sso.michael-homerln.be Open in urlscan Pro
20.39.249.2  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response sso.michael-homerln.be/	25 KB 27 KB	229ms 167ms	Document text/html	20.39.249.2 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://sso.michael-homerln.be/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.39.249.2 Paris, France, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash f0fa3dd75f616065083729330d05bf213ae1206ab9450eeef9312a46877ff126 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36 accept-language fr-FR,fr;q=0.9 Response headers Cache-Control no-cache, no-store Connection close Content-Type text/html; charset=utf-8 Date Mon, 04 Mar 2024 09:44:36 GMT Expires Mon, 04 Mar 2024 09:43:36 GMT Link <https://logincdn.msftauth.net>; rel=preconnect; crossorigin <https://acctcdn.msauth.net>; rel=preconnect; crossorigin <https://acctcdn.msftauth.net>; rel=preconnect; crossorigin <https://acctcdn.msauth.net/>; rel=dns-prefetch <https://acctcdn.msftauth.net/>; rel=dns-prefetch <https://acctcdnmsftuswe2.azureedge.net/>; rel=dns-prefetch <https://acctcdnvzeuno.azureedge.net/>; rel=dns-prefetch <https://logincdn.msauth.net/>; rel=dns-prefetch <https://logincdn.msftauth.net/>; rel=dns-prefetch <https://lgincdnvzeuno.azureedge.net/>; rel=dns-prefetch <https://lgincdnmsftuswe2.azureedge.net/>; rel=dns-prefetch P3p CP="DSP CUR OTPi IND OTRi ONL FIN" Ppserver PPV: 30 H: SN1PEPF0002F999 V: 0 Pragma no-cache Referrer-Policy strict-origin-when-cross-origin Transfer-Encoding chunked Vary Accept-Encoding X-Dns-Prefetch-Control on X-Ms-Request-Id b5a0e84c-c25d-4b0d-8405-c0522b4f2c84 X-Ms-Route-Info C543_SN1
GET H2	200	login_fr_oWWjx3mo1snkX2j3KupREA2.js Show response logincdn.msftauth.net/shared/5/js/	848 KB 218 KB	76ms 21ms	Script application/x-javascript	2606:2800:233:b411:5612:27a2:d7a8:208d EDGECAST
General Check archive.org Show headers Download Go to Full URL https://logincdn.msftauth.net/shared/5/js/login_fr_oWWjx3mo1snkX2j3KupREA2.js Requested by Host: sso.michael-homerln.be URL: https://sso.michael-homerln.be/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:b411:5612:27a2:d7a8:208d , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (paa/6F48) / Resource Hash d512a35bf98e845551fa97be3ff7971589509c3cd1dac59e542ace685eee1580 Request headers Referer https://sso.michael-homerln.be/ Origin https://sso.michael-homerln.be accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 04 Mar 2024 09:44:36 GMT content-encoding gzip content-md5 IEj9HdzYZTE0k/smFkDKug== age 384590 x-cache HIT content-length 222617 x-ms-lease-status unlocked last-modified Mon, 19 Feb 2024 20:31:37 GMT server ECAcc (paa/6F48) etag 0x8DC3189C5CADD71 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id c9d369a6-501e-00c2-0e99-6a8866000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	oneds-analytics-js_4c489ddb65b858353cb8_fr.js Show response logincdn.msftauth.net/shared/5/chunks/	88 KB 32 KB	20ms 20ms	Script application/x-javascript	2606:2800:233:b411:5612:27a2:d7a8:208d EDGECAST
General Check archive.org Show headers Download Go to Full URL https://logincdn.msftauth.net/shared/5/chunks/oneds-analytics-js_4c489ddb65b858353cb8_fr.js Requested by Host: logincdn.msftauth.net URL: https://logincdn.msftauth.net/shared/5/js/login_fr_oWWjx3mo1snkX2j3KupREA2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:b411:5612:27a2:d7a8:208d , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (paa/6F3E) / Resource Hash b70e267dfc9a990ef1b236f5cfd3e911f640aa749883051bbfe63e54671a88ca Request headers Referer https://sso.michael-homerln.be/ Origin https://sso.michael-homerln.be accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 04 Mar 2024 09:44:36 GMT content-encoding gzip content-md5 okZ88hmFbhfIkNLX9v41Wg== age 1683299 x-cache HIT content-length 32752 x-ms-lease-status unlocked last-modified Tue, 06 Feb 2024 16:57:33 GMT server ECAcc (paa/6F3E) etag 0x8DC2734B6E2C8E9 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 54b4afe1-801e-0093-18c9-5ec057000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	microsoft_logo_ee5c8d9fb6248c938fd0.svg logincdn.msftauth.net/shared/5/images/	4 KB 2 KB	73ms 19ms	Image image/svg+xml	2606:2800:233:b411:5612:27a2:d7a8:208d EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://logincdn.msftauth.net/shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg Requested by Host: sso.michael-homerln.be URL: https://sso.michael-homerln.be/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:b411:5612:27a2:d7a8:208d , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (paa/6F6F) / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers accept-language fr-FR,fr;q=0.9 Referer https://sso.michael-homerln.be/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 04 Mar 2024 09:44:37 GMT content-encoding gzip content-md5 nzaLxFgP7ZB3dfMcaybWzw== age 19779414 x-cache HIT content-length 1435 x-ms-lease-status unlocked last-modified Tue, 27 Jun 2023 15:45:14 GMT server ECAcc (paa/6F6F) etag 0x8DB77257FFE6B4E vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id ace76f44-a01e-005f-3034-baa2ec000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	2_bc3d32a696895f78c19d.svg logincdn.msftauth.net/shared/5/images/	2 KB 824 B	71ms 21ms	Image image/svg+xml	2606:2800:233:b411:5612:27a2:d7a8:208d EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://logincdn.msftauth.net/shared/5/images/2_bc3d32a696895f78c19d.svg Requested by Host: sso.michael-homerln.be URL: https://sso.michael-homerln.be/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:b411:5612:27a2:d7a8:208d , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (paa/6F69) / Resource Hash 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68 Request headers accept-language fr-FR,fr;q=0.9 Referer https://sso.michael-homerln.be/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 04 Mar 2024 09:44:37 GMT content-encoding gzip content-md5 DhdidjYrlCeaRJJRG/y9mA== age 19779414 x-cache HIT content-length 673 x-ms-lease-status unlocked last-modified Tue, 27 Jun 2023 15:45:09 GMT server ECAcc (paa/6F69) etag 0x8DB77257C91B168 vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 1c000e6b-401e-002e-5b34-ba613a000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	signin_options_4e48046ce74f4b89d450.svg logincdn.msftauth.net/shared/5/images/	2 KB 772 B	19ms 18ms	Image image/svg+xml	2606:2800:233:b411:5612:27a2:d7a8:208d EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://logincdn.msftauth.net/shared/5/images/signin_options_4e48046ce74f4b89d450.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:b411:5612:27a2:d7a8:208d , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (paa/6F6D) / Resource Hash 8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93 Request headers accept-language fr-FR,fr;q=0.9 Referer https://sso.michael-homerln.be/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 04 Mar 2024 09:44:37 GMT content-encoding gzip content-md5 R2FAVxfpONfnQAuxVxXbHg== age 19593664 x-cache HIT content-length 621 x-ms-lease-status unlocked last-modified Tue, 27 Jun 2023 15:45:19 GMT server ECAcc (paa/6F6D) etag 0x8DB772582D4527C vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id b501ed81-501e-0005-41e4-bbcb24000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
POST H2	200	/ Show response browser.events.data.microsoft.com/OneCollector/1.0/	153 B 765 B	676ms 272ms	XHR application/json	13.89.178.27 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://browser.events.data.microsoft.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 Requested by Host: logincdn.msftauth.net URL: https://logincdn.msftauth.net/shared/5/chunks/oneds-analytics-js_4c489ddb65b858353cb8_fr.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 13.89.178.27 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-HTTPAPI/2.0 / Resource Hash 869114dca9d940592c3f289813d0475b0586c0dd8ed85612babdbb1f43fed944 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers upload-time 1709545479311 accept-language fr-FR,fr;q=0.9 client-version 1DS-Web-JS-3.2.15 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36 time-delta-to-apply-millis use-collector-delta content-type application/x-json-stream cache-control no-cache, no-store Referer https://sso.michael-homerln.be/ apikey 69adc3c768bd4dc08c19416121249fcc-66f1668a-797b-4249-95e3-6c6651768c28-7293 Client-Id NO_AUTH Response headers strict-transport-security max-age=31536000 date Mon, 04 Mar 2024 09:44:40 GMT server Microsoft-HTTPAPI/2.0 time-delta-millis 1373 access-control-allow-methods POST p3p CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" content-type application/json access-control-allow-origin https://sso.michael-homerln.be access-control-expose-headers time-delta-millis access-control-allow-credentials true access-control-allow-headers P3P,Set-Cookie,time-delta-millis content-length 153
OPTIONS H2	200	/ browser.events.data.microsoft.com/OneCollector/1.0/	0 0	896ms 456ms	Preflight	13.89.178.27 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://browser.events.data.microsoft.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 13.89.178.27 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-HTTPAPI/2.0 / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept */* Access-Control-Request-Headers apikey,cache-control,client-id,client-version,content-type,time-delta-to-apply-millis,upload-time Access-Control-Request-Method POST Origin https://sso.michael-homerln.be Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers AuthMsaDeviceTicket,AuthXToken,Content-Encoding,Content-Type,Cache-Control,Client-Id,SDK-Name,sdk-version,apikey,x-apikey,client-version,upload-time,time-delta-to-apply-millis,client-time-epoch-millis,persistence-mode,reliability-mode,NoResponseBody access-control-allow-origin https://sso.michael-homerln.be access-control-max-age 3600 cache-control public, 3600 content-length 0 date Mon, 04 Mar 2024 09:44:39 GMT server Microsoft-HTTPAPI/2.0 strict-transport-security max-age=31536000

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| PROOF object| ServerData function| $Loader object| g_dtFirstByte object| g_objPageMode number| g_iSRSFailed string| g_sSRSSuccess function| SRSRetry object| webpackChunk_msidentity_sisu_msa function| clearImmediate function| setImmediate object| regeneratorRuntime object| __dynProto$Gbl

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.sso.michael-homerln.be/	1969-12-31 23:59:59	Name: uaid Value: 9a3d44c398744c77a9592db6765082c1
			.sso.michael-homerln.be/	1969-12-31 23:59:59	Name: MSPRequ Value: id=N&lt=1709545476&co=1
			.sso.michael-homerln.be/	1970-01-21 04:14:01	Name: MSCC Value: 20.39.249.2-FR
			.sso.michael-homerln.be/	1969-12-31 23:59:59	Name: MSPOK Value: $uuid-db6dfb83-87ed-4df8-8b89-6a3dbbfccf09
			.sso.michael-homerln.be/	1969-12-31 23:59:59	Name: OParams Value: 11O.DsWqvUUv*kyRJAO*0x4MZI*rdXImoJAqf2IpXuwErHmv*Z0J1fAByWVHTpSbzK0if3mb7NGYLnuKcrZUOljPsr54fxLZz0IcO*zre5OOm65*ec*sAXcFRj5V9vHMR4j!xg$$
			sso.michael-homerln.be/	1970-01-21 03:38:01	Name: MicrosoftApplicationsTelemetryDeviceId Value: 78ae2623-c81c-4545-9d58-282409e40f2a
			sso.michael-homerln.be/	1970-01-20 18:52:27	Name: ai_session Value: ajo80LHBybl0l9kdvgDAlK|1709545477309|1709545477309

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://sso.michael-homerln.be/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://sso.michael-homerln.be/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

browser.events.data.microsoft.com
logincdn.msftauth.net
sso.michael-homerln.be
13.89.178.27
20.39.249.2
2606:2800:233:b411:5612:27a2:d7a8:208d
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
869114dca9d940592c3f289813d0475b0586c0dd8ed85612babdbb1f43fed944
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
b70e267dfc9a990ef1b236f5cfd3e911f640aa749883051bbfe63e54671a88ca
d512a35bf98e845551fa97be3ff7971589509c3cd1dac59e542ace685eee1580
f0fa3dd75f616065083729330d05bf213ae1206ab9450eeef9312a46877ff126