ternum.btrhosting.com.ar Open in urlscan Pro
200.10.100.212 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://ternum.btrhosting.com.ar/?rid=cVSB850
Submission: On March 17 via automatic, source openphish (March 17th 2024, 1:20:46 am UTC) — Scanned from DE

Summary HTTP 11 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 4 domains to perform 11 HTTP transactions. The main IP is 200.10.100.212, located in Argentina and belongs to Telefonica de Argentina, AR. The main domain is ternum.btrhosting.com.ar.
TLS certificate: Issued by R3 on March 14th 2024. Valid for: 3 months.

This is the only time ternum.btrhosting.com.ar was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	200.10.100.212 200.10.100.212	10834 (Telefonic...) (Telefonica de Argentina)
9	2620:1ec:bdf::62 2620:1ec:bdf::62	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	40.126.32.74 40.126.32.74	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
11	3

1 200.10.100.212 (Argentina)

ASN10834 (Telefonica de Argentina, AR)
PTR: 212.host.advance.com.ar

ternum.btrhosting.com.ar	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2620:1ec:bdf::62 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
aadcdn.msftauthimages.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 40.126.32.74 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

login.live.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	msauth.net aadcdn.msauth.net — Cisco Umbrella Rank: 855	200 KB
2	msftauthimages.net aadcdn.msftauthimages.net — Cisco Umbrella Rank: 3411	252 KB
1	live.com login.live.com — Cisco Umbrella Rank: 61
1	btrhosting.com.ar ternum.btrhosting.com.ar	11 KB
11	4

	Domain	Requested by
7	aadcdn.msauth.net	ternum.btrhosting.com.ar
2	aadcdn.msftauthimages.net	ternum.btrhosting.com.ar
1	login.live.com	ternum.btrhosting.com.ar
1	ternum.btrhosting.com.ar
11	4

This site contains links to these domains. Also see Links.

Domain
account.live.com
www.microsoft.com
privacy.microsoft.com

Subject Issuer	Validity	Valid
ternum.btrhosting.com.ar R3	`2024-03-14` - `2024-06-12`	3 months	crt.sh
aadcdn.msauth.net DigiCert SHA2 Secure Server CA	`2024-01-29` - `2025-01-29`	a year	crt.sh
aadcdn.msftauthimages.net Microsoft Azure RSA TLS Issuing CA 07	`2024-02-18` - `2025-02-12`	a year	crt.sh
login.live.com DigiCert SHA2 Secure Server CA	`2024-02-13` - `2025-02-13`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://ternum.btrhosting.com.ar/?rid=cVSB850
Frame ID: A00933A21F1DA1B8D3D4713251816E35
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Iniciar sesión en la cuenta

Page Statistics

11
Requests

100 %
HTTPS

33 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

464 kB
Transfer

930 kB
Size

2
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fcobrandid%3d90015%26id%3d292841%26cobrandid%3d90015%26id%3d292841%26contextid%3d79F7E80859723676%26opid%3d0C8518F56E5D2883%26bk%3d1680182350&id=292841&uiflavor=web&cobrandid=90015&uaid=59d8860c8e394f88ac8fddf9386747f6&mkt=EN-US&lc=1033&bk=1680182350
Title: ¿Olvidó su contraseña?

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/es-419/servicesagreement/
Title: Términos de uso

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/es-419/privacystatement
Title: Privacidad y cookies

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
ternum.btrhosting.com.ar/ 48 KB
11 KB 3710ms
542ms Document
text/html 200.10.100.212
Telefonica de Arg...

General

Check archive.org

Show headers Download Go to

Full URL

https://ternum.btrhosting.com.ar/?rid=cVSB850

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

200.10.100.212 , Argentina, ASN10834 (Telefonica de Argentina, AR),

Reverse DNS

212.host.advance.com.ar

Software

Resource Hash

544d234ceb291e7a1ca017ddf2c109ef22c13821f955988eaa963ac4e216bf6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Sun, 17 Mar 2024 01:20:38 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Server: gophish

GET
H2 200 converged.v2.login.min_kfhrfyfy-sm2tmkm5ficcw2.css
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ 108 KB
20 KB 989ms
803ms Stylesheet
text/css 2620:1ec:bdf::62
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_kfhrfyfy-sm2tmkm5ficcw2.css
Requested by: Host: ternum.btrhosting.com.ar
URL: https://ternum.btrhosting.com.ar/?rid=cVSB850
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::62 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 8b6a3b17737161e5fe8c29e401372a94b8e650226cf0cd17b4c3c4de5b380b11

Request headers

Referer: https://ternum.btrhosting.com.ar/
Origin: https://ternum.btrhosting.com.ar
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sun, 17 Mar 2024 01:20:40 GMT
content-encoding: gzip
x-cache: TCP_MISS
x-fd-int-roxy-purgeid: 4554691
content-length: 19877
x-ms-lease-status: unlocked
last-modified: Tue, 28 Sep 2021 21:43:11 GMT
etag: 0x8D982C8F81F4375
x-azure-ref: 20240317T012039Z-scy0c87phx57336pqrhm1q06wn00000003s0000000008ym4
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 82aca58d-201e-000c-4f09-781187000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 ConvergedLogin_PCore_eqs6l1hn7CA6yn886DFa4A2.js Show response
aadcdn.msauth.net/shared/1.0/content/js/ 458 KB
126 KB 1258ms
1072ms Script
application/x-javascript 2620:1ec:bdf::62
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_eqs6l1hn7CA6yn886DFa4A2.js
Requested by: Host: ternum.btrhosting.com.ar
URL: https://ternum.btrhosting.com.ar/?rid=cVSB850
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::62 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 807d6bdf49db7f4a190aa48734f1300d2e9e63f69731cb9baf75654f13429c21

Request headers

Referer: https://ternum.btrhosting.com.ar/
Origin: https://ternum.btrhosting.com.ar
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sun, 17 Mar 2024 01:20:40 GMT
content-encoding: gzip
x-cache: TCP_MISS
x-fd-int-roxy-purgeid: 4554691
content-length: 128429
x-ms-lease-status: unlocked
last-modified: Wed, 06 Oct 2021 22:01:32 GMT
etag: 0x8D98914DB78740A
x-azure-ref: 20240317T012039Z-scy0c87phx57336pqrhm1q06wn00000003s0000000008ym6
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: aa741827-c01e-003e-2e09-786692000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 ux.converged.login.strings-es.min_jemj-fblw-6hwjts3tly8g2.js Show response
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ 46 KB
14 KB 417ms
231ms Script
application/x-javascript 2620:1ec:bdf::62
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-es.min_jemj-fblw-6hwjts3tly8g2.js
Requested by: Host: ternum.btrhosting.com.ar
URL: https://ternum.btrhosting.com.ar/?rid=cVSB850
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::62 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 8e530debb1a0d1e4a2e68377553f155df81805c53ac05001540d120573b2462c

Request headers

Referer: https://ternum.btrhosting.com.ar/
Origin: https://ternum.btrhosting.com.ar
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sun, 17 Mar 2024 01:20:40 GMT
content-encoding: gzip
x-cache: TCP_MISS
x-fd-int-roxy-purgeid: 4554691
content-length: 13365
x-ms-lease-status: unlocked
last-modified: Fri, 17 Sep 2021 22:13:17 GMT
etag: 0x8D97A2859DE3092
x-azure-ref: 20240317T012039Z-scy0c87phx57336pqrhm1q06wn00000003s0000000008ym5
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 5ab1c790-b01e-000d-2409-783a85000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 convergedlogin_ppassword_f45e109f3e4a30ae09ee.js Show response
aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/ 20 KB
6 KB 376ms
190ms Script
application/x-javascript 2620:1ec:bdf::62
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_f45e109f3e4a30ae09ee.js
Requested by: Host: ternum.btrhosting.com.ar
URL: https://ternum.btrhosting.com.ar/?rid=cVSB850
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::62 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 63905b4d13553f2d798409d03b87b167aac9200f151a9d9d65e38f82f0f231ff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ternum.btrhosting.com.ar/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sun, 17 Mar 2024 01:20:39 GMT
content-encoding: gzip
x-cache: TCP_MISS
x-fd-int-roxy-purgeid: 4554691
content-length: 5733
x-ms-lease-status: unlocked
last-modified: Tue, 28 Sep 2021 19:30:52 GMT
etag: 0x8D982B67BE5CCAC
x-azure-ref: 20240317T012039Z-ytn3rnq1x9327f1q8x7d4vvx5c00000005bg00000000gfw3
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: f37014d6-f01e-0035-4809-784385000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 bannerlogo
aadcdn.msftauthimages.net/dbd5a2dd-sasi2195yovjw86tzijyd39ezn2-jytqrfbvcw-m3nu/logintenantbranding/0/ 10 KB
10 KB 241ms
45ms Image
image/* 2620:1ec:bdf::62
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauthimages.net/dbd5a2dd-sasi2195yovjw86tzijyd39ezn2-jytqrfbvcw-m3nu/logintenantbranding/0/bannerlogo
Requested by: Host: ternum.btrhosting.com.ar
URL: https://ternum.btrhosting.com.ar/?rid=cVSB850
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::62 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: ee45bb529e018fb692ae68503df777efc6be75683dbc6528fea522371373fc5e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ternum.btrhosting.com.ar/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sun, 17 Mar 2024 01:20:39 GMT
x-cache: TCP_HIT
x-cache-info: L1_T2
x-fd-int-roxy-purgeid: 50755578
content-length: 9768
x-ms-lease-status: unlocked
last-modified: Thu, 09 Jan 2020 14:09:47 GMT
etag: 0x8D7950D95E6C157
x-azure-ref: 20240317T012039Z-ggqak5vtfx16124mec6k3x5w0w000000051g00000000nf1a
content-type: image/*
access-control-allow-origin: *
x-ms-request-id: d9017ff6-101e-0016-7601-78f184000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg
aadcdn.msauth.net/shared/1.0/content/images/ 513 B
823 B 217ms
31ms Image
image/svg+xml 2620:1ec:bdf::62
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg
Requested by: Host: ternum.btrhosting.com.ar
URL: https://ternum.btrhosting.com.ar/?rid=cVSB850
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::62 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ternum.btrhosting.com.ar/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sun, 17 Mar 2024 01:20:39 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 4554691
content-length: 276
x-ms-lease-status: unlocked
last-modified: Wed, 24 May 2023 10:11:45 GMT
etag: 0x8DB5C3F47A00633
x-azure-ref: 20240317T012039Z-ytn3rnq1x9327f1q8x7d4vvx5c00000005bg00000000gfw4
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 4816ea92-601e-0060-4c50-75a7bc000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H/1.1 200
OK Me.htm
login.live.com/ 0
0 304ms
133ms Other
text/html 40.126.32.74
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.live.com/Me.htm?v=3
Requested by: Host: ternum.btrhosting.com.ar
URL: https://ternum.btrhosting.com.ar/?rid=cVSB850
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 40.126.32.74 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ternum.btrhosting.com.ar/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

GET
H2 200 converged.v2.login.min_kfhrfyfy-sm2tmkm5ficcw2.css
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ 0
20 KB 63ms
63ms Other
text/css 2620:1ec:bdf::62
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_kfhrfyfy-sm2tmkm5ficcw2.css
Requested by: Host: ternum.btrhosting.com.ar
URL: https://ternum.btrhosting.com.ar/?rid=cVSB850
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::62 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ternum.btrhosting.com.ar/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sun, 17 Mar 2024 01:20:41 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-cache-info: L1_T2
x-fd-int-roxy-purgeid: 4554691
content-length: 19877
x-ms-lease-status: unlocked
last-modified: Tue, 28 Sep 2021 21:43:11 GMT
etag: 0x8D982C8F81F4375
x-azure-ref: 20240317T012040Z-ytn3rnq1x9327f1q8x7d4vvx5c00000005bg00000000gfz2
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 82aca58d-201e-000c-4f09-781187000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 ux.converged.login.strings-es.min_jemj-fblw-6hwjts3tly8g2.js
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ 0
14 KB 63ms
63ms Other
application/x-javascript 2620:1ec:bdf::62
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-es.min_jemj-fblw-6hwjts3tly8g2.js
Requested by: Host: ternum.btrhosting.com.ar
URL: https://ternum.btrhosting.com.ar/?rid=cVSB850
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::62 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ternum.btrhosting.com.ar/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sun, 17 Mar 2024 01:20:41 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-cache-info: L1_T2
x-fd-int-roxy-purgeid: 4554691
content-length: 13365
x-ms-lease-status: unlocked
last-modified: Fri, 17 Sep 2021 22:13:17 GMT
etag: 0x8D97A2859DE3092
x-azure-ref: 20240317T012040Z-ytn3rnq1x9327f1q8x7d4vvx5c00000005bg00000000gfz3
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 5ab1c790-b01e-000d-2409-783a85000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 illustration
aadcdn.msftauthimages.net/dbd5a2dd-sasi2195yovjw86tzijyd39ezn2-jytqrfbvcw-m3nu/logintenantbranding/0/ 241 KB
242 KB 80ms
79ms Image
image/* 2620:1ec:bdf::62
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauthimages.net/dbd5a2dd-sasi2195yovjw86tzijyd39ezn2-jytqrfbvcw-m3nu/logintenantbranding/0/illustration?ts=638338620096693900
Requested by: Host: ternum.btrhosting.com.ar
URL: https://ternum.btrhosting.com.ar/?rid=cVSB850
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::62 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: b2525935d71cfefea3c2b94fd8a54e3903dba998a7f25d78e57e2b63eb9f96d2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ternum.btrhosting.com.ar/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sun, 17 Mar 2024 01:20:41 GMT
x-cache: TCP_HIT
x-cache-info: L1_T2
x-fd-int-roxy-purgeid: 50755578
content-length: 247156
x-ms-lease-status: unlocked
last-modified: Wed, 25 Oct 2023 20:20:09 GMT
etag: 0x8DBD597C96E698C
x-azure-ref: 20240317T012040Z-ggqak5vtfx16124mec6k3x5w0w000000051g00000000nf2v
content-type: image/*
access-control-allow-origin: *
x-ms-request-id: 9bff787a-001e-0057-5501-78a960000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.login.live.com/	1969-12-31 23:59:59	Name: uaid Value: 3c4ad158c35f47d79622f251c4177e97
			.login.live.com/	1969-12-31 23:59:59	Name: MSPRequ Value: id=N&lt=1710638440&co=1

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://ternum.btrhosting.com.ar/?rid=cVSB850 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://ternum.btrhosting.com.ar/?rid=cVSB850 Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
aadcdn.msftauthimages.net
login.live.com
ternum.btrhosting.com.ar
200.10.100.212
2620:1ec:bdf::62
40.126.32.74
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
544d234ceb291e7a1ca017ddf2c109ef22c13821f955988eaa963ac4e216bf6b
63905b4d13553f2d798409d03b87b167aac9200f151a9d9d65e38f82f0f231ff
807d6bdf49db7f4a190aa48734f1300d2e9e63f69731cb9baf75654f13429c21
8b6a3b17737161e5fe8c29e401372a94b8e650226cf0cd17b4c3c4de5b380b11
8e530debb1a0d1e4a2e68377553f155df81805c53ac05001540d120573b2462c
b2525935d71cfefea3c2b94fd8a54e3903dba998a7f25d78e57e2b63eb9f96d2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ee45bb529e018fb692ae68503df777efc6be75683dbc6528fea522371373fc5e

ternum.btrhosting.com.ar Open in urlscan Pro 200.10.100.212 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

11 Requests

100 %HTTPS

33 %IPv6

4 Domains

4 Subdomains

3 IPs

3 Countries

464 kBTransfer

930 kBSize

2 Cookies

3 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

2 Cookies

2 Console Messages

Security Headers

Indicators

ternum.btrhosting.com.ar Open in urlscan Pro
200.10.100.212 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

33 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

464 kB
Transfer

930 kB
Size

2
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!