protections-useradmn01.ml Open in urlscan Pro
146.70.53.147 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://trk.klclick3.com/ls/click?upn=dzk8sNb1Vjr5WlISMNUHPiKdW-2FY3N0uASPg3WHcLhIjPCn3s-2Fz9Trj4dSJnu06B0OI0Du8DZEl-2FTU...
Effective URL:
https://protections-useradmn01.ml/993q2e7q2cpzx3k.html?_kx=
Submission: On March 03 via manual (March 3rd 2022, 5:36:12 pm UTC) from US — Scanned from DE

Summary HTTP 10 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 7 domains to perform 10 HTTP transactions. The main IP is 146.70.53.147, located in Sofia, Bulgaria and belongs to M247, GB. The main domain is protections-useradmn01.ml.
TLS certificate: Issued by R3 on March 3rd 2022. Valid for: 3 months.

This is the only time protections-useradmn01.ml was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2600:9000:224... 2600:9000:224a:7800:9:ec94:b800:93a1	16509 (AMAZON-02) (AMAZON-02)
1	146.70.53.147 146.70.53.147	9009 (M247) (M247)
1 2	2606:4700::68... 2606:4700::6810:7baf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	76.76.21.241 76.76.21.241	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
1	2a06:98c1:312... 2a06:98c1:3121::7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	192.229.221.185 192.229.221.185	15133 (EDGECAST) (EDGECAST)
10	6

1 2600:9000:224a:7800:9:ec94:b800:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

trk.klclick3.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.70.53.147 (Sofia, Bulgaria)

ASN9009 (M247, GB)

protections-useradmn01.ml	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:7baf (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 76.76.21.241 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

cdn.tailwindcss.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:3121::7 (United States)

ASN13335 (CLOUDFLARENET, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 192.229.221.185 (United States)

ASN15133 (EDGECAST, US)

logincdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	msauth.net logincdn.msauth.net — Cisco Umbrella Rank: 2290	5 KB
2	tailwindcss.com 1 redirects cdn.tailwindcss.com — Cisco Umbrella Rank: 368696	96 KB
2	unpkg.com 1 redirects unpkg.com — Cisco Umbrella Rank: 821	15 KB
1	fontawesome.com use.fontawesome.com — Cisco Umbrella Rank: 828	12 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35	964 B
1	protections-useradmn01.ml protections-useradmn01.ml	6 KB
1	klclick3.com 1 redirects trk.klclick3.com — Cisco Umbrella Rank: 17507	301 B
10	7

	Domain	Requested by
5	logincdn.msauth.net	protections-useradmn01.ml
2	cdn.tailwindcss.com	1 redirects protections-useradmn01.ml
2	unpkg.com	1 redirects protections-useradmn01.ml
1	use.fontawesome.com	protections-useradmn01.ml
1	fonts.googleapis.com	protections-useradmn01.ml
1	protections-useradmn01.ml
1	trk.klclick3.com	1 redirects
10	7

This site contains links to these domains. Also see Links.

Domain
account.live.com
signup.live.com
login.live.com

Subject Issuer	Validity	Valid
protections-useradmn01.ml R3	`2022-03-03` - `2022-06-01`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-07` - `2022-07-06`	a year	crt.sh
identitycdn.msauth.net DigiCert SHA2 Secure Server CA	`2021-05-13` - `2022-05-13`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://protections-useradmn01.ml/993q2e7q2cpzx3k.html?_kx=
Frame ID: 79F88786E4FE0AE571B4E9DEB67DB873
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Microsoft | Login

Page URL History Show full URLs

https://trk.klclick3.com/ls/click?upn=dzk8sNb1Vjr5WlISMNUHPiKdW-2FY3N0uASPg3WHcLhIjPCn3s-2Fz9Trj4dSJn... HTTP 302
https://protections-useradmn01.ml/993q2e7q2cpzx3k.html?_kx= Page URL

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

10
Requests

80 %
HTTPS

57 %
IPv6

7
Domains

7
Subdomains

6
IPs

3
Countries

134 kB
Transfer

447 kB
Size

0
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.0%26rpsnv%3d13%26ct%3d1639602099%26rver%3d7.0.6738.0%26wp%3dMBI_SSL%26wreply%3dhttps%253A%252F%252Faccount.microsoft.com%252Fauth%252Fcomplete-signin%253Fru%253Dhttps%25253A%25252F%25252Faccount.microsoft.com%25252F%25253Frefd%25253Daccount.microsoft.com%252526refp%25253Dsignedout-index%26lc%3d2057%26id%3d292666%26lw%3d1%26fl%3deasi2%26ru%3dhttps%253A%252F%252Faccount.microsoft.com%252Faccount%252F%26uaid%3d701fa177e16d44029d2a517096137b8d%26pid%3d0%26contextid%3dF4C524ED2E89BFE4%26bk%3d1639943396&id=292666&uiflavor=web&uaid=701fa177e16d44029d2a517096137b8d&mkt=EN-GB&lc=2057&bk=1639943396
Title: Forgotten your password?

Search URL Search Domain Scan URL

URL: https://signup.live.com/?wa=wsignin1.0&rpsnv=13&ct=1639602099&rver=7.0.6738.0&wp=MBI_SSL&wreply=https%3A%2F%2Faccount.microsoft.com%2Fauth%2Fcomplete-signin%3Fru%3Dhttps%253A%252F%252Faccount.microsoft.com%252F%253Frefd%253Daccount.microsoft.com%2526refp%253Dsignedout-index&id=292666&lw=1&fl=easi2&ru=https%3A%2F%2Faccount.microsoft.com%2Faccount%2F&pid=0&contextid=F4C524ED2E89BFE4&bk=1639920423&uiflavor=web&lic=1&mkt=EN-GB&lc=2057&uaid=701fa177e16d44029d2a517096137b8d
Title: Other ways to sign in

Search URL Search Domain Scan URL

URL: https://login.live.com/ppsecure/post.srf?wa=wsignin1.0&rpsnv=13&ct=1639602099&rver=7.0.6738.0&wp=MBI_SSL&wreply=https%3A%2F%2Faccount.microsoft.com%2Fauth%2Fcomplete-signin%3Fru%3Dhttps%253A%252F%252Faccount.microsoft.com%252F%253Frefd%253Daccount.microsoft.com%2526refp%253Dsignedout-index&lc=2057&id=292666&lw=1&fl=easi2&ru=https%3A%2F%2Faccount.microsoft.com%2Faccount%2F&contextid=F4C524ED2E89BFE4&bk=1639602108&uaid=701fa177e16d44029d2a517096137b8d&pid=0
Title: Sign-in options

Search URL Search Domain Scan URL

URL: https://login.live.com/gls.srf?urlID=WinLiveTermsOfUse&mkt=EN-GB&uaid=701fa177e16d44029d2a517096137b8d
Title: Terms of use

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://trk.klclick3.com/ls/click?upn=dzk8sNb1Vjr5WlISMNUHPiKdW-2FY3N0uASPg3WHcLhIjPCn3s-2Fz9Trj4dSJnu06B0OI0Du8DZEl-2FTUqo8pzHpYP-2B-2F34hkBs4r6NTWPjHpBaU-3DUtgi_tmY4D0oiUdU7wJWk9xu9MV-2BgVurKnJ-2FFlVlP6h7AwHIZDtmanNf6i7FoqAWT7hu9-2BaojvABdHCe6TVHOtGo6UwG9zWlT1SZOVt7NK7FOXJ1CYpQV9bp1Gg5dKrZYtrrg7vWPkBvjC3rcwsiR-2ByIlkc5jaLKkdAIQYQGmkxMjvzSM3bRccPDycmmvYugdJco9QFZZ91iHQFRmqWM23ncYb4Es01XxXsnLR5XYRGIVBpdEhWklVovSPDNSGvW7FeuK3eudDs4WlmyTXpmzTr8Ae-2BfLd8cyJXIrxx4-2FhpsPmlw-3D HTTP 302
https://protections-useradmn01.ml/993q2e7q2cpzx3k.html?_kx= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://unpkg.com/alpinejs@3.x.x/dist/cdn.min.js HTTP 302
https://unpkg.com/alpinejs@3.9.1/dist/cdn.min.js

Request Chain 1

https://cdn.tailwindcss.com/ HTTP 301
https://cdn.tailwindcss.com/3.0.23

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request 993q2e7q2cpzx3k.html Show response
protections-useradmn01.ml/
Redirect Chain

https://trk.klclick3.com/ls/click?upn=dzk8sNb1Vjr5WlISMNUHPiKdW-2FY3N0uASPg3WHcLhIjPCn3s-2Fz9Trj4dSJnu06B0OI0Du8DZEl-2FTUqo8pzHpYP-2B-2F34hkBs4r6NTWPjHpBaU-3DUtgi_tmY4D0oiUdU7wJWk9xu9MV-2BgVurKnJ-2...
https://protections-useradmn01.ml/993q2e7q2cpzx3k.html?_kx=

36 KB
6 KB

172ms
51ms

Document
text/html

146.70.53.147
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://protections-useradmn01.ml/993q2e7q2cpzx3k.html?_kx=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.70.53.147 Sofia, Bulgaria, ASN9009 (M247, GB),
Reverse DNS
Software: nginx /
Resource Hash: b82d77f3e2dbb660277d002ee90abbee211a175d39a68c95fe5c31ae88a53230

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Server: nginx
Date: Thu, 03 Mar 2022 17:36:06 GMT
Content-Type: text/html
Last-Modified: Thu, 03 Mar 2022 16:25:52 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: W/"6220ec10-8ea4"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Encoding: gzip

Redirect headers

content-type: text/html; charset=utf-8
content-length: 82
location: https://protections-useradmn01.ml/993q2e7q2cpzx3k.html?_kx=
server: nginx
date: Thu, 03 Mar 2022 17:36:06 GMT
x-robots-tag: noindex, nofollow
x-cache: Miss from cloudfront
via: 1.1 1b18b0df6149933160ee945c6867dc2c.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-P1
x-amz-cf-id: bFjB1D8yaQRv51FdA8KRYa4LELECF0Q5nu1QQ45YRya4Z6DzhalWcg==

GET
H2

200

cdn.min.js Show response
unpkg.com/alpinejs@3.9.1/dist/
Redirect Chain

https://unpkg.com/alpinejs@3.x.x/dist/cdn.min.js
https://unpkg.com/alpinejs@3.9.1/dist/cdn.min.js

38 KB
14 KB

50ms
50ms

Script
application/javascript

2606:4700::6810:7baf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/alpinejs@3.9.1/dist/cdn.min.js

Requested by

Host: protections-useradmn01.ml
URL: https://protections-useradmn01.ml/993q2e7q2cpzx3k.html?_kx=

Protocol

Server

2606:4700::6810:7baf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d1cbc4be2dd471fadcbbf8a85b5ac5aefb8ff7119b4b86e72c64932c9e34681

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://protections-useradmn01.ml/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 03 Mar 2022 17:36:07 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
age: 90811
fly-request-id: 01FX5Q3TPJXB12K8A4KJSSFV27-fra
content-encoding: br
vary: Accept-Encoding
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
server: cloudflare
etag: W/"9659-XsLG1d1m82MiD7zigvdCLnfpolQ"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6e6421ebeb999a3b-FRA

Redirect headers

date: Thu, 03 Mar 2022 17:36:07 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
fly-request-id: 01FX8DEJHZ7VJ8CD0S6S4H5HB6-fra
server: cloudflare
age: 206
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: text/plain; charset=utf-8
location: /alpinejs@3.9.1/dist/cdn.min.js
cache-control: public, s-maxage=600, max-age=60
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6e6421ebab189a3b-FRA
access-control-allow-origin: *

GET
H2

200

3.0.23 Show response
cdn.tailwindcss.com/
Redirect Chain

https://cdn.tailwindcss.com/
https://cdn.tailwindcss.com/3.0.23

310 KB
95 KB

27ms
26ms

Script
text/javascript

76.76.21.241
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.tailwindcss.com/3.0.23

Requested by

Host: protections-useradmn01.ml
URL: https://protections-useradmn01.ml/993q2e7q2cpzx3k.html?_kx=

Protocol

Server

76.76.21.241 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

6917436322df9ad6d26798812776854e2ff7f7248fcea1597c592ce9836f1a46

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://protections-useradmn01.ml/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 02 Mar 2022 18:47:18 GMT
content-encoding: br
server: Vercel
age: 82127
x-vercel-id: fra1::iad1::5m6zf-1646328967027-eb56bcb0f998
x-vercel-cache: HIT
strict-transport-security: max-age=63072000
content-type: text/javascript
cache-control: max-age=300

Redirect headers

date: Wed, 02 Mar 2022 18:47:18 GMT
server: Vercel
age: 82128
x-vercel-id: fra1::iad1::5m6zf-1646328967005-2f2c3ff17f97
x-vercel-cache: HIT
strict-transport-security: max-age=63072000
location: /3.0.23
cache-control: max-age=0
content-length: 0

GET
H2 200 css
fonts.googleapis.com/ 1 KB
964 B 79ms
32ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Archivo+Narrow&display=swap

Requested by

Host: protections-useradmn01.ml
URL: https://protections-useradmn01.ml/993q2e7q2cpzx3k.html?_kx=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d4d5e3202e2f11dc51334a2df5db6d3644403e3db3015505a93a005535887ada

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://protections-useradmn01.ml/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 03 Mar 2022 17:36:06 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 03 Mar 2022 17:36:06 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 03 Mar 2022 17:36:06 GMT

GET
H2 200 all.css
use.fontawesome.com/releases/v5.7.0/css/ 53 KB
12 KB 439ms
398ms Stylesheet
text/css 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.7.0/css/all.css
Requested by: Host: protections-useradmn01.ml
URL: https://protections-useradmn01.ml/993q2e7q2cpzx3k.html?_kx=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afdc6bf2de981ffd7d370b76f44e7580572f197efbe214b9cfa4005d189d8eae

Request headers

Referer: https://protections-useradmn01.ml/
Origin: https://protections-useradmn01.ml
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 03 Mar 2022 17:36:07 GMT
content-encoding: br
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: 7T1WHQMSQAW6PF43
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: NzpHLV6/pIj840shHMwUUjX+LY1DVfh8x0+E9E5JD/oOxYVWMqdmrFuggjqUy87P6oV1QCZRv9Q=
last-modified: Wed, 30 Jun 2021 15:45:15 GMT
server: cloudflare
etag: W/"251d28bd755f5269a4531df8a81d5664"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AM6xoEnJekJKYnyjqLpfBqFe70xp1XQlp15CSACQeqP2VFSiKkrYj5A7iZCzqdUWKtESiexRSh4J4rNXXA%2BAhhuWEonA3shY3tAIXaRiyYNHp1ly46ldpa8689n69r2b6ofD0wUKDpH2fdX1rip1y4vh"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 6e6421ebaf7c912e-FRA

GET
H2 200 microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
logincdn.msauth.net/shared/1.0/content/images/ 4 KB
2 KB 136ms
19ms Image
image/svg+xml 192.229.221.185
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://logincdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Requested by: Host: protections-useradmn01.ml
URL: https://protections-useradmn01.ml/993q2e7q2cpzx3k.html?_kx=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.221.185 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8E9E) /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://protections-useradmn01.ml/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 03 Mar 2022 17:36:07 GMT
content-encoding: gzip
content-md5: nzaLxFgP7ZB3dfMcaybWzw==
age: 23099081
x-cache: HIT
content-length: 1435
x-ms-lease-status: unlocked
last-modified: Wed, 22 Jan 2020 00:32:50 GMT
server: ECAcc (frc/8E9E)
etag: 0x8D79ED29CF0C29A
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: ae00a5ef-301e-0050-690f-5d9d0f000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
logincdn.msauth.net/shared/1.0/content/images/ 513 B
566 B 100ms
20ms Image
image/svg+xml 192.229.221.185
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
Requested by: Host: protections-useradmn01.ml
URL: https://protections-useradmn01.ml/993q2e7q2cpzx3k.html?_kx=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.221.185 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F6C) /
Resource Hash: 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://protections-useradmn01.ml/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 03 Mar 2022 17:36:07 GMT
content-encoding: gzip
content-md5: TjUQkZ0p0Y7rbj6LJofS9Q==
age: 24065525
x-cache: HIT
content-length: 276
x-ms-lease-status: unlocked
last-modified: Wed, 22 Jan 2020 00:32:44 GMT
server: ECAcc (frc/8F6C)
etag: 0x8D79ED2994A7074
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: c711e3da-e01e-0094-2c45-547244000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg
logincdn.msauth.net/shared/1.0/content/images/ 2 KB
758 B 104ms
25ms Image
image/svg+xml 192.229.221.185
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://logincdn.msauth.net/shared/1.0/content/images/documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg
Requested by: Host: protections-useradmn01.ml
URL: https://protections-useradmn01.ml/993q2e7q2cpzx3k.html?_kx=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.221.185 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FA7) /
Resource Hash: a76c08e9cdc3bb87bfb57627ad8f6b46f0e5ef826cc7f046dfbaf25d7b7958ea

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://protections-useradmn01.ml/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 03 Mar 2022 17:36:07 GMT
content-encoding: gzip
content-md5: 6dTbAT1RVL9d6geobv3IJg==
age: 20116798
x-cache: HIT
content-length: 606
x-ms-lease-status: unlocked
last-modified: Wed, 22 Jan 2020 00:32:48 GMT
server: ECAcc (frc/8FA7)
etag: 0x8D79ED29BA5E089
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 6a05644f-601e-0091-652f-7867e5000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 signin-options_4e48046ce74f4b89d45037c90576bfac.svg
logincdn.msauth.net/shared/1.0/content/images/ 2 KB
773 B 100ms
20ms Image
image/svg+xml 192.229.221.185
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://logincdn.msauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg
Requested by: Host: protections-useradmn01.ml
URL: https://protections-useradmn01.ml/993q2e7q2cpzx3k.html?_kx=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.221.185 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FFC) /
Resource Hash: 8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://protections-useradmn01.ml/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 03 Mar 2022 17:36:07 GMT
content-encoding: gzip
content-md5: R2FAVxfpONfnQAuxVxXbHg==
age: 18983881
x-cache: HIT
content-length: 621
x-ms-lease-status: unlocked
last-modified: Tue, 10 Nov 2020 03:41:25 GMT
server: ECAcc (frc/8FFC)
etag: 0x8D8852A7FCCA219
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 349b3025-b01e-0055-6b7c-8288ae000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 2_bc3d32a696895f78c19df6c717586a5d.svg
logincdn.msauth.net/shared/1.0/content/images/backgrounds/ 2 KB
825 B 20ms
19ms Image
image/svg+xml 192.229.221.185
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://logincdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Requested by: Host: protections-useradmn01.ml
URL: https://protections-useradmn01.ml/993q2e7q2cpzx3k.html?_kx=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.221.185 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8FE5) /
Resource Hash: 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://protections-useradmn01.ml/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 03 Mar 2022 17:36:07 GMT
content-encoding: gzip
content-md5: DhdidjYrlCeaRJJRG/y9mA==
age: 20268602
x-cache: HIT
content-length: 673
x-ms-lease-status: unlocked
last-modified: Wed, 12 Feb 2020 22:01:42 GMT
server: ECAcc (frc/8FE5)
etag: 0x8D7B00724D9E930
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 1528e7ed-101e-0063-71cd-76af16000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://protections-useradmn01.ml/993q2e7q2cpzx3k.html?_kx= Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.tailwindcss.com/, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://protections-useradmn01.ml/993q2e7q2cpzx3k.html?_kx= Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.tailwindcss.com/, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.tailwindcss.com
fonts.googleapis.com
logincdn.msauth.net
protections-useradmn01.ml
trk.klclick3.com
unpkg.com
use.fontawesome.com
146.70.53.147
192.229.221.185
2600:9000:224a:7800:9:ec94:b800:93a1
2606:4700::6810:7baf
2a00:1450:4001:830::200a
2a06:98c1:3121::7
76.76.21.241
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
3d1cbc4be2dd471fadcbbf8a85b5ac5aefb8ff7119b4b86e72c64932c9e34681
6917436322df9ad6d26798812776854e2ff7f7248fcea1597c592ce9836f1a46
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
a76c08e9cdc3bb87bfb57627ad8f6b46f0e5ef826cc7f046dfbaf25d7b7958ea
afdc6bf2de981ffd7d370b76f44e7580572f197efbe214b9cfa4005d189d8eae
b82d77f3e2dbb660277d002ee90abbee211a175d39a68c95fe5c31ae88a53230
d4d5e3202e2f11dc51334a2df5db6d3644403e3db3015505a93a005535887ada

protections-useradmn01.ml Open in urlscan Pro 146.70.53.147 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

80 %HTTPS

57 %IPv6

7 Domains

7 Subdomains

6 IPs

3 Countries

134 kBTransfer

447 kBSize

0 Cookies

4 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

protections-useradmn01.ml Open in urlscan Pro
146.70.53.147 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

80 %
HTTPS

57 %
IPv6

7
Domains

7
Subdomains

6
IPs

3
Countries

134 kB
Transfer

447 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!