login.live.com.office.prod.zensar.myshn.net Open in urlscan Pro
13.127.252.30  Malicious Activity! Public Scan

URL: https://login.live.com.office.prod.zensar.myshn.net/
Submission: On March 22 via api from US — Scanned from US

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 13.127.252.30, located in Mumbai, India and belongs to AMAZON-02, US. The main domain is login.live.com.office.prod.zensar.myshn.net.
TLS certificate: Issued by GlobalSign RSA OV SSL CA 2018 on April 12th 2023. Valid for: a year.
This is the only time login.live.com.office.prod.zensar.myshn.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
7 13.127.252.30 16509 (AMAZON-02)
8 2
Domain Requested by
5 logincdn.msftauth.net.office.prod.zensar.myshn.net login.live.com.office.prod.zensar.myshn.net
logincdn.msftauth.net.office.prod.zensar.myshn.net
1 shn--browser--shn--events--shn--data.microsoft.com.office.prod.zensar.myshn.net logincdn.msftauth.net.office.prod.zensar.myshn.net
1 login.live.com.office.prod.zensar.myshn.net
8 3

This site contains no links.

Subject Issuer Validity Valid
office.prod.zensar.myshn.net
GlobalSign RSA OV SSL CA 2018
2023-04-12 -
2024-05-13
a year crt.sh

This page contains 1 frames:

Primary Page: https://login.live.com.office.prod.zensar.myshn.net/
Frame ID: DDAD102987BA2B5B6091605EB57817A2
Requests: 7 HTTP requests in this frame

Screenshot

Page Title

Sign in to your Microsoft account

Page Statistics

8
Requests

88 %
HTTPS

0 %
IPv6

1
Domains

3
Subdomains

2
IPs

1
Countries

271 kB
Transfer

988 kB
Size

7
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
login.live.com.office.prod.zensar.myshn.net/
26 KB
12 KB
Document
General
Full URL
https://login.live.com.office.prod.zensar.myshn.net/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.127.252.30 Mumbai, India, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-127-252-30.ap-south-1.compute.amazonaws.com
Software
nginx /
Resource Hash
c3786bd1b782e2c2e721c6b241c59753567bfc39289c913f648863268d2775ca
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

Cache-Control
no-store, no-cache
Connection
keep-alive
Content-Encoding
gzip
Content-Length
10461
Content-Type
text/html; charset=utf-8
Date
Fri, 22 Mar 2024 15:24:15 GMT
Expires
Fri, 22 Mar 2024 15:23:15 GMT
Link
<https://logincdn.msftauth.net.office.prod.zensar.myshn.net>; rel=preconnect; crossorigin
P3P
CP="DSP CUR OTPi IND OTRi ONL FIN"
PPServer
PPV: 30 H: PH1PEPF00011EB9 V: 0
Pragma
no-cache
Referrer-Policy
strict-origin-when-cross-origin
Server
nginx
Strict-Transport-Security
max-age=31536000
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-DNS-Prefetch-Control
on
X-Robots-Tag
none
X-SkyHigh-Version
BuildNumber=5, BuildDate=2024-01-09 07:05
X-XSS-Protection
1; mode=block
x-ms-request-id
0fa08a5b-27e7-45f2-a62f-1a330fe88fbd
x-ms-route-info
C536_BAY
login_en_4XWJLQsDnjOrefMiFTdF2g2.js
logincdn.msftauth.net.office.prod.zensar.myshn.net/shared/5/js/
867 KB
221 KB
Script
General
Full URL
https://logincdn.msftauth.net.office.prod.zensar.myshn.net/shared/5/js/login_en_4XWJLQsDnjOrefMiFTdF2g2.js
Requested by
Host: login.live.com.office.prod.zensar.myshn.net
URL: https://login.live.com.office.prod.zensar.myshn.net/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.127.252.30 Mumbai, India, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-127-252-30.ap-south-1.compute.amazonaws.com
Software
nginx /
Resource Hash
bce865e1937b8523c883a3e8f0fff2db6e16b1e3c75a6bd8c6b13f98c88bf9b6

Request headers

Referer
https://login.live.com.office.prod.zensar.myshn.net/
Origin
https://login.live.com.office.prod.zensar.myshn.net
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
Date
Fri, 22 Mar 2024 15:24:16 GMT
Content-Encoding
gzip
Content-MD5
7srD9gWJffEfz123CPvBLA==
Age
987468
X-Cache
HIT
Connection
keep-alive
Content-Length
225261
x-ms-lease-status
unlocked
Last-Modified
Fri, 08 Mar 2024 09:15:00 GMT
Server
nginx
Etag
0x8DC3F503B562BED
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
x-ms-request-id
b8ad5e8a-601e-0035-4671-73fc3d000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
X-SkyHigh-Version
BuildNumber=5, BuildDate=2024-01-09 07:05
Accept-Ranges
bytes
X-Robots-Tag
none
oneds-analytics-js_c53074e74ebeb8e140d6_en.js
logincdn.msftauth.net.office.prod.zensar.myshn.net/shared/5/chunks/
89 KB
33 KB
Script
General
Full URL
https://logincdn.msftauth.net.office.prod.zensar.myshn.net/shared/5/chunks/oneds-analytics-js_c53074e74ebeb8e140d6_en.js
Requested by
Host: logincdn.msftauth.net.office.prod.zensar.myshn.net
URL: https://logincdn.msftauth.net.office.prod.zensar.myshn.net/shared/5/js/login_en_4XWJLQsDnjOrefMiFTdF2g2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.127.252.30 Mumbai, India, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-127-252-30.ap-south-1.compute.amazonaws.com
Software
nginx /
Resource Hash
b0309f22d54d6192a7a011a09a1286723b82c3593c6933a18124956941deb3d5

Request headers

Referer
https://login.live.com.office.prod.zensar.myshn.net/
Origin
https://login.live.com.office.prod.zensar.myshn.net
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
Date
Fri, 22 Mar 2024 15:24:18 GMT
Content-Encoding
gzip
Content-MD5
s98wrnDDS6yV/JFUTZIJvQ==
Age
828992
X-Cache
HIT
Connection
keep-alive
Content-Length
32780
x-ms-lease-status
unlocked
Last-Modified
Tue, 06 Feb 2024 16:57:45 GMT
Server
nginx
Etag
0x8DC2734BD782EB3
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
x-ms-request-id
057724de-901e-00de-5ae2-74cc5d000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
X-SkyHigh-Version
BuildNumber=5, BuildDate=2024-01-09 07:05
Accept-Ranges
bytes
X-Robots-Tag
none
microsoft_logo_ee5c8d9fb6248c938fd0.svg
logincdn.msftauth.net.office.prod.zensar.myshn.net/shared/5/images/
4 KB
2 KB
Image
General
Full URL
https://logincdn.msftauth.net.office.prod.zensar.myshn.net/shared/5/images/microsoft_logo_ee5c8d9fb6248c938fd0.svg
Requested by
Host: login.live.com.office.prod.zensar.myshn.net
URL: https://login.live.com.office.prod.zensar.myshn.net/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.127.252.30 Mumbai, India, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-127-252-30.ap-south-1.compute.amazonaws.com
Software
nginx /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

accept-language
en-US,en;q=0.9
Referer
https://login.live.com.office.prod.zensar.myshn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
Date
Fri, 22 Mar 2024 15:24:19 GMT
Content-Encoding
gzip
Content-MD5
nzaLxFgP7ZB3dfMcaybWzw==
Age
57686
X-Cache
HIT
Connection
keep-alive
Content-Length
1435
x-ms-lease-status
unlocked
Last-Modified
Tue, 27 Jun 2023 15:45:14 GMT
Server
nginx
Etag
0x8DB77257FFE6B4E
Vary
Accept-Encoding
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
x-ms-request-id
6e6b7b1a-901e-005a-6ae6-7b3700000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
X-SkyHigh-Version
BuildNumber=5, BuildDate=2024-01-09 07:05
Accept-Ranges
bytes
X-Robots-Tag
none
2_bc3d32a696895f78c19d.svg
logincdn.msftauth.net.office.prod.zensar.myshn.net/shared/5/images/
2 KB
1 KB
Image
General
Full URL
https://logincdn.msftauth.net.office.prod.zensar.myshn.net/shared/5/images/2_bc3d32a696895f78c19d.svg
Requested by
Host: login.live.com.office.prod.zensar.myshn.net
URL: https://login.live.com.office.prod.zensar.myshn.net/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.127.252.30 Mumbai, India, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-127-252-30.ap-south-1.compute.amazonaws.com
Software
nginx /
Resource Hash
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

accept-language
en-US,en;q=0.9
Referer
https://login.live.com.office.prod.zensar.myshn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
Date
Fri, 22 Mar 2024 15:24:19 GMT
Content-Encoding
gzip
Content-MD5
DhdidjYrlCeaRJJRG/y9mA==
Age
21456256
X-Cache
HIT
Connection
keep-alive
Content-Length
673
x-ms-lease-status
unlocked
Last-Modified
Tue, 27 Jun 2023 15:45:09 GMT
Server
nginx
Etag
0x8DB77257C91B168
Vary
Accept-Encoding
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
x-ms-request-id
470ff731-301e-0099-4548-b940ca000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
X-SkyHigh-Version
BuildNumber=5, BuildDate=2024-01-09 07:05
Accept-Ranges
bytes
X-Robots-Tag
none
signin_options_4e48046ce74f4b89d450.svg
logincdn.msftauth.net.office.prod.zensar.myshn.net/shared/5/images/
2 KB
1 KB
Image
General
Full URL
https://logincdn.msftauth.net.office.prod.zensar.myshn.net/shared/5/images/signin_options_4e48046ce74f4b89d450.svg
Requested by
Host: login.live.com.office.prod.zensar.myshn.net
URL: https://login.live.com.office.prod.zensar.myshn.net/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.127.252.30 Mumbai, India, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-127-252-30.ap-south-1.compute.amazonaws.com
Software
nginx /
Resource Hash
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93

Request headers

accept-language
en-US,en;q=0.9
Referer
https://login.live.com.office.prod.zensar.myshn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
Date
Fri, 22 Mar 2024 15:24:19 GMT
Content-Encoding
gzip
Content-MD5
R2FAVxfpONfnQAuxVxXbHg==
Age
57517
X-Cache
HIT
Connection
keep-alive
Content-Length
621
x-ms-lease-status
unlocked
Last-Modified
Tue, 27 Jun 2023 15:45:19 GMT
Server
nginx
Etag
0x8DB772582D4527C
Vary
Accept-Encoding
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
x-ms-request-id
6319d63a-f01e-0018-69e7-7bb215000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Cache-Control
public, max-age=31536000
x-ms-version
2009-09-19
X-SkyHigh-Version
BuildNumber=5, BuildDate=2024-01-09 07:05
Accept-Ranges
bytes
X-Robots-Tag
none
/
shn--browser--shn--events--shn--data.microsoft.com.office.prod.zensar.myshn.net/OneCollector/1.0/
0
0

/
shn--browser--shn--events--shn--data.microsoft.com.office.prod.zensar.myshn.net/OneCollector/1.0/
0
0
Preflight
General
Full URL
https://shn--browser--shn--events--shn--data.microsoft.com.office.prod.zensar.myshn.net/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.127.252.30 Mumbai, India, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-127-252-30.ap-south-1.compute.amazonaws.com
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
*/*
Access-Control-Request-Headers
apikey,cache-control,client-id,client-version,content-type,time-delta-to-apply-millis,upload-time
Access-Control-Request-Method
POST
Origin
https://login.live.com.office.prod.zensar.myshn.net
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
AuthMsaDeviceTicket,AuthXToken,Content-Encoding,Content-Type,Cache-Control,Client-Id,SDK-Name,sdk-version,apikey,x-apikey,client-version,upload-time,time-delta-to-apply-millis,client-time-epoch-millis,persistence-mode,reliability-mode,NoResponseBody
Access-Control-Allow-Origin
https://login.live.com.office.prod.zensar.myshn.net
Access-Control-Max-Age
3600
Cache-Control
public, 3600
Connection
keep-alive
Content-Length
0
Date
Fri, 22 Mar 2024 15:24:22 GMT
Server
nginx
Strict-Transport-Security
max-age=31536000
X-Robots-Tag
none
X-SkyHigh-Version
BuildNumber=5, BuildDate=2024-01-09 07:05

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
shn--browser--shn--events--shn--data.microsoft.com.office.prod.zensar.myshn.net
URL
https://shn--browser--shn--events--shn--data.microsoft.com.office.prod.zensar.myshn.net/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| PROOF object| ServerData function| $Loader object| g_dtFirstByte object| g_objPageMode number| g_iSRSFailed string| g_sSRSSuccess function| SRSRetry object| webpackChunk_msidentity_sisu_msa function| clearImmediate function| setImmediate object| regeneratorRuntime object| __dynProto$Gbl

7 Cookies

Domain/Path Name / Value
.login.live.com.office.prod.zensar.myshn.net/ Name: uaid
Value: fa7d078cebe44e499a979d253c59e1ae
.login.live.com.office.prod.zensar.myshn.net/ Name: MSPRequ
Value: id=N&lt=1711121055&co=1
.login.live.com.office.prod.zensar.myshn.net/ Name: MSCC
Value: 65.0.14.232-IN
.login.live.com.office.prod.zensar.myshn.net/ Name: MSPOK
Value: $uuid-09215910-2a4c-4ea8-a955-350e9fd75f57
.login.live.com.office.prod.zensar.myshn.net/ Name: OParams
Value: 11O.DqYlLW7sMvD9WjJU!BNF8QS0l*tSeeODbxoa5EhGUVjJrd1XeKqFNbdSQsNJH6ulvzrJuwtcPd35yV99XrGPrvFt82Wl*f1t!KnoSXv!0aArmSI5t7ix*X!C6J3pBvbFDQ$$
login.live.com.office.prod.zensar.myshn.net/ Name: MicrosoftApplicationsTelemetryDeviceId
Value: 4fa30408-d90d-4936-a568-0cb4dc6b34ca
login.live.com.office.prod.zensar.myshn.net/ Name: ai_session
Value: oNeX9zbbXRDU+RXfHFlxa/|1711121058938|1711121058938

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block