office365-outlook.com
Open in
urlscan Pro
194.28.84.212
Malicious Activity!
Public Scan
URL:
http://office365-outlook.com/login.srf%3fwa=wsignin1.0&rpsnv=13&ct=1519298322&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%253a%25...
Submission: On February 23 via automatic, source twitter_illegalFawn
Submission: On February 23 via automatic, source twitter_illegalFawn
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 11 HTTP transactions.
The main IP is 194.28.84.212, located in
Ukraine and
belongs to HOSTPRO-AS, UA.
The main domain is office365-outlook.com.
This is the only time office365-outlook.com was scanned on urlscan.io!
This is the only time office365-outlook.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Office 365 (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 8 | 194.28.84.212 194.28.84.212 | 196645 (HOSTPRO-AS) (HOSTPRO-AS) | |
| 3 | 104.111.251.171 104.111.251.171 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
| 11 | 2 |
8
194.28.84.212
(Ukraine)
ASN196645 (HOSTPRO-AS, UA)
PTR: koppa.fastbighost.net
ASN196645 (HOSTPRO-AS, UA)
PTR: koppa.fastbighost.net
| office365-outlook.com |
3
104.111.251.171
(Amsterdam, Netherlands)
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-251-171.deploy.static.akamaitechnologies.com
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-251-171.deploy.static.akamaitechnologies.com
| secure.aadcdn.microsoftonline-p.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 8 |
office365-outlook.com
office365-outlook.com |
122 KB |
| 3 |
microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com |
204 KB |
| 11 | 2 |
| Domain | Requested by | |
|---|---|---|
| 8 | office365-outlook.com |
office365-outlook.com
|
| 3 | secure.aadcdn.microsoftonline-p.com |
office365-outlook.com
|
| 11 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| account.live.com |
| passwordreset.microsoftonline.com |
| login.live.com |
| www.microsoft.com |
| privacy.microsoft.com |
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://office365-outlook.com/login.srf%3fwa=wsignin1.0&rpsnv=13&ct=1519298322&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%2526RpsCsrfState%253d444e572d-0771-c346-8a82-ffbf844db44b&id=292841&CBCXT=out&lw=1&fl=dob%252cflname%252cwld&cobrandid=90015/office/
Frame ID: (714354DAB6C615E9F28752E398FEDE81)
Requests: 11 HTTP requests in this frame
Screenshot
Detected technologies
Nginx
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
HeadJS
(JavaScript Libraries)
Expand
Overall confidence: 50%
Detected patterns
Detected patterns
- env /^head$/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- env /^jQuery$/i
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
URL: https://account.live.com/password/reset?wreply=https:%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQIIAeNisNLJKCkpKLbS1y_ILypJzNHLzUwuyi_OTyvJz8vJzEvVS87P1csvSs9MAbGKhLgEVO61sc_v1fBeUbzZV31Z7d1VjMqEjdC_wMj4gpHxFpOgf1G6Z0p4sVtqSmpRYklmft4jJt7Q4tQi_7ycypD87NS8XcwqiZbmFmmGRha6ZqZGibomqSbmupamFqa6KclJppZpJuYWJqaJF1gEXrHwGDBbcXCwCTBLMCgw_GBhXMQKdOCBb2YHdMrSvLaHcnX6RpusOcWq751bEV6WEaUfWuafUpbskZ1nWlSVZVjl6adtWFblmGTqGJXomBHiFWYamWxraGU4gU1oAhvTAU5GAA2
Title: Personal account
Title: Personal account
Search URL Search Domain Scan URL
URL: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQIIAeNisNLJKCkpKLbS1y_ILypJzNHLzUwuyi_OTyvJz8vJzEvVS87P1csvSs9MAbGKhLgEVO61sc_v1fBeUbzZV31Z7d1VjMqEjdC_wMj4gpHxFpOgf1G6Z0p4sVtqSmpRYklmft4jJt7Q4tQi_7ycypD87NS8XcwqiZbmFmmGRha6ZqZGibomqSbmupamFqa6KclJppZpJuYWJqaJF1gEXrHwGDBbcXCwCTBLMCgw_GBhXMQKdOCBb2YHdMrSvLaHcnX6RpusOcWq751bEV6WEaUfWuafUpbskZ1nWlSVZVjl6adtWFblmGTqGJXomBHiFWYamWxraGU4gU1oAhvTAU5GAA2%26uio%3d1&mkt=en-US&hosted=0&device_platform=Windows+8.1
Title: Work or school account
Title: Work or school account
Search URL Search Domain Scan URL
URL: https://login.live.com/login.srf?wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQIIAeNisNLJKCkpKLbS1y_ILypJzNHLzUwuyi_OTyvJz8vJzEvVS87P1csvSs9MAbGKhLgEVO61sc_v1fBeUbzZV31Z7d1VjMqEjdC_wMj4gpHxFpOgf1G6Z0p4sVtqSmpRYklmft4jJt7Q4tQi_7ycypD87NS8XcwqiZbmFmmGRha6ZqZGibomqSbmupamFqa6KclJppZpJuYWJqaJF1gEXrHwGDBbcXCwCTBLMCgw_GBhXMQKdOCBb2YHdMrSvLaHcnX6RpusOcWq751bEV6WEaUfWuafUpbskZ1nWlSVZVjl6adtWFblmGTqGJXomBHiFWYamWxraGU4gU1oAhvTAU5GAA2&id=&uaid=0786de248d9f4b28a873b34d27a67ddd&pcexp=false&popupui=
Title: Sign in with a Microsoft account
Title: Sign in with a Microsoft account
Search URL Search Domain Scan URL
URL: https://www.microsoft.com/en-US/servicesagreement/
Title: Terms of use
Title: Terms of use
Search URL Search Domain Scan URL
URL: https://privacy.microsoft.com/en-US/privacystatement
Title: Privacy & Cookies
Title: Privacy & Cookies
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
office365-outlook.com/login.srf%3fwa=wsignin1.0&rpsnv=13&ct=1519298322&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%2526RpsCsrfState%253d444e572... |
43 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login.css
office365-outlook.com/login.srf%3fwa=wsignin1.0&rpsnv=13&ct=1519298322&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%2526RpsCsrfState%253d444e572... |
21 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login_hover.css
office365-outlook.com/login.srf%3fwa=wsignin1.0&rpsnv=13&ct=1519298322&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%2526RpsCsrfState%253d444e572... |
89 B 463 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.js
office365-outlook.com/login.srf%3fwa=wsignin1.0&rpsnv=13&ct=1519298322&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%2526RpsCsrfState%253d444e572... |
108 KB 44 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
aad.js
office365-outlook.com/login.srf%3fwa=wsignin1.0&rpsnv=13&ct=1519298322&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%2526RpsCsrfState%253d444e572... |
174 KB 52 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
heroillustration.jpg
office365-outlook.com/login.srf%3fwa=wsignin1.0&rpsnv=13&ct=1519298322&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%2526RpsCsrfState%253d444e572... |
138 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bannerlogo.png
office365-outlook.com/login.srf%3fwa=wsignin1.0&rpsnv=13&ct=1519298322&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%2526RpsCsrfState%253d444e572... |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
microsoft_logo.png
office365-outlook.com/login.srf%3fwa=wsignin1.0&rpsnv=13&ct=1519298322&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%2526RpsCsrfState%253d444e572... |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login_hover.min.css
secure.aadcdn.microsoftonline-p.com/ests/2.1.5623.13/content/cdnbundles/ |
89 B 454 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bannerlogo
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-6ybrougjmflxqw910ieyohr7wb4x4-yvoixrlaidmz4/appbranding/askzfdsqe20i-bcjwporaywega7vbt4acqnn1hiliiw/0/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
heroillustration
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-6ybrougjmflxqw910ieyohr7wb4x4-yvoixrlaidmz4/appbranding/askzfdsqe20i-bcjwporaywega7vbt4acqnn1hiliiw/0/ |
199 KB 199 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Office 365 (Online)48 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B boolean| isTouch string| cssId object| head object| link undefined| msViewportStyle function| $ function| jQuery function| pageOnReady object| MSLogin object| proxy object| ErrorCodes object| Constants object| Context object| Background object| Logo object| Instrument object| User object| tenant_info object| EmailDiscovery function| origHide function| origShow function| origAddClass function| origRemoveClass object| Support object| MSLogout object| ThirdPartyCookieStates object| PostType object| LoginOption object| Post object| TenantBranding object| users object| Tiles object| $Api object| jQuery1112004863721001806853 object| StrongAuthCheck object| Util object| WindowsBrowserSso object| body function| check8 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| outlook.office365.com/ | Name: OIDC Value: 1 |
|
| www.office.com/ | Name: OH.DCAffinity Value: OH-weu |
|
| outlook.office365.com/ | Name: ClientId Value: 91448B9871034A0086F917AD6AFC40EE |
|
| .office.com/ | Name: MUID Value: 24A9B47D765964801A8CBFE277FF65E6 |
|
| www.office.com/ | Name: OH.SID Value: 8f1f4806-86c7-4a2f-9598-5e1910a38ff2 |
|
| portal.office.com/ | Name: s.SessID Value: c7c79f71-f5c6-4c70-8f70-b8aba07fc44e |
|
| portal.office.com/ | Name: p.PersID Value: cae46833-91e3-4781-b526-7c02d3dd48d3 |
|
| office365-outlook.com/login.srf%3fwa=wsignin1.0&rpsnv=13&ct=1519298322&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%2526RpsCsrfState%253d444e572d-0771-c346-8a82-ffbf844db44b&id=292841&CBCXT=out&lw=1&fl=dob%252cflname%252cwld&cobrandid=90015/office | Name: testcookie Value: testcookie |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
office365-outlook.com
secure.aadcdn.microsoftonline-p.com
104.111.251.171
194.28.84.212
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
91c2b74542e11d0278e02715a980b39582eae2e3b519ddd2d4f9ca939e58109c
988e349f2bf4e87154738c7b2c1fa86618713a8cfa0cef60a046f5add89bd9de
b5ea0ffbe39f577651336a1aba7746881cf235b9f7ccc1c51b151162b3da4feb
d422d055fc7e99b9a2356023659180e91ee818697425f9f488a103a9c10b38e6
d9c500706bcdb6d8e2ba4de1a6ea3d30d87417b79aa26e51fa2b9b9f4ff37e5f
dc87310ad5ba3ba71381a099028455789ffc67e9815d4cb440c92fb9df2a380a
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603