login-microsoft-online.azurewebsites.net Open in urlscan Pro
168.61.217.214  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request 9NtLRpaalri4lzBqFxEKs3o34nhdsdeeDBcWhgkWf8gx7qJNae5KYy0pywA3.html Show response login-microsoft-online.azurewebsites.net/publishProfile%20profileName/waws-prod-dm1-113/	471 B 524 B	590ms 140ms	Document text/html	168.61.217.214 Microsoft Corpora...
General Check archive.org Show headers Download Go to Full URL https://login-microsoft-online.azurewebsites.net/publishProfile%20profileName/waws-prod-dm1-113/9NtLRpaalri4lzBqFxEKs3o34nhdsdeeDBcWhgkWf8gx7qJNae5KYy0pywA3.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.61.217.214 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US), Reverse DNS Software Apache / Resource Hash a03bb7ebc4617e4b361e18a7859bec6b7c4ecf01dcdba9eb879627402846e9fd Request headers Host login-microsoft-online.azurewebsites.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site none Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Response headers Content-Length 259 Content-Type text/html Content-Encoding gzip Last-Modified Thu, 24 Oct 2019 11:49:23 GMT Accept-Ranges bytes ETag "1d7-595a69fe8821b-gzip" Vary Accept-Encoding Server Apache Date Sat, 26 Oct 2019 08:52:23 GMT
GET H/1.1	200 OK	Cookie set / radioeesongclub.ru/rtyu/ Frame 90B9	0 0	539ms 142ms	Document text/html	23.95.236.183 ColoCrossing
General Check archive.org Show headers Download Go to Full URL https://radioeesongclub.ru/rtyu/?Orderid=74784 Requested by Host: login-microsoft-online.azurewebsites.net URL: https://login-microsoft-online.azurewebsites.net/publishProfile%20profileName/waws-prod-dm1-113/9NtLRpaalri4lzBqFxEKs3o34nhdsdeeDBcWhgkWf8gx7qJNae5KYy0pywA3.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.95.236.183 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US), Reverse DNS 23-95-236-183-host.colocrossing.com Software Apache / Resource Hash Request headers Host radioeesongclub.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode nested-navigate Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site cross-site Referer https://login-microsoft-online.azurewebsites.net/publishProfile%20profileName/waws-prod-dm1-113/9NtLRpaalri4lzBqFxEKs3o34nhdsdeeDBcWhgkWf8gx7qJNae5KYy0pywA3.html Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode nested-navigate Referer https://login-microsoft-online.azurewebsites.net/publishProfile%20profileName/waws-prod-dm1-113/9NtLRpaalri4lzBqFxEKs3o34nhdsdeeDBcWhgkWf8gx7qJNae5KYy0pywA3.html Response headers Date Sat, 26 Oct 2019 08:52:24 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache refresh 0; url=utqirmas0kvcy9w42gjx618ebphfl5n73dzo Set-Cookie PHPSESSID=3f71463f1711be553dbff3ed2bfbe419; path=/ Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

login-microsoft-online.azurewebsites.net
radioeesongclub.ru
168.61.217.214
23.95.236.183
a03bb7ebc4617e4b361e18a7859bec6b7c4ecf01dcdba9eb879627402846e9fd