ms-outlook-r.replit.app Open in urlscan Pro
34.117.33.233  Malicious Activity! Public Scan

URL: https://ms-outlook-r.replit.app/
Submission: On July 15 via api from US — Scanned from GB

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 9 HTTP transactions. The main IP is 34.117.33.233, located in Kansas City, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is ms-outlook-r.replit.app.
TLS certificate: Issued by WR3 on June 16th 2024. Valid for: 3 months.
This is the only time ms-outlook-r.replit.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 34.117.33.233 396982 (GOOGLE-CL...)
7 2620:1ec:bdf::60 8075 (MICROSOFT...)
9 3
Apex Domain
Subdomains
Transfer
7 msauth.net
aadcdn.msauth.net — Cisco Umbrella Rank: 2218
143 KB
1 replit.app
ms-outlook-r.replit.app
32 KB
0 r2.dev Failed
pub-f01d9e27e86648639e57faa4e1d0070a.r2.dev Failed
9 3
Domain Requested by
7 aadcdn.msauth.net ms-outlook-r.replit.app
1 ms-outlook-r.replit.app
0 pub-f01d9e27e86648639e57faa4e1d0070a.r2.dev Failed
9 3

This site contains no links.

Subject Issuer Validity Valid
replit.app
WR3
2024-06-16 -
2024-09-14
3 months crt.sh
aadcdn.msauth.net
DigiCert SHA2 Secure Server CA
2024-04-30 -
2025-04-30
a year crt.sh

This page contains 1 frames:

Frame: https://pub-f01d9e27e86648639e57faa4e1d0070a.r2.dev/YDHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhijhKPt3JDTKN2FpnDW8CobWkfAhEktKPt3JDTKN2pfgnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobW
Frame ID: C20D937245755DAF17C73BD162ED08BD
Requests: 9 HTTP requests in this frame

Screenshot

Page Title

Sign out

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

89 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

174 kB
Transfer

473 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
ms-outlook-r.replit.app/
31 KB
32 KB
Document
General
Full URL
https://ms-outlook-r.replit.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.33.233 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
233.33.117.34.bc.googleusercontent.com
Software
/
Resource Hash
e792a95c108eda06c7ef2e13ea6617279e5a1107e6154cab57573801ff40bb11
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

age
2183
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
32120
content-type
text/html; charset=utf-8
date
Mon, 15 Jul 2024 22:10:07 GMT
strict-transport-security
max-age=63072000; includeSubDomains
via
1.1 google
converged.v2.login.min_mc5ac6ol0l4d2iaqspstyg2.css
aadcdn.msauth.net/ests/2.1/content/cdnbundles/
111 KB
20 KB
Stylesheet
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_mc5ac6ol0l4d2iaqspstyg2.css
Requested by
Host: ms-outlook-r.replit.app
URL: https://ms-outlook-r.replit.app/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:bdf::60 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
8b81b6dbb9af6502d78abe8a85d135861848e0597989901da42c62ecb841a07d

Request headers

Referer
https://ms-outlook-r.replit.app/
Origin
https://ms-outlook-r.replit.app
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 15 Jul 2024 22:10:07 GMT
content-encoding
gzip
x-cache
TCP_HIT
x-fd-int-roxy-purgeid
4554691
content-length
20390
x-ms-lease-status
unlocked
last-modified
Thu, 16 May 2024 00:58:09 GMT
etag
0x8DC754341030FA7
x-azure-ref
20240715T221007Z-r1d56846db96sq6dfr6qyq0d1w00000005x000000000atxy
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
c68fa298-d01e-001a-495c-d3a289000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
jquery.3.5.min_dc940oomzau4rsu8qesnvg2.js
aadcdn.msauth.net/ests/2.1/content/cdnbundles/
117 KB
40 KB
Script
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/jquery.3.5.min_dc940oomzau4rsu8qesnvg2.js
Requested by
Host: ms-outlook-r.replit.app
URL: https://ms-outlook-r.replit.app/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:bdf::60 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
df2aa8537c1992c94846a0ffffaa9031d430d9d0210b9e396ec059aff62627e0

Request headers

Referer
https://ms-outlook-r.replit.app/
Origin
https://ms-outlook-r.replit.app
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 15 Jul 2024 22:10:07 GMT
content-encoding
gzip
x-cache
TCP_HIT
x-fd-int-roxy-purgeid
4554691
content-length
40454
x-ms-lease-status
unlocked
last-modified
Fri, 26 Feb 2021 06:12:05 GMT
etag
0x8D8DA1D70FBDD97
x-azure-ref
20240715T221007Z-r1d56846db96sq6dfr6qyq0d1w00000005x000000000atxz
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
00e55105-a01e-0014-65f1-d3f9b4000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
aad.login.min_vmmoyj1-4wcgq_4ljx53-q2.js
aadcdn.msauth.net/ests/2.1/content/cdnbundles/
179 KB
44 KB
Script
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/aad.login.min_vmmoyj1-4wcgq_4ljx53-q2.js
Requested by
Host: ms-outlook-r.replit.app
URL: https://ms-outlook-r.replit.app/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:bdf::60 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
87e738d94f83503f243a4544d7c78a6dadd01c261a6a58fa5085715652029ab9

Request headers

Referer
https://ms-outlook-r.replit.app/
Origin
https://ms-outlook-r.replit.app
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 15 Jul 2024 22:10:07 GMT
content-encoding
gzip
x-cache
TCP_HIT
x-fd-int-roxy-purgeid
4554691
content-length
44809
x-ms-lease-status
unlocked
last-modified
Thu, 12 Oct 2023 21:23:59 GMT
etag
0x8DBCB698CEF3B25
x-azure-ref
20240715T221007Z-r1d56846db96sq6dfr6qyq0d1w00000005x000000000aty0
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
0f0bf53f-f01e-004d-4b02-d3e994000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
microsoft_logo_ea19b2112f4dfd8e90b4505ef7dcb4f9.png
aadcdn.msauth.net/shared/1.0/content/images/
1 KB
2 KB
Image
General
Full URL
https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ea19b2112f4dfd8e90b4505ef7dcb4f9.png
Requested by
Host: ms-outlook-r.replit.app
URL: https://ms-outlook-r.replit.app/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:bdf::60 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

Request headers

Referer
https://ms-outlook-r.replit.app/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 15 Jul 2024 22:10:07 GMT
x-cache
TCP_HIT
x-fd-int-roxy-purgeid
4554691
content-length
1057
x-ms-lease-status
unlocked
last-modified
Wed, 24 May 2023 10:11:48 GMT
etag
0x8DB5C3F48FD7E08
x-azure-ref
20240715T221007Z-r1d56846db9vk6w74rwp2ncuuw00000005d00000000029vu
content-type
image/png
access-control-allow-origin
*
x-ms-request-id
857bdeb6-801e-0016-3ddf-d3afb0000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
2-small_2055002f2daae2ed8f69f03944c0e5d9.jpg
aadcdn.msauth.net/shared/1.0/content/images/backgrounds/
987 B
1 KB
Image
General
Full URL
https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2-small_2055002f2daae2ed8f69f03944c0e5d9.jpg
Requested by
Host: ms-outlook-r.replit.app
URL: https://ms-outlook-r.replit.app/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:bdf::60 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
8b34a475187302935336bf43a2bf2a4e0adb9a1e87953ea51f6fcf0ef52a4a1d

Request headers

Referer
https://ms-outlook-r.replit.app/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 15 Jul 2024 22:10:07 GMT
x-cache
TCP_HIT
x-fd-int-roxy-purgeid
4554691
content-length
987
x-ms-lease-status
unlocked
last-modified
Wed, 24 May 2023 10:11:45 GMT
etag
0x8DB5C3F47A9C96D
x-azure-ref
20240715T221007Z-r1d56846db9vk6w74rwp2ncuuw00000005d00000000029wf
content-type
image/jpeg
access-control-allow-origin
*
x-ms-request-id
2a413946-701e-0079-63fb-d348cd000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
2_6ffe0a92d779c878835b40171ffc2e13.jpg
aadcdn.msauth.net/shared/1.0/content/images/backgrounds/
17 KB
18 KB
Image
General
Full URL
https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_6ffe0a92d779c878835b40171ffc2e13.jpg
Requested by
Host: ms-outlook-r.replit.app
URL: https://ms-outlook-r.replit.app/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:bdf::60 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3

Request headers

Referer
https://ms-outlook-r.replit.app/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 15 Jul 2024 22:10:07 GMT
x-cache
TCP_HIT
x-fd-int-roxy-purgeid
4554691
content-length
17453
x-ms-lease-status
unlocked
last-modified
Wed, 24 May 2023 10:11:45 GMT
etag
0x8DB5C3F47C27F84
x-azure-ref
20240715T221007Z-r1d56846db9vk6w74rwp2ncuuw00000005d00000000029wg
content-type
image/jpeg
access-control-allow-origin
*
x-ms-request-id
039719ac-501e-0014-3e2b-d48b39000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
favicon_a_eupayfgghqiai7k9sol6lg2.ico
aadcdn.msauth.net/shared/1.0/content/images/
17 KB
17 KB
Other
General
Full URL
https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:bdf::60 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

Request headers

Referer
https://ms-outlook-r.replit.app/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 15 Jul 2024 22:10:08 GMT
x-cache
TCP_HIT
x-fd-int-roxy-purgeid
4554691
content-length
17174
x-ms-lease-status
unlocked
last-modified
Sun, 18 Oct 2020 03:02:03 GMT
etag
0x8D8731230C851A6
x-azure-ref
20240715T221008Z-r1d56846db9vk6w74rwp2ncuuw00000005d00000000029wt
content-type
image/x-icon
access-control-allow-origin
*
x-ms-request-id
35127f2d-c01e-0029-6c3a-d4fd22000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
YDHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhijhKPt3JDTKN2FpnDW8CobWkfAhEktKPt3JDTKN2pfgnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobW
pub-f01d9e27e86648639e57faa4e1d0070a.r2.dev/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
pub-f01d9e27e86648639e57faa4e1d0070a.r2.dev
URL
https://pub-f01d9e27e86648639e57faa4e1d0070a.r2.dev/YDHDSDFcgcbTEX2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhijhKPt3JDTKN2FpnDW8CobWkfAhEktKPt3JDTKN2pfgnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobWfAhEktKPt3JDTKN2FpnDW8CobW

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

50 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B function| $ function| jQuery object| MSLogin object| proxy object| ErrorCodes object| Constants object| Context object| Background object| Logo object| Instrument object| User object| tenant_info object| MSLogout object| ThirdPartyCookieStates object| PostType object| LoginOption object| TenantBranding object| Tiles object| $Api object| EmailDiscovery object| Support object| Post object| StrongAuthCheck object| Util function| SetImageStatus function| ImageTimeout function| IframeTimeout function| SignoutFormTimeout function| MsaTimeout function| CreateChromeProviderAsync function| WebNativeBridgeSignout function| TryCompleteSignout function| CompleteSignout function| CompleteSignoutRender function| RenderSignoutSuccess function| RenderSignoutFailure function| WriteSignoutFailedCookie function| InitiatorRedirect object| imageStatusArray object| updatedUsers object| MsaSignoutStatus

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000; includeSubDomains