www.easternts.com Open in urlscan Pro
2a01:4f8:10b:1625:: Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.easternts.com/_/microsoftonline/index.php
Effective URL:
https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email=
Submission Tags: 6930102
Submission: On January 21 via api (January 21st 2021, 2:19:09 pm UTC) from NL

Summary HTTP 11 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 2a01:4f8:10b:1625::, located in Germany and belongs to HETZNER-AS, DE. The main domain is www.easternts.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 23rd 2020. Valid for: 3 months.

This is the only time www.easternts.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 8	2a01:4f8:10b:... 2a01:4f8:10b:1625::	24940 (HETZNER-AS) (HETZNER-AS)
3	192.229.221.185 192.229.221.185	15133 (EDGECAST) (EDGECAST)
1	2620:1ec:bdf::13 2620:1ec:bdf::13	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
11	3

8 2a01:4f8:10b:1625:: (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)

www.easternts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.229.221.185 (United States)

ASN15133 (EDGECAST, US)

logincdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:bdf::13 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	easternts.com 1 redirects www.easternts.com	14 KB
4	msauth.net logincdn.msauth.net aadcdn.msauth.net	75 KB
11	2

	Domain	Requested by
8	www.easternts.com	1 redirects www.easternts.com
3	logincdn.msauth.net	www.easternts.com
1	aadcdn.msauth.net	www.easternts.com
11	3

This site contains links to these domains. Also see Links.

Domain
signup.live.com
login.live.com

Subject Issuer	Validity	Valid
easternts.com cPanel, Inc. Certification Authority	`2020-11-23` - `2021-02-21`	3 months	crt.sh
identitycdn.msauth.net DigiCert SHA2 Secure Server CA	`2020-07-20` - `2021-07-20`	a year	crt.sh
aadcdn.msauth.net DigiCert SHA2 Secure Server CA	`2020-10-09` - `2021-10-09`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email=
Frame ID: 99FBAEEEBFA420285A44A029B83F291C
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.easternts.com/_/microsoftonline/index.php HTTP 302
https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email= Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

11
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

89 kB
Transfer

215 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://signup.live.com/signup?wa=wsignin1.0&rpsnv=13&ct=1601919882&rver=7.3.6963.0&wp=SAPI&wreply=https%3A%2F%2Fstores.office.com%2Fauthredir%3Furl%3Dhttps%253a%252f%252fstores.office.com%253a443%252fsubscription%252facquire%253fpt%253dOfficePurchase%2526productid%253dCFQ7TTC0K5BF%2526skuid%253d007R%2526pmo%253dGB%2526rs%253den-GB%2526culture%253den-gb%2526country%253dGB%2526ui%253den-US%2526ad%253dGB%2526oref%253dhttps%25253A%25252F%25252Fwww.microsoft.com%25252F%26hurl%3DRLuraPE4qBxeJi9YKNgjAD4G8l2CIcl8%252fVLUKALDEEk%253d.spuV3dzLEMehBG4G8EKwiG2o%252fbfudgZ%252bRftfgVlLPWc%253d%26ipt%3D0%26sn%3DIDSAPI%26si%3D1%26wctx%3D1c178e3d-d641-4b6d-a9a6-2772ce940fa8&id=290950&lw=1&fl=easi2&cobrandid=58564b52-f72a-42da-9d02-6f932683862d&contextid=B1819D3E9AAEE1AE&bk=1601919883&uiflavor=web&lic=1&mkt=EN-US&lc=1033&uaid=bb3018ca1a374a6ae163b8ce63441724
Title: Create one!

Search URL Search Domain Scan URL

URL: https://login.live.com/gls.srf?urlID=WinLiveTermsOfUse&mkt=EN-US&vv=1600&uaid=bb3018ca1a374a6ae163b8ce63441724
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://login.live.com/gls.srf?urlID=MSNPrivacyStatement&mkt=EN-US&vv=1600&uaid=bb3018ca1a374a6ae163b8ce63441724
Title: Privacy & cookies

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.easternts.com/_/microsoftonline/index.php HTTP 302
https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request m.php Show response www.easternts.com/_/microsoftonline/ Redirect Chain https://www.easternts.com/_/microsoftonline/index.php https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email=	53 KB 13 KB	97ms 97ms	Document text/html	2a01:4f8:10b:1625:: HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a01:4f8:10b:1625:: , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software Apache / Resource Hash `5de6b42bbe883db9ec30a9a17db57c96da13dee52e58b24ddc7be9d951a00e44` Request headers :method GET :authority www.easternts.com :scheme https :path /_/microsoftonline/m.php?rand=WebAppSecurity.1&email= pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 21 Jan 2021 14:18:51 GMT server Apache content-encoding gzip vary Accept-Encoding content-type text/html; charset=UTF-8 Redirect headers date Thu, 21 Jan 2021 14:18:51 GMT server Apache content-encoding gzip vary Accept-Encoding location m.php?rand=WebAppSecurity.1&email= content-type text/html; charset=UTF-8
GET H2	200	Converged_v21033_5plpI1P0_uKjrokWdqCoBw2.css logincdn.msauth.net/16.000/	103 KB 19 KB	29ms 28ms	Stylesheet text/css	192.229.221.185 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://logincdn.msauth.net/16.000/Converged_v21033_5plpI1P0_uKjrokWdqCoBw2.css Requested by Host: www.easternts.com URL: https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.221.185 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (lhd/35F4) / Resource Hash `edc22ddb46d0dee7c192892cb834e4c9bfea54bf5fd324d01357d5249db8d6d4` Request headers Referer https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 21 Jan 2021 14:18:51 GMT content-encoding gzip content-md5 VBwBzy3TblLMnS1j3l8rDQ== age 4194380 x-cache HIT content-length 19290 x-ms-lease-status unlocked last-modified Sat, 11 Jul 2020 05:10:57 GMT server ECAcc (lhd/35F4) etag 0x8D82558CBC4E5D5 vary Accept-Encoding content-type text/css access-control-allow-origin * x-ms-request-id 2f0e9b10-c01e-000c-1fda-c91206000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	500	ConvergedLoginPaginatedStrings.js www.easternts.com/_/microsoftonline/Sign7_files/	0 0	11ms 11ms	Script text/html	2a01:4f8:10b:1625:: HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://www.easternts.com/_/microsoftonline/Sign7_files/ConvergedLoginPaginatedStrings.js Requested by Host: www.easternts.com URL: https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a01:4f8:10b:1625:: , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software Apache / Resource Hash Request headers Origin https://www.easternts.com Referer https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 21 Jan 2021 14:18:51 GMT server Apache content-length 667 content-type text/html; charset=iso-8859-1
GET H2	500	ConvergedLogin_PCore_dPUlFZDruMhcATtVx_0xNw2.js www.easternts.com/_/microsoftonline/Sign7_files/	0 0	12ms 11ms	Script text/html	2a01:4f8:10b:1625:: HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://www.easternts.com/_/microsoftonline/Sign7_files/ConvergedLogin_PCore_dPUlFZDruMhcATtVx_0xNw2.js Requested by Host: www.easternts.com URL: https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a01:4f8:10b:1625:: , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software Apache / Resource Hash Request headers Origin https://www.easternts.com Referer https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 21 Jan 2021 14:18:51 GMT server Apache content-length 667 content-type text/html; charset=iso-8859-1
GET H2	200	microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg aadcdn.msauth.net/shared/1.0/content/images/	4 KB 2 KB	26ms 9ms	Image image/svg+xml	2620:1ec:bdf::13 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg Requested by Host: www.easternts.com URL: https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:bdf::13 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers Referer https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 21 Jan 2021 14:18:51 GMT content-encoding gzip x-azure-ref-originshield 0ym0GYAAAAAAQu3iEcapsRK4G+rrZHUKDTE9OMjFFREdFMDExNgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-md5 nzaLxFgP7ZB3dfMcaybWzw== x-cache TCP_HIT content-length 1435 x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:38 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D79B8373CB2849 x-azure-ref 0S40JYAAAAABcyZzH3OMwQ6TV7q7ibDhRRlJBRURHRTEwMTQAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2 content-type image/svg+xml access-control-allow-origin * x-ms-request-id d2c8ac35-801e-0027-02b9-ed774e000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	500	ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg www.easternts.com/_/microsoftonline/Sign7_files/	667 B 667 B	11ms 11ms	Image text/html	2a01:4f8:10b:1625:: HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.easternts.com/_/microsoftonline/Sign7_files/ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg Requested by Host: www.easternts.com URL: https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a01:4f8:10b:1625:: , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software Apache / Resource Hash `75b751afd6dcccd5fd258715764e357091a0dbaa4fd1485616c9aa666474eb78` Request headers Referer https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 21 Jan 2021 14:18:51 GMT server Apache content-length 667 content-type text/html; charset=iso-8859-1
GET H2	500	ConvergedLoginPaginatedStrings.js www.easternts.com/_/microsoftonline/Sign7_files/	0 0	14ms 14ms	Script text/html	2a01:4f8:10b:1625:: HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://www.easternts.com/_/microsoftonline/Sign7_files/ConvergedLoginPaginatedStrings.js Requested by Host: www.easternts.com URL: https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a01:4f8:10b:1625:: , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software Apache / Resource Hash Request headers Origin https://www.easternts.com Referer https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 21 Jan 2021 14:18:51 GMT server Apache content-length 667 content-type text/html; charset=iso-8859-1
GET H2	500	ConvergedLogin_PCore_dPUlFZDruMhcATtVx_0xNw2.js www.easternts.com/_/microsoftonline/Sign7_files/	0 0	10ms 10ms	Script text/html	2a01:4f8:10b:1625:: HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://www.easternts.com/_/microsoftonline/Sign7_files/ConvergedLogin_PCore_dPUlFZDruMhcATtVx_0xNw2.js Requested by Host: www.easternts.com URL: https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a01:4f8:10b:1625:: , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software Apache / Resource Hash Request headers Origin https://www.easternts.com Referer https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 21 Jan 2021 14:18:51 GMT server Apache content-length 667 content-type text/html; charset=iso-8859-1
GET H2	500	ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg www.easternts.com/_/microsoftonline/Sign7_files/	667 B 667 B	11ms 10ms	Image text/html	2a01:4f8:10b:1625:: HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.easternts.com/_/microsoftonline/Sign7_files/ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg Requested by Host: www.easternts.com URL: https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a01:4f8:10b:1625:: , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software Apache / Resource Hash `75b751afd6dcccd5fd258715764e357091a0dbaa4fd1485616c9aa666474eb78` Request headers Referer https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 21 Jan 2021 14:18:51 GMT server Apache content-length 667 content-type text/html; charset=iso-8859-1
GET H2	200	45-small_d1bd671935adc1cdf63956e8eb9afac2.jpg logincdn.msauth.net/shared/1.0/content/images/appbackgrounds/	870 B 997 B	44ms 43ms	Image image/jpeg	192.229.221.185 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://logincdn.msauth.net/shared/1.0/content/images/appbackgrounds/45-small_d1bd671935adc1cdf63956e8eb9afac2.jpg Requested by Host: www.easternts.com URL: https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.221.185 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (lhd/35DA) / Resource Hash `6d336eebe1b0cee0781d914905c1ffc44981d4ec03075cec289963c8e16a76f0` Request headers Referer https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 21 Jan 2021 14:18:51 GMT content-md5 0b1nGTWtwc32OVbo65r6wg== age 4194375 x-cache HIT content-length 870 x-ms-lease-status unlocked last-modified Fri, 31 Jan 2020 05:42:02 GMT server ECAcc (lhd/35DA) etag 0x8D7A6104C81F4E5 content-type image/jpeg access-control-allow-origin * x-ms-request-id 90d47102-b01e-0037-77da-c90730000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	45_4bd86b5aafbf253bf94ec89250b80bee.jpg logincdn.msauth.net/shared/1.0/content/images/appbackgrounds/	53 KB 53 KB	27ms 27ms	Image image/jpeg	192.229.221.185 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://logincdn.msauth.net/shared/1.0/content/images/appbackgrounds/45_4bd86b5aafbf253bf94ec89250b80bee.jpg Requested by Host: www.easternts.com URL: https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.221.185 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (lhd/3586) / Resource Hash `8bfaa5dcd648bb76cc6450c6a6a9b4560e2f4ca88a9fe18a88c415549af37a02` Request headers Referer https://www.easternts.com/_/microsoftonline/m.php?rand=WebAppSecurity.1&email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 21 Jan 2021 14:18:51 GMT content-md5 S9hrWq+/JTv5TsiSULgL7g== age 4194375 x-cache HIT content-length 54120 x-ms-lease-status unlocked last-modified Fri, 31 Jan 2020 05:42:02 GMT server ECAcc (lhd/3586) etag 0x8D7A6104C7A0432 content-type image/jpeg access-control-allow-origin * x-ms-request-id 677ab92e-901e-0002-6eda-c9d3e8000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
logincdn.msauth.net
www.easternts.com
192.229.221.185
2620:1ec:bdf::13
2a01:4f8:10b:1625::
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
5de6b42bbe883db9ec30a9a17db57c96da13dee52e58b24ddc7be9d951a00e44
6d336eebe1b0cee0781d914905c1ffc44981d4ec03075cec289963c8e16a76f0
75b751afd6dcccd5fd258715764e357091a0dbaa4fd1485616c9aa666474eb78
8bfaa5dcd648bb76cc6450c6a6a9b4560e2f4ca88a9fe18a88c415549af37a02
edc22ddb46d0dee7c192892cb834e4c9bfea54bf5fd324d01357d5249db8d6d4

www.easternts.com Open in urlscan Pro 2a01:4f8:10b:1625:: Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

67 %IPv6

2 Domains

3 Subdomains

3 IPs

2 Countries

89 kBTransfer

215 kBSize

0 Cookies

3 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

16 JavaScript Global Variables

0 Cookies

Indicators

www.easternts.com Open in urlscan Pro
2a01:4f8:10b:1625:: Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

89 kB
Transfer

215 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!