militarplus.com Open in urlscan Pro
72.167.84.16 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://militarplus.com/m?c3Y9bzM2NV8xX3NwJnJhbmQ9VGtKUFF6Zz0mdWlkPVVTRVIxNzExMjAyNFUzODExMTc1Mw==N0123N
Effective URL:
https://militarplus.com/m/?c3Y9bzM2NV8xX3NwJnJhbmQ9VGtKUFF6Zz0mdWlkPVVTRVIxNzExMjAyNFUzODExMTc1Mw==N0123N
Submission: On January 08 via api (January 8th 2025, 4:51:28 pm UTC) from BR — Scanned from US

Summary HTTP 13 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 9 IPs in 1 countries across 8 domains to perform 13 HTTP transactions. The main IP is 72.167.84.16, located in United States and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is militarplus.com.
TLS certificate: Issued by R10 on November 10th 2024. Valid for: 3 months.

This is the only time militarplus.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 3	72.167.84.16 72.167.84.16	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
1	3.168.73.27 3.168.73.27	16509 (AMAZON-02) (AMAZON-02)
1	2600:141b:1c0... 2600:141b:1c00:2e::17d1:48c5	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
4	2620:1ec:bdf::40 2620:1ec:bdf::40	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2600:141b:1c0... 2600:141b:1c00:2e::17d1:48c7	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	2606:4700:440... 2606:4700:4400::ac40:9043	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:2800:11f... 2606:2800:11f:1cb7:261b:1f9c:2074:3c	15133 (EDGECAST) (EDGECAST)
1	2607:f8b0:400... 2607:f8b0:4006:81c::2003	15169 (GOOGLE) (GOOGLE)
13	9

3 72.167.84.16 (United States) 1 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: 16.84.167.72.host.secureserver.net

militarplus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.168.73.27 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-168-73-27.jfk50.r.cloudfront.net

cdn.socket.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:1c00:2e::17d1:48c5 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

www.w3schools.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:bdf::40 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
logincdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:1c00:2e::17d1:48c7 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

cdn-dynmedia-1.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9043 (United States)

ASN13335 (CLOUDFLARENET, US)

ih1.redbubble.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:11f:1cb7:261b:1f9c:2074:3c (United States)

ASN15133 (EDGECAST, US)

aadcdn.msftauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81c::2003 (United States)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	msauth.net aadcdn.msauth.net — Cisco Umbrella Rank: 871 logincdn.msauth.net — Cisco Umbrella Rank: 4454	6 KB
3	militarplus.com 1 redirects militarplus.com	15 KB
1	gstatic.com www.gstatic.com	3 KB
1	msftauth.net aadcdn.msftauth.net — Cisco Umbrella Rank: 876	1 KB
1	redbubble.net ih1.redbubble.net — Cisco Umbrella Rank: 26769	10 KB
1	microsoft.com cdn-dynmedia-1.microsoft.com — Cisco Umbrella Rank: 730	1 KB
1	w3schools.com www.w3schools.com — Cisco Umbrella Rank: 21781	5 KB
1	socket.io cdn.socket.io — Cisco Umbrella Rank: 38789	15 KB
13	8

	Domain	Requested by
3	aadcdn.msauth.net
3	militarplus.com	1 redirects militarplus.com
1	www.gstatic.com
1	aadcdn.msftauth.net
1	logincdn.msauth.net
1	ih1.redbubble.net
1	cdn-dynmedia-1.microsoft.com
1	www.w3schools.com	militarplus.com
1	cdn.socket.io	militarplus.com
13	9

This site contains links to these domains. Also see Links.

Domain
go.microsoft.com

Subject Issuer	Validity	Valid
www.militarplus.com R10	`2024-11-10` - `2025-02-08`	3 months	crt.sh
cdn.socket.io Amazon RSA 2048 M02	`2024-09-19` - `2025-10-16`	a year	crt.sh
www.w3schools.com R10	`2024-12-20` - `2025-03-20`	3 months	crt.sh
aadcdn.msauth.net DigiCert SHA2 Secure Server CA	`2024-10-29` - `2025-10-29`	a year	crt.sh
secure4s.scene7.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-12-16` - `2025-12-15`	a year	crt.sh
redbubble.net WE1	`2024-12-06` - `2025-03-06`	3 months	crt.sh
identitycdn.msauth.net Microsoft Azure RSA TLS Issuing CA 03	`2024-11-25` - `2025-05-24`	6 months	crt.sh
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA	`2024-05-25` - `2025-05-25`	a year	crt.sh
*.gstatic.com WR2	`2024-12-02` - `2025-02-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://militarplus.com/m/?c3Y9bzM2NV8xX3NwJnJhbmQ9VGtKUFF6Zz0mdWlkPVVTRVIxNzExMjAyNFUzODExMTc1Mw==N0123N
Frame ID: 0C151EE0721750AFED93A8EAFAACAE61
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Authenticating ...

Page URL History Show full URLs

https://militarplus.com/m?c3Y9bzM2NV8xX3NwJnJhbmQ9VGtKUFF6Zz0mdWlkPVVTRVIxNzExMjAyNFUzODExMTc1Mw==N0... HTTP 301
https://militarplus.com/m/?c3Y9bzM2NV8xX3NwJnJhbmQ9VGtKUFF6Zz0mdWlkPVVTRVIxNzExMjAyNFUzODExMTc1Mw==N... Page URL

Detected technologies

Socket.io (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

socket\.io.*\.js

Page Statistics

13
Requests

92 %
HTTPS

75 %
IPv6

8
Domains

9
Subdomains

9
IPs

1
Countries

57 kB
Transfer

220 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://go.microsoft.com/fwlink/?linkid=845480
Title: Privacy & Cookies

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://militarplus.com/m?c3Y9bzM2NV8xX3NwJnJhbmQ9VGtKUFF6Zz0mdWlkPVVTRVIxNzExMjAyNFUzODExMTc1Mw==N0123N HTTP 301
https://militarplus.com/m/?c3Y9bzM2NV8xX3NwJnJhbmQ9VGtKUFF6Zz0mdWlkPVVTRVIxNzExMjAyNFUzODExMTc1Mw==N0123N Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
militarplus.com/m/
Redirect Chain

https://militarplus.com/m?c3Y9bzM2NV8xX3NwJnJhbmQ9VGtKUFF6Zz0mdWlkPVVTRVIxNzExMjAyNFUzODExMTc1Mw==N0123N
https://militarplus.com/m/?c3Y9bzM2NV8xX3NwJnJhbmQ9VGtKUFF6Zz0mdWlkPVVTRVIxNzExMjAyNFUzODExMTc1Mw==N0123N

365 B
344 B

128ms
128ms

Document
text/html

72.167.84.16
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://militarplus.com/m/?c3Y9bzM2NV8xX3NwJnJhbmQ9VGtKUFF6Zz0mdWlkPVVTRVIxNzExMjAyNFUzODExMTc1Mw==N0123N
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.167.84.16 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: 16.84.167.72.host.secureserver.net
Software: Apache / PHP/8.1.31
Resource Hash: c07321843910d25f43168695f77d18a1ade886c81f38b0e8fbf1aaea34b3f783

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: br
content-length: 261
content-type: text/html; charset=UTF-8
date: Wed, 08 Jan 2025 16:51:23 GMT
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.1.31

Redirect headers

content-length: 313
content-type: text/html; charset=iso-8859-1
date: Wed, 08 Jan 2025 16:51:23 GMT
location: https://militarplus.com/m/?c3Y9bzM2NV8xX3NwJnJhbmQ9VGtKUFF6Zz0mdWlkPVVTRVIxNzExMjAyNFUzODExMTc1Mw==N0123N
server: Apache

GET
H2 200 socket.io.min.js Show response
cdn.socket.io/4.7.5/ 49 KB
15 KB 488ms
148ms Script
application/javascript 3.168.73.27
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.socket.io/4.7.5/socket.io.min.js

Requested by

Host: militarplus.com
URL: https://militarplus.com/m/?c3Y9bzM2NV8xX3NwJnJhbmQ9VGtKUFF6Zz0mdWlkPVVTRVIxNzExMjAyNFUzODExMTc1Mw==N0123N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.168.73.27 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-168-73-27.jfk50.r.cloudfront.net

Software

Vercel /

Resource Hash

73eba16bc895fdfa454e27ecb80def31ede8d861f99e175ff93b110eabec044f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://militarplus.com
Referer: https://militarplus.com/

Response headers

content-encoding: gzip
etag: W/"777eb8fd4f8320b6e5cc9a7159bdec6a"
age: 4758623
x-cache: Hit from cloudfront
x-amz-cf-id: RHnOF9SjPhLfcbXz794nodli4aGG126n6k9lwohCXS73gKaaD3BpcQ==
date: Thu, 02 Jan 2025 19:26:12 GMT
content-type: application/javascript; charset=utf-8
content-disposition: inline; filename="socket.io.min.js"
last-modified: Thu, 14 Nov 2024 15:01:00 GMT
strict-transport-security: max-age=63072000
cache-control: public, max-age=31536000, immutable
x-vercel-cache: HIT
via: 1.1 66c374ec2fe81f7f4706bf6c5b053668.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P9
server: Vercel
x-vercel-id: iad1::8xgg7-1735845972645-8456c991d4d9

GET
H2 200 jssp.js Show response
militarplus.com/m/ 121 KB
15 KB 107ms
106ms Script
text/javascript 72.167.84.16
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://militarplus.com/m/jssp.js
Requested by: Host: militarplus.com
URL: https://militarplus.com/m/?c3Y9bzM2NV8xX3NwJnJhbmQ9VGtKUFF6Zz0mdWlkPVVTRVIxNzExMjAyNFUzODExMTc1Mw==N0123N
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.167.84.16 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: 16.84.167.72.host.secureserver.net
Software: Apache /
Resource Hash: 0a2b7076f0192cb6f92de702f2722df26350c99a433684f35342a4c2130e83c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://militarplus.com/m/?c3Y9bzM2NV8xX3NwJnJhbmQ9VGtKUFF6Zz0mdWlkPVVTRVIxNzExMjAyNFUzODExMTc1Mw==N0123N

Response headers

content-encoding: br
etag: "1002d0-1e55c-628f5dbdca38c-br"
accept-ranges: bytes
content-length: 14780
date: Wed, 08 Jan 2025 16:51:23 GMT
last-modified: Wed, 11 Dec 2024 03:04:41 GMT
vary: Accept-Encoding
server: Apache
content-type: text/javascript

GET
H2 200 w3.css
www.w3schools.com/w3css/4/ 23 KB
5 KB 445ms
135ms Stylesheet
text/css 2600:141b:1c00:2e::17d1:48c5
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.w3schools.com/w3css/4/w3.css

Requested by

Host: militarplus.com
URL: https://militarplus.com/m/jssp.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:1c00:2e::17d1:48c5 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

c4f2aba13970ecf8303fb9329f97c8824861569273b0aa27acce48abc61d04f5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://mycourses.w3schools.com https://pathfinder.w3schools.com;
X-Content-Security-Policy	frame-ancestors 'self' https://mycourses.w3schools.com https://pathfinder.w3schools.com;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://militarplus.com/

Response headers

content-security-policy: frame-ancestors 'self' https://mycourses.w3schools.com https://pathfinder.w3schools.com;
cache-control: public, max-age=31513146
content-encoding: gzip
etag: "0c2b5743a60db1:0"
x-content-security-policy: frame-ancestors 'self' https://mycourses.w3schools.com https://pathfinder.w3schools.com;
expires: Thu, 08 Jan 2026 10:30:30 GMT
accept-ranges: bytes
content-length: 5256
date: Wed, 08 Jan 2025 16:51:24 GMT
content-type: text/css
last-modified: Mon, 06 Jan 2025 12:56:52 GMT
vary: Accept-Encoding

GET
H2 200 microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
aadcdn.msauth.net/shared/1.0/content/images/ 4 KB
2 KB 331ms
78ms Image
image/svg+xml 2620:1ec:bdf::40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://militarplus.com/

Response headers

access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DB5C3F4911527F
x-ms-lease-status: unlocked
x-fd-int-roxy-purgeid: 0
x-cache: TCP_HIT
date: Wed, 08 Jan 2025 16:51:24 GMT
content-type: image/svg+xml
last-modified: Wed, 24 May 2023 10:11:48 GMT
cache-control: public, max-age=31536000
x-ms-request-id: 10d18be2-001e-002e-5565-5be6fe000000
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1435
x-azure-ref: 20250108T165124Z-1868988d889hs5j6hC1LAXnqbn0000000tbg00000000q0m3
x-ms-blob-type: BlockBlob

GET
DATA 200
OK truncated
/ 568 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 03dc72b3a244c623d319d5f363335acad57b97b39fab945b020379dc10705a7e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 LinkNav-Microsoft-Outlook-75x75
cdn-dynmedia-1.microsoft.com/is/image/microsoftcorp/ 1 KB
1 KB 559ms
138ms Image
image/webp 2600:141b:1c00:2e::17d1:48c7
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-dynmedia-1.microsoft.com/is/image/microsoftcorp/LinkNav-Microsoft-Outlook-75x75

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:1c00:2e::17d1:48c7 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Unknown /

Resource Hash

0fe6aa8a56a4b66ba0b2d23c8af6f1f94a894e5525c5e193c7fd70ef05a7e5e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://militarplus.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "0b0d324d8294ab9e1c36efacb6276980"
x-adobe-smart-imaging: 1428
expires: Wed, 08 Jan 2025 22:16:21 GMT
access-control-allow-origin: *
content-length: 1246
date: Wed, 08 Jan 2025 16:51:24 GMT
akamai-grn: 0.4fa6d017.1736355084.6897ba31
last-modified: Sat, 15 May 2021 00:03:25 GMT
content-type: image/webp
server: Unknown
x-akamai-cache: Hit

GET
H2 200 raf,360x360,075,t,fafafa:ca443f4786.jpg
ih1.redbubble.net/image.3812524360.1168/ 9 KB
10 KB 253ms
90ms Image
image/jpeg 2606:4700:4400::ac40:9043
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ih1.redbubble.net/image.3812524360.1168/raf,360x360,075,t,fafafa:ca443f4786.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9043 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

48273ec7955de6b58e1ccbe7525dea9ad4ca5373f61ede3042d4722d0db7be92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://militarplus.com/

Response headers

x-request-id: a2e66341-f27a-4fc9-9f3a-1fc7bef390e0
access-control-expose-headers: Content-Length,Content-Range
cf-bgj: h2pri
etag: W/"48273ec7955de6b58e1ccbe7525dea9a"
age: 1768424
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
access-control-allow-methods: GET, OPTIONS
x-content-type-options: nosniff
date: Wed, 08 Jan 2025 16:51:24 GMT
content-type: image/jpeg
content-disposition: inline
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=31556952, public
content-transfer-encoding: binary
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8fedb12becbacba2-LAX
access-control-allow-origin: https://www.redbubble.com
x-xss-protection: 1; mode=block
server: cloudflare

GET
H2 200 picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg
aadcdn.msauth.net/shared/1.0/content/images/ 7 KB
3 KB 331ms
80ms Image
image/svg+xml 2620:1ec:bdf::40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://militarplus.com/

Response headers

access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DB5C3F499A9B99
x-ms-lease-status: unlocked
x-fd-int-roxy-purgeid: 0
x-cache: TCP_HIT
date: Wed, 08 Jan 2025 16:51:24 GMT
content-type: image/svg+xml
last-modified: Wed, 24 May 2023 10:11:49 GMT
cache-control: public, max-age=31536000
x-ms-request-id: 0142d6ea-401e-0069-2824-5bc5b7000000
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2407
x-azure-ref: 20250108T165124Z-1868988d889hs5j6hC1LAXnqbn0000000tbg00000000q0m4
x-ms-blob-type: BlockBlob

GET
H2 200 arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
logincdn.msauth.net/shared/1.0/content/images/ 513 B
824 B 341ms
89ms Image
image/svg+xml 2620:1ec:bdf::40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://militarplus.com/

Response headers

access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8D79ED35591CF44
x-ms-lease-status: unlocked
x-fd-int-roxy-purgeid: 79218156
x-cache: TCP_HIT
date: Wed, 08 Jan 2025 16:51:24 GMT
content-type: image/svg+xml
last-modified: Wed, 22 Jan 2020 00:38:00 GMT
cache-control: public, max-age=31536000
x-ms-request-id: faa0143d-201e-0040-2ebd-60fbc3000000
accept-ranges: bytes
access-control-allow-origin: *
content-length: 276
x-azure-ref: 20250108T165124Z-1868988d889x92xjhC1LAXbdys0000000rv00000000025m6
x-ms-blob-type: BlockBlob

GET
H2 200 picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg
aadcdn.msftauth.net/shared/1.0/content/images/ 2 KB
1 KB 310ms
72ms Image
image/svg+xml 2606:2800:11f:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lac/55B8) /
Resource Hash: cbb3706e65b35a43bdcfebd23b5479dc0542ca7e23197869b683d12b524472fe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://militarplus.com/

Response headers

content-md5: 1jQlecEJaGhFO2st5KXLhg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-lease-status: unlocked
etag: 0x8DB5C3F4AC59B47
age: 25073018
x-ms-version: 2009-09-19
x-cache: HIT
date: Wed, 08 Jan 2025 16:51:24 GMT
content-type: image/svg+xml
last-modified: Wed, 24 May 2023 10:11:51 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
x-ms-request-id: 623135c3-801e-002b-5de3-7dee02000000
accept-ranges: bytes
access-control-allow-origin: *
content-length: 790
x-ms-blob-type: BlockBlob
server: ECAcc (lac/55B8)

GET
H2 200 picker_verify_sms_12b7d768ba76f2e782cc74e328171091.svg
aadcdn.msauth.net/shared/1.0/content/images/ 250 B
741 B 330ms
79ms Image
image/svg+xml 2620:1ec:bdf::40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_sms_12b7d768ba76f2e782cc74e328171091.svg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 8ed8f3acb9b87f99e42c74463d4e2be96ee85b8a87cd6eb874295ace420a5904

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://militarplus.com/

Response headers

access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DB5C3F49C21D98
x-ms-lease-status: unlocked
x-fd-int-roxy-purgeid: 0
x-cache: TCP_HIT
date: Wed, 08 Jan 2025 16:51:24 GMT
content-type: image/svg+xml
last-modified: Wed, 24 May 2023 10:11:49 GMT
cache-control: public, max-age=31536000
x-ms-request-id: 5131ee55-d01e-0068-0824-5ba5c6000000
accept-ranges: bytes
access-control-allow-origin: *
content-length: 199
x-azure-ref: 20250108T165124Z-1868988d889hs5j6hC1LAXnqbn0000000tbg00000000q0m5
x-ms-blob-type: BlockBlob

GET
H2 200 logo_48.png
www.gstatic.com/recaptcha/api2/ 2 KB
3 KB 425ms
137ms Image
image/png 2607:f8b0:4006:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://militarplus.com/

Response headers

age: 13288
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
x-content-type-options: nosniff
expires: Wed, 15 Jan 2025 13:09:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 08 Jan 2025 13:09:56 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: image/png
cache-control: public, max-age=604800
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
accept-ranges: bytes
content-length: 2228
x-xss-protection: 0
server: sffe

GET favicon.ico
militarplus.com/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: militarplus.com
URL: https://militarplus.com/favicon.ico

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| io function| _0x2533 function| _0x248e

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.redbubble.net/	1970-01-21 02:19:16	Name: __cf_bm Value: 3rbIWvdlCkgd4iu53FtdsI1gUJhL.2VbdSGAVoL1ysM-1736355084-1.0.1.1-Rzt8fiPd7.avSO_WwhCnbH6jGErPUG78IudTjE1YQtX8Rbl_yxaQRCP1QGX4JzdeiHBtBSz9yZF4u3ZMDT221Q

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://militarplus.com/m/?c3Y9bzM2NV8xX3NwJnJhbmQ9VGtKUFF6Zz0mdWlkPVVTRVIxNzExMjAyNFUzODExMTc1Mw==N0123N Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
aadcdn.msftauth.net
cdn-dynmedia-1.microsoft.com
cdn.socket.io
ih1.redbubble.net
logincdn.msauth.net
militarplus.com
www.gstatic.com
www.w3schools.com
militarplus.com
2600:141b:1c00:2e::17d1:48c5
2600:141b:1c00:2e::17d1:48c7
2606:2800:11f:1cb7:261b:1f9c:2074:3c
2606:4700:4400::ac40:9043
2607:f8b0:4006:81c::2003
2620:1ec:bdf::40
3.168.73.27
72.167.84.16
03dc72b3a244c623d319d5f363335acad57b97b39fab945b020379dc10705a7e
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0a2b7076f0192cb6f92de702f2722df26350c99a433684f35342a4c2130e83c0
0fe6aa8a56a4b66ba0b2d23c8af6f1f94a894e5525c5e193c7fd70ef05a7e5e6
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
48273ec7955de6b58e1ccbe7525dea9ad4ca5373f61ede3042d4722d0db7be92
73eba16bc895fdfa454e27ecb80def31ede8d861f99e175ff93b110eabec044f
8ed8f3acb9b87f99e42c74463d4e2be96ee85b8a87cd6eb874295ace420a5904
a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8
c07321843910d25f43168695f77d18a1ade886c81f38b0e8fbf1aaea34b3f783
c4f2aba13970ecf8303fb9329f97c8824861569273b0aa27acce48abc61d04f5
cbb3706e65b35a43bdcfebd23b5479dc0542ca7e23197869b683d12b524472fe

militarplus.com Open in urlscan Pro 72.167.84.16 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

92 %HTTPS

75 %IPv6

8 Domains

9 Subdomains

9 IPs

1 Countries

57 kBTransfer

220 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

militarplus.com Open in urlscan Pro
72.167.84.16 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

92 %
HTTPS

75 %
IPv6

8
Domains

9
Subdomains

9
IPs

1
Countries

57 kB
Transfer

220 kB
Size

1
Cookies

13 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!