controlpanel.msoutlookonline.net Open in urlscan Pro
104.18.42.234 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.owa.myownhelpdesk.com/
Effective URL:
https://controlpanel.msoutlookonline.net/Portal/ADUser/Login
Submission: On July 25 via automatic, source certstream-suspicious (July 25th 2024, 10:58:35 am UTC) — Scanned from GB

Summary HTTP 15 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 4 countries across 4 domains to perform 15 HTTP transactions. The main IP is 104.18.42.234, located in and belongs to CLOUDFLARENET, US. The main domain is controlpanel.msoutlookonline.net. The Cisco Umbrella rank of the primary domain is 762946.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on October 13th 2023. Valid for: a year.

This is the only time controlpanel.msoutlookonline.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	5.134.14.67 5.134.14.67	34282 (UKNOC-AS) (UKNOC-AS)
1 13	104.18.42.234 104.18.42.234	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:2800:133... 2606:2800:133:206e:1315:22a5:2006:24fd	15133 (EDGECAST) (EDGECAST)
2	20.50.88.244 20.50.88.244	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
15	3

1 5.134.14.67 (United Kingdom) 1 redirects

ASN34282 (UKNOC-AS, GB)
PTR: shared2.myownhelpdesk.net

www.owa.myownhelpdesk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 104.18.42.234 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

controlpanel.msoutlookonline.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:133:206e:1315:22a5:2006:24fd (United States)

ASN15133 (EDGECAST, US)

az416426.vo.msecnd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 20.50.88.244 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

dc.services.visualstudio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	msoutlookonline.net 1 redirects controlpanel.msoutlookonline.net — Cisco Umbrella Rank: 762946	130 KB
2	visualstudio.com dc.services.visualstudio.com — Cisco Umbrella Rank: 853	200 B
1	msecnd.net az416426.vo.msecnd.net — Cisco Umbrella Rank: 5485	22 KB
1	myownhelpdesk.com 1 redirects www.owa.myownhelpdesk.com	974 B
15	4

	Domain	Requested by
13	controlpanel.msoutlookonline.net	1 redirects controlpanel.msoutlookonline.net
2	dc.services.visualstudio.com	az416426.vo.msecnd.net
1	az416426.vo.msecnd.net	controlpanel.msoutlookonline.net
1	www.owa.myownhelpdesk.com	1 redirects
15	4

This site contains links to these domains. Also see Links.

Domain
outdatedbrowser.com

Subject Issuer	Validity	Valid
controlpanel.msoutlookonline.net Cloudflare Inc ECC CA-3	`2023-10-13` - `2024-10-12`	a year	crt.sh
*.vo.msecnd.net DigiCert SHA2 Secure Server CA	`2024-06-06` - `2025-06-06`	a year	crt.sh
prod.ai.ingestion.msftcloudes.com Microsoft Azure RSA TLS Issuing CA 03	`2024-06-24` - `2025-06-19`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://controlpanel.msoutlookonline.net/Portal/ADUser/Login
Frame ID: 9A14128F07EF129C02A5BBE48CC5A742
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Outlook Web Access

Page URL History Show full URLs

https://www.owa.myownhelpdesk.com/ HTTP 301
https://controlpanel.msoutlookonline.net/asp/MManager/Login.asp HTTP 302
https://controlpanel.msoutlookonline.net/Portal/ADUser/Login Page URL

Page Statistics

15
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

4
Countries

151 kB
Transfer

346 kB
Size

3
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://outdatedbrowser.com/en
Title: Update my browser

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.owa.myownhelpdesk.com/ HTTP 301
https://controlpanel.msoutlookonline.net/asp/MManager/Login.asp HTTP 302
https://controlpanel.msoutlookonline.net/Portal/ADUser/Login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request Login Show response
controlpanel.msoutlookonline.net/Portal/ADUser/
Redirect Chain

https://www.owa.myownhelpdesk.com/
https://controlpanel.msoutlookonline.net/asp/MManager/Login.asp
https://controlpanel.msoutlookonline.net/Portal/ADUser/Login

10 KB
3 KB

316ms
315ms

Document
text/html

104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.msoutlookonline.net/Portal/ADUser/Login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET ARR/3.0

Resource Hash

9b9a838d2b412a5262a1bc6f29fc507a6557fd622f6e4d2ecd66bf78d0d37316

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: Request-Context
cache-control: private
cf-cache-status: DYNAMIC
cf-ray: 8a8ba294ec9f531c-LHR
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 25 Jul 2024 10:58:29 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
request-context: appId=cid-v1:3d955e26-37b2-4f34-8edf-38006fe65a6b
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-aspnetmvc-version: 5.2
x-frame-options: SAMEORIGIN
x-powered-by: ASP.NET ARR/3.0

Redirect headers

cache-control: private,no-cache
cf-cache-status: DYNAMIC
cf-ray: 8a8ba28ff81b531c-LHR
content-security-policy-report-only: script-src 'none'; connect-src 'none'; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=xLtSHAA9afqcfp8RLGFu3WrMLKJzsV5IPe9v5lqnfkM-1721905109-1.0.1.1-iuBr2TKfE1gEQwQZbOr4mXQxoCFy5nycvoOQ7UyZIQBbO.4jRSdx_RonHJICTG7c2.2AKu1tYsE1Cvl_A2ie3deqk6w9ISv1F26nNa4s51mtK1qwuTKBpiN2MWupys4YTjnX.vONlYE2s8sIEruWTLd8PUadlJlIkr833Kr85dp3QJtZTfHwzwAUxQPi2W5H; report-to cf-csp-endpoint
content-type: text/html; Charset=utf-8
date: Thu, 25 Jul 2024 10:58:29 GMT
expires: Thu, 25 Jul 2024 10:57:29 GMT
location: /Portal/ADUser/Login
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
report-to: {"endpoints":[{"url":"https:\/\/csp-reporting.cloudflare.com\/cdn-cgi\/script_monitor\/report?m=xLtSHAA9afqcfp8RLGFu3WrMLKJzsV5IPe9v5lqnfkM-1721905109-1.0.1.1-iuBr2TKfE1gEQwQZbOr4mXQxoCFy5nycvoOQ7UyZIQBbO.4jRSdx_RonHJICTG7c2.2AKu1tYsE1Cvl_A2ie3deqk6w9ISv1F26nNa4s51mtK1qwuTKBpiN2MWupys4YTjnX.vONlYE2s8sIEruWTLd8PUadlJlIkr833Kr85dp3QJtZTfHwzwAUxQPi2W5H"}],"group":"cf-csp-endpoint","max_age":86400}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-frame-options: DENY SAMEORIGIN
x-powered-by: ASP.NET ARR/3.0

GET
H2 200 aduser
controlpanel.msoutlookonline.net/Portal/bundles/styles/login/ 15 KB
3 KB 406ms
404ms Stylesheet
text/css 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.msoutlookonline.net/Portal/bundles/styles/login/aduser?v=W7BlBDeKoLwh8af7SGN3zTnaNVVx3_J0LsG11KaUjz81

Requested by

Host: controlpanel.msoutlookonline.net
URL: https://controlpanel.msoutlookonline.net/Portal/ADUser/Login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

54cd0006ab5219d98a5c6d6e4ab7ac36444de6d41a99dd911cc6561157d1aadb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://controlpanel.msoutlookonline.net/Portal/ADUser/Login
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 10:58:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: DYNAMIC
x-powered-by: ASP.NET, ARR/3.0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
request-context: appId=cid-v1:3d955e26-37b2-4f34-8edf-38006fe65a6b
last-modified: Thu, 25 Jul 2024 10:58:30 GMT
server: cloudflare
vary: User-Agent
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-expose-headers: Request-Context
cache-control: public
cf-ray: 8a8ba2989fd6531c-LHR
expires: Fri, 25 Jul 2025 10:58:30 GMT

GET
H2 200 form Show response
controlpanel.msoutlookonline.net/Portal/bundles/scripts/login/ 149 KB
47 KB 163ms
162ms Script
text/javascript 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.msoutlookonline.net/Portal/bundles/scripts/login/form?v=CmdgOWPmbhvy-YqQrxjWVdKbUwAQPUKB8GGJxjDJB141

Requested by

Host: controlpanel.msoutlookonline.net
URL: https://controlpanel.msoutlookonline.net/Portal/ADUser/Login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

550442f99dfb72f1a38dac692203051548fdb7c87f3ec43784c038a214381aa7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://controlpanel.msoutlookonline.net/Portal/ADUser/Login
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 10:58:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: DYNAMIC
x-powered-by: ASP.NET, ARR/3.0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
request-context: appId=cid-v1:3d955e26-37b2-4f34-8edf-38006fe65a6b
last-modified: Thu, 25 Jul 2024 10:58:29 GMT
server: cloudflare
vary: User-Agent
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
access-control-expose-headers: Request-Context
cache-control: public
cf-ray: 8a8ba2989fd7531c-LHR
expires: Fri, 25 Jul 2025 10:58:29 GMT

GET
H2 200 appInsights.PROD.js Show response
controlpanel.msoutlookonline.net/aspx/scripts/analytics/ 1 KB
746 B 45ms
45ms Script
application/javascript 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.msoutlookonline.net/aspx/scripts/analytics/appInsights.PROD.js

Requested by

Host: controlpanel.msoutlookonline.net
URL: https://controlpanel.msoutlookonline.net/Portal/ADUser/Login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

198f5a54eb65cf21e9bb2adb40fbaa153d834080b45e9d74cb38eb121ad91649

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://controlpanel.msoutlookonline.net/Portal/ADUser/Login
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 10:58:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 17 Jul 2024 08:27:38 GMT
server: cloudflare
age: 6610
etag: W/"039b62e23d8da1:0"
x-powered-by: ASP.NET, ARR/3.0
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-type: application/javascript
cf-ray: 8a8ba2989fd8531c-LHR

GET
H2 200 warning-orange_24.png
controlpanel.msoutlookonline.net/Content/images/icons/24/ 270 B
420 B 44ms
43ms Image
image/png 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://controlpanel.msoutlookonline.net/Content/images/icons/24/warning-orange_24.png

Requested by

Host: controlpanel.msoutlookonline.net
URL: https://controlpanel.msoutlookonline.net/Portal/ADUser/Login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

021552f50478176acb8b290389a5b4758927f7eea728b66142ca701eaaaa3f1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://controlpanel.msoutlookonline.net/Portal/ADUser/Login
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 10:58:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: HIT
age: 100375
x-powered-by: ASP.NET, ARR/3.0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-length: 270
last-modified: Tue, 18 Jun 2024 20:41:44 GMT
server: cloudflare
etag: "0b431eebfc1da1:0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=172800
accept-ranges: bytes
cf-ray: 8a8ba2989fd9531c-LHR

GET
H2 200 aduser Show response
controlpanel.msoutlookonline.net/Portal/bundles/scripts/login/form/ 1 KB
729 B 404ms
403ms Script
text/javascript 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.msoutlookonline.net/Portal/bundles/scripts/login/form/aduser?v=B87zorpzZDMoJcsZoh1VXPIom52zrbX9F7qXIbJKQ3w1

Requested by

Host: controlpanel.msoutlookonline.net
URL: https://controlpanel.msoutlookonline.net/Portal/ADUser/Login

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

f562bb61bd39f8ea2265b5a70f749d6cb5565b47aa4b8e6df44b624156a6c98b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://controlpanel.msoutlookonline.net/Portal/ADUser/Login
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 10:58:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: DYNAMIC
x-powered-by: ASP.NET, ARR/3.0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
request-context: appId=cid-v1:3d955e26-37b2-4f34-8edf-38006fe65a6b
last-modified: Thu, 25 Jul 2024 10:58:30 GMT
server: cloudflare
vary: User-Agent
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
access-control-expose-headers: Request-Context
cache-control: public
cf-ray: 8a8ba2989fdb531c-LHR
expires: Fri, 25 Jul 2025 10:58:30 GMT

GET
H2 200 ai.0.js Show response
az416426.vo.msecnd.net/scripts/a/ 94 KB
22 KB 228ms
29ms Script
application/x-javascript 2606:2800:133:206e:1315:22a5:2006:24fd
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by: Host: controlpanel.msoutlookonline.net
URL: https://controlpanel.msoutlookonline.net/aspx/scripts/analytics/appInsights.PROD.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:133:206e:1315:22a5:2006:24fd , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lhc/794B) /
Resource Hash: 5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

Referer: https://controlpanel.msoutlookonline.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 25 Jul 2024 10:58:31 GMT
content-encoding: gzip
x-ms-meta-lastmodified: 2020-10-01 19:31:04
content-md5: HdY95yzx9wIyQkVEGES+Ew==
age: 747
x-cache: HIT
content-length: 22495
x-ms-lease-status: unlocked
last-modified: Thu, 11 Mar 2021 07:46:59 GMT
server: ECAcc (lhc/794B)
etag: 0x8D8E461DA1A5889
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: a25cde9a-201e-00fa-697f-de92bf000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=1800
x-ms-version: 2009-09-19
expires: Thu, 25 Jul 2024 11:28:31 GMT

GET
H2 200 aduser.svg
controlpanel.msoutlookonline.net/content/images/icons/custom/ 1 KB
692 B 68ms
66ms Image
image/svg+xml 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://controlpanel.msoutlookonline.net/content/images/icons/custom/aduser.svg

Requested by

Host: controlpanel.msoutlookonline.net
URL: https://controlpanel.msoutlookonline.net/Portal/bundles/styles/login/aduser?v=W7BlBDeKoLwh8af7SGN3zTnaNVVx3_J0LsG11KaUjz81

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

36f53d513f4ade6962ea9b5342113dfb07037c5c22252338ebecc6d20d4dd11e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://controlpanel.msoutlookonline.net/Portal/bundles/styles/login/aduser?v=W7BlBDeKoLwh8af7SGN3zTnaNVVx3_J0LsG11KaUjz81
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 10:58:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 18 Jun 2024 20:41:46 GMT
server: cloudflare
age: 103367
etag: W/"0e162efbfc1da1:0"
x-powered-by: ASP.NET, ARR/3.0
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-type: image/svg+xml
cache-control: max-age=172800
cf-ray: 8a8ba29eee1e531c-LHR

GET
H2 200 info-white_16.svg
controlpanel.msoutlookonline.net/Content/images/icons/16/ 859 B
597 B 51ms
50ms Image
image/svg+xml 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://controlpanel.msoutlookonline.net/Content/images/icons/16/info-white_16.svg

Requested by

Host: controlpanel.msoutlookonline.net
URL: https://controlpanel.msoutlookonline.net/Portal/bundles/styles/login/aduser?v=W7BlBDeKoLwh8af7SGN3zTnaNVVx3_J0LsG11KaUjz81

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

e954ae1ddb505f8e8fbad2f1bbab6036287633051e969f09cf7b353589c1e3a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://controlpanel.msoutlookonline.net/Portal/bundles/styles/login/aduser?v=W7BlBDeKoLwh8af7SGN3zTnaNVVx3_J0LsG11KaUjz81
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 10:58:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 18 Jun 2024 20:41:44 GMT
server: cloudflare
age: 6673
etag: W/"0b431eebfc1da1:0"
x-powered-by: ASP.NET, ARR/3.0
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-type: image/svg+xml
cache-control: max-age=172800
cf-ray: 8a8ba29eee21531c-LHR

GET
H2 200 dinot-webfont.woff
controlpanel.msoutlookonline.net/content/font/ 23 KB
23 KB 46ms
46ms Font
font/x-woff 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.msoutlookonline.net/content/font/dinot-webfont.woff

Requested by

Host: controlpanel.msoutlookonline.net
URL: https://controlpanel.msoutlookonline.net/Portal/bundles/styles/login/aduser?v=W7BlBDeKoLwh8af7SGN3zTnaNVVx3_J0LsG11KaUjz81

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

75769c069372a5f8d8da31d6f20c102b919269ef27b876b2a56b3dd381321a26

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://controlpanel.msoutlookonline.net/Portal/bundles/styles/login/aduser?v=W7BlBDeKoLwh8af7SGN3zTnaNVVx3_J0LsG11KaUjz81
Origin: https://controlpanel.msoutlookonline.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 10:58:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 18 Jun 2024 20:41:44 GMT
server: cloudflare
age: 68322
etag: W/"0b431eebfc1da1:0"
x-powered-by: ASP.NET, ARR/3.0
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-type: font/x-woff
cache-control: max-age=172800
cf-ray: 8a8ba29faea9531c-LHR

GET
H2 200 dinot-medium-webfont.woff
controlpanel.msoutlookonline.net/content/font/ 25 KB
25 KB 61ms
61ms Font
font/x-woff 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.msoutlookonline.net/content/font/dinot-medium-webfont.woff

Requested by

Host: controlpanel.msoutlookonline.net
URL: https://controlpanel.msoutlookonline.net/Portal/bundles/styles/login/aduser?v=W7BlBDeKoLwh8af7SGN3zTnaNVVx3_J0LsG11KaUjz81

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

4d0ae714a36becfdb44141b5e04f6e7b8869d9f4a778c281fae28bf01a868afa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://controlpanel.msoutlookonline.net/Portal/bundles/styles/login/aduser?v=W7BlBDeKoLwh8af7SGN3zTnaNVVx3_J0LsG11KaUjz81
Origin: https://controlpanel.msoutlookonline.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 10:58:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 18 Jun 2024 20:41:44 GMT
server: cloudflare
age: 159534
etag: W/"0b431eebfc1da1:0"
x-powered-by: ASP.NET, ARR/3.0
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-type: font/x-woff
cache-control: max-age=172800
cf-ray: 8a8ba29faeac531c-LHR

GET
H2 200 opensans-regular-webfont.woff
controlpanel.msoutlookonline.net/content/font/ 24 KB
24 KB 66ms
59ms Font
font/x-woff 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.msoutlookonline.net/content/font/opensans-regular-webfont.woff

Requested by

Host: controlpanel.msoutlookonline.net
URL: https://controlpanel.msoutlookonline.net/Portal/bundles/styles/login/aduser?v=W7BlBDeKoLwh8af7SGN3zTnaNVVx3_J0LsG11KaUjz81

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

ca510e3ff10ec424392a2e5f5ff640c8059671b92fe8b42ae5911b6dc844e41b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://controlpanel.msoutlookonline.net/Portal/bundles/styles/login/aduser?v=W7BlBDeKoLwh8af7SGN3zTnaNVVx3_J0LsG11KaUjz81
Origin: https://controlpanel.msoutlookonline.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 10:58:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 18 Jun 2024 20:41:44 GMT
server: cloudflare
age: 159534
etag: W/"0b431eebfc1da1:0"
x-powered-by: ASP.NET, ARR/3.0
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-type: font/x-woff
cache-control: max-age=172800
cf-ray: 8a8ba2a02f0e531c-LHR

GET
H2 200 favicon.ico
controlpanel.msoutlookonline.net/ 1 KB
272 B 594ms
594ms Other
image/x-icon 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.msoutlookonline.net/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

8cce2770de445408e0fb08d8d74f2cfa19cf76329bacf743f2100ecbe06ec4ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://controlpanel.msoutlookonline.net/Portal/ADUser/Login
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Thu, 25 Jul 2024 10:58:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Wed, 17 Jul 2024 08:27:12 GMT
server: cloudflare
etag: W/"0f0361f23d8da1:0"
x-powered-by: ASP.NET, ARR/3.0
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-type: image/x-icon
cf-ray: 8a8ba2a1a814531c-LHR

POST
H2 200 track Show response
dc.services.visualstudio.com/v2/ 96 B
200 B 363ms
362ms XHR
application/json 20.50.88.244
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dc.services.visualstudio.com/v2/track

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

20.50.88.244 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-HTTPAPI/2.0 /

Resource Hash

2f3c28c092416eb4039e5c202e1f4365a509d0a1d6b759686da09b7a239eb4d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://controlpanel.msoutlookonline.net/
Sdk-Context: appId
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-type: application/json

Response headers

access-control-allow-origin: *
strict-transport-security: max-age=31536000
date: Thu, 25 Jul 2024 10:58:31 GMT
x-content-type-options: nosniff
server: Microsoft-HTTPAPI/2.0
content-type: application/json; charset=utf-8

OPTIONS
H2 204 track
dc.services.visualstudio.com/v2/ 0
0 546ms
161ms Preflight 20.50.88.244
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dc.services.visualstudio.com/v2/track

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

20.50.88.244 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-HTTPAPI/2.0 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,sdk-context
Access-Control-Request-Method: POST
Origin: https://controlpanel.msoutlookonline.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin,X-Requested-With,Content-Name,Content-Type,Accept,Cache-Control,Sdk-Context
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 3600
date: Thu, 25 Jul 2024 10:58:31 GMT
server: Microsoft-HTTPAPI/2.0
strict-transport-security: max-age=31536000

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
controlpanel.msoutlookonline.net/	1969-12-31 23:59:59	Name: ASPSESSIONIDAECRSADR Value: BNMBCHBBCHAJOEJNOPFMHCED
controlpanel.msoutlookonline.net/	1970-01-21 07:04:01	Name: ai_user Value: D2hVO\|2024-07-25T10:58:31.193Z
controlpanel.msoutlookonline.net/	1970-01-20 22:18:26	Name: ai_session Value: 0svF+\|1721905111344.2\|1721905111344.2

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://controlpanel.msoutlookonline.net/Portal/ADUser/Login Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

az416426.vo.msecnd.net
controlpanel.msoutlookonline.net
dc.services.visualstudio.com
www.owa.myownhelpdesk.com
104.18.42.234
20.50.88.244
2606:2800:133:206e:1315:22a5:2006:24fd
5.134.14.67
021552f50478176acb8b290389a5b4758927f7eea728b66142ca701eaaaa3f1a
198f5a54eb65cf21e9bb2adb40fbaa153d834080b45e9d74cb38eb121ad91649
2f3c28c092416eb4039e5c202e1f4365a509d0a1d6b759686da09b7a239eb4d4
36f53d513f4ade6962ea9b5342113dfb07037c5c22252338ebecc6d20d4dd11e
4d0ae714a36becfdb44141b5e04f6e7b8869d9f4a778c281fae28bf01a868afa
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e
54cd0006ab5219d98a5c6d6e4ab7ac36444de6d41a99dd911cc6561157d1aadb
550442f99dfb72f1a38dac692203051548fdb7c87f3ec43784c038a214381aa7
75769c069372a5f8d8da31d6f20c102b919269ef27b876b2a56b3dd381321a26
8cce2770de445408e0fb08d8d74f2cfa19cf76329bacf743f2100ecbe06ec4ae
9b9a838d2b412a5262a1bc6f29fc507a6557fd622f6e4d2ecd66bf78d0d37316
ca510e3ff10ec424392a2e5f5ff640c8059671b92fe8b42ae5911b6dc844e41b
e954ae1ddb505f8e8fbad2f1bbab6036287633051e969f09cf7b353589c1e3a4
f562bb61bd39f8ea2265b5a70f749d6cb5565b47aa4b8e6df44b624156a6c98b

controlpanel.msoutlookonline.net Open in urlscan Pro 104.18.42.234 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

15 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

3 IPs

4 Countries

151 kBTransfer

346 kBSize

3 Cookies

1 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

25 JavaScript Global Variables

3 Cookies

1 Console Messages

Security Headers

Indicators

controlpanel.msoutlookonline.net Open in urlscan Pro
104.18.42.234 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

4
Countries

151 kB
Transfer

346 kB
Size

3
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!