www.ms-docs.xyz Open in urlscan Pro
101.99.88.62 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://wodprime.com/#bWljaGFlbC50ZXdlcyRzYWZyYS5jb20=
Effective URL:
https://www.ms-docs.xyz/check.php?tap=ozvvvdlu7b682lHCkShY6f5tgGy3Kw246z6VoZC99E5c32fDXfaeSv8UpfaO6MEVvq1raGLkd7Jb40vyBw...
Submission: On December 03 via manual (December 3rd 2024, 2:45:55 pm UTC) from US — Scanned from DE

Summary HTTP 7 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 7 HTTP transactions. The main IP is 101.99.88.62, located in Malaysia and belongs to SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY. The main domain is www.ms-docs.xyz.
TLS certificate: Issued by R11 on November 2nd 2024. Valid for: 3 months.

This is the only time www.ms-docs.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	2001:8d8:100f... 2001:8d8:100f:f000::244	8560 (IONOS-AS ...) (IONOS-AS IONOS SE)
1	101.99.88.67 101.99.88.67	45839 (SHINJIRU-...) (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd)
2 4	101.99.88.62 101.99.88.62	45839 (SHINJIRU-...) (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd)
7	4

1 2001:8d8:100f:f000::244 (Germany)

ASN8560 (IONOS-AS IONOS SE, DE)

wodprime.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 101.99.88.67 (Malaysia)

ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY)
PTR: server1.kamon.la

ofdls.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 101.99.88.62 (Malaysia) 2 redirects

ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY)
PTR: server1.kamon.la

www.ms-docs.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	ms-docs.xyz 2 redirects www.ms-docs.xyz	77 KB
1	ofdls.online ofdls.online	1 KB
1	wodprime.com wodprime.com	37 KB
0	google.com Failed www.google.com Failed
7	4

	Domain	Requested by
4	www.ms-docs.xyz	2 redirects ofdls.online
1	ofdls.online	wodprime.com
1	wodprime.com
0	www.google.com Failed	www.ms-docs.xyz
7	4

This site contains no links.

Subject Issuer	Validity	Valid
*.wodprime.com Sectigo RSA Domain Validation Secure Server CA	`2024-12-01` - `2025-12-01`	a year	crt.sh
webmail.odflow.online R11	`2024-10-17` - `2025-01-15`	3 months	crt.sh
mail.ms-docs.top R11	`2024-11-02` - `2025-01-31`	3 months	crt.sh

This page contains 1 frames:

Frame: https://www.ms-docs.xyz/check.php?tap=ozvvvdlu7b682lHCkShY6f5tgGy3Kw246z6VoZC99E5c32fDXfaeSv8UpfaO6MEVvq1raGLkd7Jb40vyBwOFSbOBP6eYiAyD8GT657cJUmlmLCsowy8RoUk9kje2rcBU
Frame ID: ED2B33B2B4A16596AE9E8B0A34796BD7
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Outlook

Page URL History Show full URLs

https://wodprime.com/ Page URL
https://ofdls.online/ Page URL
https://www.ms-docs.xyz/?email=bWljaGFlbC50ZXdlc0BzYWZyYS5jb20= HTTP 302
https://www.ms-docs.xyz/index.php?csrftoken=MTczMzIzNzE0MDM2MjBiOWZmM2Q4YWE0ZWI1ZTIwNmJlMDMyMjA4MGMx... HTTP 302
https://www.ms-docs.xyz/check.php?tap=ozvvvdlu7b682lHCkShY6f5tgGy3Kw246z6VoZC99E5c32fDXfaeSv8UpfaO6M... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

7
Requests

57 %
HTTPS

33 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

114 kB
Transfer

121 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://wodprime.com/ Page URL
https://ofdls.online/ Page URL
https://www.ms-docs.xyz/?email=bWljaGFlbC50ZXdlc0BzYWZyYS5jb20= HTTP 302
https://www.ms-docs.xyz/index.php?csrftoken=MTczMzIzNzE0MDM2MjBiOWZmM2Q4YWE0ZWI1ZTIwNmJlMDMyMjA4MGMxYjM0MWUyNTc0YzUzYWIwYzRhZjIwZjRlNjAxMjIwYzg5MTk2NjI2Mg== HTTP 302
https://www.ms-docs.xyz/check.php?tap=ozvvvdlu7b682lHCkShY6f5tgGy3Kw246z6VoZC99E5c32fDXfaeSv8UpfaO6MEVvq1raGLkd7Jb40vyBwOFSbOBP6eYiAyD8GT657cJUmlmLCsowy8RoUk9kje2rcBU Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

https://www.ms-docs.xyz/prem/fonts/segoeui-regular.woff HTTP 0
http://www.google.com/search?q=404%20page

Request Chain 4

https://www.ms-docs.xyz/prem/fonts/segoeui-regular.ttf HTTP 0
http://www.google.com/search?q=404%20page

7 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 /
wodprime.com/ 37 KB
37 KB 170ms
111ms Document
text/html 2001:8d8:100f:f000::244
IONOS-AS IONOS SE

General

Check archive.org

Show headers Download Go to

Full URL: https://wodprime.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:8d8:100f:f000::244 , Germany, ASN8560 (IONOS-AS IONOS SE, DE),
Reverse DNS
Software: Apache / PHP/8.3.14
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 03 Dec 2024 14:45:38 GMT
server: Apache
x-powered-by: PHP/8.3.14

GET
H/1.1 200
OK /
ofdls.online/ 1 KB
1 KB 564ms
185ms Document
text/html 101.99.88.67
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://ofdls.online/
Requested by: Host: wodprime.com
URL: https://wodprime.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 101.99.88.67 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: server1.kamon.la
Software: Apache /
Resource Hash

Request headers

Referer: https://wodprime.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Tue, 03 Dec 2024 14:45:39 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Transfer-Encoding: chunked

GET
H/1.1

200
OK

Primary Request check.php Show response
www.ms-docs.xyz/
Redirect Chain

https://www.ms-docs.xyz/?email=bWljaGFlbC50ZXdlc0BzYWZyYS5jb20=
https://www.ms-docs.xyz/index.php?csrftoken=MTczMzIzNzE0MDM2MjBiOWZmM2Q4YWE0ZWI1ZTIwNmJlMDMyMjA4MGMxYjM0MWUyNTc0YzUzYWIwYzRhZjIwZjRlNjAxMjIwYzg5MTk2NjI2Mg==
https://www.ms-docs.xyz/check.php?tap=ozvvvdlu7b682lHCkShY6f5tgGy3Kw246z6VoZC99E5c32fDXfaeSv8UpfaO6MEVvq1raGLkd7Jb40vyBwOFSbOBP6eYiAyD8GT657cJUmlmLCsowy8RoUk9kje2rcBU

67 KB
68 KB

174ms
174ms

Document
text/html

101.99.88.62
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ms-docs.xyz/check.php?tap=ozvvvdlu7b682lHCkShY6f5tgGy3Kw246z6VoZC99E5c32fDXfaeSv8UpfaO6MEVvq1raGLkd7Jb40vyBwOFSbOBP6eYiAyD8GT657cJUmlmLCsowy8RoUk9kje2rcBU

Requested by

Host: ofdls.online
URL: https://ofdls.online/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

101.99.88.62 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),

Reverse DNS

server1.kamon.la

Software

Apache /

Resource Hash

fe098c82f6e7ae00f5259a8c7d8cbc45e26da66ea0400e02524d806197ce5f5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ofdls.online/#bWljaGFlbC50ZXdlc0BzYWZyYS5jb20=
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Tue, 03 Dec 2024 14:45:40 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=98
Pragma: no-cache
Server: Apache
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Tue, 03 Dec 2024 14:45:40 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=99
Location: check.php?tap=ozvvvdlu7b682lHCkShY6f5tgGy3Kw246z6VoZC99E5c32fDXfaeSv8UpfaO6MEVvq1raGLkd7Jb40vyBwOFSbOBP6eYiAyD8GT657cJUmlmLCsowy8RoUk9kje2rcBU
Pragma: no-cache
Server: Apache
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

GET
DATA 200
OK truncated
/ 8 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET

search
www.google.com/
Redirect Chain

https://www.ms-docs.xyz/prem/fonts/segoeui-regular.woff
http://www.google.com/search?q=404%20page

0
0

GET

search
www.google.com/
Redirect Chain

https://www.ms-docs.xyz/prem/fonts/segoeui-regular.ttf
http://www.google.com/search?q=404%20page

0
0

GET
H/1.1 200
OK favicon.ico
www.ms-docs.xyz/auth/resources/ 8 KB
8 KB 496ms
495ms Other
image/x-icon 101.99.88.62
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ms-docs.xyz/auth/resources/favicon.ico

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

101.99.88.62 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),

Reverse DNS

server1.kamon.la

Software

Apache /

Resource Hash

cf0808a61ec571e0c4975663903b288009d55502ac0445d9948983b339a5cf6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Connection: Keep-Alive
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
Content-Length: 7886
Keep-Alive: timeout=5, max=95
Date: Tue, 03 Dec 2024 14:45:41 GMT
X-XSS-Protection: 1; mode=block
Last-Modified: Sun, 06 Oct 2019 23:13:10 GMT
Content-Type: image/x-icon
Server: Apache

POST check.php
www.ms-docs.xyz/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.google.com
URL: http://www.google.com/search?q=404%20page

Domain: www.google.com
URL: http://www.google.com/search?q=404%20page

Domain: www.ms-docs.xyz
URL: https://www.ms-docs.xyz/check.php?tap=ozvvvdlu7b682lHCkShY6f5tgGy3Kw246z6VoZC99E5c32fDXfaeSv8UpfaO6MEVvq1raGLkd7Jb40vyBwOFSbOBP6eYiAyD8GT657cJUmlmLCsowy8RoUk9kje2rcBU

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| LocaleFontFamilyTemplate string| ThemedColorTemplate string| o365ColorTemplate string| HeaderImageTemplate

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.ms-docs.xyz/	1969-12-31 23:59:59	Name: PHPSESSID Value: 81f9d0c70dd16e2a4be1cddc2434a5a8

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://www.ms-docs.xyz/check.php?tap=ozvvvdlu7b682lHCkShY6f5tgGy3Kw246z6VoZC99E5c32fDXfaeSv8UpfaO6MEVvq1raGLkd7Jb40vyBwOFSbOBP6eYiAyD8GT657cJUmlmLCsowy8RoUk9kje2rcBU Message: Mixed Content: The page at 'https://www.ms-docs.xyz/check.php?tap=ozvvvdlu7b682lHCkShY6f5tgGy3Kw246z6VoZC99E5c32fDXfaeSv8UpfaO6MEVvq1raGLkd7Jb40vyBwOFSbOBP6eYiAyD8GT657cJUmlmLCsowy8RoUk9kje2rcBU' was loaded over HTTPS, but requested an insecure font 'http://www.google.com/search?q=404%20page'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://www.ms-docs.xyz/check.php?tap=ozvvvdlu7b682lHCkShY6f5tgGy3Kw246z6VoZC99E5c32fDXfaeSv8UpfaO6MEVvq1raGLkd7Jb40vyBwOFSbOBP6eYiAyD8GT657cJUmlmLCsowy8RoUk9kje2rcBU Message: Mixed Content: The page at 'https://www.ms-docs.xyz/check.php?tap=ozvvvdlu7b682lHCkShY6f5tgGy3Kw246z6VoZC99E5c32fDXfaeSv8UpfaO6MEVvq1raGLkd7Jb40vyBwOFSbOBP6eYiAyD8GT657cJUmlmLCsowy8RoUk9kje2rcBU' was loaded over HTTPS, but requested an insecure font 'http://www.google.com/search?q=404%20page'. This request has been blocked; the content must be served over HTTPS.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ofdls.online
wodprime.com
www.google.com
www.ms-docs.xyz
www.google.com
www.ms-docs.xyz
101.99.88.62
101.99.88.67
2001:8d8:100f:f000::244
a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6
cf0808a61ec571e0c4975663903b288009d55502ac0445d9948983b339a5cf6e
fe098c82f6e7ae00f5259a8c7d8cbc45e26da66ea0400e02524d806197ce5f5e

www.ms-docs.xyz Open in urlscan Pro 101.99.88.62 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

57 %HTTPS

33 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

114 kBTransfer

121 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

1 Cookies

2 Console Messages

Indicators

www.ms-docs.xyz Open in urlscan Pro
101.99.88.62 Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

57 %
HTTPS

33 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

114 kB
Transfer

121 kB
Size

1
Cookies

7 HTTP transactions
1 data transactions