20.126.99.66
Open in
urlscan Pro
20.126.99.66
Malicious Activity!
Public Scan
URL:
http://20.126.99.66/
Submission: On June 24 via manual from FR — Scanned from FR
Submission: On June 24 via manual from FR — Scanned from FR
Summary
This website contacted 2 IPs
in 2 countries
across 1 domains to perform 7 HTTP transactions.
The main IP is 20.126.99.66, located in
Amsterdam, Netherlands and
belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US.
The main domain is 20.126.99.66.
This is the only time 20.126.99.66 was scanned on urlscan.io!
This is the only time 20.126.99.66 was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Office 365 (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 5 | 20.126.99.66 20.126.99.66 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 2 | 2a02:26f0:ef:... 2a02:26f0:ef:2a1::35c1 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 7 | 2 |
2
2a02:26f0:ef:2a1::35c1
(Frankfurt am Main, Germany)
ASN20940 (AKAMAI-ASN1, NL)
ASN20940 (AKAMAI-ASN1, NL)
| secure.aadcdn.microsoftonline-p.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 2 |
microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com — Cisco Umbrella Rank: 11283 |
204 KB |
| 7 | 1 |
| Domain | Requested by | |
|---|---|---|
| 2 | secure.aadcdn.microsoftonline-p.com |
20.126.99.66
|
| 7 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| secure.aadcdn.microsoftonline-p.com Microsoft RSA TLS CA 02 |
2021-11-18 - 2022-11-18 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://20.126.99.66/
Frame ID: 34C9C32C78B5DA4C73CD79F11F78A508
Requests: 7 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
20.126.99.66/ |
8 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login.ltr.css
20.126.99.66/ |
26 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.1.5.1.min.js
20.126.99.66/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
aad.login.js
20.126.99.66/ |
126 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.easing.1.3.js
20.126.99.66/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo.png
secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/Office365/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
illustration.jpg
secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/Office365/ |
199 KB 199 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Office 365 (Online)42 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation function| $ function| jQuery object| ErrorCodes object| Constants object| Context object| Background object| Logo object| Instrument object| User object| tenant_info function| pageOnReady object| Util object| PostType object| LoginOption object| Post function| origHide function| origShow function| origAddClass function| origRemoveClass object| Support object| users object| Tiles object| HIP object| EmailDiscovery object| ProofUp object| StrongAuthCheck object| ThirdPartyCookieStates object| TenantBranding object| MSLogin object| jQuery15107290081525079686 object| HIP_MODE object| MSStrongAuth object| MSLogout object| body string| alt_logo_image string| alt_background_image0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
secure.aadcdn.microsoftonline-p.com
20.126.99.66
2a02:26f0:ef:2a1::35c1
034c645ad27e252f5ce9da4d2a167a282976263f18eab6cfb0202bb6b3526a70
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
a81d77d83ae67c0f25c7a29a0a68741105c6972407c082eb33a51c4505301d90
c0e8f9bd4e4f24da93af1648f7123a9614d1081754af0238d2f9e22bae3307ce
c49b5ed790e1ba23bef326f0e90ffd3d306766e57b190e452e35850fe968defa
de0039e963599a1222bc40976c5c3ae445ce07d00b23a18af6988ea915a635cf
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603