wiganparishchurch.org
Open in
urlscan Pro
192.254.235.39
Malicious Activity!
Public Scan
URL:
http://wiganparishchurch.org/secure/newoffice/index.htm
Submission: On September 08 via automatic, source openphish — Scanned from DE
Submission: On September 08 via automatic, source openphish — Scanned from DE
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 9 HTTP transactions.
The main IP is 192.254.235.39, located in
United States and
belongs to UNIFIEDLAYER-AS-1, US.
The main domain is wiganparishchurch.org.
This is the only time wiganparishchurch.org was scanned on urlscan.io!
This is the only time wiganparishchurch.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 192.254.235.39 192.254.235.39 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
| 8 | 2a02:26f0:480... 2a02:26f0:480:981::35c1 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 9 | 2 |
1
192.254.235.39
(United States)
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 192-254-235-39.unifiedlayer.com
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 192-254-235-39.unifiedlayer.com
| wiganparishchurch.org |
8
2a02:26f0:480:981::35c1
(Frankfurt am Main, Germany)
ASN20940 (AKAMAI-ASN1, NL)
ASN20940 (AKAMAI-ASN1, NL)
| secure.aadcdn.microsoftonline-p.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 8 |
microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com — Cisco Umbrella Rank: 15346 |
428 KB |
| 1 |
wiganparishchurch.org
wiganparishchurch.org |
8 KB |
| 9 | 2 |
| Domain | Requested by | |
|---|---|---|
| 8 | secure.aadcdn.microsoftonline-p.com |
wiganparishchurch.org
|
| 1 | wiganparishchurch.org | |
| 9 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.microsoft.com |
| privacy.microsoft.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| secure.aadcdn.microsoftonline-p.com Microsoft Azure TLS Issuing CA 06 |
2022-10-21 - 2023-10-16 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://wiganparishchurch.org/secure/newoffice/index.htm
Frame ID: 84643FC80D5833D91C53D83A9786AB95
Requests: 9 HTTP requests in this frame
2 Outgoing links
These are links going to different origins than the main page.
URL: https://www.microsoft.com/en-US/servicesagreement/
Title: Terms of use
Title: Terms of use
Search URL Search Domain Scan URL
URL: https://privacy.microsoft.com/en-US/privacystatement
Title: Privacy & cookies
Title: Privacy & cookies
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
index.htm
wiganparishchurch.org/secure/newoffice/ |
21 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
converged.v2.login.min.css
secure.aadcdn.microsoftonline-p.com/ests/2.1.7651.13/content/cdnbundles/ |
91 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
convergedlogin_pcore.min.js
secure.aadcdn.microsoftonline-p.com/ests/2.1.7651.13/content/cdnbundles/ |
458 KB 122 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
convergedloginpaginatedstrings-en.min.js
secure.aadcdn.microsoftonline-p.com/ests/2.1.7651.13/content/cdnbundles/ |
16 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
microsoft_logo.svg
secure.aadcdn.microsoftonline-p.com/ests/2.1.7651.13/content/images/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ellipsis_white.svg
secure.aadcdn.microsoftonline-p.com/ests/2.1.7651.13/content/images/ |
915 B 641 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ellipsis_grey.svg
secure.aadcdn.microsoftonline-p.com/ests/2.1.7651.13/content/images/ |
915 B 641 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
0-small.jpg
secure.aadcdn.microsoftonline-p.com/ests/2.1.7651.13/content/images/backgrounds/ |
3 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
0.jpg
secure.aadcdn.microsoftonline-p.com/ests/2.1.7651.13/content/images/backgrounds/ |
277 KB 277 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| webpackJsonp object| StringRepository boolean| __0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
secure.aadcdn.microsoftonline-p.com
wiganparishchurch.org
192.254.235.39
2a02:26f0:480:981::35c1
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
7ce316d179eadf0fffdf5822900c2ffdac69ead026cf7c7ea2f36f2404ca2e16
87777b3677853f4b1eba5d12efc828fe84d49781a077d10dfddc991e974399bb
af45f5b99a5a0cb6a535ef09befc2c9cc4cff031ce99cb223d39a82b184ba7cf
b7d3e41a051f9d67c8f9d12f82239d0d69d568454042f2eb6cc0e80da43b9569
f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea