test0222.cloudfilesend.com Open in urlscan Pro
52.228.106.140  Malicious Activity! Public Scan

URL: https://test0222.cloudfilesend.com/x/jD4QdNgTay3kQ
Submission: On February 10 via manual from IN — Scanned from CA

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main IP is 52.228.106.140, located in Toronto, Canada and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is test0222.cloudfilesend.com.
TLS certificate: Issued by R3 on December 21st 2021. Valid for: 3 months.
This is the only time test0222.cloudfilesend.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 52.228.106.140 8075 (MICROSOFT...)
3 2620:1ec:bdf::40 8068 (MICROSOFT...)
4 2
Apex Domain
Subdomains
Transfer
3 msauth.net
logincdn.msauth.net — Cisco Umbrella Rank: 2289
23 KB
1 cloudfilesend.com
test0222.cloudfilesend.com
23 KB
4 2
Domain Requested by
3 logincdn.msauth.net test0222.cloudfilesend.com
1 test0222.cloudfilesend.com
4 2

This site contains no links.

Subject Issuer Validity Valid
cloudfilesend.com
R3
2021-12-21 -
2022-03-21
3 months crt.sh
identitycdn.msauth.net
Microsoft Azure TLS Issuing CA 06
2021-11-22 -
2022-11-17
a year crt.sh

This page contains 1 frames:

Primary Page: https://test0222.cloudfilesend.com/x/jD4QdNgTay3kQ
Frame ID: 5DF131EE7B7206F4D1C484F048693ABE
Requests: 4 HTTP requests in this frame

Screenshot

Page Title

Sign in to your Microsoft account

Page Statistics

4
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

45 kB
Transfer

135 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request jD4QdNgTay3kQ
test0222.cloudfilesend.com/x/
23 KB
23 KB
Document
General
Full URL
https://test0222.cloudfilesend.com/x/jD4QdNgTay3kQ
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
52.228.106.140 Toronto, Canada, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
b7b8c75e27ba70d4c9a912c1b81cbf141b2e16afdd46354ce309f1fda7745233
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
en-CA,en;q=0.9

Response headers

date
Thu, 10 Feb 2022 01:37:35 GMT
content-type
text/html;charset=UTF-8
content-length
23065
strict-transport-security
max-age=15724800; includeSubDomains
Converged_v21033__M8MTZS7Nv0I1zR18wdR-g2.css
logincdn.msauth.net/16.000/
107 KB
20 KB
Stylesheet
General
Full URL
https://logincdn.msauth.net/16.000/Converged_v21033__M8MTZS7Nv0I1zR18wdR-g2.css
Requested by
Host: test0222.cloudfilesend.com
URL: https://test0222.cloudfilesend.com/x/jD4QdNgTay3kQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::40 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
6099ca3afb2bad6883021c5aa6941615a9e92428d9936d09c522c371f803cbdc

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://test0222.cloudfilesend.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 10 Feb 2022 01:37:35 GMT
content-encoding
gzip
x-azure-ref-originshield
00Kv8YQAAAAA2/KZbbn1YQ7pS2O7AcvB0RVdSMzBFREdFMDUxMABkYjY2MmZlMy1mNDM4LTQzYzItYTI5Zi1lNjU5MGM0ZjVlNTE=
content-md5
eRgGUB/DLn4Fqo+te3OPNg==
x-cache
TCP_HIT
content-length
19837
x-ms-lease-status
unlocked
last-modified
Sat, 05 Jun 2021 05:27:11 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D927E291FC3141
x-azure-ref
0YGwEYgAAAADLFHkZU3MtTJaVRQe70jOGWVRPMDFFREdFMDYxOABkYjY2MmZlMy1mNDM4LTQzYzItYTI5Zi1lNjU5MGM0ZjVlNTE=
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
903cf9c1-d01e-002a-05ef-18a855000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
logincdn.msauth.net/shared/1.0/content/images/
4 KB
2 KB
Image
General
Full URL
https://logincdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Requested by
Host: test0222.cloudfilesend.com
URL: https://test0222.cloudfilesend.com/x/jD4QdNgTay3kQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::40 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://test0222.cloudfilesend.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 10 Feb 2022 01:37:35 GMT
content-encoding
gzip
x-azure-ref-originshield
0R7T8YQAAAAB4dAQhwBuBSpJtdOi7TJ3VRVdSMzBFREdFMDUwOABkYjY2MmZlMy1mNDM4LTQzYzItYTI5Zi1lNjU5MGM0ZjVlNTE=
content-md5
nzaLxFgP7ZB3dfMcaybWzw==
x-cache
TCP_HIT
content-length
1435
x-ms-lease-status
unlocked
last-modified
Wed, 22 Jan 2020 00:38:07 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D79ED359808AB6
x-azure-ref
0YGwEYgAAAACRaBoPzmsuQ4wYuKYBwIqLWVRPMDFFREdFMDYxOABkYjY2MmZlMy1mNDM4LTQzYzItYTI5Zi1lNjU5MGM0ZjVlNTE=
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
4b1612c1-c01e-0067-2524-16a45f000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
2_bc3d32a696895f78c19df6c717586a5d.svg
logincdn.msauth.net/shared/1.0/content/images/backgrounds/
2 KB
980 B
Image
General
Full URL
https://logincdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::40 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

Accept-Language
en-CA,en;q=0.9
Referer
https://test0222.cloudfilesend.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 10 Feb 2022 01:37:35 GMT
content-encoding
gzip
x-azure-ref-originshield
0OOT8YQAAAAAqXrXVBkJdRbM8xTb0ReyERVdSMzBFREdFMDUyMQBkYjY2MmZlMy1mNDM4LTQzYzItYTI5Zi1lNjU5MGM0ZjVlNTE=
content-md5
DhdidjYrlCeaRJJRG/y9mA==
x-cache
TCP_HIT
content-length
673
x-ms-lease-status
unlocked
last-modified
Wed, 12 Feb 2020 22:01:56 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D7B0072D292595
x-azure-ref
0YGwEYgAAAADMUgpeiZuFRJvEU0l44zAQWVRPMDFFREdFMDYxOABkYjY2MmZlMy1mNDM4LTQzYzItYTI5Zi1lNjU5MGM0ZjVlNTE=
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
558431f6-401e-003b-18a1-193375000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=15724800; includeSubDomains