vmaccessfile.ga Open in urlscan Pro
147.182.174.56  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response vmaccessfile.ga/	55 KB 12 KB	521ms 185ms	Document text/html	147.182.174.56 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://vmaccessfile.ga/?rid=oPcLNxb Protocol H2 Security TLS 1.3, , AES_128_GCM Server 147.182.174.56 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash 17b3a8e5ffb6fd50d5dba4ca7f0f08e01c8b07975e143156e2b18b8f6acacfd3 Request headers :method GET :authority vmaccessfile.ga :scheme https :path /?rid=oPcLNxb pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers content-encoding gzip content-type text/html; charset=utf-8 vary Accept-Encoding x-server gophish date Wed, 21 Jul 2021 16:22:41 GMT
GET H/1.1	200 OK	style.css msft.sts.microsoft.com/adfs/portal/css/	30 KB 31 KB	613ms 150ms	Stylesheet text/css	157.58.197.16 MICROSOFT-CORP-AS
General Check archive.org Show headers Download Go to Full URL https://msft.sts.microsoft.com/adfs/portal/css/style.css?id=A7618A91AF9831C8CDF5863B4179236EC332904F166B2A3D6BF41BE9F87FCC37 Requested by Host: vmaccessfile.ga URL: https://vmaccessfile.ga/?rid=oPcLNxb Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 157.58.197.16 Johnston, United States, ASN3598 (MICROSOFT-CORP-AS, US), Reverse DNS Software Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 / Resource Hash a7618a91af9831c8cdf5863b4179236ec332904f166b2a3d6bf41be9f87fcc37 Request headers Referer https://vmaccessfile.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Wed, 21 Jul 2021 16:22:39 GMT Expires Fri, 20 Aug 2021 16:22:42 GMT Server Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 ETag A7618A91AF9831C8CDF5863B4179236EC332904F166B2A3D6BF41BE9F87FCC37 Content-Length 31224 Content-Type text/css
GET H/1.1	200 OK	logo.png msft.sts.microsoft.com/adfs/portal/logo/	4 KB 4 KB	609ms 145ms	Image image/png	157.58.197.16 MICROSOFT-CORP-AS
General Check archive.org Show headers Download Go to Show image Full URL https://msft.sts.microsoft.com/adfs/portal/logo/logo.png?id=112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960 Requested by Host: vmaccessfile.ga URL: https://vmaccessfile.ga/?rid=oPcLNxb Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 157.58.197.16 Johnston, United States, ASN3598 (MICROSOFT-CORP-AS, US), Reverse DNS Software Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 / Resource Hash 112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960 Request headers Referer https://vmaccessfile.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Wed, 21 Jul 2021 16:22:39 GMT Expires Fri, 20 Aug 2021 16:22:42 GMT Server Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 ETag 112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960 Content-Length 4054 Content-Type image/png
GET DATA	200 OK	truncated /	411 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 0a26533ae425bfd7f89f7b3b517ead714a5a79a44e28d05a103f9b8204f7b809 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	323 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a914e9556879fe0765e6a45eae910940a06a3321277e845479917659778fc610 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET H2	200	ai.0.js Show response az416426.vo.msecnd.net/scripts/a/	94 KB 22 KB	26ms 7ms	Script application/x-javascript	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://az416426.vo.msecnd.net/scripts/a/ai.0.js Requested by Host: vmaccessfile.ga URL: https://vmaccessfile.ga/?rid=oPcLNxb Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8FA5) / Resource Hash 5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e Request headers Referer https://vmaccessfile.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 21 Jul 2021 16:22:42 GMT content-encoding gzip x-ms-meta-lastmodified 2020-10-01 19:31:04 content-md5 HdY95yzx9wIyQkVEGES+Ew== age 996 x-cache HIT content-length 22495 x-ms-lease-status unlocked last-modified Thu, 11 Mar 2021 07:46:59 GMT server ECAcc (frc/8FA5) etag 0x8D8E461DA1A5889 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 83c91dca-b01e-0022-724a-7e2d6a000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding cache-control public, max-age=1800 x-ms-version 2009-09-19 expires Wed, 21 Jul 2021 16:52:42 GMT
GET H/1.1	200 OK	illustration.jpg msft.sts.microsoft.com/adfs/portal/illustration/	17 KB 17 KB	149ms 149ms	Image image/jpeg	157.58.197.16 MICROSOFT-CORP-AS
General Check archive.org Show headers Download Go to Show image Full URL https://msft.sts.microsoft.com/adfs/portal/illustration/illustration.jpg?id=D8F5AB3E00202FD3B45BE1ACD95D677B137064001E171BC79B06826D98F1E1D3 Requested by Host: vmaccessfile.ga URL: https://vmaccessfile.ga/?rid=oPcLNxb Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 157.58.197.16 Johnston, United States, ASN3598 (MICROSOFT-CORP-AS, US), Reverse DNS Software Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 / Resource Hash d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3 Request headers Referer https://vmaccessfile.ga/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Wed, 21 Jul 2021 16:22:39 GMT Expires Fri, 20 Aug 2021 16:22:42 GMT Server Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 ETag D8F5AB3E00202FD3B45BE1ACD95D677B137064001E171BC79B06826D98F1E1D3 Content-Length 17453 Content-Type image/jpeg
OPTIONS H2	200	track dc.services.visualstudio.com/v2/	0 0	102ms 29ms	Preflight	52.236.186.210 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dc.services.visualstudio.com/v2/track Protocol H2 Server 52.236.186.210 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers content-type,sdk-context Origin https://vmaccessfile.ga User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode cors Response headers access-control-allow-methods POST access-control-allow-headers Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context access-control-allow-origin * access-control-max-age 3600 x-content-type-options nosniff date Wed, 21 Jul 2021 16:22:42 GMT content-length 0
POST H2	200	track Show response dc.services.visualstudio.com/v2/	96 B 213 B	419ms 419ms	XHR application/json	52.236.186.210 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dc.services.visualstudio.com/v2/track Requested by Host: az416426.vo.msecnd.net URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.236.186.210 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 7f93e62a67f435b4b11eeeca7ce79e85352e021c7b84d50578fb2e6ee410478f Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://vmaccessfile.ga/ Sdk-Context appId User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-type application/json Response headers x-ms-session-id 082F6D7E-39F0-49FF-83F0-6402A7C63F11 strict-transport-security max-age=31536000 x-content-type-options nosniff date Wed, 21 Jul 2021 16:22:42 GMT access-control-max-age 3600 content-type application/json; charset=utf-8 access-control-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context content-length 96
OPTIONS H2	200	track dc.services.visualstudio.com/v2/	0 0	102ms 30ms	Preflight	52.236.186.210 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dc.services.visualstudio.com/v2/track Protocol H2 Server 52.236.186.210 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers content-type,sdk-context Origin https://vmaccessfile.ga User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode cors Response headers access-control-allow-methods POST access-control-allow-headers Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context access-control-allow-origin * access-control-max-age 3600 x-content-type-options nosniff date Wed, 21 Jul 2021 16:22:42 GMT content-length 0
POST H2	200	track Show response dc.services.visualstudio.com/v2/	96 B 163 B	503ms 503ms	XHR application/json	52.236.186.210 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://dc.services.visualstudio.com/v2/track Requested by Host: az416426.vo.msecnd.net URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.236.186.210 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash f8815bfd268f5bf3201e5a946e017762d5dfa23a5341a4c580748a763460b8ff Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Request headers Referer https://vmaccessfile.ga/ Sdk-Context appId User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-type application/json Response headers x-ms-session-id 8B82706D-AECB-4945-8661-8514B03B3738 strict-transport-security max-age=31536000 x-content-type-options nosniff date Wed, 21 Jul 2021 16:22:42 GMT access-control-max-age 3600 content-type application/json; charset=utf-8 access-control-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context content-length 96

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

35 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| LoginErrors number| maxPasswordLength function| InputUtil object| paginationManager object| PaginationUtil object| PaginationManager object| Login object| LoginManager function| SelectOption object| options object| _self undefined| emails undefined| msViewportStyle undefined| viewport function| getStyle function| computeLoadIllustration function| SetIllustrationImage object| TelemetryManager object| pageTelemetryManager object| appInsights object| AI object| Microsoft function| __extends function| _endsWith

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://vmaccessfile.ga/?rid=oPcLNxb(Line 1325) Message: TelemetryManager: Start trying to produce telemetry
console-api	log	URL: https://vmaccessfile.ga/?rid=oPcLNxb(Line 993) Message: TelemetryManager: Generating a new App Insights object
console-api	log	URL: https://vmaccessfile.ga/?rid=oPcLNxb(Line 998) Message: TelemetryManager: Set new App Insights object against the current window
console-api	log	URL: https://vmaccessfile.ga/?rid=oPcLNxb(Line 1010) Message: Exit: TelemetryManager.Initialize
console-api	log	URL: https://vmaccessfile.ga/?rid=oPcLNxb(Line 1052) Message: Enter: TelemetryManager.ProducePageDetectionTelemetry
console-api	log	URL: https://vmaccessfile.ga/?rid=oPcLNxb(Line 1080) Message: ProducePageDetectionTelemetry: Found Forms Page
console-api	log	URL: https://vmaccessfile.ga/?rid=oPcLNxb(Line 1329) Message: TelemetryManager: End trying to produce telemetry

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

az416426.vo.msecnd.net
dc.services.visualstudio.com
msft.sts.microsoft.com
vmaccessfile.ga
147.182.174.56
157.58.197.16
2606:2800:233:1cb7:261b:1f9c:2074:3c
52.236.186.210
0a26533ae425bfd7f89f7b3b517ead714a5a79a44e28d05a103f9b8204f7b809
112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960
17b3a8e5ffb6fd50d5dba4ca7f0f08e01c8b07975e143156e2b18b8f6acacfd3
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e
7f93e62a67f435b4b11eeeca7ce79e85352e021c7b84d50578fb2e6ee410478f
a7618a91af9831c8cdf5863b4179236ec332904f166b2a3d6bf41be9f87fcc37
a914e9556879fe0765e6a45eae910940a06a3321277e845479917659778fc610
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3
f8815bfd268f5bf3201e5a946e017762d5dfa23a5341a4c580748a763460b8ff