urlscan.io logo urlscan.io
SecurityTrails logo

logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com Open in urlscan Pro
144.217.255.169  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
Submission: On April 16 via manual from FR
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 144.217.255.169, located in Beauharnois, Canada and belongs to OVH, FR. The main domain is logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com.
This is the only time logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
8 144.217.255.169 16276 (OVH)
8 2
Domain Requested by
8 logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com
8 1

This site contains no links.

Subject Issuer Validity Valid

This page contains 4 frames:

Primary Page: http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
Frame ID: 7D6FFAABAF708DD294A88A29769BDDE0
Requests: 7 HTTP requests in this frame

Frame: http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/portal.office.com/logout?sid=9c2405c3-1ca5-4bbc-b982-a7930e33d52b
Frame ID: 5255FEEAA181C31ACA7C6AA9C989F502
Requests: 1 HTTP requests in this frame

Frame: http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/Sign%20out_files/logout.txt
Frame ID: A7D6FF96893701D6D51E2C9D193F0B2C
Requests: 1 HTTP requests in this frame

Frame: http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/outlook.office365.com/owa/auth/logoff.aspx?cmd=logoff&exlive=1&lgtype=1&sid=9c2405c3-1ca5-4bbc-b982-a7930e33d52b
Frame ID: 93A0979D17EBC7B62B4CD08F43976E33
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • env /^jQuery$/i

Page Statistics

8
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

1215 kB
Transfer

1505 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set /
logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/ 		845 KB
845 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
Protocol
HTTP/1.1
Server
144.217.255.169 Beauharnois, Canada, ASN16276 (OVH, FR),
Reverse DNS
cp5.rockhoster.biz
Software
Apache / PHP/7.0.29
Resource Hash
e18c6025085fe7f3191b473ff1284ac503a130b3b854dcda9caf0ad7dd3c8693

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control
no-cache
Connection
keep-alive
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 16 Apr 2018 23:20:17 GMT
Server
Apache
X-Powered-By
PHP/7.0.29
Content-Type
text/html; charset=UTF-8
Set-Cookie
PHPSESSID=2ke7th97ir6f7p1h1kbk6ffs74; path=/
Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Content-Length
865381
Expires
Thu, 19 Nov 1981 08:52:00 GMT
converged.css
logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/Sign%20out_files/ 		85 KB
85 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/Sign%20out_files/converged.css
Requested by
Host: logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com
URL: http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
Protocol
HTTP/1.1
Server
144.217.255.169 Beauharnois, Canada, ASN16276 (OVH, FR),
Reverse DNS
cp5.rockhoster.biz
Software
Apache /
Resource Hash
6b45dd55c4ad636857096cc8a3a41f1a04ee06f9cff88b77bcca8285fa512b18

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
Cookie
PHPSESSID=2ke7th97ir6f7p1h1kbk6ffs74
Connection
keep-alive
Cache-Control
no-cache
Referer
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date
Mon, 16 Apr 2018 23:20:18 GMT
Last-Modified
Sun, 15 Apr 2018 20:18:22 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
87277
jquery.js
logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/Sign%20out_files/ 		108 KB
108 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/Sign%20out_files/jquery.js
Requested by
Host: logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com
URL: http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
Protocol
HTTP/1.1
Server
144.217.255.169 Beauharnois, Canada, ASN16276 (OVH, FR),
Reverse DNS
cp5.rockhoster.biz
Software
Apache /
Resource Hash
080ff245615e719959bc5537e164ac4495c4b8036462dfee2076dd92f22c8491

Request headers

Pragma
no-cache
Origin
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com
Accept-Encoding
gzip, deflate
Host
logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept
*/*
Referer
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
Cookie
PHPSESSID=2ke7th97ir6f7p1h1kbk6ffs74
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Referer
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
Origin
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com

Response headers

Date
Mon, 16 Apr 2018 23:20:18 GMT
Last-Modified
Sun, 15 Apr 2018 20:18:22 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
110256
aad.js
logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/Sign%20out_files/ 		173 KB
173 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/Sign%20out_files/aad.js
Requested by
Host: logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com
URL: http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
Protocol
HTTP/1.1
Server
144.217.255.169 Beauharnois, Canada, ASN16276 (OVH, FR),
Reverse DNS
cp5.rockhoster.biz
Software
Apache /
Resource Hash
fc28b79ef81125bcf50a93f2175825bb4c6861a2ebc5e0d4de6d804b05d1a49a

Request headers

Pragma
no-cache
Origin
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com
Accept-Encoding
gzip, deflate
Host
logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept
*/*
Referer
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
Cookie
PHPSESSID=2ke7th97ir6f7p1h1kbk6ffs74
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Referer
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
Origin
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com

Response headers

Date
Mon, 16 Apr 2018 23:20:18 GMT
Last-Modified
Sun, 15 Apr 2018 20:18:22 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
177164
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c13db279143e1845ee4aaee5afedc5bd75e9f7d50024b63883b45332c4960b3b

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/jpeg
microsoft_logo.png
logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/Sign%20out_files/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/Sign%20out_files/microsoft_logo.png
Requested by
Host: logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com
URL: http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
Protocol
HTTP/1.1
Server
144.217.255.169 Beauharnois, Canada, ASN16276 (OVH, FR),
Reverse DNS
cp5.rockhoster.biz
Software
Apache /
Resource Hash
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
Cookie
PHPSESSID=2ke7th97ir6f7p1h1kbk6ffs74
Connection
keep-alive
Cache-Control
no-cache
Referer
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date
Mon, 16 Apr 2018 23:20:18 GMT
Last-Modified
Sun, 15 Apr 2018 20:18:22 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
1057
truncated
/ 		291 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/jpeg
logout
logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/portal.office.com/ Frame 5255 		341 B
541 B 		Document
General
Check archive.org
Download Go to
Full URL
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/portal.office.com/logout?sid=9c2405c3-1ca5-4bbc-b982-a7930e33d52b
Requested by
Host: logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com
URL: http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
Protocol
HTTP/1.1
Server
144.217.255.169 Beauharnois, Canada, ASN16276 (OVH, FR),
Reverse DNS
cp5.rockhoster.biz
Software
Apache /
Resource Hash
63ce23bf4b8332c6f5707ae5fb422bc648d41535e03cbe8f3b29e8b6f3e80427

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
Cookie
PHPSESSID=2ke7th97ir6f7p1h1kbk6ffs74
Connection
keep-alive
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
Referer
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date
Mon, 16 Apr 2018 23:20:18 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
341
Content-Type
text/html; charset=iso-8859-1
logout.txt
logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/Sign%20out_files/ Frame A7D6 		0
240 B 		Document
General
Check archive.org
Download Go to
Full URL
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/Sign%20out_files/logout.txt
Requested by
Host: logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com
URL: http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
Protocol
HTTP/1.1
Server
144.217.255.169 Beauharnois, Canada, ASN16276 (OVH, FR),
Reverse DNS
cp5.rockhoster.biz
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
Cookie
PHPSESSID=2ke7th97ir6f7p1h1kbk6ffs74
Connection
keep-alive
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
Referer
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date
Mon, 16 Apr 2018 23:20:18 GMT
Last-Modified
Sun, 15 Apr 2018 20:18:22 GMT
Server
Apache
Content-Type
text/plain
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
0
logoff.aspx
logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/outlook.office365.com/owa/auth/ Frame 93A0 		359 B
559 B 		Document
General
Check archive.org
Download Go to
Full URL
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/outlook.office365.com/owa/auth/logoff.aspx?cmd=logoff&exlive=1&lgtype=1&sid=9c2405c3-1ca5-4bbc-b982-a7930e33d52b
Requested by
Host: logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com
URL: http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
Protocol
HTTP/1.1
Server
144.217.255.169 Beauharnois, Canada, ASN16276 (OVH, FR),
Reverse DNS
cp5.rockhoster.biz
Software
Apache /
Resource Hash
88ad72f1d2c05cfce9f4f5183cc23ae6f3cca489b430024104c3cd8244334142

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
Cookie
PHPSESSID=2ke7th97ir6f7p1h1kbk6ffs74
Connection
keep-alive
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
Referer
http://logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date
Mon, 16 Apr 2018 23:20:18 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
359
Content-Type
text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

53 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B function| $ function| jQuery object| jQuery111208270197101092589 object| MSLogin object| proxy object| ErrorCodes object| Constants object| Context object| Background object| Logo object| Instrument object| User object| tenant_info object| MSLogout object| ThirdPartyCookieStates object| PostType object| LoginOption object| TenantBranding object| users object| Tiles object| $Api object| EmailDiscovery object| Support object| Post object| StrongAuthCheck object| Util object| WindowsBrowserSso function| SetImageStatus function| ImageTimeout function| IframeTimeout function| MsaTimeout function| TryCompleteSignout function| CompleteSignout function| CompleteSignoutRender function| RenderSignoutSuccess function| RenderSignoutFailure function| WriteSignoutFailedCookie function| InitiatorRedirect object| imageStatusArray boolean| imageStatusTimeout object| updatedUsers number| msaSignoutStatus object| msaSignoutTimerId boolean| iframeStatusTimeout

1 Cookies

Domain/Path Name / Value
logoon.nhnicrs0fthtnlinnne.configuurrationnnne.ativat.com/ Name: PHPSESSID
Value: 2ke7th97ir6f7p1h1kbk6ffs74