.1.min.js
Requested by
Host: signin.microsofonilne.com
URL: http://signin.microsofonilne.com/?rid=DDMtw8N
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.185.208.52 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
vip052.ssl.hwcdn.net
Software
nginx /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://signin.microsofonilne.com/?rid=DDMtw8N
Origin
http://signin.microsofonilne.com

Response headers

Date
Tue, 19 Mar 2019 09:00:32 GMT
Content-Encoding
gzip
Last-Modified
Sat, 20 Jan 2018 17:26:44 GMT
Server
nginx
ETag
W/"5a637bd4-1538f"
Vary
Accept-Encoding
X-HW
1552986032.dop037.fr8.t,1552986032.cds008.fr8.shn,1552986032.cds008.fr8.c
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000, public
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
30288
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.3/umd/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.3/umd/popper.min.js
Requested by
Host: signin.microsofonilne.com
URL: http://signin.microsofonilne.com/?rid=DDMtw8N
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c797 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7cbc01a310318defd4e31e4616543e2cf3baef5a47562c73ece4c0b716f157e
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://signin.microsofonilne.com/?rid=DDMtw8N
Origin
http://signin.microsofonilne.com

Response headers

date
Tue, 19 Mar 2019 09:00:32 GMT
content-encoding
br
cf-cache-status
HIT
status
200
strict-transport-security
max-age=15780000; includeSubDomains
last-modified
Thu, 17 May 2018 09:25:14 GMT
server
cloudflare
etag
W/"5afd4a7a-4f71"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
expires
Sun, 08 Mar 2020 09:00:32 GMT
cache-control
public, max-age=30672000
cf-ray
4b9e41addcdf96be-FRA
served-in-seconds
0.001
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ 		50 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Requested by
Host: signin.microsofonilne.com
URL: http://signin.microsofonilne.com/?rid=DDMtw8N
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.197.3.15 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
vip0x00f.map2.ssl.hwcdn.net
Software
/
Resource Hash
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://signin.microsofonilne.com/?rid=DDMtw8N
Origin
http://signin.microsofonilne.com

Response headers

date
Tue, 19 Mar 2019 09:00:32 GMT
content-encoding
gzip
last-modified
Wed, 12 Dec 2018 18:33:54 GMT
access-control-allow-origin
*
etag
"1544639634"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
status
200
cache-control
public, max-age=31536000
x-hello-human
Say hello back! @getBootstrapCDN on Twitter
accept-ranges
bytes
timing-allow-origin
*
content-length
14090
bk.png
awareness.threatcop.ai/ 		524 KB
524 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://awareness.threatcop.ai/bk.png
Requested by
Host: signin.microsofonilne.com
URL: http://signin.microsofonilne.com/?rid=DDMtw8N
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.61.12.124 , United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
7c.0c.3da9.ip4.static.sl-reverse.com
Software
Apache /
Resource Hash
ad24898d24b54cde95f9e64a38db2265c018d9d38257ff6fc33050f8c35ab63d

Request headers

Referer
http://signin.microsofonilne.com/?rid=DDMtw8N
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 19 Mar 2019 09:00:32 GMT
Last-Modified
Fri, 28 Dec 2018 10:47:01 GMT
Server
Apache
ETag
"8309b-57e12c87b3f48"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
536731

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| Popper object| bootstrap

1 Cookies

Domain/Path Name / Value
signin.microsofonilne.com/ Name: connect.sid
Value: s%3ACLLUrf0IweIvOBwU1AoigF5QV1wh5-8Z.7Y2w%2FAt16oMsqQULJYQ7l9YcrKzQHvOqlPvsRPHXvTs

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block