devisoftcr.com
Open in
urlscan Pro
64.16.210.156
Malicious Activity!
Public Scan
URL:
http://devisoftcr.com/stme/
Submission: On November 14 via automatic, source openphish
Submission: On November 14 via automatic, source openphish
Summary
This website contacted 5 IPs
in 2 countries
across 3 domains to perform 15 HTTP transactions.
The main IP is 64.16.210.156, located in
Tampa, United States and
belongs to SAGO NET - Sago Networks, LLC, US.
The main domain is devisoftcr.com.
This is the only time devisoftcr.com was scanned on urlscan.io!
This is the only time devisoftcr.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Office 365 (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 64.16.210.156 64.16.210.156 | 21840 (SAGO NET) (SAGO NET - Sago Networks) | |
| 10 | 209.59.163.6 209.59.163.6 | 32244 (LIQUID-WE...) (LIQUID-WEB-INC - Liquid Web) | |
| 2 | 2a02:26f0:122... 2a02:26f0:122:381::35c1 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 1 | 2a02:26f0:122... 2a02:26f0:122:38f::35c1 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 15 | 5 |
1
64.16.210.156
(Tampa, United States)
ASN21840 (SAGO NET - Sago Networks, LLC, US)
PTR: sd01.ipservercr.com
ASN21840 (SAGO NET - Sago Networks, LLC, US)
PTR: sd01.ipservercr.com
| devisoftcr.com |
10
209.59.163.6
(Lansing, United States)
ASN32244 (LIQUID-WEB-INC - Liquid Web, L.L.C, US)
PTR: host.vitaminaonline.com.mx
ASN32244 (LIQUID-WEB-INC - Liquid Web, L.L.C, US)
PTR: host.vitaminaonline.com.mx
| www.academiadespa.edu.mx |
2
2a02:26f0:122:381::35c1
(European Union)
ASN20940 (AKAMAI-ASN1, US)
ASN20940 (AKAMAI-ASN1, US)
| secure.aadcdn.microsoftonline-p.com |
1
2a02:26f0:122:38f::35c1
(European Union)
ASN20940 (AKAMAI-ASN1, US)
ASN20940 (AKAMAI-ASN1, US)
| secure.aadcdn.microsoftonline-p.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 10 |
academiadespa.edu.mx
www.academiadespa.edu.mx Failed |
291 KB |
| 3 |
microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com |
203 KB |
| 1 |
devisoftcr.com
devisoftcr.com |
189 B |
| 15 | 3 |
| Domain | Requested by | |
|---|---|---|
| 10 | www.academiadespa.edu.mx |
www.academiadespa.edu.mx
|
| 3 | secure.aadcdn.microsoftonline-p.com |
www.academiadespa.edu.mx
|
| 1 | devisoftcr.com | |
| 15 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| signup.live.com |
| passwordreset.microsoftonline.com |
| login.live.com |
| login.microsoftonline.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| academiadespa.edu.mx cPanel, Inc. Certification Authority |
2017-10-16 - 2018-01-14 |
3 months | crt.sh |
| secure.aadcdn.microsoftonline-p.com Microsoft IT TLS CA 1 |
2017-08-15 - 2019-08-15 |
2 years | crt.sh |
This page contains 2 frames:
Frame:
https://www.academiadespa.edu.mx/kent/office360/index.htm
Frame ID: 19084.1
Requests: 2 HTTP requests in this frame
Frame:
https://www.academiadespa.edu.mx/kent/office360/index.htm
Frame ID: 19101.1
Requests: 13 HTTP requests in this frame
Screenshot
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
URL: https://signup.live.com/signup.aspx?id=12&uiflavor=web&mkt=en-US
Title: get a new Microsoft account
Title: get a new Microsoft account
Search URL Search Domain Scan URL
URL: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQIIAbPSySgpKSi20tcvyC8qSczRy81MLsovzk8ryc_LycxL1UvOz9XLL0rPTAGxioS4BLiey3EKX9ztu7cp-kycBfeMVYzKhI3Qv8DI-IKR8RaToH9RumdKeLFbakpqUWJJZn7eIybe0OLUIv-8nMqQ_OzUvEnMfDn56Zl58cVFafFpOfnlQAGgCQWJySXxJZnJ2aklu5hVzNIsjVKTLJJ0E40TU3VNEk0tdRMT00x1DSyTDJONjI0s0xItL7AI_GBhPMDJCAA1&mkt=en-US
Title: Can’t access your account?
Title: Can’t access your account?
Search URL Search Domain Scan URL
URL: https://login.live.com/login.srf?wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQIIAbPSySgpKSi20tcvyC8qSczRy81MLsovzk8ryc_LycxL1UvOz9XLL0rPTAGxioS4BLiey3EKX9ztu7cp-kycBfeMVYzKhI3Qv8DI-IKR8RaToH9RumdKeLFbakpqUWJJZn7eIybe0OLUIv-8nMqQ_OzUvEnMfDn56Zl58cVFafFpOfnlQAGgCQWJySXxJZnJ2aklu5hVzNIsjVKTLJJ0E40TU3VNEk0tdRMT00x1DSyTDJONjI0s0xItL7AI_GBhPMDJCAA1&id=
Title: Sign in with a Microsoft account
Title: Sign in with a Microsoft account
Search URL Search Domain Scan URL
URL: https://login.microsoftonline.com/termsofuse
Title: Terms of use
Title: Terms of use
Search URL Search Domain Scan URL
URL: https://login.microsoftonline.com/privacy
Title: Privacy & Cookies
Title: Privacy & Cookies
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
devisoftcr.com/stme/ |
183 B 189 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
index.htm
www.academiadespa.edu.mx/kent/office360/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
index.htm
www.academiadespa.edu.mx/kent/office360/ Frame 1910 |
33 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login_002.css
www.academiadespa.edu.mx/kent/office360/Sign%20in%20to%20Office%20365_files/ Frame 1910 |
29 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login.css
www.academiadespa.edu.mx/kent/office360/Sign%20in%20to%20Office%20365_files/ Frame 1910 |
332 B 178 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-1.js
www.academiadespa.edu.mx/kent/office360/Sign%20in%20to%20Office%20365_files/ Frame 1910 |
94 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-migrate-1.js
www.academiadespa.edu.mx/kent/office360/Sign%20in%20to%20Office%20365_files/ Frame 1910 |
7 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.js
www.academiadespa.edu.mx/kent/office360/Sign%20in%20to%20Office%20365_files/ Frame 1910 |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
aad.js
www.academiadespa.edu.mx/kent/office360/Sign%20in%20to%20Office%20365_files/ Frame 1910 |
154 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
heroillustration.jpg
www.academiadespa.edu.mx/kent/office360/Sign%20in%20to%20Office%20365_files/ Frame 1910 |
199 KB 199 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bannerlogo.png
www.academiadespa.edu.mx/kent/office360/Sign%20in%20to%20Office%20365_files/ Frame 1910 |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ad_glyph_footer_30x30.png
www.academiadespa.edu.mx/kent/office360/Sign%20in%20to%20Office%20365_files/ Frame 1910 |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login.hover.css
secure.aadcdn.microsoftonline-p.com/ests/1.0.0.76/content/css/ Frame 1910 |
332 B 178 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bannerlogo
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-6ybrougjmflxqw910ieyohr7wb4x4-yvoixrlaidmz4/appbranding/askzfdsqe20i-bcjwporaywega7vbt4acqnn1hiliiw/0/ Frame 1910 |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
heroillustration
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-6ybrougjmflxqw910ieyohr7wb4x4-yvoixrlaidmz4/appbranding/askzfdsqe20i-bcjwporaywega7vbt4acqnn1hiliiw/0/ Frame 1910 |
199 KB 199 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.academiadespa.edu.mx
- URL
- https://www.academiadespa.edu.mx/kent/office360/index.htm
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Office 365 (Online)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
devisoftcr.com
secure.aadcdn.microsoftonline-p.com
www.academiadespa.edu.mx
www.academiadespa.edu.mx
209.59.163.6
2a02:26f0:122:381::35c1
2a02:26f0:122:38f::35c1
64.16.210.156
136decc19024c46f88cbd442e9238fde2fb13fa3f41975894418261dc0d4ddfa
1e3690b37bff80fd8a060f01e926ca5799c1391508520601226d7007d3331b4d
3917a062ad2d4a2121ff55063783a28b37a357aeb12c0399ba5eeb5c8dd0773d
43e80023dfe39393ce9cd9c521af65f585688ac271550862f01cfba5897e8d18
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
a271a3f9e3cae897ced669d6652699e947928ef095e56384c4f9dd04bbb942ec
afe61bca932a909a573e0174543cf4dc9df4fcf10e9255a48fbbd3bf1df8a12d
b13c62ced0284d26df5d1ce5d05effe4ed8d9d04e1d9dfc0cc4c40db39c884bd
b3c4fd39a0c96930c595c60d3bd41ed0fb032380017fb367db5e7c4c9cf0bf52
c4d24f6b27cc7ceea56fbec786bb1f486fdad9a1f998f760f76d1f44671e105c
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603