URL: https://azure-security-microsoft.com/
Submission Tags: @phishunt_io
Submission: On January 26 via api from ES

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 46.20.237.40, located in Melbourne, United Kingdom and belongs to IOMART-AS, GB. The main domain is azure-security-microsoft.com.
TLS certificate: Issued by R3 on January 26th 2021. Valid for: 3 months.
This is the only time azure-security-microsoft.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
4 46.20.237.40 20860 (IOMART-AS)
2 94.199.239.17 202038 (INTERCITY...)
6 2
Domain Requested by
4 azure-security-microsoft.com azure-security-microsoft.com
2 fs.intercity.technology azure-security-microsoft.com
6 2

This site contains no links.

Subject Issuer Validity Valid
azure-security-microsoft.com
R3
2021-01-26 -
2021-04-26
3 months crt.sh
*.intercity.technology
Starfield Secure Certificate Authority - G2
2019-11-19 -
2021-11-28
2 years crt.sh

This page contains 1 frames:

Primary Page: https://azure-security-microsoft.com/
Frame ID: 23FA86EEC3DB6E46BF27956280AD787F
Requests: 6 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

127 kB
Transfer

194 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
azure-security-microsoft.com/
18 KB
6 KB
Document
General
Full URL
https://azure-security-microsoft.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
46.20.237.40 Melbourne, United Kingdom, ASN20860 (IOMART-AS, GB),
Reverse DNS
pp-ce-portal.com
Software
Apache /
Resource Hash
ea3273a5bc173ef01ce0821c816671f1c4215dbf4a2002fe03d7a0b39480baca
Security Headers
Name Value
Strict-Transport-Security max-age=0;includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Host
azure-security-microsoft.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 26 Jan 2021 21:40:51 GMT
Server
Apache
Strict-Transport-Security
max-age=0;includeSubDomains
X-Frame-Options
DENY SAMEORIGIN
X-Content-Type-Options
nosniff
Last-Modified
Tue, 26 Jan 2021 13:19:50 GMT
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Encoding
gzip
X-XSS-Protection
1;mode=block
Cache-Control
max-age=0, no-cache, no-store, must-revalidate
Pragma
no-cache
Expires
Wed, 11 Jan 1984 05:00:00 GMT
Content-Length
5280
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html
jquery-3.1.1.min.js
azure-security-microsoft.com/includes/js/
85 KB
30 KB
Script
General
Full URL
https://azure-security-microsoft.com/includes/js/jquery-3.1.1.min.js
Requested by
Host: azure-security-microsoft.com
URL: https://azure-security-microsoft.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
46.20.237.40 Melbourne, United Kingdom, ASN20860 (IOMART-AS, GB),
Reverse DNS
pp-ce-portal.com
Software
Apache /
Resource Hash
892fcc249b9b0fd6e8727741d21d5cdd5474238327ba116308b5dfad6ddfd1bd
Security Headers
Name Value
Strict-Transport-Security max-age=0;includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY, SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://azure-security-microsoft.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 26 Jan 2021 21:40:51 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Vary
Accept-Encoding
Content-Length
30079
X-XSS-Protection
1;mode=block
Pragma
no-cache
Last-Modified
Tue, 26 Jan 2021 11:56:16 GMT
Server
Apache
X-Frame-Options
DENY, SAMEORIGIN
Strict-Transport-Security
max-age=0;includeSubDomains
Content-Type
application/javascript
Cache-Control
max-age=0, no-cache, no-store, must-revalidate
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Expires
Wed, 11 Jan 1984 05:00:00 GMT
capture.js
azure-security-microsoft.com/includes/js/
1 KB
1 KB
Script
General
Full URL
https://azure-security-microsoft.com/includes/js/capture.js
Requested by
Host: azure-security-microsoft.com
URL: https://azure-security-microsoft.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
46.20.237.40 Melbourne, United Kingdom, ASN20860 (IOMART-AS, GB),
Reverse DNS
pp-ce-portal.com
Software
Apache /
Resource Hash
571e71bd644eac5922a8185e2768b2d6000e153b38a213ca44f93e85ba4bff91
Security Headers
Name Value
Strict-Transport-Security max-age=0;includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY, SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://azure-security-microsoft.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 26 Jan 2021 21:40:51 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Keep-Alive
Vary
Accept-Encoding
Content-Length
581
X-XSS-Protection
1;mode=block
Pragma
no-cache
Last-Modified
Tue, 26 Jan 2021 12:30:41 GMT
Server
Apache
X-Frame-Options
DENY, SAMEORIGIN
Strict-Transport-Security
max-age=0;includeSubDomains
Content-Type
application/javascript
Cache-Control
max-age=0, no-cache, no-store, must-revalidate
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Expires
Wed, 11 Jan 1984 05:00:00 GMT
style.css
fs.intercity.technology/adfs/portal/css/
8 KB
8 KB
Stylesheet
General
Full URL
https://fs.intercity.technology/adfs/portal/css/style.css?id=0A13280A86E7DFA6949BD016EA848912FCAFC05E88CBEDF538AC325B27041205
Requested by
Host: azure-security-microsoft.com
URL: https://azure-security-microsoft.com/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_CBC
Server
94.199.239.17 Leyton, United Kingdom, ASN202038 (INTERCITY-BOLTON, GB),
Reverse DNS
server-ef-11.hosting.imerja.net
Software
Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
0a13280a86e7dfa6949bd016ea848912fcafc05e88cbedf538ac325b27041205

Request headers

Referer
https://azure-security-microsoft.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 26 Jan 2021 21:40:51 GMT
Expires
Thu, 25 Feb 2021 21:41:12 GMT
Server
Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
ETag
0A13280A86E7DFA6949BD016EA848912FCAFC05E88CBEDF538AC325B27041205
Content-Length
8144
Content-Type
text/css
illustration.png
fs.intercity.technology/adfs/portal/illustration/
82 KB
82 KB
Image
General
Full URL
https://fs.intercity.technology/adfs/portal/illustration/illustration.png?id=33B454A92F245133659695E28B3E19FA2B9C3BCF82181414A90150CFBB7A9D3D
Requested by
Host: azure-security-microsoft.com
URL: https://azure-security-microsoft.com/
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_CBC
Server
94.199.239.17 Leyton, United Kingdom, ASN202038 (INTERCITY-BOLTON, GB),
Reverse DNS
server-ef-11.hosting.imerja.net
Software
Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
33b454a92f245133659695e28b3e19fa2b9c3bcf82181414a90150cfbb7a9d3d

Request headers

Referer
https://azure-security-microsoft.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 26 Jan 2021 21:40:51 GMT
Expires
Thu, 25 Feb 2021 21:41:12 GMT
Server
Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
ETag
33B454A92F245133659695E28B3E19FA2B9C3BCF82181414A90150CFBB7A9D3D
Content-Length
83659
Content-Type
image/png
capture_ajax.php
azure-security-microsoft.com/includes/
20 B
389 B
XHR
General
Full URL
https://azure-security-microsoft.com/includes/capture_ajax.php?click_event=click_event&attack_id=1
Requested by
Host: azure-security-microsoft.com
URL: https://azure-security-microsoft.com/includes/js/jquery-3.1.1.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
46.20.237.40 Melbourne, United Kingdom, ASN20860 (IOMART-AS, GB),
Reverse DNS
pp-ce-portal.com
Software
Apache /
Resource Hash
121b06b32df0dc2dba42540289cf40d40fbdc79b0279bc15c59e557b9ea17117
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY, SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Accept
text/plain, */*; q=0.01
Referer
https://azure-security-microsoft.com/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 26 Jan 2021 21:40:51 GMT
X-Content-Type-Options
nosniff
Server
Apache
X-Frame-Options
DENY, SAMEORIGIN
Content-Type
text/html; charset=UTF-8
Connection
Keep-Alive
Strict-Transport-Security
max-age=63072000; includeSubdomains;
Keep-Alive
timeout=5, max=97
Content-Length
20
X-XSS-Protection
1;mode=block

Verdicts & Comments Add Verdict or Comment

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery number| $attack_id function| LoginErrors number| maxPasswordLength function| InputUtil function| SelectOption function| Login undefined| emails undefined| msViewportStyle undefined| viewport function| getStyle function| computeLoadIllustration function| SetIllustrationImage

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0;includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY SAMEORIGIN
X-Xss-Protection 1;mode=block