urlscan.io logo urlscan.io
SecurityTrails logo

secure.altcoinsnews.com Open in urlscan Pro
91.215.85.143  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://9bccf633-e97dfc8c.altcoinsnews.com/
Effective URL: https://secure.altcoinsnews.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%...
Submission: On May 03 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 2 HTTP transactions. The main IP is 91.215.85.143, located in Russian Federation and belongs to PROSPERO-AS, RU. The main domain is secure.altcoinsnews.com.
TLS certificate: Issued by R3 on May 3rd 2023. Valid for: 3 months.
This is the only time secure.altcoinsnews.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
3 5 91.215.85.143 200593 (PROSPERO-AS)
2 2
Apex Domain
Subdomains		 Transfer
5 altcoinsnews.com
9bccf633-e97dfc8c.altcoinsnews.com
secure.altcoinsnews.com
166 KB
2 1
Domain Requested by
3 9bccf633-e97dfc8c.altcoinsnews.com 3 redirects
2 secure.altcoinsnews.com secure.altcoinsnews.com
2 2

This site contains no links.

Subject Issuer Validity Valid
altcoinsnews.com
R3		 2023-05-03 -
2023-08-01		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://secure.altcoinsnews.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f9bccf633-e97dfc8c.altcoinsnews.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=4916eec2-a663-6780-af26-24966d983709&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638187374136084421.a3b6f1d3-4978-4567-8769-bcafb5f57143&state=DcsxEoAwCABBouNzMEEIkOcQnbSWfl-Kve4KAOxpS6VlwJSd3NiEWJuLXHQGT130MMowR-lq6KYD5x1r9tWNhEu-R32_qD8
Frame ID: DF8ACB61453A0028CDAD81EFB6A917AA
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

reCAPTCHA

Page URL History Show full URLs

  1. http://9bccf633-e97dfc8c.altcoinsnews.com/ HTTP 301
    https://9bccf633-e97dfc8c.altcoinsnews.com/ HTTP 302
    https://9bccf633-e97dfc8c.altcoinsnews.com/owa/ HTTP 302
    https://secure.altcoinsnews.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redir... Page URL

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

163 kB
Transfer

454 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://9bccf633-e97dfc8c.altcoinsnews.com/ HTTP 301
    https://9bccf633-e97dfc8c.altcoinsnews.com/ HTTP 302
    https://9bccf633-e97dfc8c.altcoinsnews.com/owa/ HTTP 302
    https://secure.altcoinsnews.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f9bccf633-e97dfc8c.altcoinsnews.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=4916eec2-a663-6780-af26-24966d983709&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638187374136084421.a3b6f1d3-4978-4567-8769-bcafb5f57143&state=DcsxEoAwCABBouNzMEEIkOcQnbSWfl-Kve4KAOxpS6VlwJSd3NiEWJuLXHQGT130MMowR-lq6KYD5x1r9tWNhEu-R32_qD8 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request authorize
secure.altcoinsnews.com/common/oauth2/
Redirect Chain
  • http://9bccf633-e97dfc8c.altcoinsnews.com/
  • https://9bccf633-e97dfc8c.altcoinsnews.com/
  • https://9bccf633-e97dfc8c.altcoinsnews.com/owa/
  • https://secure.altcoinsnews.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f9bccf633-e97dfc8c.altcoinsnews.com%2fowa%2f&resource=00000002-0000-...
413 KB
163 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://secure.altcoinsnews.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f9bccf633-e97dfc8c.altcoinsnews.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=4916eec2-a663-6780-af26-24966d983709&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638187374136084421.a3b6f1d3-4978-4567-8769-bcafb5f57143&state=DcsxEoAwCABBouNzMEEIkOcQnbSWfl-Kve4KAOxpS6VlwJSd3NiEWJuLXHQGT130MMowR-lq6KYD5x1r9tWNhEu-R32_qD8
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
91.215.85.143 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software
nginx /
Resource Hash
397c426c369ee5552b075bd9cb0d04fb8fad7c902c3c6920b2aa95736ed44d21
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=utf-8
date
Wed, 03 May 2023 19:03:37 GMT
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding

Redirect headers

access-control-allow-headers
*
access-control-allow-origin
*
content-type
text/html; charset=utf-8
date
Wed, 03 May 2023 19:03:35 GMT
location
https://secure.altcoinsnews.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f9bccf633-e97dfc8c.altcoinsnews.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=4916eec2-a663-6780-af26-24966d983709&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638187374136084421.a3b6f1d3-4978-4567-8769-bcafb5f57143&state=DcsxEoAwCABBouNzMEEIkOcQnbSWfl-Kve4KAOxpS6VlwJSd3NiEWJuLXHQGT130MMowR-lq6KYD5x1r9tWNhEu-R32_qD8
nel
{"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01}
p3p
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
report-to
{"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://caef4110-e97dfc8c.altcoinsnews.com/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=ZRH"}],"include_subdomains":true}
request-id
4916eec2-a663-6780-af26-24966d983709
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains
x-backend-begin
2023-05-03T19:03:33.608
x-backend-end
2023-05-03T19:03:33.608
x-backendhttpstatus
302, 302
x-beserver
GVAP278MB0007
x-besku
WCS6
x-calculatedbetarget
GVAP278MB0007.CHEP278.PROD.OUTLOOK.COM
x-calculatedfetarget
GV0P278CU004.internal.outlook.com
x-diaginfo
GVAP278MB0007
x-feefzinfo
ZRH
x-feproxyinfo
ZR2P278CA0039.CHEP278.PROD.OUTLOOK.COM
x-feserver
GV0P278CA0070, ZR2P278CA0039
x-firsthopcafeefz
ZRH
x-iids
0
x-owa-diagnosticsinfo
0;0;0
x-proxy-backendserverstatus
302
x-proxy-routingcorrectness
1
x-rum-notupdatequerieddbcopy
1
x-rum-notupdatequeriedpath
1
x-rum-validated
1
x-ua-compatible
IE=EmulateIE7
truncated
/ 		858 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
19b8ee66ab60c45d5d24988d090b61c938b44c2ee9a5f8558335b27a2f315072

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		40 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
64c2019b369b4f3b45009d1740f4c7ae0856bb2608aea7d7628b78f43cecb3fa

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type
image/png
authorize
secure.altcoinsnews.com/common/oauth2/ 		203 B
343 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://secure.altcoinsnews.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f9bccf633-e97dfc8c.altcoinsnews.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=4916eec2-a663-6780-af26-24966d983709&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638187374136084421.a3b6f1d3-4978-4567-8769-bcafb5f57143&state=DcsxEoAwCABBouNzMEEIkOcQnbSWfl-Kve4KAOxpS6VlwJSd3NiEWJuLXHQGT130MMowR-lq6KYD5x1r9tWNhEu-R32_qD8
Requested by
Host: secure.altcoinsnews.com
URL: https://secure.altcoinsnews.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f9bccf633-e97dfc8c.altcoinsnews.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=4916eec2-a663-6780-af26-24966d983709&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638187374136084421.a3b6f1d3-4978-4567-8769-bcafb5f57143&state=DcsxEoAwCABBouNzMEEIkOcQnbSWfl-Kve4KAOxpS6VlwJSd3NiEWJuLXHQGT130MMowR-lq6KYD5x1r9tWNhEu-R32_qD8
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
91.215.85.143 , Russian Federation, ASN200593 (PROSPERO-AS, RU),
Reverse DNS
Software
nginx /
Resource Hash
9bb52fa6207300f0e741910e7bb17dd971a317bb4c5eeb34404a2ae747309748
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 03 May 2023 19:03:40 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
vary
Accept-Encoding
content-type
application/json

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| a0_0x4b63 function| a0_0x54fc function| setCookie function| onCheckBoxChange

4 Cookies

Domain/Path Name / Value
9bccf633-e97dfc8c.altcoinsnews.com/ Name: ClientId
Value: E183BE34EBEA49C7AAACD4E81C9FE0F6
9bccf633-e97dfc8c.altcoinsnews.com/ Name: OIDC
Value: 1
9bccf633-e97dfc8c.altcoinsnews.com/ Name: OpenIdConnect.nonce.v3.ipAt9flX8zU4Nt2KfWWkTEBBL3AORMuBWJIAbSxT9_E
Value: 638187374136084421.a3b6f1d3-4978-4567-8769-bcafb5f57143
9bccf633-e97dfc8c.altcoinsnews.com/ Name: X-OWA-RedirectHistory
Value: ArLym14BxUeFFwlM2wg

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains