urlscan.io logo urlscan.io
SecurityTrails logo

legendstechsolution.com Open in urlscan Pro
2a06:98c1:3121::7  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://url5507.sba.net/ls/click?upn=bMguIO-2B4n7lAjy-2BPur-2Bg0h5auSsjShkabBVFc532-2Bj8nI3zjGfiEsGLQUaD09fQDsOn6wZL7eUb...
Effective URL: https://legendstechsolution.com/wp-includes/fonts/app/info/issues/app.php?signon=true&access_token=jT364RmHy40vPwmSXehnITHPUEj14...
Submission: On April 04 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 5 domains to perform 5 HTTP transactions. The main IP is 2a06:98c1:3121::7, located in United States and belongs to CLOUDFLARENET, US. The main domain is legendstechsolution.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on April 2nd 2022. Valid for: a year.
This is the only time legendstechsolution.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Community Verdicts: Malicious — 2 votes Show Verdicts

Domain & IP information

IP Address AS Autonomous System
1 1 167.89.118.52 11377 (SENDGRID)
1 1 45.33.123.16 63949 (LINODE-AP...)
2 5 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 192.229.221.185 15133 (EDGECAST)
5 3
1    167.89.118.52 (Las Vegas, United States)

ASN11377 (SENDGRID, US)
PTR: o16789118x52.outbound-mail.sendgrid.net
url5507.sba.net
1    45.33.123.16 (Richardson, United States)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li1060-16.members.linode.com
stormshelterdefender.com
5    2a06:98c1:3121::7 (United States)

ASN13335 (CLOUDFLARENET, US)
legendstechsolution.com
1    2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
1    192.229.221.185 (United States)

ASN15133 (EDGECAST, US)
logincdn.msauth.net
Apex Domain
Subdomains		 Transfer
5 legendstechsolution.com
legendstechsolution.com
31 KB
1 msauth.net
logincdn.msauth.net — Cisco Umbrella Rank: 2481
1 KB
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 280
30 KB
1 stormshelterdefender.com
stormshelterdefender.com
411 B
1 sba.net
url5507.sba.net
289 B
5 5
Domain Requested by
5 legendstechsolution.com 2 redirects legendstechsolution.com
1 logincdn.msauth.net legendstechsolution.com
1 ajax.googleapis.com legendstechsolution.com
1 stormshelterdefender.com 1 redirects
1 url5507.sba.net 1 redirects
5 5

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-04-02 -
2023-04-02		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2022-03-17 -
2022-06-09		 3 months crt.sh
identitycdn.msauth.net
DigiCert SHA2 Secure Server CA		 2021-05-13 -
2022-05-13		 a year crt.sh

This page contains 1 frames:

Primary Page: https://legendstechsolution.com/wp-includes/fonts/app/info/issues/app.php?signon=true&access_token=jT364RmHy40vPwmSXehnITHPUEj14fHeLlLjbvxbM10ymmbNzC9xHE0sldfe7wBVg4nFsEi3Z06FCbSc
Frame ID: 63AD9E7E7D7FCEE46A63B34CEC56E7E5
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign in to your Microsoft account

Page URL History Show full URLs

  1. http://url5507.sba.net/ls/click?upn=bMguIO-2B4n7lAjy-2BPur-2Bg0h5auSsjShkabBVFc532-2Bj8nI3zjGfiEsGL... HTTP 302
    https://stormshelterdefender.com/wp-content/themes/audio/app/?e=ehahn@cproperties.com HTTP 301
    https://legendstechsolution.com/wp-includes/fonts/app/info?e=ehahn@cproperties.com HTTP 301
    https://legendstechsolution.com/wp-includes/fonts/app/info/?e=ehahn@cproperties.com HTTP 302
    https://legendstechsolution.com/wp-includes/fonts/app/info/issues/app.php?signon=true&access_token=jT364RmHy... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

5
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

3
IPs

2
Countries

62 kB
Transfer

234 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://url5507.sba.net/ls/click?upn=bMguIO-2B4n7lAjy-2BPur-2Bg0h5auSsjShkabBVFc532-2Bj8nI3zjGfiEsGLQUaD09fQDsOn6wZL7eUbMzfqV3CZNpPjcrNijvahaSwOtw6FKHcObnlPKAfFdQP4H8mCUIqgNkgtu_aHPAHUaar1efji7ClsLl-2BS4GFj0YpwNwrA94b2wKmCHILq5EY0kcxSuotjKrgv7yk4FqqwkR-2FHbnbObsGN0ArEgzibqWBMSJS2cZh9dKI5qlRmYC7rkmVG-2FlG-2FfsoahKkcZ09VIP8ozES5eQJYf9Iz1sVktTwiJYlecU57Q26AA-2B9LjeQKqBsrJl6LxfOfNTdKWXlPnPSGYocKBGgTcjyg-3D-3D HTTP 302
    https://stormshelterdefender.com/wp-content/themes/audio/app/?e=ehahn@cproperties.com HTTP 301
    https://legendstechsolution.com/wp-includes/fonts/app/info?e=ehahn@cproperties.com HTTP 301
    https://legendstechsolution.com/wp-includes/fonts/app/info/?e=ehahn@cproperties.com HTTP 302
    https://legendstechsolution.com/wp-includes/fonts/app/info/issues/app.php?signon=true&access_token=jT364RmHy40vPwmSXehnITHPUEj14fHeLlLjbvxbM10ymmbNzC9xHE0sldfe7wBVg4nFsEi3Z06FCbSc Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request app.php
legendstechsolution.com/wp-includes/fonts/app/info/issues/
Redirect Chain
  • http://url5507.sba.net/ls/click?upn=bMguIO-2B4n7lAjy-2BPur-2Bg0h5auSsjShkabBVFc532-2Bj8nI3zjGfiEsGLQUaD09fQDsOn6wZL7eUbMzfqV3CZNpPjcrNijvahaSwOtw6FKHcObnlPKAfFdQP4H8mCUIqgNkgtu_aHPAHUaar1efji7ClsLl...
  • https://stormshelterdefender.com/wp-content/themes/audio/app/?e=ehahn@cproperties.com
  • https://legendstechsolution.com/wp-includes/fonts/app/info?e=ehahn@cproperties.com
  • https://legendstechsolution.com/wp-includes/fonts/app/info/?e=ehahn@cproperties.com
  • https://legendstechsolution.com/wp-includes/fonts/app/info/issues/app.php?signon=true&access_token=jT364RmHy40vPwmSXehnITHPUEj14fHeLlLjbvxbM10ymmbNzC9xHE0sldfe7wBVg4nFsEi3Z06FCbSc
6 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://legendstechsolution.com/wp-includes/fonts/app/info/issues/app.php?signon=true&access_token=jT364RmHy40vPwmSXehnITHPUEj14fHeLlLjbvxbM10ymmbNzC9xHE0sldfe7wBVg4nFsEi3Z06FCbSc
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9f758dbe1a9042e042f70b3f89082609c5ad70424ff24371e3eb6bcafb78f5fc

Request headers

Accept-Language
de-DE,de;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
6f6c6122787b102b-MRS
content-type
text/html; charset=UTF-8
date
Mon, 04 Apr 2022 19:16:37 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nEgvgbKoTEfQ84G%2Fb7q8bVL0QDSBJTyQvMDIvzKuYUDwrgJYHJ3aHidwmh%2BmS3Uvpd2LCipG3hsGbU1rSZz2RX5SKwOruYbUgBNVhySfipuj6E8bT51i7VeACdz0v4okfV16DL41HfsnVa7iZwlxgZCo%2FS9ung%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare

Redirect headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
6f6c6120bb177339-MRS
content-type
text/html; charset=UTF-8
date
Mon, 04 Apr 2022 19:16:36 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
issues/app.php?signon=true&access_token=jT364RmHy40vPwmSXehnITHPUEj14fHeLlLjbvxbM10ymmbNzC9xHE0sldfe7wBVg4nFsEi3Z06FCbSc
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=avPKATReqWK%2FYkdjajzBYO9f3nnv361Hq8Q1X2a8DVXnZwz0ZwiNrzke9oDYolI3ujPstctPImXNWf6SO11Zh9J3LRXfxWISxE3RpFY2Iztfgu65gkH%2FD5AzJe1h4vOEqTVsVnr7ipthYtr%2BCSmmnUpAPbSDqQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
midnight.css
legendstechsolution.com/wp-includes/fonts/app/info/css/ 		137 KB
21 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://legendstechsolution.com/wp-includes/fonts/app/info/css/midnight.css
Requested by
Host: legendstechsolution.com
URL: https://legendstechsolution.com/wp-includes/fonts/app/info/issues/app.php?signon=true&access_token=jT364RmHy40vPwmSXehnITHPUEj14fHeLlLjbvxbM10ymmbNzC9xHE0sldfe7wBVg4nFsEi3Z06FCbSc
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
da4ab9db5186122f56914f9b80f5796a190475e39cab73122b971731db9f6ecc

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://legendstechsolution.com/wp-includes/fonts/app/info/issues/app.php?signon=true&access_token=jT364RmHy40vPwmSXehnITHPUEj14fHeLlLjbvxbM10ymmbNzC9xHE0sldfe7wBVg4nFsEi3Z06FCbSc
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 19:16:38 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 05 Oct 2021 17:07:04 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lWq1g8B03f4fr7kLOHI7phl2YxfIYJlcPGAau%2BfIIzgHc4XawfY1PKx8ElpQNBICXwKRXHbpgPrdz0i9FlmV5wvwQGRV4lycgNjxod3u04okJS59nZGGS434S2k2Z8pOYXOki5pqRaLx0Jqn%2Fbv5EgmMzHWScg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6f6c61268873102b-MRS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js
Requested by
Host: legendstechsolution.com
URL: https://legendstechsolution.com/wp-includes/fonts/app/info/issues/app.php?signon=true&access_token=jT364RmHy40vPwmSXehnITHPUEj14fHeLlLjbvxbM10ymmbNzC9xHE0sldfe7wBVg4nFsEi3Z06FCbSc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://legendstechsolution.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 28 Mar 2022 22:39:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
592609
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
30306
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 28 Mar 2023 22:39:48 GMT
midnight2.svg
legendstechsolution.com/wp-includes/fonts/app/info/css/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://legendstechsolution.com/wp-includes/fonts/app/info/css/midnight2.svg
Requested by
Host: legendstechsolution.com
URL: https://legendstechsolution.com/wp-includes/fonts/app/info/issues/app.php?signon=true&access_token=jT364RmHy40vPwmSXehnITHPUEj14fHeLlLjbvxbM10ymmbNzC9xHE0sldfe7wBVg4nFsEi3Z06FCbSc
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://legendstechsolution.com/wp-includes/fonts/app/info/issues/app.php?signon=true&access_token=jT364RmHy40vPwmSXehnITHPUEj14fHeLlLjbvxbM10ymmbNzC9xHE0sldfe7wBVg4nFsEi3Z06FCbSc
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 19:16:38 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 05 Oct 2021 17:07:04 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dCH83qtsp8XccvF2Cwt3xK3ywBBo28ZKPJ7CkRHqUvdZVxZILRTta661dkBJGgZMNN79xPPujR671xBR89hvJe%2BCV8pdsXusHK3wnq2ISv0u0%2FGHJ6B46Uzq9b4qzqgrr79bmuLXGf0hCTiuNJWm4yKxwlRBkQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6f6c6126d909102b-MRS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
2_bc3d32a696895f78c19df6c717586a5d.svg
logincdn.msauth.net/shared/1.0/content/images/backgrounds/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://logincdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Requested by
Host: legendstechsolution.com
URL: https://legendstechsolution.com/wp-includes/fonts/app/info/issues/app.php?signon=true&access_token=jT364RmHy40vPwmSXehnITHPUEj14fHeLlLjbvxbM10ymmbNzC9xHE0sldfe7wBVg4nFsEi3Z06FCbSc
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.221.185 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (lha/8DA2) /
Resource Hash
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://legendstechsolution.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 04 Apr 2022 19:16:38 GMT
content-encoding
gzip
content-md5
DhdidjYrlCeaRJJRG/y9mA==
age
29563949
x-cache
HIT
content-length
673
x-ms-lease-status
unlocked
last-modified
Wed, 12 Feb 2020 22:01:42 GMT
server
ECAcc (lha/8DA2)
etag
0x8D7B00724D9E930
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
4f198054-101e-008d-5376-3b144e000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes

Verdicts & Comments Add Verdict or Comment

Malicious page.url
Submitted on April 4th 2022, 7:18:33 pm UTC — From United States

Threats: Phishing Social Engineering Brand Impersonation
Brands: Microsoft US
Comment: Phishing Office 365 creds. Do not open or login.

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails function| $ function| jQuery function| validatepx function| validatemail object| emailx function| change_color

1 Cookies

Domain/Path Name / Value
legendstechsolution.com/ Name: PHPSESSID
Value: 33cfa2178e029cc77cf76d1f7a3d2799