mstroklog.com Open in urlscan Pro
199.188.201.231 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://mstroklog.com/234521/
Submission: On March 19 via manual (March 19th 2022, 12:51:42 am UTC) from US — Scanned from DE

Summary HTTP 21 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 6 domains to perform 21 HTTP transactions. The main IP is 199.188.201.231, located in United States and belongs to NAMECHEAP-NET, US. The main domain is mstroklog.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 17th 2022. Valid for: a year.

This is the only time mstroklog.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 13	199.188.201.231 199.188.201.231	22612 (NAMECHEAP...) (NAMECHEAP-NET)
4	2600:9000:225... 2600:9000:2251:e400:c:7955:fe00:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:813::2008	15169 (GOOGLE) (GOOGLE)
1	2620:1ec:bdf::44 2620:1ec:bdf::44	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a00:1450:400... 2a00:1450:4001:810::200e	15169 (GOOGLE) (GOOGLE)
1	176.9.17.111 176.9.17.111	24940 (HETZNER-AS) (HETZNER-AS)
21	6

13 199.188.201.231 (United States) 1 redirects

ASN22612 (NAMECHEAP-NET, US)
PTR: business129-5.web-hosting.com

mstroklog.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:2251:e400:c:7955:fe00:93a1 (United States)

ASN16509 (AMAZON-02, US)

citrix-cloud-content.customer.pendo.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:bdf::44 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 176.9.17.111 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.111.17.9.176.clients.your-server.de

www.freepnglogos.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	mstroklog.com 1 redirects mstroklog.com	13 KB
4	pendo.io citrix-cloud-content.customer.pendo.io — Cisco Umbrella Rank: 59363	173 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 31	20 KB
1	freepnglogos.com www.freepnglogos.com — Cisco Umbrella Rank: 159752	50 KB
1	msauth.net aadcdn.msauth.net — Cisco Umbrella Rank: 1253	2 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 54	55 KB
21	6

	Domain	Requested by
13	mstroklog.com	1 redirects mstroklog.com
4	citrix-cloud-content.customer.pendo.io	mstroklog.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
1	www.freepnglogos.com	mstroklog.com
1	aadcdn.msauth.net	mstroklog.com
1	www.googletagmanager.com	mstroklog.com
21	6

This site contains links to these domains. Also see Links.

Domain
onboarding.cloud.com
docs.citrix.com

Subject Issuer	Validity	Valid
mstroklog.com Sectigo RSA Domain Validation Secure Server CA	`2022-03-17` - `2023-03-17`	a year	crt.sh
citrix-cloud-content.customer.pendo.io Amazon	`2021-11-18` - `2022-12-16`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh
aadcdn.msauth.net DigiCert SHA2 Secure Server CA	`2022-02-22` - `2023-02-22`	a year	crt.sh
freepnglogos.com Sectigo RSA Domain Validation Secure Server CA	`2021-12-11` - `2023-01-10`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://mstroklog.com/234521/
Frame ID: 277CBDF6C712138C45D9681856E9D02F
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign In

Page URL History Show full URLs

https://mstroklog.com/234521 HTTP 301
https://mstroklog.com/234521/ Page URL

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

Page Statistics

21
Requests

100 %
HTTPS

67 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

312 kB
Transfer

957 kB
Size

3
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://onboarding.cloud.com/

Search URL Search Domain Scan URL

URL: https://docs.citrix.com/en-us/citrix-cloud/overview/how-to-get-help-and-support.html

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://mstroklog.com/234521 HTTP 301
https://mstroklog.com/234521/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
mstroklog.com/234521/
Redirect Chain

https://mstroklog.com/234521
https://mstroklog.com/234521/

55 KB
11 KB

193ms
193ms

Document
text/html

199.188.201.231
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://mstroklog.com/234521/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

199.188.201.231 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business129-5.web-hosting.com

Software

LiteSpeed / PHP/7.2.34

Resource Hash

64fa003b07f94c3b7651719004aa99e9a908426bbdfb38e5e3d8e4ca4ff90a92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

x-powered-by: PHP/7.2.34
content-type: text/html; charset=UTF-8
content-length: 11012
content-encoding: br
vary: Accept-Encoding
date: Sat, 19 Mar 2022 00:51:37 GMT
server: LiteSpeed
x-turbo-charged-by: LiteSpeed
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
referrer-policy: no-referrer-when-downgrade

Redirect headers

content-type: text/html
content-length: 707
date: Sat, 19 Mar 2022 00:51:37 GMT
server: LiteSpeed
location: https://mstroklog.com/234521/
x-turbo-charged-by: LiteSpeed
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
referrer-policy: no-referrer-when-downgrade

GET
H2 200 pendo.js Show response
citrix-cloud-content.customer.pendo.io/agent/static/abed0313-153d-4162-49b1-18a3df280498/ 470 KB
145 KB 85ms
14ms Script
application/javascript 2600:9000:2251:e400:c:7955:fe00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://citrix-cloud-content.customer.pendo.io/agent/static/abed0313-153d-4162-49b1-18a3df280498/pendo.js
Requested by: Host: mstroklog.com
URL: https://mstroklog.com/234521/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:e400:c:7955:fe00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 5da8bf901ea210e18f5301f505f0d088ebdf06b08943cc872fd2f9807e345749

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mstroklog.com/234521/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 19 Mar 2022 00:49:16 GMT
content-encoding: gzip
age: 320
x-guploader-uploadid: ADPycduF61X3nUNjhMdKnG01Baff_F0yY3LogQhCXIQ7wwMfgUL-5CCM72qnrmCXbLMLSCxBlukQWX9SsJv1rOWKWTU
x-cache: Hit from cloudfront
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 147897
access-control-allow-origin: *
last-modified: Thu, 17 Mar 2022 19:10:15 GMT
server: UploadServer
etag: "6394edd9a731d6945076689f97f9759d"
vary: Accept-Encoding
x-goog-hash: crc32c=xk3IHQ==, md5=Y5Tt2acx1pRQdmifl/l1nQ==
x-goog-generation: 1647544214955593
via: 1.1 c80ae6bd97b709ed6e4747f0d5ea4efc.cloudfront.net (CloudFront)
access-control-expose-headers: *
cache-control: max-age=450
x-goog-stored-content-length: 147897
x-amz-cf-pop: FRA60-P3
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: fuDyLkn4zcygrMEJx2QeaoZfChDeP1qfDyiMwD3lZZq_hJy74SYtkg==
expires: Sat, 19 Mar 2022 00:53:47 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 240 KB
55 KB 38ms
15ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NW58833

Requested by

Host: mstroklog.com
URL: https://mstroklog.com/234521/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cb5264535a06710a16ebbb05f76b6c72296876bf65dec735560c3edde21fa352

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mstroklog.com/234521/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 19 Mar 2022 00:51:37 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55865
x-xss-protection: 0
last-modified: Sat, 19 Mar 2022 00:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 19 Mar 2022 00:51:37 GMT

GET
H2 404 1.js
mstroklog.com/identity/assets/ 0
0 152ms
150ms Script
text/html 199.188.201.231
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://mstroklog.com/identity/assets/1.js

Requested by

Host: mstroklog.com
URL: https://mstroklog.com/234521/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

199.188.201.231 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business129-5.web-hosting.com

Software

LiteSpeed /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mstroklog.com/234521/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 19 Mar 2022 00:51:37 GMT
x-content-type-options: nosniff
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
x-turbo-charged-by: LiteSpeed
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 1238
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade

GET
H2 404 2.js
mstroklog.com/identity/assets/ 0
0 152ms
151ms Script
text/html 199.188.201.231
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://mstroklog.com/identity/assets/2.js

Requested by

Host: mstroklog.com
URL: https://mstroklog.com/234521/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

199.188.201.231 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business129-5.web-hosting.com

Software

LiteSpeed /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mstroklog.com/234521/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 19 Mar 2022 00:51:37 GMT
x-content-type-options: nosniff
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
x-turbo-charged-by: LiteSpeed
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 1238
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade

GET
H2 404 3.js
mstroklog.com/identity/assets/ 0
0 152ms
151ms Script
text/html 199.188.201.231
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://mstroklog.com/identity/assets/3.js

Requested by

Host: mstroklog.com
URL: https://mstroklog.com/234521/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

199.188.201.231 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business129-5.web-hosting.com

Software

LiteSpeed /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mstroklog.com/234521/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 19 Mar 2022 00:51:37 GMT
x-content-type-options: nosniff
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
x-turbo-charged-by: LiteSpeed
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 1238
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade

GET
H2 404 4.js
mstroklog.com/identity/assets/ 0
0 152ms
151ms Script
text/html 199.188.201.231
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://mstroklog.com/identity/assets/4.js

Requested by

Host: mstroklog.com
URL: https://mstroklog.com/234521/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

199.188.201.231 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business129-5.web-hosting.com

Software

LiteSpeed /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mstroklog.com/234521/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 19 Mar 2022 00:51:37 GMT
x-content-type-options: nosniff
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
x-turbo-charged-by: LiteSpeed
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 1238
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade

GET
H2 200 guide.css
citrix-cloud-content.customer.pendo.io/agent/releases/2.128.1/ 16 KB
3 KB 198ms
128ms Stylesheet
text/css 2600:9000:2251:e400:c:7955:fe00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://citrix-cloud-content.customer.pendo.io/agent/releases/2.128.1/guide.css
Requested by: Host: mstroklog.com
URL: https://mstroklog.com/234521/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:e400:c:7955:fe00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: UploadServer /
Resource Hash: ecc37e01ea37e3b466592107b3d727fe4a0b4d0bbdca98a65016c41192218396

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mstroklog.com/234521/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 19 Mar 2022 00:51:37 GMT
content-encoding: gzip
x-amz-cf-pop: FRA60-P3
x-guploader-uploadid: ADPycdsyeiI0Qn6jqOxQ93KhNvpXaVHgCMFoexoP_C7tNNlDVFPBYtLjKLv7hRNgl71u8TVy96EWroiknr5UNNuaaoqRuWhEHg
x-cache: RefreshHit from cloudfront
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 2736
access-control-allow-origin: *
last-modified: Wed, 16 Mar 2022 20:29:31 GMT
server: UploadServer
etag: "d0a6f88bf6fd013b665b972bb7732c6e"
vary: Accept-Encoding
x-goog-hash: crc32c=VExOMg==, md5=0Kb4i/b9ATtmW5crt3Msbg==
x-goog-generation: 1647462571433812
via: 1.1 c80ae6bd97b709ed6e4747f0d5ea4efc.cloudfront.net (CloudFront)
access-control-expose-headers: *
cache-control: no-cache
x-goog-stored-content-length: 2736
accept-ranges: bytes
content-type: text/css
x-amz-cf-id: Oq1BCwL0rFqL2lkkQQcO7lNEcyumxvXfj4cDLkqDd3moQV_dRo7wfw==
expires: Sun, 19 Mar 2023 00:51:37 GMT

GET
H2 200 guide.-323232.1637350105998.css
citrix-cloud-content.customer.pendo.io/ 16 KB
16 KB 77ms
8ms Stylesheet
text/css 2600:9000:2251:e400:c:7955:fe00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://citrix-cloud-content.customer.pendo.io/guide.-323232.1637350105998.css
Requested by: Host: mstroklog.com
URL: https://mstroklog.com/234521/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:e400:c:7955:fe00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 14fa0f288a3f5985061e883fab756ce79b3bef7508b8875f40388f347d7218da

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mstroklog.com/234521/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 19 Mar 2022 00:11:40 GMT
via: 1.1 c80ae6bd97b709ed6e4747f0d5ea4efc.cloudfront.net (CloudFront)
age: 2435
x-guploader-uploadid: ADPycdu4uV2vBEmHY1i61v_7XP-x46obOQ0rNnjXJ5ErwLyA6umsNTy6y60-L04nn9OK37jVXuSstgS2k02y3zoBYKk
x-cache: Hit from cloudfront
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 16109
last-modified: Fri, 19 Nov 2021 19:28:26 GMT
server: UploadServer
etag: "6fc2f13e79eb69c22f3734db721e86c9"
x-goog-hash: crc32c=eCgjwQ==, md5=b8LxPnnracIvNzTbch6GyQ==
x-goog-generation: 1637350106329628
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=3600
x-goog-stored-content-length: 16109
x-amz-cf-pop: FRA60-P3
accept-ranges: bytes
content-type: text/css
x-amz-cf-id: F_0W41GTp8IQdwPovVHtkpIbZGAxQkscxkuU3mdKNsQ3VpcbWyYt6A==
expires: Sat, 19 Mar 2022 01:11:02 GMT

GET
H2 200 gPMz3cVtTpYo59bpfpMf7rbMcdY.guide.css
citrix-cloud-content.customer.pendo.io/guide-content/I3Lze5leDbyf3P0vNs_FkYYN6Ds/tuo7gd6CC1Grgfz7b8gFqBi37l4/ 57 KB
8 KB 78ms
9ms Stylesheet
text/css 2600:9000:2251:e400:c:7955:fe00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://citrix-cloud-content.customer.pendo.io/guide-content/I3Lze5leDbyf3P0vNs_FkYYN6Ds/tuo7gd6CC1Grgfz7b8gFqBi37l4/gPMz3cVtTpYo59bpfpMf7rbMcdY.guide.css
Requested by: Host: mstroklog.com
URL: https://mstroklog.com/234521/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2251:e400:c:7955:fe00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: UploadServer /
Resource Hash: f0855c108b6cd64d19b0fa505eccbf9ad8567190d52bfb9fc7e45481271e6534

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mstroklog.com/234521/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 19 Mar 2022 00:21:31 GMT
content-encoding: gzip
age: 1815
x-guploader-uploadid: ADPycdvSf1IlpQxSFV1dSACnpGIZ1I8b6jyBwUilQAIjKi_mSXrk37WNUjDnxsKjvgn_On8s1Pu5jvrc88GYjEXW70c
x-cache: Hit from cloudfront
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 7067
access-control-allow-origin: *
last-modified: Mon, 03 Feb 2020 19:11:14 GMT
server: UploadServer
etag: "e60fc1cdedf392fb55f1be298f2a0986"
vary: Accept-Encoding
x-goog-hash: crc32c=ML1ZbQ==, md5=5g/Bze3zkvtV8b4pjyoJhg==
x-goog-generation: 1580757074548211
via: 1.1 c80ae6bd97b709ed6e4747f0d5ea4efc.cloudfront.net (CloudFront)
access-control-expose-headers: *
cache-control: public, max-age=3600
x-goog-stored-content-length: 7067
x-amz-cf-pop: FRA60-P3
accept-ranges: bytes
content-type: text/css; charset=utf-8
x-amz-cf-id: JXsccAOhgFYiJrGHmsfBXPanx4url8D1A98QUVboV68fShvKkFfIWw==
expires: Sat, 19 Mar 2022 01:21:22 GMT

GET
H2 200 microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msauth.net/shared/1.0/content/images/ 4 KB
2 KB 81ms
9ms Image
image/svg+xml 2620:1ec:bdf::44
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Requested by: Host: mstroklog.com
URL: https://mstroklog.com/234521/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:bdf::44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mstroklog.com/234521/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 19 Mar 2022 00:51:37 GMT
content-encoding: gzip
x-azure-ref-originshield: 0Vu80YgAAAAD63TCsR3xjT5CaTKEU2L2lQU1TMDRFREdFMTgwNgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-md5: nzaLxFgP7ZB3dfMcaybWzw==
x-cache: TCP_HIT
content-length: 1435
x-ms-lease-status: unlocked
last-modified: Fri, 17 Jan 2020 19:28:38 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D79B8373CB2849
x-azure-ref: 0GSk1YgAAAADfZSD/uqt9SYxYWtZHoYWERlJBRURHRTEwMDkAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: a676d75e-d01e-0052-2308-3b0244000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 34ms
6ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NW58833

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mstroklog.com/234521/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 4607
date: Fri, 18 Mar 2022 23:34:50 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Sat, 19 Mar 2022 01:34:50 GMT

GET
H/1.1 200
OK outlook-integrations-perforce-18.png
www.freepnglogos.com/uploads/logo-outlook-png/ 49 KB
50 KB 84ms
24ms Image
image/png 176.9.17.111
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.freepnglogos.com/uploads/logo-outlook-png/outlook-integrations-perforce-18.png
Requested by: Host: mstroklog.com
URL: https://mstroklog.com/234521/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.9.17.111 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.111.17.9.176.clients.your-server.de
Software: nginx /
Resource Hash: 89bbe5417ccb11ad765bdc612c606543ba25f5f7b77ca44591f278bbf64f90ad

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mstroklog.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 19 Mar 2022 00:51:37 GMT
Last-Modified: Fri, 27 Dec 2019 07:28:33 GMT
Server: nginx
ETag: "c5ec-59aaa70e92a40"
Content-Type: image/png
Cache-Control: max-age=3600, no-cache, must-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 50668
Expires: Sat, 19 Mar 2022 01:51:37 GMT

GET
H2 404 2e24b4f8e324c0d8976e634a9c19c341.svg
mstroklog.com/identity/assets/ 1 KB
1 KB 150ms
150ms Image
text/html 199.188.201.231
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mstroklog.com/identity/assets/2e24b4f8e324c0d8976e634a9c19c341.svg

Requested by

Host: mstroklog.com
URL: https://mstroklog.com/234521/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

199.188.201.231 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business129-5.web-hosting.com

Software

LiteSpeed /

Resource Hash

5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mstroklog.com/234521/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 19 Mar 2022 00:51:37 GMT
x-content-type-options: nosniff
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
x-turbo-charged-by: LiteSpeed
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 1238
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade

GET
H2 404 029f6f0129beaededd6e592095429d81.woff2
mstroklog.com/identity/assets/ 0
0 150ms
149ms Font
text/html 199.188.201.231
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://mstroklog.com/identity/assets/029f6f0129beaededd6e592095429d81.woff2

Requested by

Host: mstroklog.com
URL: https://mstroklog.com/234521/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

199.188.201.231 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business129-5.web-hosting.com

Software

LiteSpeed /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://mstroklog.com/234521/
Origin: https://mstroklog.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 19 Mar 2022 00:51:37 GMT
x-content-type-options: nosniff
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
x-turbo-charged-by: LiteSpeed
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 1238
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade

GET
H2 404 96ca2a24c1787dd7f2d08e4a01df959c.woff2
mstroklog.com/identity/assets/ 0
0 151ms
150ms Font
text/html 199.188.201.231
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://mstroklog.com/identity/assets/96ca2a24c1787dd7f2d08e4a01df959c.woff2

Requested by

Host: mstroklog.com
URL: https://mstroklog.com/234521/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

199.188.201.231 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business129-5.web-hosting.com

Software

LiteSpeed /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://mstroklog.com/234521/
Origin: https://mstroklog.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 19 Mar 2022 00:51:37 GMT
x-content-type-options: nosniff
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
x-turbo-charged-by: LiteSpeed
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 1238
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade

GET
H2 404 82ee13d8c71c9fe2af41c81666cc6e9d.woff2
mstroklog.com/identity/assets/ 0
0 151ms
151ms Font
text/html 199.188.201.231
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://mstroklog.com/identity/assets/82ee13d8c71c9fe2af41c81666cc6e9d.woff2

Requested by

Host: mstroklog.com
URL: https://mstroklog.com/234521/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

199.188.201.231 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business129-5.web-hosting.com

Software

LiteSpeed /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://mstroklog.com/234521/
Origin: https://mstroklog.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 19 Mar 2022 00:51:37 GMT
x-content-type-options: nosniff
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
x-turbo-charged-by: LiteSpeed
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 1238
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
204 B 14ms
13ms XHR
text/plain 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1535040789&t=pageview&_s=1&dl=https%3A%2F%2Fmstroklog.com%2F234521%2F&ul=en-us&de=UTF-8&dt=Sign%20In&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=1316413250&gjid=1303250609&cid=1697224619.1647651098&tid=UA-120693288-1&_gid=887162912.1647651098&_r=1&gtm=2wg3e0NW58833&cd3=0&z=1173489372

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://mstroklog.com/234521/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 19 Mar 2022 00:51:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://mstroklog.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 404 2243fca7f2a1614eaa9acce218533979.woff
mstroklog.com/identity/assets/ 0
0 150ms
149ms Font
text/html 199.188.201.231
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://mstroklog.com/identity/assets/2243fca7f2a1614eaa9acce218533979.woff

Requested by

Host: mstroklog.com
URL: https://mstroklog.com/234521/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

199.188.201.231 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business129-5.web-hosting.com

Software

LiteSpeed /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://mstroklog.com/234521/
Origin: https://mstroklog.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 19 Mar 2022 00:51:37 GMT
x-content-type-options: nosniff
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
x-turbo-charged-by: LiteSpeed
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 1238
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade

GET
H2 404 a18a5351690728aac7d6a5d64a746811.woff
mstroklog.com/identity/assets/ 0
0 150ms
150ms Font
text/html 199.188.201.231
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://mstroklog.com/identity/assets/a18a5351690728aac7d6a5d64a746811.woff

Requested by

Host: mstroklog.com
URL: https://mstroklog.com/234521/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

199.188.201.231 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business129-5.web-hosting.com

Software

LiteSpeed /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://mstroklog.com/234521/
Origin: https://mstroklog.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 19 Mar 2022 00:51:37 GMT
x-content-type-options: nosniff
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
x-turbo-charged-by: LiteSpeed
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 1238
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade

GET
H2 404 eae23c7f06b433058e99213287bb8c12.woff
mstroklog.com/identity/assets/ 0
0 150ms
150ms Font
text/html 199.188.201.231
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://mstroklog.com/identity/assets/eae23c7f06b433058e99213287bb8c12.woff

Requested by

Host: mstroklog.com
URL: https://mstroklog.com/234521/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

199.188.201.231 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business129-5.web-hosting.com

Software

LiteSpeed /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://mstroklog.com/234521/
Origin: https://mstroklog.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 19 Mar 2022 00:51:37 GMT
x-content-type-options: nosniff
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
x-turbo-charged-by: LiteSpeed
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 1238
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.mstroklog.com/	1970-01-20 19:12:03	Name: _ga Value: GA1.2.1697224619.1647651098
.mstroklog.com/	1970-01-20 01:42:17	Name: _gid Value: GA1.2.887162912.1647651098
.mstroklog.com/	1970-01-20 01:40:51	Name: _gat_UA-120693288-1 Value: 1

11 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://mstroklog.com/identity/assets/1.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://mstroklog.com/identity/assets/2.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://mstroklog.com/identity/assets/3.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://mstroklog.com/identity/assets/4.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://mstroklog.com/identity/assets/2e24b4f8e324c0d8976e634a9c19c341.svg Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://mstroklog.com/identity/assets/029f6f0129beaededd6e592095429d81.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://mstroklog.com/identity/assets/96ca2a24c1787dd7f2d08e4a01df959c.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://mstroklog.com/identity/assets/82ee13d8c71c9fe2af41c81666cc6e9d.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://mstroklog.com/identity/assets/2243fca7f2a1614eaa9acce218533979.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://mstroklog.com/identity/assets/a18a5351690728aac7d6a5d64a746811.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://mstroklog.com/identity/assets/eae23c7f06b433058e99213287bb8c12.woff Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
citrix-cloud-content.customer.pendo.io
mstroklog.com
www.freepnglogos.com
www.google-analytics.com
www.googletagmanager.com
176.9.17.111
199.188.201.231
2600:9000:2251:e400:c:7955:fe00:93a1
2620:1ec:bdf::44
2a00:1450:4001:810::200e
2a00:1450:4001:813::2008
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
14fa0f288a3f5985061e883fab756ce79b3bef7508b8875f40388f347d7218da
5da8bf901ea210e18f5301f505f0d088ebdf06b08943cc872fd2f9807e345749
5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807
64fa003b07f94c3b7651719004aa99e9a908426bbdfb38e5e3d8e4ca4ff90a92
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
89bbe5417ccb11ad765bdc612c606543ba25f5f7b77ca44591f278bbf64f90ad
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
cb5264535a06710a16ebbb05f76b6c72296876bf65dec735560c3edde21fa352
ecc37e01ea37e3b466592107b3d727fe4a0b4d0bbdca98a65016c41192218396
f0855c108b6cd64d19b0fa505eccbf9ad8567190d52bfb9fc7e45481271e6534

mstroklog.com Open in urlscan Pro 199.188.201.231 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

21 Requests

100 %HTTPS

67 %IPv6

6 Domains

6 Subdomains

6 IPs

2 Countries

312 kBTransfer

957 kBSize

3 Cookies

2 Outgoing links

Page URL History

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

3 Cookies

11 Console Messages

Security Headers

Indicators

mstroklog.com Open in urlscan Pro
199.188.201.231 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

100 %
HTTPS

67 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

312 kB
Transfer

957 kB
Size

3
Cookies

21 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!