urlscan.io logo urlscan.io
SecurityTrails logo

microsoft.ch-mailsafe.ch Open in urlscan Pro
116.203.197.71  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
Submission: On November 10 via manual from AT — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 15 HTTP transactions. The main IP is 116.203.197.71, located in Germany and belongs to HETZNER-AS, DE. The main domain is microsoft.ch-mailsafe.ch.
This is the only time microsoft.ch-mailsafe.ch was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer) Office 365 (Online)

Domain & IP information

IP Address AS Autonomous System
12 116.203.197.71 24940 (HETZNER-AS)
1 3 142.250.185.77 15169 (GOOGLE)
1 1 142.250.185.110 15169 (GOOGLE)
1 104.244.42.129 13414 (TWITTER)
15 3
Apex Domain
Subdomains		 Transfer
12 ch-mailsafe.ch
microsoft.ch-mailsafe.ch
249 KB
4 google.com
accounts.google.com — Cisco Umbrella Rank: 80
plus.google.com — Cisco Umbrella Rank: 8321
3 KB
1 twitter.com
twitter.com — Cisco Umbrella Rank: 195
15 3
Domain Requested by
12 microsoft.ch-mailsafe.ch microsoft.ch-mailsafe.ch
3 accounts.google.com 1 redirects microsoft.ch-mailsafe.ch
1 twitter.com microsoft.ch-mailsafe.ch
1 plus.google.com 1 redirects
15 4

This site contains no links.

Subject Issuer Validity Valid
accounts.google.com
GTS CA 1C3		 2022-10-25 -
2023-01-17		 3 months crt.sh
twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-03-07 -
2023-03-06		 a year crt.sh

This page contains 1 frames:

Primary Page: http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
Frame ID: 535C5124BB6C011B02F961DD841D3975
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Login

Detected technologies

Overall confidence: 100%
Detected patterns
  • tracker\.js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

13 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

249 kB
Transfer

308 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7
  • https://plus.google.com/up/?continue=https://www.google.com/intl/en/images/logos/accounts_logo.png&type=st&gpsrc=ogpy0 HTTP 302
  • https://accounts.google.com/ServiceLogin?passive=1209600&osid=1&continue=https://plus.google.com/up/?continue%3Dhttps://www.google.com/intl/en/images/logos/accounts_logo.png%26type%3Dst%26gpsrc%3Dogpy0&followup=https://plus.google.com/up/?continue%3Dhttps://www.google.com/intl/en/images/logos/accounts_logo.png%26type%3Dst%26gpsrc%3Dogpy0 HTTP 302
  • https://accounts.google.com/v3/signin/identifier?dsh=S-536799578%3A1668088292712424&continue=https%3A%2F%2Fplus.google.com%2Fup%2F%3Fcontinue%3Dhttps%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png%26type%3Dst%26gpsrc%3Dogpy0&followup=https%3A%2F%2Fplus.google.com%2Fup%2F%3Fcontinue%3Dhttps%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png%26type%3Dst%26gpsrc%3Dogpy0&osid=1&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=ARgdvAuO0GJrP-LQ-fgWQgdqENjcci9Gyf8ymFRozFnT_y0LKOeTzQhBahc8ON4t4WUnlqdfIiEsAQ

15 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 8we0sditt5c5oyht
microsoft.ch-mailsafe.ch/ 		5 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
Protocol
HTTP/1.1
Server
116.203.197.71 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
mail.cloudserver329.com
Software
Lucy /
Resource Hash
5e4fa9da5aa7b4d037f3ebe7bdab8bc18c342669ddbc5424d8d4e81ca5d25cd6

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Access-Control-Allow-Headers
*
Access-Control-Allow-Methods
*
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
1931
Content-Type
text/html; charset=UTF-8
Date
Thu, 10 Nov 2022 13:51:32 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=100
Pragma
no-cache
Server
Lucy
Vary
Accept-Encoding
events.js
microsoft.ch-mailsafe.ch/js/ 		558 B
917 B 		Script
General
Check archive.org
Download Go to
Full URL
http://microsoft.ch-mailsafe.ch/js/events.js
Requested by
Host: microsoft.ch-mailsafe.ch
URL: http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
Protocol
HTTP/1.1
Server
116.203.197.71 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
mail.cloudserver329.com
Software
Lucy /
Resource Hash
a8f7e59c2a6d75c51e1898b2d1ff9f6f666caad39a12d215e506202fce2ce150

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Thu, 10 Nov 2022 13:51:32 GMT
Server
Lucy
Access-Control-Allow-Methods
*
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=86400
Connection
Keep-Alive
Access-Control-Allow-Headers
*
Content-Length
558
Keep-Alive
timeout=5, max=99
Expires
Fri, 11 Nov 2022 13:51:32 GMT
office.png
microsoft.ch-mailsafe.ch/public/campaign/159/189/15/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://microsoft.ch-mailsafe.ch/public/campaign/159/189/15/office.png
Requested by
Host: microsoft.ch-mailsafe.ch
URL: http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
Protocol
HTTP/1.1
Server
116.203.197.71 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
mail.cloudserver329.com
Software
Lucy /
Resource Hash
175986272200fb72da9a598d30016bbda9ddcaa9e6e3f07eb94bc74196d4b805

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Thu, 10 Nov 2022 13:51:32 GMT
Last-Modified
Wed, 02 Nov 2022 12:52:52 GMT
Server
Lucy
ETag
"665-5ec7c5196f007"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
1637
jquery-1.11.3.min.js
microsoft.ch-mailsafe.ch/public/campaign/159/189/15/ 		94 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://microsoft.ch-mailsafe.ch/public/campaign/159/189/15/jquery-1.11.3.min.js
Requested by
Host: microsoft.ch-mailsafe.ch
URL: http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
Protocol
HTTP/1.1
Server
116.203.197.71 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
mail.cloudserver329.com
Software
Lucy /
Resource Hash
d052d0c3c047d723c2fcb341ed69e4f53ab1aa8650d33c75b039aef0b014555c

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Thu, 10 Nov 2022 13:51:32 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Nov 2022 12:50:23 GMT
Server
Lucy
ETag
"176fe-5ec7c48b1c706-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
33314
timeme.min.js
microsoft.ch-mailsafe.ch/js/ 		4 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://microsoft.ch-mailsafe.ch/js/timeme.min.js
Requested by
Host: microsoft.ch-mailsafe.ch
URL: http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
Protocol
HTTP/1.1
Server
116.203.197.71 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
mail.cloudserver329.com
Software
Lucy /
Resource Hash
3ae66a8d261814acf0678914f1832973fe5be31912abf545f81fe4f97fd707dd

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Thu, 10 Nov 2022 13:51:32 GMT
Server
Lucy
Access-Control-Allow-Methods
*
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=86400
Connection
Keep-Alive
Access-Control-Allow-Headers
*
Content-Length
4210
Keep-Alive
timeout=5, max=99
Expires
Fri, 11 Nov 2022 13:51:32 GMT
time-tracker.js
microsoft.ch-mailsafe.ch/js/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://microsoft.ch-mailsafe.ch/js/time-tracker.js
Requested by
Host: microsoft.ch-mailsafe.ch
URL: http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
Protocol
HTTP/1.1
Server
116.203.197.71 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
mail.cloudserver329.com
Software
Lucy /
Resource Hash
ce5b41bb9e310321a957d16cbd21b476c2f68454eb3eb6c5f79a3f3e823908c0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Thu, 10 Nov 2022 13:51:32 GMT
Server
Lucy
Access-Control-Allow-Methods
*
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=86400
Connection
Keep-Alive
Access-Control-Allow-Headers
*
Content-Length
1597
Keep-Alive
timeout=5, max=100
Expires
Fri, 11 Nov 2022 13:51:32 GMT
analyse.js
microsoft.ch-mailsafe.ch/js/ 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://microsoft.ch-mailsafe.ch/js/analyse.js
Requested by
Host: microsoft.ch-mailsafe.ch
URL: http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
Protocol
HTTP/1.1
Server
116.203.197.71 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
mail.cloudserver329.com
Software
Lucy /
Resource Hash
df44e74c857de0cd2b94ae343fe1afced4203aacb6dce3a7107338b0c9a76593

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Thu, 10 Nov 2022 13:51:32 GMT
Server
Lucy
Access-Control-Allow-Methods
*
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=86400
Connection
Keep-Alive
Access-Control-Allow-Headers
*
Content-Length
2938
Keep-Alive
timeout=5, max=100
Expires
Fri, 11 Nov 2022 13:51:32 GMT
CheckCookie
accounts.google.com/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://accounts.google.com/CheckCookie?continue=https%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png&followup=https%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png&chtml=LoginDoneHtml&checkedDomains=youtube&checkConnection=youtube%3A291%3A1
Requested by
Host: microsoft.ch-mailsafe.ch
URL: http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.77 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f13.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://microsoft.ch-mailsafe.ch/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers
identifier
accounts.google.com/v3/signin/
Redirect Chain
  • https://plus.google.com/up/?continue=https://www.google.com/intl/en/images/logos/accounts_logo.png&type=st&gpsrc=ogpy0
  • https://accounts.google.com/ServiceLogin?passive=1209600&osid=1&continue=https://plus.google.com/up/?continue%3Dhttps://www.google.com/intl/en/images/logos/accounts_logo.png%26type%3Dst%26gpsrc%3Do...
  • https://accounts.google.com/v3/signin/identifier?dsh=S-536799578%3A1668088292712424&continue=https%3A%2F%2Fplus.google.com%2Fup%2F%3Fcontinue%3Dhttps%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Fl...
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://accounts.google.com/v3/signin/identifier?dsh=S-536799578%3A1668088292712424&continue=https%3A%2F%2Fplus.google.com%2Fup%2F%3Fcontinue%3Dhttps%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png%26type%3Dst%26gpsrc%3Dogpy0&followup=https%3A%2F%2Fplus.google.com%2Fup%2F%3Fcontinue%3Dhttps%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png%26type%3Dst%26gpsrc%3Dogpy0&osid=1&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=ARgdvAuO0GJrP-LQ-fgWQgdqENjcci9Gyf8ymFRozFnT_y0LKOeTzQhBahc8ON4t4WUnlqdfIiEsAQ
Requested by
Host: microsoft.ch-mailsafe.ch
URL: http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
Protocol
H3
Server
142.250.185.77 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f13.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://microsoft.ch-mailsafe.ch/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Redirect headers

date
Thu, 10 Nov 2022 13:51:32 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
content-security-policy
require-trusted-types-for 'script';report-uri /cspreport, script-src 'report-sample' 'nonce-nixJezEudU-FXKK9KRGcow' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
446
x-xss-protection
1; mode=block
pragma
no-cache
server
GSE
x-frame-options
DENY
report-to
{"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-type
text/html; charset=UTF-8
location
https://accounts.google.com/v3/signin/identifier?dsh=S-536799578%3A1668088292712424&continue=https%3A%2F%2Fplus.google.com%2Fup%2F%3Fcontinue%3Dhttps%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png%26type%3Dst%26gpsrc%3Dogpy0&followup=https%3A%2F%2Fplus.google.com%2Fup%2F%3Fcontinue%3Dhttps%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png%26type%3Dst%26gpsrc%3Dogpy0&osid=1&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=ARgdvAuO0GJrP-LQ-fgWQgdqENjcci9Gyf8ymFRozFnT_y0LKOeTzQhBahc8ON4t4WUnlqdfIiEsAQ
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy-report-only
same-origin; report-to="coop_gse_qebhlk"
expires
Mon, 01 Jan 1990 00:00:00 GMT
login
twitter.com/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://twitter.com/login?redirect_after_login=/favicon.ico
Requested by
Host: microsoft.ch-mailsafe.ch
URL: http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.129 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://microsoft.ch-mailsafe.ch/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers
heroillustration.jpg
microsoft.ch-mailsafe.ch/public/campaign/159/189/15/ 		199 KB
199 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://microsoft.ch-mailsafe.ch/public/campaign/159/189/15/heroillustration.jpg
Requested by
Host: microsoft.ch-mailsafe.ch
URL: http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
Protocol
HTTP/1.1
Server
116.203.197.71 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
mail.cloudserver329.com
Software
Lucy /
Resource Hash
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Thu, 10 Nov 2022 13:51:32 GMT
Last-Modified
Wed, 02 Nov 2022 12:50:23 GMT
Server
Lucy
ETag
"31a1e-5ec7c48b1c706"
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
203294
run-analyse
microsoft.ch-mailsafe.ch/8we0sditt5c5oyht/ 		0
495 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht/run-analyse
Requested by
Host: microsoft.ch-mailsafe.ch
URL: http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
Protocol
HTTP/1.1
Server
116.203.197.71 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
mail.cloudserver329.com
Software
Lucy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryZElTpHwPGAxqBSnQ

Response headers

Pragma
no-cache
Date
Thu, 10 Nov 2022 13:51:32 GMT
Server
Lucy
Access-Control-Allow-Methods
*
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
Keep-Alive
Access-Control-Allow-Headers
*
Content-Length
0
Keep-Alive
timeout=5, max=99
Expires
Thu, 19 Nov 1981 08:52:00 GMT
run-analyse
microsoft.ch-mailsafe.ch/8we0sditt5c5oyht/ 		0
495 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht/run-analyse
Requested by
Host: microsoft.ch-mailsafe.ch
URL: http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
Protocol
HTTP/1.1
Server
116.203.197.71 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
mail.cloudserver329.com
Software
Lucy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundary9s5KIhP3aXsjgGvM

Response headers

Pragma
no-cache
Date
Thu, 10 Nov 2022 13:51:32 GMT
Server
Lucy
Access-Control-Allow-Methods
*
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
Keep-Alive
Access-Control-Allow-Headers
*
Content-Length
0
Keep-Alive
timeout=5, max=97
Expires
Thu, 19 Nov 1981 08:52:00 GMT
track-time
microsoft.ch-mailsafe.ch/scenario/ 		0
665 B 		Ping
General
Check archive.org
Download Go to
Full URL
http://microsoft.ch-mailsafe.ch/scenario/track-time
Requested by
Host: microsoft.ch-mailsafe.ch
URL: http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
Protocol
HTTP/1.1
Server
116.203.197.71 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
mail.cloudserver329.com
Software
Lucy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 10 Nov 2022 13:51:33 GMT
Server
Lucy
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
*
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Access-Control-Allow-Headers
*
Content-Length
0
Keep-Alive
timeout=5, max=96
Expires
Thu, 19 Nov 1981 08:52:00 GMT
track-time
microsoft.ch-mailsafe.ch/scenario/ 		0
665 B 		Ping
General
Check archive.org
Download Go to
Full URL
http://microsoft.ch-mailsafe.ch/scenario/track-time
Requested by
Host: microsoft.ch-mailsafe.ch
URL: http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
Protocol
HTTP/1.1
Server
116.203.197.71 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
mail.cloudserver329.com
Software
Lucy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://microsoft.ch-mailsafe.ch/8we0sditt5c5oyht
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 10 Nov 2022 13:51:38 GMT
Server
Lucy
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
*
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Access-Control-Allow-Headers
*
Content-Length
0
Keep-Alive
timeout=5, max=95
Expires
Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer) Office 365 (Online)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| lucyDispatchEvent function| $ function| jQuery function| resize object| jQuery111307424784686140107 object| TimeMe boolean| injected function| trackTime function| sendUserActivityTimeData function| runChromeTimeTracker function| isChrome object| dataAnalyse string| analysisUrl function| sendAnalyseData function| updateSocialStatus function| runAnalyse function| doAnalysis

3 Cookies

Domain/Path Name / Value
microsoft.ch-mailsafe.ch/ Name: link
Value: 8we0sditt5c5oyht
.google.com/ Name: NID
Value: 511=W0iRR_jChviKus1NZ0Q_YbXVoiPTqgMLuueib8hSWFM7k3msxVZl4pnL0k8VzB-wwJjbI326l4ZMtz37f1XnHeIDUR-rdCjjSH9Df-ZAUW66SPWhmfnm-uNvwedTz3ZnyKYkK_QMiR8IvFpzD8eN15imWtUwNyNMNj3zdX1753I
.twitter.com/ Name: guest_id
Value: v1%3A166808829267291090

2 Console Messages

Source Level URL
Text
network error URL: https://accounts.google.com/CheckCookie?continue=https%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png&followup=https%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png&chtml=LoginDoneHtml&checkedDomains=youtube&checkConnection=youtube%3A291%3A1
Message:
Failed to load resource: the server responded with a status of 400 ()
network error URL: https://accounts.google.com/v3/signin/identifier?dsh=S-536799578%3A1668088292712424&continue=https%3A%2F%2Fplus.google.com%2Fup%2F%3Fcontinue%3Dhttps%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png%26type%3Dst%26gpsrc%3Dogpy0&followup=https%3A%2F%2Fplus.google.com%2Fup%2F%3Fcontinue%3Dhttps%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png%26type%3Dst%26gpsrc%3Dogpy0&osid=1&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=ARgdvAuO0GJrP-LQ-fgWQgdqENjcci9Gyf8ymFRozFnT_y0LKOeTzQhBahc8ON4t4WUnlqdfIiEsAQ
Message:
Failed to load resource: the server responded with a status of 403 ()