52.76.105.204 Open in urlscan Pro
52.76.105.204 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://52.76.105.204/Mos/hotis/step2-authen.php
Submission: On June 17 via automatic, source openphish (June 17th 2018, 5:15:19 am UTC)

Summary HTTP 7 Redirects Links 4 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 52.76.105.204, located in Singapore, Singapore and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is 52.76.105.204.
TLS certificate: Issued by cPanel, Inc. Certification Authority on June 14th 2018. Valid for: 3 months.

This is the only time 52.76.105.204 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
1	52.76.105.204 52.76.105.204		16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
5	184.31.81.125 184.31.81.125		20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	40.101.61.130 40.101.61.130		8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
7	3

1 52.76.105.204 (Singapore, Singapore)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-76-105-204.ap-southeast-1.compute.amazonaws.com

52.76.105.204	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 184.31.81.125 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a184-31-81-125.deploy.static.akamaitechnologies.com

auth.gfx.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 40.101.61.130 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

outlook.office365.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	gfx.ms auth.gfx.ms	82 KB
1	office365.com outlook.office365.com
7	2

	Domain	Requested by
5	auth.gfx.ms	52.76.105.204
1	outlook.office365.com	52.76.105.204
7	2

This site contains links to these domains. Also see Links.

Domain
account.live.com
login.live.com

Subject Issuer	Validity	Valid
changworld.com cPanel, Inc. Certification Authority	`2018-06-14` - `2018-09-12`	3 months	crt.sh
outlook.com DigiCert Cloud Services CA-1	`2017-09-13` - `2018-09-13`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://52.76.105.204/Mos/hotis/step2-authen.php
Frame ID: F66AFEF3D41B0208B9A7DDFF65E4AB95
Requests: 6 HTTP requests in this frame

Frame: https://outlook.office365.com/owa/prefetch.aspx?id=292841&mkt=EN-GB
Frame ID: 0F522DBAD7B08DEBA447C9BA966DF98E
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

webpack (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

env /^webpackJsonp$/i

Page Statistics

7
Requests

14 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

99 kB
Transfer

304 kB
Size

3
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.0%26rpsnv%3d13%26ct%3d1479722006%26rver%3d6.4.6456.0%26wp%3dMBI_SSL%26wreply%3dhttps%253a%252f%252foutlook.live.com%252fowa%252f%26lc%3d2057%26id%3d292841%26mkt%3den-gb%26cbcxt%3dout%26fl%3dwld%26contextid%3d3120DC6F591A060F%26bk%3d1479722009&id=292841&uiflavor=web&uaid=2419581f135940218028ecd616c02d58&mkt=EN-GB&lc=2057&bk=1479722009
Title: Forgotten my password

Search URL Search Domain Scan URL

URL: https://login.live.com/logout.srf?wa=wsignin1.0&rpsnv=13&ct=1479722006&rver=6.4.6456.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f&lc=2057&id=292841&mkt=en-gb&cbcxt=out&fl=wld&contextid=3120DC6F591A060F&ru=https://outlook.live.com/owa/&bk=1479722009&lm=I
Title: Sign in with a different Microsoft account

Search URL Search Domain Scan URL

URL: https://login.live.com/gls.srf?urlID=WinLiveTermsOfUse&mkt=EN-GB&vv=1600
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://login.live.com/gls.srf?urlID=MSNPrivacyStatement&mkt=EN-GB&vv=1600
Title: Privacy & Cookies

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set step2-authen.php Show response
52.76.105.204/Mos/hotis/ 17 KB
17 KB 1262ms
196ms Document
text/html 52.76.105.204
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://52.76.105.204/Mos/hotis/step2-authen.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.76.105.204 Singapore, Singapore, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-76-105-204.ap-southeast-1.compute.amazonaws.com
Software: Apache/2.4.18 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 / PHP/5.5.30
Resource Hash: 185cff29d1ed12c007635573c747aa18e5e643b02c69bbde899e196bb11d7995

Request headers

Host: 52.76.105.204
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: F66AFEF3D41B0208B9A7DDFF65E4AB95

Response headers

Date: Sun, 17 Jun 2018 05:15:08 GMT
Server: Apache/2.4.18 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
X-Powered-By: PHP/5.5.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=1581bd3358fe3d3a10a66c8581359d61; path=/
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html

GET
H/1.1 200
OK Default2057.css
auth.gfx.ms/16.000.26754.00.1/ 74 KB
15 KB 7ms
6ms Stylesheet
text/css 184.31.81.125
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://auth.gfx.ms/16.000.26754.00.1/Default2057.css
Requested by: Host: 52.76.105.204
URL: https://52.76.105.204/Mos/hotis/step2-authen.php
Protocol: HTTP/1.1
Server: 184.31.81.125 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-31-81-125.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/8.5 /
Resource Hash: ca078e9833f067c6e28abe33c37a8ca9565fd02abe961e2ebc227635b1b03027

Request headers

Referer: https://52.76.105.204/Mos/hotis/step2-authen.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Sun, 17 Jun 2018 05:15:08 GMT
Content-Encoding: gzip
Last-Modified: Tue, 15 Nov 2016 09:04:21 GMT
PPServer: PPV: 30 H: BAYIDSPRTS3G004 V: 0
ETag: "8098bf401f3fd21:0"
Vary: Accept-Encoding
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=355551
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 14670
Server: Microsoft-IIS/8.5

GET
H/1.1 200
OK DefaultLoginPaginatedStrings.EN-GB.js Show response
auth.gfx.ms/16.000.26754.00.1/ 11 KB
4 KB 6ms
6ms Script
application/javascript 184.31.81.125
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://auth.gfx.ms/16.000.26754.00.1/DefaultLoginPaginatedStrings.EN-GB.js
Requested by: Host: 52.76.105.204
URL: https://52.76.105.204/Mos/hotis/step2-authen.php
Protocol: HTTP/1.1
Server: 184.31.81.125 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-31-81-125.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/8.5 /
Resource Hash: c582c2fe5f74458f0af90fa1469af95bf4eb88601cc4d017bd7ef5e1b52ffaf4

Request headers

Referer: https://52.76.105.204/Mos/hotis/step2-authen.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Sun, 17 Jun 2018 05:15:08 GMT
Content-Encoding: gzip
Last-Modified: Tue, 15 Nov 2016 09:11:52 GMT
PPServer: PPV: 30 H: BAYIDSPRTS3G004 V: 0
ETag: "0bc904d203fd21:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=355612
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3794
Server: Microsoft-IIS/8.5

GET
H/1.1 200
OK DefaultLogin_PCore.js Show response
auth.gfx.ms/16.000.26754.00.1/ 190 KB
57 KB 13ms
6ms Script
application/javascript 184.31.81.125
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://auth.gfx.ms/16.000.26754.00.1/DefaultLogin_PCore.js
Requested by: Host: 52.76.105.204
URL: https://52.76.105.204/Mos/hotis/step2-authen.php
Protocol: HTTP/1.1
Server: 184.31.81.125 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-31-81-125.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/8.5 /
Resource Hash: 8a3aa480509e9e782ec14eb1592d7fc0f68c82b443045751fcdfd051b03029ac

Request headers

Referer: https://52.76.105.204/Mos/hotis/step2-authen.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Sun, 17 Jun 2018 05:15:08 GMT
Content-Encoding: gzip
Last-Modified: Thu, 17 Nov 2016 17:19:22 GMT
PPServer: PPV: 30 H: BAYIDSPRTS3G003 V: 0
ETag: "59fd1ebdf640d21:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=347280
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 57865
Server: Microsoft-IIS/8.5

GET
H/1.1 200
OK AppCentipede_Microsoft.svg
auth.gfx.ms/16.000.26754.00.1/images/AppCentipede/ 7 KB
3 KB 6ms
6ms Image
image/svg+xml 184.31.81.125
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth.gfx.ms/16.000.26754.00.1/images/AppCentipede/AppCentipede_Microsoft.svg
Requested by: Host: 52.76.105.204
URL: https://52.76.105.204/Mos/hotis/step2-authen.php
Protocol: HTTP/1.1
Server: 184.31.81.125 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-31-81-125.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/8.5 /
Resource Hash: bde5e27f76f371121f1955806f1b662f323f3793b079455f5bfe83365a393625

Request headers

Referer: https://52.76.105.204/Mos/hotis/step2-authen.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Sun, 17 Jun 2018 05:15:08 GMT
Content-Encoding: gzip
Last-Modified: Wed, 19 Oct 2016 13:11:49 GMT
PPServer: PPV: 30 H: BAYIDSPRTS3G004 V: 0
ETag: "8058b159a2ad21:0"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Cache-Control: max-age=355619
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2946
Server: Microsoft-IIS/8.5

GET
H/1.1 200
OK Microsoft_Logotype_Gray.svg
auth.gfx.ms/16.000.26754.00.1/images/ 5 KB
3 KB 6ms
6ms Image
image/svg+xml 184.31.81.125
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth.gfx.ms/16.000.26754.00.1/images/Microsoft_Logotype_Gray.svg
Requested by: Host: 52.76.105.204
URL: https://52.76.105.204/Mos/hotis/step2-authen.php
Protocol: HTTP/1.1
Server: 184.31.81.125 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-31-81-125.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/8.5 /
Resource Hash: 356f7d1241f92c9de9c9cfd0bebb6c10d1b38508a3f37cebc26329c656bad19f

Request headers

Referer: https://52.76.105.204/Mos/hotis/step2-authen.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Sun, 17 Jun 2018 05:15:08 GMT
Content-Encoding: gzip
Last-Modified: Wed, 19 Oct 2016 13:11:49 GMT
PPServer: PPV: 30 H: BAYIDSPRTS3G004 V: 0
ETag: "8058b159a2ad21:0"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Cache-Control: max-age=355513
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2160
Server: Microsoft-IIS/8.5

GET
H/1.1 200
OK Cookie set prefetch.aspx
outlook.office365.com/owa/ Frame 0F52 0
0 49ms
49ms Document
text/html 40.101.61.130
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://outlook.office365.com/owa/prefetch.aspx?id=292841&mkt=EN-GB

Requested by

Host: 52.76.105.204
URL: https://52.76.105.204/Mos/hotis/step2-authen.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

40.101.61.130 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Host: outlook.office365.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://52.76.105.204/Mos/hotis/step2-authen.php
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: F66AFEF3D41B0208B9A7DDFF65E4AB95
Referer: https://52.76.105.204/Mos/hotis/step2-authen.php

Response headers

Cache-Control: private, no-store
Content-Type: text/html
Server: Microsoft-IIS/10.0
request-id: 46905f47-ef45-4ab9-9997-8160c462e694
X-CalculatedFETarget: DB6PR04CU002.internal.outlook.com
X-BackEndHttpStatus: 200 200
Set-Cookie: ClientId=D369C0A33B0241B18EBD088D8041F0FA; expires=Mon, 17-Jun-2019 05:15:08 GMT; path=/; secure ClientId=D369C0A33B0241B18EBD088D8041F0FA; expires=Mon, 17-Jun-2019 05:15:08 GMT; path=/; secure OIDC=1; expires=Mon, 17-Dec-2018 05:15:08 GMT; path=/; secure; HttpOnly
X-FEProxyInfo: DB6PR04CA0002.EURPRD04.PROD.OUTLOOK.COM
X-CalculatedBETarget: DB6PR0501MB2232.EURPRD05.PROD.OUTLOOK.COM
X-RUM-Validated: 1
X-Content-Type-Options: nosniff
X-OWA-Version: 15.20.863.19
X-OWA-DiagnosticsInfo: 2;0;0
X-BackEnd-Begin: 2018-06-17T05:15:08.742
X-BackEnd-End: 2018-06-17T05:15:08.745
X-DiagInfo: DB6PR0501MB2232
X-BEServer: DB6PR0501MB2232
X-UA-Compatible: IE=EmulateIE7
Strict-Transport-Security: max-age=31536000; includeSubDomains max-age=31536000; includeSubDomains
X-FEServer: DB6PR04CA0002 AM5PR0502CA0015
X-Powered-By: ASP.NET
Date: Sun, 17 Jun 2018 05:15:08 GMT
Content-Length: 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| PROOF number| g_iSRSFailed string| g_sSRSSuccess function| SRSRetry object| g_dtFirstByte object| g_objPageMode object| StringRepository boolean| __DefaultLoginPaginatedStrings function| webpackJsonp function| check

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			outlook.office365.com/	1970-01-18 21:10:23	Name: OIDC Value: 1
			outlook.office365.com/	1970-01-19 01:32:28	Name: ClientId Value: D369C0A33B0241B18EBD088D8041F0FA
			52.76.105.204/	1969-12-31 23:59:59	Name: PHPSESSID Value: 1581bd3358fe3d3a10a66c8581359d61

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

auth.gfx.ms
outlook.office365.com
184.31.81.125
40.101.61.130
52.76.105.204
185cff29d1ed12c007635573c747aa18e5e643b02c69bbde899e196bb11d7995
356f7d1241f92c9de9c9cfd0bebb6c10d1b38508a3f37cebc26329c656bad19f
8a3aa480509e9e782ec14eb1592d7fc0f68c82b443045751fcdfd051b03029ac
bde5e27f76f371121f1955806f1b662f323f3793b079455f5bfe83365a393625
c582c2fe5f74458f0af90fa1469af95bf4eb88601cc4d017bd7ef5e1b52ffaf4
ca078e9833f067c6e28abe33c37a8ca9565fd02abe961e2ebc227635b1b03027