waldlaeufer-mk.de
Open in
urlscan Pro
144.76.75.26
Malicious Activity!
Public Scan
URL:
http://waldlaeufer-mk.de/express/delivery/shipment/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=87&id=331...
Submission: On August 29 via manual from IE
Submission: On August 29 via manual from IE
Summary
This website contacted 3 IPs
in 3 countries
across 3 domains to perform 7 HTTP transactions.
The main IP is 144.76.75.26, located in
Germany and
belongs to HETZNER-AS, DE.
The main domain is waldlaeufer-mk.de.
This is the only time waldlaeufer-mk.de was scanned on urlscan.io!
This is the only time waldlaeufer-mk.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Office 365 (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 | 144.76.75.26 144.76.75.26 | 24940 (HETZNER-AS) (HETZNER-AS) | |
| 3 | 184.30.220.87 184.30.220.87 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 2 | 2a02:26f0:10c... 2a02:26f0:10c:383::35c1 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 7 | 3 |
3
184.30.220.87
(Amsterdam, Netherlands)
ASN20940 (AKAMAI-ASN1, US)
PTR: a184-30-220-87.deploy.static.akamaitechnologies.com
ASN20940 (AKAMAI-ASN1, US)
PTR: a184-30-220-87.deploy.static.akamaitechnologies.com
| auth.gfx.ms |
2
2a02:26f0:10c:383::35c1
(European Union)
ASN20940 (AKAMAI-ASN1, US)
ASN20940 (AKAMAI-ASN1, US)
| secure.aadcdn.microsoftonline-p.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 3 |
gfx.ms
auth.gfx.ms |
55 KB |
| 2 |
microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com |
5 KB |
| 2 |
waldlaeufer-mk.de
waldlaeufer-mk.de |
7 KB |
| 7 | 3 |
| Domain | Requested by | |
|---|---|---|
| 3 | auth.gfx.ms |
waldlaeufer-mk.de
|
| 2 | secure.aadcdn.microsoftonline-p.com |
waldlaeufer-mk.de
|
| 2 | waldlaeufer-mk.de |
waldlaeufer-mk.de
|
| 7 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| msagfx.live.com Microsoft IT TLS CA 4 |
2017-07-27 - 2019-07-17 |
2 years | crt.sh |
| secure.aadcdn.microsoftonline-p.com Microsoft IT TLS CA 1 |
2017-08-15 - 2019-08-15 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://waldlaeufer-mk.de/express/delivery/shipment/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=87&id=3311290480
Frame ID: 7095.1
Requests: 7 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
Login.php
waldlaeufer-mk.de/express/delivery/shipment/ |
15 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Default1033.css
auth.gfx.ms/16.000.26210.00/ |
73 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
DefaultLoginStrings1033.js
waldlaeufer-mk.de/express/delivery/shipment/hotmail_files/ |
4 KB 1 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
DefaultLogin_Core.js
auth.gfx.ms/16.000.26210.00/ |
117 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bannerlogo
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-6ybrougjmflxqw910ieyohr7wb4x4-yvoixrlaidmz4/appbranding/askzfdsqe20i-bcjwporaywega7vbt4acqnn1hiliiw/0/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
microsoft_logo.png
secure.aadcdn.microsoftonline-p.com/ests/2.1.4856.17/content/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
DefaultLoginStrings1033.js
auth.gfx.ms/16.000.26210.00/ |
10 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Office 365 (Online)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
auth.gfx.ms
secure.aadcdn.microsoftonline-p.com
waldlaeufer-mk.de
144.76.75.26
184.30.220.87
2a02:26f0:10c:383::35c1
1b8975df0003c5335d6fb2c0e0d8cd0ec1a0c5d93d0756f6258c428d4772695a
33050f70999f61c52f657945a49646e8b140bba5f0c60a19484294b905bc0edb
6b60bc2bc502e123352302021351eedffe091be3ed6227ce3c3375a8ecdaadc1
988e349f2bf4e87154738c7b2c1fa86618713a8cfa0cef60a046f5add89bd9de
9b095928a69573d2dd52b3739e9fbe00a3e860ada852b0fad41b398a678d68af
b891a2332f1c64f4203473a929917ce150426bcbd1efe28af98d0ddfc90e1343
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603