ms-outlook-r.replit.app
Open in
urlscan Pro
34.117.33.233
Malicious Activity!
Public Scan
Submission: On July 15 via api from US — Scanned from GB
Summary
TLS certificate: Issued by WR3 on June 16th 2024. Valid for: 3 months.
This is the only time ms-outlook-r.replit.app was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 34.117.33.233 34.117.33.233 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
7 | 2620:1ec:bdf::60 2620:1ec:bdf::60 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
9 | 3 |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 233.33.117.34.bc.googleusercontent.com
ms-outlook-r.replit.app |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
msauth.net
aadcdn.msauth.net — Cisco Umbrella Rank: 2218 |
143 KB |
1 |
replit.app
ms-outlook-r.replit.app |
32 KB |
0 |
r2.dev
Failed
pub-f01d9e27e86648639e57faa4e1d0070a.r2.dev Failed |
|
9 | 3 |
Domain | Requested by | |
---|---|---|
7 | aadcdn.msauth.net |
ms-outlook-r.replit.app
|
1 | ms-outlook-r.replit.app | |
0 | pub-f01d9e27e86648639e57faa4e1d0070a.r2.dev Failed | |
9 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
replit.app WR3 |
2024-06-16 - 2024-09-14 |
3 months | crt.sh |
aadcdn.msauth.net DigiCert SHA2 Secure Server CA |
2024-04-30 - 2025-04-30 |
a year | crt.sh |
This page contains 1 frames:
Frame:
https://pub-f01d9e27e86648639e57faa4e1d0070a.r2.dev/YDHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhijhKPt3JDTKN2FpnDW8CobWkfAhEktKPt3JDTKN2pfgnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobW
Frame ID: C20D937245755DAF17C73BD162ED08BD
Requests: 9 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
ms-outlook-r.replit.app/ |
31 KB 32 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
converged.v2.login.min_mc5ac6ol0l4d2iaqspstyg2.css
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ |
111 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.3.5.min_dc940oomzau4rsu8qesnvg2.js
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ |
117 KB 40 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aad.login.min_vmmoyj1-4wcgq_4ljx53-q2.js
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ |
179 KB 44 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo_ea19b2112f4dfd8e90b4505ef7dcb4f9.png
aadcdn.msauth.net/shared/1.0/content/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2-small_2055002f2daae2ed8f69f03944c0e5d9.jpg
aadcdn.msauth.net/shared/1.0/content/images/backgrounds/ |
987 B 1 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2_6ffe0a92d779c878835b40171ffc2e13.jpg
aadcdn.msauth.net/shared/1.0/content/images/backgrounds/ |
17 KB 18 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon_a_eupayfgghqiai7k9sol6lg2.ico
aadcdn.msauth.net/shared/1.0/content/images/ |
17 KB 17 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
YDHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhijhKPt3JDTKN2FpnDW8CobWkfAhEktKPt3JDTKN2pfgnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobW
pub-f01d9e27e86648639e57faa4e1d0070a.r2.dev/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- pub-f01d9e27e86648639e57faa4e1d0070a.r2.dev
- URL
- https://pub-f01d9e27e86648639e57faa4e1d0070a.r2.dev/YDHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhijhKPt3JDTKN2FpnDW8CobWkfAhEktKPt3JDTKN2pfgnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobW
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)50 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B function| $ function| jQuery object| MSLogin object| proxy object| ErrorCodes object| Constants object| Context object| Background object| Logo object| Instrument object| User object| tenant_info object| MSLogout object| ThirdPartyCookieStates object| PostType object| LoginOption object| TenantBranding object| Tiles object| $Api object| EmailDiscovery object| Support object| Post object| StrongAuthCheck object| Util function| SetImageStatus function| ImageTimeout function| IframeTimeout function| SignoutFormTimeout function| MsaTimeout function| CreateChromeProviderAsync function| WebNativeBridgeSignout function| TryCompleteSignout function| CompleteSignout function| CompleteSignoutRender function| RenderSignoutSuccess function| RenderSignoutFailure function| WriteSignoutFailedCookie function| InitiatorRedirect object| imageStatusArray object| updatedUsers object| MsaSignoutStatus0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=63072000; includeSubDomains |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msauth.net
ms-outlook-r.replit.app
pub-f01d9e27e86648639e57faa4e1d0070a.r2.dev
pub-f01d9e27e86648639e57faa4e1d0070a.r2.dev
2620:1ec:bdf::60
34.117.33.233
87e738d94f83503f243a4544d7c78a6dadd01c261a6a58fa5085715652029ab9
8b34a475187302935336bf43a2bf2a4e0adb9a1e87953ea51f6fcf0ef52a4a1d
8b81b6dbb9af6502d78abe8a85d135861848e0597989901da42c62ecb841a07d
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3
df2aa8537c1992c94846a0ffffaa9031d430d9d0210b9e396ec059aff62627e0
e792a95c108eda06c7ef2e13ea6617279e5a1107e6154cab57573801ff40bb11
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c