office365live.ayerdiamonds.com

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 6 HTTP transactions. The main IP is 204.93.177.101, located in Chicago, United States and belongs to SERVERCENTRAL - Server Central Network, US. The main domain is office365live.ayerdiamonds.com.

This is the only time office365live.ayerdiamonds.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
3	204.93.177.101 204.93.177.101	23352 (SERVERCEN...) (SERVERCENTRAL - Server Central Network)
2	205.185.216.42 205.185.216.42	20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group)
1	172.217.23.170 172.217.23.170	15169 (GOOGLE) (GOOGLE - Google LLC)
6	3

3 204.93.177.101 (Chicago, United States)

ASN23352 (SERVERCENTRAL - Server Central Network, US)
PTR: rs101.nsresponse.com

office365live.ayerdiamonds.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 205.185.216.42 (Phoenix, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: map2.hwcdn.net

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.23.170 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s22-in-f10.1e100.net

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	ayerdiamonds.com office365live.ayerdiamonds.com	287 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com	30 KB
1	googleapis.com ajax.googleapis.com	30 KB
6	3

	Domain	Requested by
3	office365live.ayerdiamonds.com	office365live.ayerdiamonds.com
2	maxcdn.bootstrapcdn.com	office365live.ayerdiamonds.com
1	ajax.googleapis.com	office365live.ayerdiamonds.com
6	3

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://office365live.ayerdiamonds.com/
Frame ID: DAF186F74431C8748B1469B73B670D88
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js/i
env /^jQuery$/i

Twitter Bootstrap () Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i
script /(?:twitter\.github\.com\/bootstrap|bootstrap(?:\.js|\.min\.js))/i

Page Statistics

6
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

347 kB
Transfer

528 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
office365live.ayerdiamonds.com/ 3 KB
1 KB 235ms
117ms Document
text/html 204.93.177.101
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: http://office365live.ayerdiamonds.com/
Protocol: HTTP/1.1
Server: 204.93.177.101 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: rs101.nsresponse.com
Software: LiteSpeed /
Resource Hash: c56fa28f8ce9bb31541806258ad2e7c71e39b2f514bebf11a65005a556438835

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: office365live.ayerdiamonds.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Tue, 24 Apr 2018 17:21:35 GMT
Content-Encoding: gzip
Last-Modified: Tue, 24 Apr 2018 14:16:10 GMT
Server: LiteSpeed
Vary: Accept-Encoding
Content-Type: text/html
Connection: close
Accept-Ranges: bytes
Content-Length: 957

GET
H/1.1 200
OK bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 118 KB
20 KB 30ms
8ms Stylesheet
text/css 205.185.216.42
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Requested by: Host: office365live.ayerdiamonds.com
URL: http://office365live.ayerdiamonds.com/
Protocol: HTTP/1.1
Server: 205.185.216.42 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: map2.hwcdn.net
Software: /
Resource Hash: f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Request headers

Referer: http://office365live.ayerdiamonds.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Tue, 24 Apr 2018 17:21:35 GMT
Content-Encoding: gzip
Last-Modified: Tue, 20 Feb 2018 05:57:55 GMT
Connection: Keep-Alive
ETag: 1519106275
Vary: Accept-Encoding
X-Cache: HIT
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000
X-Hello-Human: Say hello back! @getBootstrapCDN on Twitter
Accept-Ranges: bytes
Content-Length: 19740

GET
S 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ 85 KB
30 KB 7ms
6ms Script
text/javascript 172.217.23.170
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js

Requested by

Host: office365live.ayerdiamonds.com
URL: http://office365live.ayerdiamonds.com/

Protocol

SPDY

Server

172.217.23.170 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f10.1e100.net

Software

sffe /

Resource Hash

87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://office365live.ayerdiamonds.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date: Thu, 01 Feb 2018 20:48:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7072362
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303433; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 30306
x-xss-protection: 1; mode=block
last-modified: Fri, 24 Mar 2017 20:55:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 01 Feb 2019 20:48:53 GMT

GET
H/1.1 200
OK bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ 36 KB
10 KB 34ms
9ms Script
application/javascript 205.185.216.42
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
Requested by: Host: office365live.ayerdiamonds.com
URL: http://office365live.ayerdiamonds.com/
Protocol: HTTP/1.1
Server: 205.185.216.42 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: map2.hwcdn.net
Software: /
Resource Hash: 53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef

Request headers

Referer: http://office365live.ayerdiamonds.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Tue, 24 Apr 2018 17:21:35 GMT
Content-Encoding: gzip
Last-Modified: Tue, 20 Feb 2018 05:58:03 GMT
Connection: Keep-Alive
ETag: 1519106283
Vary: Accept-Encoding
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000
X-Hello-Human: Say hello back! @getBootstrapCDN on Twitter
Accept-Ranges: bytes
Content-Length: 9832

GET
H/1.1 200
OK ccc.jpg
office365live.ayerdiamonds.com/ 9 KB
9 KB 263ms
130ms Image
image/jpeg 204.93.177.101
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://office365live.ayerdiamonds.com/ccc.jpg
Requested by: Host: office365live.ayerdiamonds.com
URL: http://office365live.ayerdiamonds.com/
Protocol: HTTP/1.1
Server: 204.93.177.101 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: rs101.nsresponse.com
Software: LiteSpeed /
Resource Hash: a1f4c4c3a2074697deb94ca2cbdbbf41f4866ad8a08bcc84d2a7826c1ce65d5c

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: office365live.ayerdiamonds.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://office365live.ayerdiamonds.com/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://office365live.ayerdiamonds.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Tue, 24 Apr 2018 17:21:35 GMT
Last-Modified: Tue, 24 Apr 2018 13:26:50 GMT
Server: LiteSpeed
Content-Type: image/jpeg
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 9026
Expires: Tue, 01 May 2018 17:21:35 GMT

GET
H/1.1 200
OK mmm.jpg
office365live.ayerdiamonds.com/ 277 KB
277 KB 217ms
107ms Image
image/jpeg 204.93.177.101
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://office365live.ayerdiamonds.com/mmm.jpg
Requested by: Host: office365live.ayerdiamonds.com
URL: http://office365live.ayerdiamonds.com/
Protocol: HTTP/1.1
Server: 204.93.177.101 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: rs101.nsresponse.com
Software: LiteSpeed /
Resource Hash: 211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: office365live.ayerdiamonds.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://office365live.ayerdiamonds.com/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://office365live.ayerdiamonds.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Tue, 24 Apr 2018 17:21:35 GMT
Last-Modified: Tue, 24 Apr 2018 13:15:16 GMT
Server: LiteSpeed
Content-Type: image/jpeg
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 283351
Expires: Tue, 01 May 2018 17:21:35 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
maxcdn.bootstrapcdn.com
office365live.ayerdiamonds.com
172.217.23.170
204.93.177.101
205.185.216.42
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
a1f4c4c3a2074697deb94ca2cbdbbf41f4866ad8a08bcc84d2a7826c1ce65d5c
c56fa28f8ce9bb31541806258ad2e7c71e39b2f514bebf11a65005a556438835
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

office365live.ayerdiamonds.com Open in urlscan Pro 204.93.177.101 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

6 Requests

0 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

347 kBTransfer

528 kBSize

0 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

office365live.ayerdiamonds.com Open in urlscan Pro
204.93.177.101 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

347 kB
Transfer

528 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!