loginonlinemicrosoft.omnisofts.com Open in urlscan Pro
3.96.220.211 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://loginonlinemicrosoft.omnisofts.com/
Effective URL:
https://loginonlinemicrosoft.omnisofts.com/login.html
Submission: On December 03 via automatic, source certstream-suspicious (December 3rd 2020, 7:32:52 pm UTC)

Summary HTTP 13 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 13 HTTP transactions. The main IP is 3.96.220.211, located in Seattle, United States and belongs to AMAZON-02, US. The main domain is loginonlinemicrosoft.omnisofts.com.
TLS certificate: Issued by R3 on December 3rd 2020. Valid for: 3 months.

This is the only time loginonlinemicrosoft.omnisofts.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 8	3.96.220.211 3.96.220.211	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:817::2008	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:6c0... 2a02:26f0:6c00:283::34ef	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	152.199.23.37 152.199.23.37	15133 (EDGECAST) (EDGECAST)
1	2a02:26f0:2b0... 2a02:26f0:2b00:98f::34ef	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a00:1450:400... 2a00:1450:4001:824::200e	15169 (GOOGLE) (GOOGLE)
13	6

8 3.96.220.211 (Seattle, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-96-220-211.ca-central-1.compute.amazonaws.com

loginonlinemicrosoft.omnisofts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:817::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:283::34ef (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

msagfx.live.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 152.199.23.37 (United States)

ASN15133 (EDGECAST, US)

aadcdn.msftauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:2b00:98f::34ef (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

auth.gfx.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:824::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	omnisofts.com 1 redirects loginonlinemicrosoft.omnisofts.com	567 KB
2	google-analytics.com www.google-analytics.com	131 B
1	gfx.ms auth.gfx.ms	209 B
1	msftauth.net aadcdn.msftauth.net	1 KB
1	live.com msagfx.live.com
1	googletagmanager.com www.googletagmanager.com	51 KB
13	6

	Domain	Requested by
8	loginonlinemicrosoft.omnisofts.com	1 redirects loginonlinemicrosoft.omnisofts.com
2	www.google-analytics.com	www.googletagmanager.com
1	auth.gfx.ms	loginonlinemicrosoft.omnisofts.com
1	aadcdn.msftauth.net	loginonlinemicrosoft.omnisofts.com
1	msagfx.live.com	loginonlinemicrosoft.omnisofts.com
1	www.googletagmanager.com	loginonlinemicrosoft.omnisofts.com
13	6

This site contains links to these domains. Also see Links.

Domain
account.live.com
login.live.com

Subject Issuer	Validity	Valid
termont.ca R3	`2020-12-03` - `2021-03-03`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-11-03` - `2021-01-26`	3 months	crt.sh
msagfx.live.com Microsoft IT TLS CA 2	`2019-06-13` - `2021-06-13`	2 years	crt.sh
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA	`2020-07-09` - `2021-07-09`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://loginonlinemicrosoft.omnisofts.com/login.html
Frame ID: DE75D0337ABEFE719863161A0C0CC89D
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://loginonlinemicrosoft.omnisofts.com/ HTTP 302
https://loginonlinemicrosoft.omnisofts.com/login.html Page URL

Detected technologies

Debian (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Debian/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

13
Requests

100 %
HTTPS

67 %
IPv6

6
Domains

6
Subdomains

6
IPs

3
Countries

619 kB
Transfer

699 kB
Size

2
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fcontextid%3d796F05AD372B6B25%26bk%3d1527904891&id=38936&uiflavor=web&cobrandid=140703588335528&uaid=d9c1b58bf69145d98c0dddf2c55abe77&mkt=EN-US&lc=1033&bk=1527904891
Title: Forgot my password

Search URL Search Domain Scan URL

URL: https://login.live.com/gls.srf?urlID=WinLiveTermsOfUse&mkt=EN-US&vv=1600
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://login.live.com/gls.srf?urlID=MSNPrivacyStatement&mkt=EN-US&vv=1600
Title: Privacy & cookies

Search URL Search Domain Scan URL

URL: https://login.live.com/pp1600/
Title:

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://loginonlinemicrosoft.omnisofts.com/ HTTP 302
https://loginonlinemicrosoft.omnisofts.com/login.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request login.html Show response
loginonlinemicrosoft.omnisofts.com/
Redirect Chain

https://loginonlinemicrosoft.omnisofts.com/
https://loginonlinemicrosoft.omnisofts.com/login.html

34 KB
34 KB

110ms
110ms

Document
text/html

3.96.220.211
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://loginonlinemicrosoft.omnisofts.com/login.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.96.220.211 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-96-220-211.ca-central-1.compute.amazonaws.com
Software: Apache/2.4.46 (Debian) /
Resource Hash: e1e5a06dd72caab439a7129b1aaa31d24b53b61fb6808609ae0c786129db0361

Request headers

Host: loginonlinemicrosoft.omnisofts.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 03 Dec 2020 19:32:34 GMT
Server: Apache/2.4.46 (Debian)
Last-Modified: Tue, 01 Dec 2020 18:43:47 GMT
ETag: "86a7-5b56b81c73ec0"
Accept-Ranges: bytes
Content-Length: 34471
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html

Redirect headers

Date: Thu, 03 Dec 2020 19:32:34 GMT
Server: Apache/2.4.46 (Debian)
Location: login.html
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK Converged_v21033.css
loginonlinemicrosoft.omnisofts.com/index_files/ 92 KB
92 KB 113ms
112ms Stylesheet
text/css 3.96.220.211
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://loginonlinemicrosoft.omnisofts.com/index_files/Converged_v21033.css
Requested by: Host: loginonlinemicrosoft.omnisofts.com
URL: https://loginonlinemicrosoft.omnisofts.com/login.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.96.220.211 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-96-220-211.ca-central-1.compute.amazonaws.com
Software: Apache/2.4.46 (Debian) /
Resource Hash: 4e9e7c1c2df9e91cf271a7afe529360d199cdff23a721473062ee1ebabd6821f

Request headers

Referer: https://loginonlinemicrosoft.omnisofts.com/login.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 03 Dec 2020 19:32:34 GMT
Last-Modified: Mon, 30 Nov 2020 23:31:05 GMT
Server: Apache/2.4.46 (Debian)
ETag: "16e63-5b55b6766e040"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 93795

GET
H/1.1 200
OK ConvergedLoginPaginatedStrings.EN.js Show response
loginonlinemicrosoft.omnisofts.com/index_files/ 16 KB
16 KB 327ms
107ms Script
application/javascript 3.96.220.211
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://loginonlinemicrosoft.omnisofts.com/index_files/ConvergedLoginPaginatedStrings.EN.js
Requested by: Host: loginonlinemicrosoft.omnisofts.com
URL: https://loginonlinemicrosoft.omnisofts.com/login.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.96.220.211 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-96-220-211.ca-central-1.compute.amazonaws.com
Software: Apache/2.4.46 (Debian) /
Resource Hash: 9ed7ca26da41a6314db0efd4c26badf3346991b6b7cdf9eec315fa6730ee688a

Request headers

Referer: https://loginonlinemicrosoft.omnisofts.com/login.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 03 Dec 2020 19:32:34 GMT
Last-Modified: Mon, 30 Nov 2020 23:31:05 GMT
Server: Apache/2.4.46 (Debian)
ETag: "4014-5b55b6766e040"
Content-Language: en
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: application/javascript
Keep-Alive: timeout=5, max=97
Content-Length: 16404

GET
H/1.1 200
OK ConvergedLogin_PCore.js Show response
loginonlinemicrosoft.omnisofts.com/index_files/ 418 KB
418 KB 333ms
109ms Script
application/javascript 3.96.220.211
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://loginonlinemicrosoft.omnisofts.com/index_files/ConvergedLogin_PCore.js
Requested by: Host: loginonlinemicrosoft.omnisofts.com
URL: https://loginonlinemicrosoft.omnisofts.com/login.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.96.220.211 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-96-220-211.ca-central-1.compute.amazonaws.com
Software: Apache/2.4.46 (Debian) /
Resource Hash: db255a3725ebe9511b9f4bc95d906b8ea2d1bc8d37ed799efa8cadb5ca6b6206

Request headers

Referer: https://loginonlinemicrosoft.omnisofts.com/login.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 03 Dec 2020 19:32:34 GMT
Last-Modified: Mon, 30 Nov 2020 23:31:05 GMT
Server: Apache/2.4.46 (Debian)
ETag: "688ac-5b55b6766e040"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 428204

GET
H/1.1 200
OK microsoft_logo.svg
loginonlinemicrosoft.omnisofts.com/index_files/ 4 KB
4 KB 113ms
113ms Image
image/svg+xml 3.96.220.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loginonlinemicrosoft.omnisofts.com/index_files/microsoft_logo.svg
Requested by: Host: loginonlinemicrosoft.omnisofts.com
URL: https://loginonlinemicrosoft.omnisofts.com/login.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.96.220.211 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-96-220-211.ca-central-1.compute.amazonaws.com
Software: Apache/2.4.46 (Debian) /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Referer: https://loginonlinemicrosoft.omnisofts.com/login.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 03 Dec 2020 19:32:34 GMT
Last-Modified: Mon, 30 Nov 2020 23:31:05 GMT
Server: Apache/2.4.46 (Debian)
ETag: "e43-5b55b6766e040"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 3651

GET
H/1.1 200
OK ellipsis_white.svg
loginonlinemicrosoft.omnisofts.com/index_files/ 915 B
1 KB 111ms
110ms Image
image/svg+xml 3.96.220.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loginonlinemicrosoft.omnisofts.com/index_files/ellipsis_white.svg
Requested by: Host: loginonlinemicrosoft.omnisofts.com
URL: https://loginonlinemicrosoft.omnisofts.com/login.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.96.220.211 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-96-220-211.ca-central-1.compute.amazonaws.com
Software: Apache/2.4.46 (Debian) /
Resource Hash: 6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea

Request headers

Referer: https://loginonlinemicrosoft.omnisofts.com/login.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 03 Dec 2020 19:32:34 GMT
Last-Modified: Mon, 30 Nov 2020 23:31:05 GMT
Server: Apache/2.4.46 (Debian)
ETag: "393-5b55b6766e040"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 915

GET
H/1.1 200
OK ellipsis_grey.svg
loginonlinemicrosoft.omnisofts.com/index_files/ 915 B
1 KB 108ms
107ms Image
image/svg+xml 3.96.220.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loginonlinemicrosoft.omnisofts.com/index_files/ellipsis_grey.svg
Requested by: Host: loginonlinemicrosoft.omnisofts.com
URL: https://loginonlinemicrosoft.omnisofts.com/login.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.96.220.211 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-96-220-211.ca-central-1.compute.amazonaws.com
Software: Apache/2.4.46 (Debian) /
Resource Hash: 16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6

Request headers

Referer: https://loginonlinemicrosoft.omnisofts.com/login.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 03 Dec 2020 19:32:35 GMT
Last-Modified: Mon, 30 Nov 2020 23:31:05 GMT
Server: Apache/2.4.46 (Debian)
ETag: "393-5b55b6766e040"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=94
Content-Length: 915

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 132 KB
51 KB 40ms
40ms Script
application/javascript 2a00:1450:4001:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-7MNGR3WDB7

Requested by

Host: loginonlinemicrosoft.omnisofts.com
URL: https://loginonlinemicrosoft.omnisofts.com/login.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9757c9f84d51bf8497ac3998de47a9c23a148baa202fc12516ded021bbcac15a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://loginonlinemicrosoft.omnisofts.com/login.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 03 Dec 2020 19:32:34 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51855
x-xss-protection: 0
expires: Thu, 03 Dec 2020 19:32:34 GMT

GET
H/1.1 404
Not Found ConvergedLogin_PCore.js
msagfx.live.com/16.000.27773.2/ 0
0 868ms
745ms Script
text/plain 2a02:26f0:6c00:283::34ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://msagfx.live.com/16.000.27773.2/ConvergedLogin_PCore.js
Requested by: Host: loginonlinemicrosoft.omnisofts.com
URL: https://loginonlinemicrosoft.omnisofts.com/login.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:283::34ef , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash

Request headers

Referer: https://loginonlinemicrosoft.omnisofts.com/login.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 03 Dec 2020 19:32:35 GMT
PPServer: PPV: 30 H: BY1PPFE65DB61AE V: 0
Connection: keep-alive
Content-Length: 0
Server: Microsoft-IIS/10.0

GET
H2 200 2_bc3d32a696895f78c19df6c717586a5d.svg
aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/ 2 KB
1 KB 48ms
13ms Image
image/svg+xml 152.199.23.37
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Requested by: Host: loginonlinemicrosoft.omnisofts.com
URL: https://loginonlinemicrosoft.omnisofts.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FE5) /
Resource Hash: 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

Referer: https://loginonlinemicrosoft.omnisofts.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 03 Dec 2020 19:32:35 GMT
content-encoding: gzip
content-md5: DhdidjYrlCeaRJJRG/y9mA==
age: 21179208
x-cache: HIT
content-length: 673
x-ms-lease-status: unlocked
last-modified: Wed, 12 Feb 2020 22:01:50 GMT
server: ECAcc (frc/8FE5)
etag: 0x8D7B007297AE131
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 5546d644-801e-004d-080b-0910a9000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H/1.1 404
Not Found 0.jpg
auth.gfx.ms/16.000.27773.2/images/Backgrounds/ 0
209 B 705ms
631ms Image
text/plain 2a02:26f0:2b00:98f::34ef
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth.gfx.ms/16.000.27773.2/images/Backgrounds/0.jpg?x=a5dbd4393ff6a725c7e62b61df7e72f0
Requested by: Host: loginonlinemicrosoft.omnisofts.com
URL: https://loginonlinemicrosoft.omnisofts.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:2b00:98f::34ef , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://loginonlinemicrosoft.omnisofts.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 03 Dec 2020 19:32:36 GMT
PPServer: PPV: 30 H: BY1PPFE5C598CC6 V: 0
Connection: keep-alive
Content-Length: 0
Server: Microsoft-IIS/10.0

POST
H2 204 collect
www.google-analytics.com/g/ 0
77 B 13ms
13ms Other
text/plain 2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-7MNGR3WDB7&gtm=2oeb41&_p=2005779865&sr=1600x1200&ul=en-us&cid=1305281987.1607023956&_s=1&dl=https%3A%2F%2Floginonlinemicrosoft.omnisofts.com%2Flogin.html&dr=&dt=Sign%20in%20to%20your%20Microsoft%20account&sid=1607023955&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-7MNGR3WDB7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://loginonlinemicrosoft.omnisofts.com/login.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 03 Dec 2020 19:32:35 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://loginonlinemicrosoft.omnisofts.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
54 B 13ms
13ms Other
text/plain 2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-7MNGR3WDB7&gtm=2oeb41&_p=2005779865&sr=1600x1200&ul=en-us&cid=1305281987.1607023956&_s=2&dl=https%3A%2F%2Floginonlinemicrosoft.omnisofts.com%2Flogin.html&dr=&dt=Sign%20in%20to%20your%20Microsoft%20account&sid=1607023955&sct=1&seg=0&en=scroll&_et=464&epn.percent_scrolled=90
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-7MNGR3WDB7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://loginonlinemicrosoft.omnisofts.com/login.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 03 Dec 2020 19:32:41 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://loginonlinemicrosoft.omnisofts.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

24 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.omnisofts.com/	1970-01-20 07:54:55	Name: _ga_7MNGR3WDB7 Value: GS1.1.1607023955.1.0.1607023956.0
			.omnisofts.com/	1970-01-20 07:54:55	Name: _ga Value: GA1.1.1305281987.1607023956

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msftauth.net
auth.gfx.ms
loginonlinemicrosoft.omnisofts.com
msagfx.live.com
www.google-analytics.com
www.googletagmanager.com
152.199.23.37
2a00:1450:4001:817::2008
2a00:1450:4001:824::200e
2a02:26f0:2b00:98f::34ef
2a02:26f0:6c00:283::34ef
3.96.220.211
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6
4e9e7c1c2df9e91cf271a7afe529360d199cdff23a721473062ee1ebabd6821f
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
9757c9f84d51bf8497ac3998de47a9c23a148baa202fc12516ded021bbcac15a
9ed7ca26da41a6314db0efd4c26badf3346991b6b7cdf9eec315fa6730ee688a
db255a3725ebe9511b9f4bc95d906b8ea2d1bc8d37ed799efa8cadb5ca6b6206
e1e5a06dd72caab439a7129b1aaa31d24b53b61fb6808609ae0c786129db0361
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

loginonlinemicrosoft.omnisofts.com Open in urlscan Pro 3.96.220.211 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

67 %IPv6

6 Domains

6 Subdomains

6 IPs

3 Countries

619 kBTransfer

699 kBSize

2 Cookies

4 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

24 JavaScript Global Variables

2 Cookies

Indicators

loginonlinemicrosoft.omnisofts.com Open in urlscan Pro
3.96.220.211 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

67 %
IPv6

6
Domains

6
Subdomains

6
IPs

3
Countries

619 kB
Transfer

699 kB
Size

2
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!