urlscan.io logo urlscan.io
SecurityTrails logo

login-live.com-s02.info Open in urlscan Pro
116.202.176.40  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
Submission: On July 14 via manual from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 13 HTTP transactions. The main IP is 116.202.176.40, located in Germany and belongs to HETZNER-AS, DE. The main domain is login-live.com-s02.info.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 3rd 2020. Valid for: 3 months.
This is the only time login-live.com-s02.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
12 116.202.176.40 24940 (HETZNER-AS)
1 116.203.22.29 24940 (HETZNER-AS)
13 2
Apex Domain
Subdomains		 Transfer
12 com-s02.info
login-live.com-s02.info
1004 KB
1 sosafe.de
api.sosafe.de
50 KB
13 2
Domain Requested by
12 login-live.com-s02.info login-live.com-s02.info
1 api.sosafe.de login-live.com-s02.info
13 2

This site contains no links.

Subject Issuer Validity Valid
login-live.com-s02.info
Let's Encrypt Authority X3		 2020-07-03 -
2020-10-01		 3 months crt.sh
api.sosafe.de
Let's Encrypt Authority X3		 2020-07-09 -
2020-10-07		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
Frame ID: FE035A434EFF936366D9DBC929616039
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

1054 kB
Transfer

1051 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
login-live.com-s02.info/en/ 		4 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
116.202.176.40 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
web.sosafe.de
Software
nginx /
Resource Hash
d87a180305021ddf6213539dd35065599a1afde007a4705b86b51c80c5332f35

Request headers

Host
login-live.com-s02.info
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server
nginx
Date
Tue, 14 Jul 2020 11:54:45 GMT
Content-Type
text/html
Content-Length
4270
Last-Modified
Tue, 14 Jul 2020 11:33:27 GMT
Connection
keep-alive
ETag
"5f0d9807-10ae"
Accept-Ranges
bytes
bootstrap.min.css
login-live.com-s02.info/assets/bootstrap/css/ 		138 KB
138 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://login-live.com-s02.info/assets/bootstrap/css/bootstrap.min.css
Requested by
Host: login-live.com-s02.info
URL: https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
116.202.176.40 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
web.sosafe.de
Software
nginx /
Resource Hash
46b4721c80749cc5e1ec6cf4c5fec78a2c51fdfc4ee9c94f2223cdaf4fbd8ced

Request headers

Referer
https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 14 Jul 2020 11:54:45 GMT
Last-Modified
Tue, 14 Jul 2020 11:33:27 GMT
Server
nginx
ETag
"5f0d9807-22646"
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
140870
fontawesome-all.min.css
login-live.com-s02.info/assets/fonts/ 		40 KB
40 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://login-live.com-s02.info/assets/fonts/fontawesome-all.min.css
Requested by
Host: login-live.com-s02.info
URL: https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
116.202.176.40 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
web.sosafe.de
Software
nginx /
Resource Hash
fd702d8d6882cc47c74308ec46b1476035492c3d887741b279bb830c49b9b2bf

Request headers

Referer
https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 14 Jul 2020 11:54:45 GMT
Last-Modified
Tue, 14 Jul 2020 11:33:27 GMT
Server
nginx
ETag
"5f0d9807-a033"
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
41011
material-icons.min.css
login-live.com-s02.info/assets/fonts/ 		667 B
897 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://login-live.com-s02.info/assets/fonts/material-icons.min.css
Requested by
Host: login-live.com-s02.info
URL: https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
116.202.176.40 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
web.sosafe.de
Software
nginx /
Resource Hash
3b1570b5ff9ff35087c117c63a418199a11c6eeaf6954846b297b7bf95496129

Request headers

Referer
https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 14 Jul 2020 11:54:45 GMT
Last-Modified
Tue, 14 Jul 2020 11:33:27 GMT
Server
nginx
ETag
"5f0d9807-29b"
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
667
typicons.min.css
login-live.com-s02.info/assets/fonts/ 		15 KB
15 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://login-live.com-s02.info/assets/fonts/typicons.min.css
Requested by
Host: login-live.com-s02.info
URL: https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
116.202.176.40 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
web.sosafe.de
Software
nginx /
Resource Hash
8660ed12799916f277ccbb1fa1ba74dc2483dffa91089998ddfed5a9feb32200

Request headers

Referer
https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 14 Jul 2020 11:54:45 GMT
Last-Modified
Tue, 14 Jul 2020 11:33:27 GMT
Server
nginx
ETag
"5f0d9807-3a89"
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
14985
styles.min.css
login-live.com-s02.info/assets/css/ 		4 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://login-live.com-s02.info/assets/css/styles.min.css
Requested by
Host: login-live.com-s02.info
URL: https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
116.202.176.40 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
web.sosafe.de
Software
nginx /
Resource Hash
dd3bfb00b7273590ca408b03823bf86903ead0c497de2f7b5f6934d1473c20e2

Request headers

Referer
https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 14 Jul 2020 11:54:45 GMT
Last-Modified
Tue, 14 Jul 2020 11:33:27 GMT
Server
nginx
ETag
"5f0d9807-fa9"
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4009
main.js
login-live.com-s02.info/assets/js/ 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://login-live.com-s02.info/assets/js/main.js
Requested by
Host: login-live.com-s02.info
URL: https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
116.202.176.40 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
web.sosafe.de
Software
nginx /
Resource Hash
175a9dace60135c168b82e0431dec92fc0e24ef14bef56d79e721f26388be0e7

Request headers

Referer
https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 14 Jul 2020 11:54:45 GMT
Last-Modified
Tue, 14 Jul 2020 11:33:27 GMT
Server
nginx
ETag
"5f0d9807-a19"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2585
info.svg
login-live.com-s02.info/assets/img/ 		338 B
573 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login-live.com-s02.info/assets/img/info.svg
Requested by
Host: login-live.com-s02.info
URL: https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
116.202.176.40 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
web.sosafe.de
Software
nginx /
Resource Hash
e78098c9d55fcd196acc23bb905e94881fbe157504e9c179f23ae85399e28682

Request headers

Referer
https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 14 Jul 2020 11:54:45 GMT
Last-Modified
Tue, 14 Jul 2020 11:33:27 GMT
Server
nginx
ETag
"5f0d9807-152"
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
338
question.svg
login-live.com-s02.info/assets/img/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login-live.com-s02.info/assets/img/question.svg
Requested by
Host: login-live.com-s02.info
URL: https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
116.202.176.40 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
web.sosafe.de
Software
nginx /
Resource Hash
a76c08e9cdc3bb87bfb57627ad8f6b46f0e5ef826cc7f046dfbaf25d7b7958ea

Request headers

Referer
https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 14 Jul 2020 11:54:45 GMT
Last-Modified
Tue, 14 Jul 2020 11:33:27 GMT
Server
nginx
ETag
"5f0d9807-613"
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1555
jquery.min.js
login-live.com-s02.info/assets/js/ 		85 KB
85 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://login-live.com-s02.info/assets/js/jquery.min.js
Requested by
Host: login-live.com-s02.info
URL: https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
116.202.176.40 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
web.sosafe.de
Software
nginx /
Resource Hash
39646863a414e0a84920b3a8639c0f3e8c94535e8dc051b42b485a068dc2902f

Request headers

Referer
https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 14 Jul 2020 11:54:45 GMT
Last-Modified
Tue, 14 Jul 2020 11:33:27 GMT
Server
nginx
ETag
"5f0d9807-15282"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
86658
bootstrap.min.js
login-live.com-s02.info/assets/bootstrap/js/ 		69 KB
69 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://login-live.com-s02.info/assets/bootstrap/js/bootstrap.min.js
Requested by
Host: login-live.com-s02.info
URL: https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
116.202.176.40 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
web.sosafe.de
Software
nginx /
Resource Hash
928f97f310d8f768c5e3d521e3b1ce2cff156f9cc60c5d09fad772f4a2c43f52

Request headers

Referer
https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 14 Jul 2020 11:54:45 GMT
Last-Modified
Tue, 14 Jul 2020 11:33:27 GMT
Server
nginx
ETag
"5f0d9807-1141a"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
70682
report
api.sosafe.de/v1/ 		50 KB
50 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.sosafe.de/v1/report?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7&type=2
Requested by
Host: login-live.com-s02.info
URL: https://login-live.com-s02.info/assets/js/main.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
116.203.22.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx /
Resource Hash
72a7b101c91e419bd69358aafaec719f9fd84678013eeae29d149896927f9cd6
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 14 Jul 2020 11:54:45 GMT
X-Content-Type-Options
nosniff
Server
nginx
ETag
W/"c7a7-JNxQajkti+yg72RdOAyWluLW430"
X-Download-Options
noopen
X-Frame-Options
SAMEORIGIN
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Connection
keep-alive
Access-Control-Allow-Credentials
true
Strict-Transport-Security
max-age=15552000; includeSubDomains
X-DNS-Prefetch-Control
off
Content-Length
51111
X-XSS-Protection
1; mode=block
1.png
login-live.com-s02.info/assets/img/ 		642 KB
642 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login-live.com-s02.info/assets/img/1.png
Requested by
Host: login-live.com-s02.info
URL: https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
116.202.176.40 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
web.sosafe.de
Software
nginx /
Resource Hash
81c4f50096d17e8cdfe9c95d5996af25efba6d081462ddd068a1014fd7cd28d4

Request headers

Referer
https://login-live.com-s02.info/en/?code=10aed5fdcd9a45e6ff2f3d6788f4c3b7
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 14 Jul 2020 11:54:45 GMT
Last-Modified
Tue, 14 Jul 2020 11:33:27 GMT
Server
nginx
ETag
"5f0d9807-a06fb"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
657147

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| findGetParameter object| Http object| elements function| $ function| jQuery object| bootstrap

0 Cookies