URL: https://healingcompany.ca/wp-content/themes/twentynineteen/sass/site/outlook.htm
Submission: On February 22 via automatic, source openphish

Summary

This website contacted 4 IPs in 2 countries across 5 domains to perform 4 HTTP transactions. The main IP is 198.71.233.184, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US. The main domain is healingcompany.ca.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on November 1st 2017. Valid for: 3 years.
This is the only time healingcompany.ca was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 198.71.233.184 26496 (AS-26496-...)
3 3 137.49.1.224 393337 (UOFHARTFORD)
3 3 40.97.161.50 8075 (MICROSOFT...)
3 3 2603:1026:c06... 8075 (MICROSOFT...)
3 3 2603:1026:c06... 8075 (MICROSOFT...)
2 40.126.9.65 8075 (MICROSOFT...)
3 3 2603:1026:c06... 8075 (MICROSOFT...)
1 40.126.1.128 8075 (MICROSOFT...)
4 4
Domain Requested by
6 outlook.office365.com 6 redirects
3 login.microsoftonline.com healingcompany.ca
3 www.outlook.com 3 redirects
3 outlook.com 3 redirects
3 hawkmail.hartford.edu 3 redirects
1 healingcompany.ca
4 6

This site contains no links.

Subject Issuer Validity Valid
healingcompany.ca
Go Daddy Secure Certificate Authority - G2
2017-11-01 -
2020-11-01
3 years crt.sh
stamp2.login.microsoftonline.com
Microsoft IT TLS CA 1
2018-09-24 -
2020-09-24
2 years crt.sh

This page contains 1 frames:

Primary Page: https://healingcompany.ca/wp-content/themes/twentynineteen/sass/site/outlook.htm
Frame ID: 5A6971B800DC85306C9B9ABC2885046F
Requests: 5 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link\s[^>]*href="[^"]*?([\d.]+)\/themes\/resources\/owafont\.css/i

Overall confidence: 50%
Detected patterns
  • html /<link\s[^>]*href="[^"]*?([\d.]+)\/themes\/resources\/owafont\.css/i

Overall confidence: 100%
Detected patterns
  • html /<link\s[^>]*href="[^"]*?([\d.]+)\/themes\/resources\/owafont\.css/i

Overall confidence: 100%
Detected patterns
  • headers server /ATS\/?([\d.]+)?/i

Overall confidence: 50%
Detected patterns
  • html /<link\s[^>]*href="[^"]*?([\d.]+)\/themes\/resources\/owafont\.css/i

Page Statistics

4
Requests

100 %
HTTPS

38 %
IPv6

5
Domains

6
Subdomains

4
IPs

2
Countries

20 kB
Transfer

25 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://hawkmail.hartford.edu/owa/14.3.210.2/themes/resources/logon.css HTTP 302
  • https://outlook.com/hartford.edu HTTP 301
  • https://www.outlook.com/hartford.edu HTTP 301
  • https://outlook.office365.com/hartford.edu HTTP 302
  • https://outlook.office365.com/owa/hartford.edu HTTP 302
  • https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=a0e6a54b-d2df-458a-9ad2-f706bcadd710&protectedtoken=true&domain_hint=hartford.edu&nonce=636864055515681684.61bcd44a-63fd-4671-8d44-d77d28420bcf&state=DYtJDoAgDABBX-BDkK20_Q5QiTcSovH79jCTzGGsMWZXNsUGlSHMyAihlBILckSGE2PrAlAd5iEOkKJjbSdEkhhSaH1YfQ8_v-rvup4xl5yXvD8
Request Chain 1
  • https://hawkmail.hartford.edu/owa/14.3.210.2/themes/resources/owafont.css HTTP 302
  • https://outlook.com/hartford.edu HTTP 301
  • https://www.outlook.com/hartford.edu HTTP 301
  • https://outlook.office365.com/hartford.edu HTTP 302
  • https://outlook.office365.com/owa/hartford.edu HTTP 302
  • https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=58099cee-b2f8-464b-8bc5-f65aff421c5d&protectedtoken=true&domain_hint=hartford.edu&nonce=636864055515851429.bcb92b8e-195b-4aa3-a148-15775aadff0c&state=DcvJDYAgEEBR0AoshGWAgaGcYYs3EqKxfTm8f_tSCHFuxybtjkjRR4rBIiIgIQSXdaklu0JdQcaiArNXDIEUYErI3MawVe73MvNjc_N6xlxN9_b-
Request Chain 2
  • https://hawkmail.hartford.edu/owa/14.3.210.2/scripts/premium/flogon.js HTTP 302
  • https://outlook.com/hartford.edu HTTP 301
  • https://www.outlook.com/hartford.edu HTTP 301
  • https://outlook.office365.com/hartford.edu HTTP 302
  • https://outlook.office365.com/owa/hartford.edu HTTP 302
  • https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=60ab5c94-499e-48a3-94e9-383d51c561dd&protectedtoken=true&domain_hint=hartford.edu&nonce=636864055516352197.1c7225bd-324b-4b23-be5f-e2a5e0c0b391&state=DctLDoAgDABR0BN4EARaCnIcyifuSIjG69vFm91opdQuNqGdRKWI8YrBEZGPSOBzOn1NAMTNIAQ2gQENdxqmQ6HuqmPMXst72PkVe5f1jLna2dv7Aw

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request outlook.htm
healingcompany.ca/wp-content/themes/twentynineteen/sass/site/
21 KB
8 KB
Document
General
Full URL
https://healingcompany.ca/wp-content/themes/twentynineteen/sass/site/outlook.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.71.233.184 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-198-71-233-184.ip.secureserver.net
Software
ATS/7.1.2 /
Resource Hash
2baf30df11ad6cbda06129159230345c041b4144a89d59da46c2d5ee00356dcd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Host
healingcompany.ca
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Last-Modified
Thu, 21 Feb 2019 17:28:58 GMT
ETag
"556e-5826acf3d2d18-gzip"
Content-Encoding
gzip
X-XSS-Protection
1; mode=block
X-Content-Type-Options
nosniff
Content-Type
text/html
X-Port
port_10630
X-Cacheable
YES:Forced
Content-Length
7786
Date
Fri, 22 Feb 2019 04:12:29 GMT
Age
25912
Vary
Accept-Encoding, User-Agent
X-Cache
cached
X-Cache-Hit
HIT
X-Backend
all_requests
Accept-Ranges
bytes
Connection
keep-alive
Via
http/1.1 a2nlwpproxy018.prod.iad2.secureserver.net (ApacheTrafficServer/7.1.2 [uSc sSf pSeN:tOc i p sS])
Server
ATS/7.1.2
authorize
login.microsoftonline.com/common/oauth2/
Redirect Chain
  • https://hawkmail.hartford.edu/owa/14.3.210.2/themes/resources/logon.css
  • https://outlook.com/hartford.edu
  • https://www.outlook.com/hartford.edu
  • https://outlook.office365.com/hartford.edu
  • https://outlook.office365.com/owa/hartford.edu
  • https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-0...
0
4 KB
Stylesheet
General
Full URL
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=a0e6a54b-d2df-458a-9ad2-f706bcadd710&protectedtoken=true&domain_hint=hartford.edu&nonce=636864055515681684.61bcd44a-63fd-4671-8d44-d77d28420bcf&state=DYtJDoAgDABBX-BDkK20_Q5QiTcSovH79jCTzGGsMWZXNsUGlSHMyAihlBILckSGE2PrAlAd5iEOkKJjbSdEkhhSaH1YfQ8_v-rvup4xl5yXvD8
Requested by
Host: healingcompany.ca
URL: https://healingcompany.ca/wp-content/themes/twentynineteen/sass/site/outlook.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.126.9.65 Tokyo, Japan, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://healingcompany.ca/wp-content/themes/twentynineteen/sass/site/outlook.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Redirect headers

X-BEServer
LO2P265MB0415
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-BackEndHttpStatus
302
X-BackEnd-End
2019-02-22T04:12:31.569
X-FEServer
LO2P265CA0277
P3P
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Server
Microsoft-IIS/10.0
X-RUM-Validated
1
request-id
a0e6a54b-d2df-458a-9ad2-f706bcadd710
Content-Length
723
X-BackEnd-Begin
2019-02-22T04:12:31.567
X-UA-Compatible
IE=EmulateIE7
X-CalculatedBETarget
LO2P265MB0415.GBRP265.PROD.OUTLOOK.COM
Date
Fri, 22 Feb 2019 04:12:31 GMT
Content-Type
text/html; charset=utf-8
Location
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=a0e6a54b-d2df-458a-9ad2-f706bcadd710&protectedtoken=true&domain_hint=hartford.edu&nonce=636864055515681684.61bcd44a-63fd-4671-8d44-d77d28420bcf&state=DYtJDoAgDABBX-BDkK20_Q5QiTcSovH79jCTzGGsMWZXNsUGlSHMyAihlBILckSGE2PrAlAd5iEOkKJjbSdEkhhSaH1YfQ8_v-rvup4xl5yXvD8
X-DiagInfo
LO2P265MB0415
X-Content-Type-Options
nosniff
authorize
login.microsoftonline.com/common/oauth2/
Redirect Chain
  • https://hawkmail.hartford.edu/owa/14.3.210.2/themes/resources/owafont.css
  • https://outlook.com/hartford.edu
  • https://www.outlook.com/hartford.edu
  • https://outlook.office365.com/hartford.edu
  • https://outlook.office365.com/owa/hartford.edu
  • https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-0...
0
4 KB
Stylesheet
General
Full URL
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=58099cee-b2f8-464b-8bc5-f65aff421c5d&protectedtoken=true&domain_hint=hartford.edu&nonce=636864055515851429.bcb92b8e-195b-4aa3-a148-15775aadff0c&state=DcvJDYAgEEBR0AoshGWAgaGcYYs3EqKxfTm8f_tSCHFuxybtjkjRR4rBIiIgIQSXdaklu0JdQcaiArNXDIEUYErI3MawVe73MvNjc_N6xlxN9_b-
Requested by
Host: healingcompany.ca
URL: https://healingcompany.ca/wp-content/themes/twentynineteen/sass/site/outlook.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.126.9.65 Tokyo, Japan, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://healingcompany.ca/wp-content/themes/twentynineteen/sass/site/outlook.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Redirect headers

X-BEServer
LNXP265MB0346
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-BackEndHttpStatus
302
X-BackEnd-End
2019-02-22T04:12:31.586
X-FEServer
LO2P265CA0159
P3P
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Server
Microsoft-IIS/10.0
X-RUM-Validated
1
request-id
58099cee-b2f8-464b-8bc5-f65aff421c5d
Content-Length
724
X-BackEnd-Begin
2019-02-22T04:12:31.584
X-UA-Compatible
IE=EmulateIE7
X-CalculatedBETarget
LNXP265MB0346.GBRP265.PROD.OUTLOOK.COM
Date
Fri, 22 Feb 2019 04:12:31 GMT
Content-Type
text/html; charset=utf-8
Location
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=58099cee-b2f8-464b-8bc5-f65aff421c5d&protectedtoken=true&domain_hint=hartford.edu&nonce=636864055515851429.bcb92b8e-195b-4aa3-a148-15775aadff0c&state=DcvJDYAgEEBR0AoshGWAgaGcYYs3EqKxfTm8f_tSCHFuxybtjkjRR4rBIiIgIQSXdaklu0JdQcaiArNXDIEUYErI3MawVe73MvNjc_N6xlxN9_b-
X-DiagInfo
LNXP265MB0346
X-Content-Type-Options
nosniff
authorize
login.microsoftonline.com/common/oauth2/
Redirect Chain
  • https://hawkmail.hartford.edu/owa/14.3.210.2/scripts/premium/flogon.js
  • https://outlook.com/hartford.edu
  • https://www.outlook.com/hartford.edu
  • https://outlook.office365.com/hartford.edu
  • https://outlook.office365.com/owa/hartford.edu
  • https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-0...
0
4 KB
Script
General
Full URL
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=60ab5c94-499e-48a3-94e9-383d51c561dd&protectedtoken=true&domain_hint=hartford.edu&nonce=636864055516352197.1c7225bd-324b-4b23-be5f-e2a5e0c0b391&state=DctLDoAgDABR0BN4EARaCnIcyifuSIjG69vFm91opdQuNqGdRKWI8YrBEZGPSOBzOn1NAMTNIAQ2gQENdxqmQ6HuqmPMXst72PkVe5f1jLna2dv7Aw
Requested by
Host: healingcompany.ca
URL: https://healingcompany.ca/wp-content/themes/twentynineteen/sass/site/outlook.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.126.1.128 Tokyo, Japan, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://healingcompany.ca/wp-content/themes/twentynineteen/sass/site/outlook.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Redirect headers

X-BEServer
CWLP265MB0498
Strict-Transport-Security
max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
X-BackEndHttpStatus
302, 302
X-BackEnd-End
2019-02-22T04:12:31.636
X-CalculatedFETarget
CWLP265CU013.internal.outlook.com
P3P
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-CalculatedBETarget
CWLP265MB0498.GBRP265.PROD.OUTLOOK.COM
X-FEProxyInfo
CWLP265CA0295.GBRP265.PROD.OUTLOOK.COM
X-RUM-Validated
1
request-id
60ab5c94-499e-48a3-94e9-383d51c561dd
Content-Length
726
X-BackEnd-Begin
2019-02-22T04:12:31.635
X-UA-Compatible
IE=EmulateIE7
Server
Microsoft-IIS/10.0
Date
Fri, 22 Feb 2019 04:12:30 GMT
Content-Type
text/html; charset=utf-8
Location
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=60ab5c94-499e-48a3-94e9-383d51c561dd&protectedtoken=true&domain_hint=hartford.edu&nonce=636864055516352197.1c7225bd-324b-4b23-be5f-e2a5e0c0b391&state=DctLDoAgDABR0BN4EARaCnIcyifuSIjG69vFm91opdQuNqGdRKWI8YrBEZGPSOBzOn1NAMTNIAQ2gQENdxqmQ6HuqmPMXst72PkVe5f1jLna2dv7Aw
X-DiagInfo
CWLP265MB0498
X-Content-Type-Options
nosniff
X-FEServer
CWLP265CA0295, LO2P265CA0168
truncated
/
4 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6ecdf56bf8a51301e8c84659c56754f78b3436a08e6fbc1b60011afa65e3b336

Request headers

Response headers

Content-Type
image/jpeg

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask number| a_fRC number| g_fFcs number| a_fLOff number| a_fCAC number| a_fEnbSMm function| IsMimeCtlInst function| RndMimeCtl function| RndMimeCtlHlpr

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block