urlscan.io logo urlscan.io
SecurityTrails logo

owaexchserver.com Open in urlscan Pro
38.45.18.202  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://owaexchserver.com/exch/Outlook2.html
Submission Tags: @ecarlesi possiblethreat phishing opendir Search All
Submission: On December 28 via api from IT — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 38.45.18.202, located in Toronto, Canada and belongs to COGENT-174, US. The main domain is owaexchserver.com.
TLS certificate: Issued by R11 on December 28th 2024. Valid for: 3 months.
This is the only time owaexchserver.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

IP Address AS Autonomous System
4 38.45.18.202 174 (COGENT-174)
1 151.101.2.137 54113 (FASTLY)
6 3
Apex Domain
Subdomains		 Transfer
4 owaexchserver.com
owaexchserver.com
16 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 847
31 KB
0 Failed
function sub() { [native code] }. Failed
6 3
Domain Requested by
4 owaexchserver.com owaexchserver.com
1 code.jquery.com owaexchserver.com
0 Failed
6 3

This site contains no links.

Subject Issuer Validity Valid
www.owaexchserver.com
R11		 2024-12-28 -
2025-03-28		 3 months crt.sh
*.jquery.com
Sectigo ECC Domain Validation Secure Server CA		 2024-06-25 -
2025-06-25		 a year crt.sh

This page contains 1 frames:

Primary Page: https://owaexchserver.com/exch/Outlook2.html
Frame ID: 04DF6E04D29A10E94B5A4F2DE90A6302
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Outlook

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

6
Requests

83 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

46 kB
Transfer

114 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Outlook2.html
owaexchserver.com/exch/ 		15 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://owaexchserver.com/exch/Outlook2.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
38.45.18.202 Toronto, Canada, ASN174 (COGENT-174, US),
Reverse DNS
cp2.hostsilo.com
Software
LiteSpeed /
Resource Hash
796108e8733437fb7a25526a47c5e3c223a68c7b14e6a70824c2bc91464ebe6e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
br
content-length
4104
content-type
text/html
date
Sat, 28 Dec 2024 16:44:14 GMT
last-modified
Sat, 28 Dec 2024 07:15:06 GMT
server
LiteSpeed
vary
Accept-Encoding
1.png
owaexchserver.com/exch/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://owaexchserver.com/exch/1.png
Requested by
Host: owaexchserver.com
URL: https://owaexchserver.com/exch/Outlook2.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
38.45.18.202 Toronto, Canada, ASN174 (COGENT-174, US),
Reverse DNS
cp2.hostsilo.com
Software
LiteSpeed /
Resource Hash
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://owaexchserver.com/exch/Outlook2.html

Response headers

cache-control
public, max-age=604800
expires
Sat, 04 Jan 2025 16:44:14 GMT
accept-ranges
bytes
content-length
2503
date
Sat, 28 Dec 2024 16:44:14 GMT
content-type
image/png
last-modified
Sat, 28 Dec 2024 07:14:56 GMT
server
LiteSpeed
2.png
owaexchserver.com/exch/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://owaexchserver.com/exch/2.png
Requested by
Host: owaexchserver.com
URL: https://owaexchserver.com/exch/Outlook2.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
38.45.18.202 Toronto, Canada, ASN174 (COGENT-174, US),
Reverse DNS
cp2.hostsilo.com
Software
LiteSpeed /
Resource Hash
a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://owaexchserver.com/exch/Outlook2.html

Response headers

cache-control
public, max-age=604800
expires
Sat, 04 Jan 2025 16:44:14 GMT
accept-ranges
bytes
content-length
7746
date
Sat, 28 Dec 2024 16:44:14 GMT
content-type
image/png
last-modified
Sat, 28 Dec 2024 07:14:59 GMT
server
LiteSpeed
3.png
owaexchserver.com/exch/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://owaexchserver.com/exch/3.png
Requested by
Host: owaexchserver.com
URL: https://owaexchserver.com/exch/Outlook2.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
38.45.18.202 Toronto, Canada, ASN174 (COGENT-174, US),
Reverse DNS
cp2.hostsilo.com
Software
LiteSpeed /
Resource Hash
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://owaexchserver.com/exch/Outlook2.html

Response headers

cache-control
public, max-age=604800
expires
Sat, 04 Jan 2025 16:44:14 GMT
accept-ranges
bytes
content-length
1441
date
Sat, 28 Dec 2024 16:44:14 GMT
content-type
image/png
last-modified
Sat, 28 Dec 2024 07:15:03 GMT
server
LiteSpeed
jquery-3.6.0.min.js
code.jquery.com/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.6.0.min.js
Requested by
Host: owaexchserver.com
URL: https://owaexchserver.com/exch/Outlook2.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://owaexchserver.com/

Response headers

content-encoding
gzip
etag
W/"28feccc0-15d9d"
age
3927545
x-cache
HIT, HIT
date
Sat, 28 Dec 2024 16:44:14 GMT
content-type
application/javascript; charset=utf-8
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits
468275, 464043
x-served-by
cache-lga21931-LGA, cache-yyz4562-YYZ
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1735404255.502464,VS0,VE0
cross-origin-resource-policy
cross-origin
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
30875
server
nginx
favicon.ico
/C:/owa/auth/15.2.1544/themes/resources/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
URL
file:///C:/owa/auth/15.2.1544/themes/resources/favicon.ico

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| generateRandomString function| getIpAndLocation function| sendToTelegram function| handleLogin function| autoFillEmail

0 Cookies

2 Console Messages

Source Level URL
Text
recommendation verbose URL: https://owaexchserver.com/exch/Outlook2.html
Message:
[DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o
javascript error URL: https://owaexchserver.com/exch/Outlook2.html
Message:
Not allowed to load local resource: file:///C:/owa/auth/15.2.1544/themes/resources/favicon.ico