funksa7.blob.core.windows.net Open in urlscan Pro
13.77.112.132  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://home-3.azurewebsites.net/201995VINCI-FACILITIES1759VINCI-FACILITIES1759 Page URL
2. https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	404 Not Found	Cookie set 201995VINCI-FACILITIES1759VINCI-FACILITIES1759 Show response home-3.azurewebsites.net/	2 KB 2 KB	777ms 245ms	Document text/html	52.173.28.95 Microsoft Corpora...
General Check archive.org Show headers Download Go to Full URL https://home-3.azurewebsites.net/201995VINCI-FACILITIES1759VINCI-FACILITIES1759 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.173.28.95 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US), Reverse DNS Software Microsoft-IIS/10.0 / PHP/7.0.33 ASP.NET Resource Hash 35cbf9582821d77ad709391a5784e97becc15f7d8a7d3e70b46ef8456bc16b1f Request headers Host home-3.azurewebsites.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Cache-Control no-cache, must-revalidate, max-age=0 Content-Length 1587 Content-Type text/html; charset=UTF-8 Expires Wed, 11 Jan 1984 05:00:00 GMT Server Microsoft-IIS/10.0 X-Powered-By PHP/7.0.33 ASP.NET Link <https://home-3.azurewebsites.net/wp-json/>; rel="https://api.w.org/" Set-Cookie ARRAffinity=baac66d472b9a4a5f5ad4012f21f60dec486d0140a2bd5f5a262a03bca0873ee;Path=/;HttpOnly;Domain=home-3.azurewebsites.net Date Fri, 05 Apr 2019 10:05:13 GMT
GET H/1.1	200 OK	jquery-3.3.1.slim.min.js Show response code.jquery.com/	68 KB 24 KB	64ms 20ms	Script application/javascript	205.185.208.52 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.3.1.slim.min.js Requested by Host: home-3.azurewebsites.net URL: https://home-3.azurewebsites.net/201995VINCI-FACILITIES1759VINCI-FACILITIES1759 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 205.185.208.52 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US), Reverse DNS vip052.ssl.hwcdn.net Software nginx / Resource Hash dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer https://home-3.azurewebsites.net/201995VINCI-FACILITIES1759VINCI-FACILITIES1759 Origin https://home-3.azurewebsites.net Response headers Date Fri, 05 Apr 2019 10:05:14 GMT Content-Encoding gzip Last-Modified Sat, 20 Jan 2018 17:26:44 GMT Server nginx ETag "5a637bd4-1111d" Vary Accept-Encoding X-HW 1554458714.dop007.pa1.shc,1554458714.dop007.pa1.t,1554458714.cds032.pa1.c Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control max-age=315360000, public Connection Keep-Alive Accept-Ranges bytes Content-Length 24038
GET H2	200	popper.min.js Show response cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/	20 KB 7 KB	35ms 33ms	Script application/javascript	2606:4700::6813:c597 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js Requested by Host: home-3.azurewebsites.net URL: https://home-3.azurewebsites.net/201995VINCI-FACILITIES1759VINCI-FACILITIES1759 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:c597 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5 Security Headers Name Value Strict-Transport-Security max-age=15780000; includeSubDomains Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer https://home-3.azurewebsites.net/201995VINCI-FACILITIES1759VINCI-FACILITIES1759 Origin https://home-3.azurewebsites.net Response headers date Fri, 05 Apr 2019 10:05:14 GMT content-encoding br cf-cache-status HIT status 200 strict-transport-security max-age=15780000; includeSubDomains last-modified Thu, 17 May 2018 09:26:22 GMT server cloudflare etag W/"5afd4abe-500f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript access-control-allow-origin * expires Wed, 25 Mar 2020 10:05:14 GMT cache-control public, max-age=30672000 cf-ray 4c2ab3d7fde697f8-FRA served-in-seconds 0.001
GET H2	200	bootstrap.min.js stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/	49 KB 14 KB	71ms 18ms	Script text/javascript	209.197.3.15 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js Requested by Host: home-3.azurewebsites.net URL: https://home-3.azurewebsites.net/201995VINCI-FACILITIES1759VINCI-FACILITIES1759 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 209.197.3.15 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US), Reverse DNS vip0x00f.map2.ssl.hwcdn.net Software / Resource Hash Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer https://home-3.azurewebsites.net/201995VINCI-FACILITIES1759VINCI-FACILITIES1759 Origin https://home-3.azurewebsites.net Response headers date Fri, 05 Apr 2019 10:05:14 GMT content-encoding gzip last-modified Wed, 12 Dec 2018 18:33:53 GMT access-control-allow-origin * etag "1544639633" vary Accept-Encoding x-cache HIT content-type text/javascript; charset=utf-8 status 200 cache-control public, max-age=31536000 x-hello-human Say hello back! @getBootstrapCDN on Twitter accept-ranges bytes timing-allow-origin * content-length 14038
GET H/1.1	200 OK	jquery-1.9.1.min.js code.jquery.com/	90 KB 32 KB	63ms 20ms	Script application/javascript	205.185.208.52 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-1.9.1.min.js Requested by Host: home-3.azurewebsites.net URL: https://home-3.azurewebsites.net/201995VINCI-FACILITIES1759VINCI-FACILITIES1759 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 205.185.208.52 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US), Reverse DNS vip052.ssl.hwcdn.net Software nginx / Resource Hash Request headers Referer https://home-3.azurewebsites.net/201995VINCI-FACILITIES1759VINCI-FACILITIES1759 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 05 Apr 2019 10:05:14 GMT Content-Encoding gzip Last-Modified Fri, 24 Oct 2014 00:16:07 GMT Server nginx ETag W/"54499a47-169d5" Vary Accept-Encoding X-HW 1554458714.dop007.pa1.shc,1554458714.dop007.pa1.t,1554458714.cds029.pa1.c Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control max-age=315360000, public Connection Keep-Alive Accept-Ranges bytes Content-Length 32772
GET H/1.1	200 OK	Primary Request update7.html Show response funksa7.blob.core.windows.net/owe7/	12 KB 12 KB	715ms 370ms	Document text/html	13.77.112.132 Microsoft Corpora...
General Check archive.org Show headers Download Go to Full URL https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b Requested by Host: home-3.azurewebsites.net URL: https://home-3.azurewebsites.net/201995VINCI-FACILITIES1759VINCI-FACILITIES1759 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 13.77.112.132 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash a04f45eddedb04362eb9b8679e3a355291e751a02866c3058dcaccb2d5a17ef0 Request headers Host funksa7.blob.core.windows.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Referer https://home-3.azurewebsites.net/201995VINCI-FACILITIES1759VINCI-FACILITIES1759 Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer https://home-3.azurewebsites.net/201995VINCI-FACILITIES1759VINCI-FACILITIES1759 Response headers Content-Length 12168 Content-Type text/html Last-Modified Fri, 05 Apr 2019 08:07:53 GMT Accept-Ranges bytes ETag "0x8D6B99DCE01ECC9" Server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id 559c54c6-101e-0014-6f97-eb7572000000 x-ms-version 2018-03-28 x-ms-creation-time Fri, 05 Apr 2019 08:07:53 GMT x-ms-lease-status unlocked x-ms-lease-state available x-ms-blob-type BlockBlob x-ms-server-encrypted true Date Fri, 05 Apr 2019 10:05:14 GMT
GET H2	200	bootstrap.min.css maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/	118 KB 19 KB	30ms 20ms	Stylesheet text/css	209.197.3.15 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css Requested by Host: funksa7.blob.core.windows.net URL: https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b Protocol H2 Security TLS 1.3, , AES_256_GCM Server 209.197.3.15 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US), Reverse DNS vip0x00f.map2.ssl.hwcdn.net Software / Resource Hash f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b Origin https://funksa7.blob.core.windows.net Response headers date Fri, 05 Apr 2019 10:05:15 GMT content-encoding gzip last-modified Wed, 12 Dec 2018 18:34:07 GMT access-control-allow-origin * etag "1544639647" vary Accept-Encoding x-cache HIT content-type text/css; charset=utf-8 status 200 cache-control public, max-age=31536000 x-hello-human Say hello back! @getBootstrapCDN on Twitter accept-ranges bytes timing-allow-origin * content-length 19740
GET H2	200	font-awesome.css cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/	37 KB 7 KB	20ms 12ms	Stylesheet text/css	2606:4700::6813:c597 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css Requested by Host: funksa7.blob.core.windows.net URL: https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:c597 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c Security Headers Name Value Strict-Transport-Security max-age=15780000; includeSubDomains Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b Origin https://funksa7.blob.core.windows.net Response headers date Fri, 05 Apr 2019 10:05:15 GMT content-encoding br cf-cache-status HIT status 200 strict-transport-security max-age=15780000; includeSubDomains last-modified Thu, 17 May 2018 09:19:53 GMT server cloudflare etag W/"5afd4939-9226" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * expires Wed, 25 Mar 2020 10:05:15 GMT cache-control public, max-age=30672000 cf-ray 4c2ab3dd4f0e97f8-FRA served-in-seconds 0.001
GET H2	200	font-awesome.min.css stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/	30 KB 7 KB	26ms 18ms	Stylesheet text/css	209.197.3.15 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css Requested by Host: funksa7.blob.core.windows.net URL: https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b Protocol H2 Security TLS 1.3, , AES_256_GCM Server 209.197.3.15 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US), Reverse DNS vip0x00f.map2.ssl.hwcdn.net Software / Resource Hash 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b Origin https://funksa7.blob.core.windows.net Response headers date Fri, 05 Apr 2019 10:05:15 GMT content-encoding gzip last-modified Wed, 12 Dec 2018 18:35:20 GMT access-control-allow-origin * etag "1544639720" vary Accept-Encoding x-cache HIT content-type text/css; charset=utf-8 status 200 cache-control public, max-age=31536000 x-hello-human Say hello back! @getBootstrapCDN on Twitter accept-ranges bytes timing-allow-origin * content-length 7050
GET H2	200	50026317_339286620241287_4340865794721185792_n.jpg scontent-hbe1-1.xx.fbcdn.net/v/t1.0-9/	3 KB 4 KB	233ms 66ms	Image image/jpeg	2a03:2880:f03b:1c:face:b00c:0:3 Facebook
General Check archive.org Show headers Download Go to Show image Full URL https://scontent-hbe1-1.xx.fbcdn.net/v/t1.0-9/50026317_339286620241287_4340865794721185792_n.jpg?_nc_cat=101&_nc_ht=scontent-hbe1-1.xx&oh=2714334079b2d8d37c17d916d3e2216c&oe=5CD2D594 Requested by Host: funksa7.blob.core.windows.net URL: https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f03b:1c:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software / Resource Hash 12ab0075b9ad760b303f755cdd32866b2ff83d13941d42c7ba644b3527307aa3 Request headers Referer https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers x-haystack-needlechecksum 3753426852 date Fri, 05 Apr 2019 10:05:15 GMT last-modified Mon, 07 Jan 2019 17:27:19 GMT access-control-allow-origin * content-type image/jpeg status 200 access-control-expose-headers X-FB-CEC-Video-Limit cache-control max-age=1209600, no-transform x-needle-checksum 2291052758 x-fb-config-version-olb-prod 469 timing-allow-origin * content-length 3412
GET H/1.1	200 OK	picker_account_aad.png secure.aadcdn.microsoftonline-p.com/ests/2.1.7230.10/content/images/	1 KB 1 KB	57ms 8ms	Image image/png	2a02:26f0:6c00:283::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.7230.10/content/images/picker_account_aad.png Requested by Host: funksa7.blob.core.windows.net URL: https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash a3ec79086c71191b0dbc128b397d1a27d132bd2b658667bc4229b53cbcb20b05 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 05 Apr 2019 10:05:15 GMT Last-Modified Sat, 03 Feb 2018 03:29:43 GMT Content-MD5 nciOew3+QXz8WWEjgXKGmA== Strict-Transport-Security max-age=31536000 Content-Type image/png Access-Control-Allow-Origin * Access-Control-Expose-Headers x-ms-request-id,x-ms-version,x-ms-lease-status,x-ms-blob-type Cache-Control public, max-age=265581 Connection keep-alive Content-Length 1082
GET H/1.1	200 OK	picker_more.png secure.aadcdn.microsoftonline-p.com/ests/2.1.7230.10/content/images/	192 B 613 B	55ms 7ms	Image image/png	2a02:26f0:6c00:283::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.7230.10/content/images/picker_more.png Requested by Host: funksa7.blob.core.windows.net URL: https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash 1b8e9869c33c1086478e807f8537b155c84660c631c830d6a83d83accfd1ed18 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 05 Apr 2019 10:05:15 GMT Last-Modified Sat, 03 Feb 2018 03:29:43 GMT Content-MD5 ztMxwTK195jx86s2cS1GCA== Strict-Transport-Security max-age=31536000 Content-Type image/png Access-Control-Allow-Origin * Access-Control-Expose-Headers x-ms-request-id,x-ms-version,x-ms-lease-status,x-ms-blob-type Cache-Control public, max-age=265581 Connection keep-alive Content-Length 192
GET H/1.1	200 OK	picker_account_add.svg secure.aadcdn.microsoftonline-p.com/ests/2.1.7230.10/content/images/	222 B 656 B	55ms 8ms	Image image/svg+xml	2a02:26f0:6c00:283::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.7230.10/content/images/picker_account_add.svg Requested by Host: funksa7.blob.core.windows.net URL: https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash 749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 05 Apr 2019 10:05:15 GMT Content-Encoding gzip Last-Modified Sat, 03 Feb 2018 03:29:43 GMT Content-MD5 ykuOnMaTo0vw2Gx/ZceiPg== Vary Accept-Encoding Strict-Transport-Security max-age=31536000 Content-Type image/svg+xml Access-Control-Allow-Origin * Access-Control-Expose-Headers x-ms-request-id,x-ms-version,x-ms-lease-status,x-ms-blob-type Cache-Control public, max-age=265581 Connection keep-alive Content-Length 184
GET H/1.1	200 OK	success-icon-10.png www.freeiconspng.com/uploads/	9 KB 9 KB	136ms 26ms	Image image/png	2a01:4f9:2a:f67::2 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.freeiconspng.com/uploads/success-icon-10.png Requested by Host: funksa7.blob.core.windows.net URL: https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a01:4f9:2a:f67::2 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software nginx / Resource Hash 43d7977e40842a30573239834df28dcd59fd7f8f95ab44a48e9fd5d008e99f54 Request headers Referer https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 05 Apr 2019 10:05:15 GMT MS-Author-Via DAV Last-Modified Tue, 14 Mar 2017 23:16:07 GMT Server nginx ETag "124bda-2488-54ab903389bc0" Content-Type image/png Cache-Control max-age=2592000, public, no-cache, must-revalidate Connection keep-alive Accept-Ranges bytes Content-Length 9352
GET H/1.1	200 OK	jquery-3.3.1.slim.min.js Show response code.jquery.com/	68 KB 24 KB	24ms 18ms	Script application/javascript	205.185.208.52 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.3.1.slim.min.js Requested by Host: funksa7.blob.core.windows.net URL: https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 205.185.208.52 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US), Reverse DNS vip052.ssl.hwcdn.net Software nginx / Resource Hash dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b Origin https://funksa7.blob.core.windows.net Response headers Date Fri, 05 Apr 2019 10:05:15 GMT Content-Encoding gzip Last-Modified Sat, 20 Jan 2018 17:26:44 GMT Server nginx ETag "5a637bd4-1111d" Vary Accept-Encoding X-HW 1554458714.dop007.pa1.shc,1554458714.dop007.pa1.t,1554458715.cds032.pa1.c Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control max-age=315360000, public Connection Keep-Alive Accept-Ranges bytes Content-Length 24038
GET H2	200	popper.min.js Show response cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/	20 KB 7 KB	176ms 168ms	Script application/javascript	2606:4700::6813:c597 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js Requested by Host: funksa7.blob.core.windows.net URL: https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:c597 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5 Security Headers Name Value Strict-Transport-Security max-age=15780000; includeSubDomains Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b Origin https://funksa7.blob.core.windows.net Response headers date Fri, 05 Apr 2019 10:05:15 GMT content-encoding br cf-cache-status MISS status 200 strict-transport-security max-age=15780000; includeSubDomains last-modified Thu, 17 May 2018 09:25:14 GMT server cloudflare etag W/"5afd4a7a-500f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript access-control-allow-origin * expires Wed, 25 Mar 2020 10:05:15 GMT cache-control public, max-age=30672000 cf-ray 4c2ab3dd4f1097f8-FRA served-in-seconds 0.001
GET H2	200	bootstrap.min.js Show response maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/	36 KB 10 KB	27ms 18ms	Script text/javascript	209.197.3.15 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js Requested by Host: funksa7.blob.core.windows.net URL: https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b Protocol H2 Security TLS 1.3, , AES_256_GCM Server 209.197.3.15 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US), Reverse DNS vip0x00f.map2.ssl.hwcdn.net Software / Resource Hash 53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b Origin https://funksa7.blob.core.windows.net Response headers date Fri, 05 Apr 2019 10:05:15 GMT content-encoding gzip last-modified Wed, 12 Dec 2018 18:33:51 GMT access-control-allow-origin * etag "1544639631" vary Accept-Encoding x-cache HIT content-type text/javascript; charset=utf-8 status 200 cache-control public, max-age=31536000 x-hello-human Say hello back! @getBootstrapCDN on Twitter accept-ranges bytes timing-allow-origin * content-length 9832
GET H/1.1	200 OK	Cookie set logout.srf login.microsoftonline.com/ Frame BB24	0 0	143ms 40ms	Document text/html	20.190.137.97 Microsoft Corpora...
General Check archive.org Show headers Download Go to Full URL https://login.microsoftonline.com/logout.srf?ct=1548343592&rver=64.4.6456.0&lc=1033&id=501392 Requested by Host: funksa7.blob.core.windows.net URL: https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 20.190.137.97 Falls Church, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US), Reverse DNS Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Host login.microsoftonline.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Referer https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b Response headers Cache-Control no-cache, no-store Pragma no-cache Content-Type text/html; charset=utf-8 Content-Encoding gzip Expires -1 Vary Accept-Encoding Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Link <https://aadcdn.msauth.net>; rel=preconnect; crossorigin <https://aadcdn.msauth.net>; rel=dns-prefetch <https://aadcdn.msftauth.net>; rel=dns-prefetch X-DNS-Prefetch-Control on x-ms-request-id 3131a8b7-b59c-4af7-a22e-d3202f5d1600 P3P CP="DSP CUR OTPi IND OTRi ONL FIN" Set-Cookie SignInStateCookie=CAQABAAIAAADCoMpjJXrxTq9VG9te-7FX8fxCy73UnUn79ewduLuBz7rbTfoDM4gU9Vjrq4ItAzkAn4NmO9bsD1f7vQVaBq4rUsJTOcwhvN7NkwIWZJsI9SAA; path=/; secure; HttpOnly ESTSSSOTILES=1; expires=Thu, 05-Apr-2029 10:05:15 GMT; path=/; secure AADSSOTILES=1; expires=Thu, 05-Apr-2029 10:05:15 GMT; path=/; secure; HttpOnly ESTSAUTHPERSISTENT=AQABAAQAAADCoMpjJXrxTq9VG9te-7FXSRjVtNgv9tuNTQ4Ec6_5U_lEn-9wxRTgM7fkGwax3Cce1e3iUNyRp2KweRaoz7bLmAlg4QrVcH5KzKy_BgWlg-UmStuZMgAcevTDWa56K6QC_rsPcqDEENFC2p0A3aBiTVAQ-0Ky4-xdUKb4nxafyBptBSlQfXGdLmDv_4dHNM0_2rdkrh5fkjAjX5AFrMcWvQlc19BGma8m-Vu2ItWL7SAAIABAACAAAAA; domain=.login.microsoftonline.com; expires=Thu, 04-Jul-2019 10:05:15 GMT; path=/; secure; HttpOnly ESTSAUTH=AQABAAQAAADCoMpjJXrxTq9VG9te-7FXlfvRqvDtGMwvfjUf7zqton1PfB37IwqfSrLNRrtDHcbWfbQDq3wAdTizdYYaZOpQumMXvLG3FaBPemAgCo-88zXGFa7KVbwBj_Xljd3h4CbHxxYlCCygGSobDBDQxKrAxB201QhR0dNsIzanovHuqUM16keKVPh_juWXbLXeoeqwXr-zqziMdAwakjh3h5_uVDXIWrLWhacTwrV8Ewvx4yAAIABAACAAAAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly ESTSAUTHLIGHT=+; path=/; secure ESTSSC=00; path=/; secure; HttpOnly buid=AQABAAEAAADCoMpjJXrxTq9VG9te-7FXLZ9SpJTCa2xJRuU24o_DIqS-DOm179fL1SPGXrzRe-u2oYr9mjplyIn4jpC4QoK9AedkDJAEBG7gUGNFxnzKq5pSQuScQ5xUt4FHLq6aiZkgAA; expires=Sun, 05-May-2019 10:05:15 GMT; path=/; secure; HttpOnly fpc=AuyBMA6i8aVJhiIbIzGKZE4; expires=Sun, 05-May-2019 10:05:15 GMT; path=/; secure; HttpOnly esctx=AQABAAAAAADCoMpjJXrxTq9VG9te-7FX0rHS200T50-6elMaKQKq1mMxxWXCHkh2CuIAjgBcqfrpcZNRs46gzEB84Ai6u2S03sPohaEz4SwCM4ScrrOVU-jwZMERZC4Eritpy-b0M6SShOUdgQ0KyJoWgHelEXztgNYk7WoHH2kTzW911uR7vTnvf4D802T60SNz0RKgykMgAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly x-ms-gateway-slice=prod; path=/; secure; HttpOnly stsservicecookie=ests; path=/; secure; HttpOnly Date Fri, 05 Apr 2019 10:05:15 GMT Content-Length 10954
GET H2	200	48422006_339286713574611_2218872287996674048_n.jpg scontent-hbe1-1.xx.fbcdn.net/v/t1.0-9/	83 KB 83 KB	181ms 67ms	Image image/jpeg	2a03:2880:f03b:1c:face:b00c:0:3 Facebook
General Check archive.org Show headers Download Go to Show image Full URL https://scontent-hbe1-1.xx.fbcdn.net/v/t1.0-9/48422006_339286713574611_2218872287996674048_n.jpg?_nc_cat=102&_nc_ht=scontent-hbe1-1.xx&oh=17558c8070f2813454d242b7502dab99&oe=5CBE3ADC Requested by Host: funksa7.blob.core.windows.net URL: https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f03b:1c:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software / Resource Hash df74024f75221b8cc36cbbb2151de88a8ebb2a8fc077b8814a2944335d4fb18b Request headers Referer https://funksa7.blob.core.windows.net/owe7/update7.html?sp=r&st=2019-04-05T08:08:00Z&se=2019-04-05T16:08:00Z&spr=https&sv=2018-03-28&sig=IBJjIkjnMauvU7moHoP2PTNdp5mSWQ6ZrweCEGDAyyo%3D&sr=b User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers x-haystack-needlechecksum 754850199 date Fri, 05 Apr 2019 10:05:15 GMT last-modified Mon, 07 Jan 2019 17:27:33 GMT access-control-allow-origin * content-type image/jpeg status 200 access-control-expose-headers X-FB-CEC-Video-Limit cache-control max-age=1209600, no-transform x-needle-checksum 4092876034 x-fb-config-version-olb-prod 472 timing-allow-origin * content-length 84980

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery function| Popper string| hash function| sendmails

12 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			login.microsoftonline.com/	1969-12-31 23:59:59	Name: stsservicecookie Value: ests
			login.microsoftonline.com/	1970-01-19 00:30:50	Name: buid Value: AQABAAEAAADCoMpjJXrxTq9VG9te-7FXLZ9SpJTCa2xJRuU24o_DIqS-DOm179fL1SPGXrzRe-u2oYr9mjplyIn4jpC4QoK9AedkDJAEBG7gUGNFxnzKq5pSQuScQ5xUt4FHLq6aiZkgAA
			login.microsoftonline.com/	1970-01-22 15:27:57	Name: AADSSOTILES Value: 1
			login.microsoftonline.com/	1969-12-31 23:59:59	Name: ESTSSC Value: 00
			login.microsoftonline.com/	1969-12-31 23:59:59	Name: ESTSAUTHLIGHT Value: +
			.login.microsoftonline.com/	1969-12-31 23:59:59	Name: ESTSAUTH Value: AQABAAQAAADCoMpjJXrxTq9VG9te-7FXlfvRqvDtGMwvfjUf7zqton1PfB37IwqfSrLNRrtDHcbWfbQDq3wAdTizdYYaZOpQumMXvLG3FaBPemAgCo-88zXGFa7KVbwBj_Xljd3h4CbHxxYlCCygGSobDBDQxKrAxB201QhR0dNsIzanovHuqUM16keKVPh_juWXbLXeoeqwXr-zqziMdAwakjh3h5_uVDXIWrLWhacTwrV8Ewvx4yAAIABAACAAAAA
			.login.microsoftonline.com/	1970-01-19 01:57:14	Name: ESTSAUTHPERSISTENT Value: AQABAAQAAADCoMpjJXrxTq9VG9te-7FXSRjVtNgv9tuNTQ4Ec6_5U_lEn-9wxRTgM7fkGwax3Cce1e3iUNyRp2KweRaoz7bLmAlg4QrVcH5KzKy_BgWlg-UmStuZMgAcevTDWa56K6QC_rsPcqDEENFC2p0A3aBiTVAQ-0Ky4-xdUKb4nxafyBptBSlQfXGdLmDv_4dHNM0_2rdkrh5fkjAjX5AFrMcWvQlc19BGma8m-Vu2ItWL7SAAIABAACAAAAA
			login.microsoftonline.com/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: prod
			.login.microsoftonline.com/	1969-12-31 23:59:59	Name: esctx Value: AQABAAAAAADCoMpjJXrxTq9VG9te-7FX0rHS200T50-6elMaKQKq1mMxxWXCHkh2CuIAjgBcqfrpcZNRs46gzEB84Ai6u2S03sPohaEz4SwCM4ScrrOVU-jwZMERZC4Eritpy-b0M6SShOUdgQ0KyJoWgHelEXztgNYk7WoHH2kTzW911uR7vTnvf4D802T60SNz0RKgykMgAA
			login.microsoftonline.com/	1970-01-19 00:30:50	Name: fpc Value: AuyBMA6i8aVJhiIbIzGKZE4
			login.microsoftonline.com/	1970-01-22 15:27:57	Name: ESTSSSOTILES Value: 1
			login.microsoftonline.com/	1969-12-31 23:59:59	Name: SignInStateCookie Value: CAQABAAIAAADCoMpjJXrxTq9VG9te-7FX8fxCy73UnUn79ewduLuBz7rbTfoDM4gU9Vjrq4ItAzkAn4NmO9bsD1f7vQVaBq4rUsJTOcwhvN7NkwIWZJsI9SAA

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
code.jquery.com
funksa7.blob.core.windows.net
home-3.azurewebsites.net
login.microsoftonline.com
maxcdn.bootstrapcdn.com
scontent-hbe1-1.xx.fbcdn.net
secure.aadcdn.microsoftonline-p.com
stackpath.bootstrapcdn.com
www.freeiconspng.com
13.77.112.132
20.190.137.97
205.185.208.52
209.197.3.15
2606:4700::6813:c597
2a01:4f9:2a:f67::2
2a02:26f0:6c00:283::35c1
2a03:2880:f03b:1c:face:b00c:0:3
52.173.28.95
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5
12ab0075b9ad760b303f755cdd32866b2ff83d13941d42c7ba644b3527307aa3
1b8e9869c33c1086478e807f8537b155c84660c631c830d6a83d83accfd1ed18
35cbf9582821d77ad709391a5784e97becc15f7d8a7d3e70b46ef8456bc16b1f
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
43d7977e40842a30573239834df28dcd59fd7f8f95ab44a48e9fd5d008e99f54
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
a04f45eddedb04362eb9b8679e3a355291e751a02866c3058dcaccb2d5a17ef0
a3ec79086c71191b0dbc128b397d1a27d132bd2b658667bc4229b53cbcb20b05
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
df74024f75221b8cc36cbbb2151de88a8ebb2a8fc077b8814a2944335d4fb18b
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c