urlscan.io logo urlscan.io
SecurityTrails logo

invoice.easypayouttrade.us Open in urlscan Pro
198.177.123.49  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://invoice.easypayouttrade.us/invoice?invoice=js/?invoice=js/?invoice=js/?invoice=
Effective URL: https://invoice.easypayouttrade.us/invoice/js/invoice.microsoftonline.com/?client_id=426-35363201d503&response_mode=form_post&respo...
Submission: On July 25 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 198.177.123.49, located in United States and belongs to NAMECHEAP-NET, US. The main domain is invoice.easypayouttrade.us.
TLS certificate: Issued by R10 on July 24th 2024. Valid for: 3 months.
This is the only time invoice.easypayouttrade.us was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
3 4 198.177.123.49 22612 (NAMECHEAP...)
5 2620:1ec:29:1... 8075 (MICROSOFT...)
6 2
Apex Domain
Subdomains		 Transfer
5 microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com — Cisco Umbrella Rank: 22773
300 KB
4 easypayouttrade.us
invoice.easypayouttrade.us
111 KB
6 2
Domain Requested by
5 secure.aadcdn.microsoftonline-p.com invoice.easypayouttrade.us
4 invoice.easypayouttrade.us 3 redirects
6 2

This site contains links to these domains. Also see Links.

Domain
udsc.com.au
www.microsoft.com
privacy.microsoft.com
Subject Issuer Validity Valid
*.easypayouttrade.us
R10		 2024-07-24 -
2024-10-22		 3 months crt.sh
secure.aadcdn.microsoftonline-p.com
Microsoft Azure RSA TLS Issuing CA 04		 2024-05-22 -
2025-05-17		 a year crt.sh

This page contains 1 frames:

Primary Page: https://invoice.easypayouttrade.us/invoice/js/invoice.microsoftonline.com/?client_id=426-35363201d503&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%3dVbsQaWL6xMRpquRs72kLy51ftN9Eg0XT1cYWgjpVAG6yxgoS3PwxFG-Dn8XGtPuKmPawM9sjKIs7hMCSGi9VffcSyyI3tcWKqP8BrSB8OYSwq1dEOsbvOxjI3K5UwMkh&nonce=636606385551308369.YjhhMTlkOTktZmU0NS00MTcwLWEyYjMtZThmYzZjOTJmZTlmM2Y0YzAwNTctMDUzYy00ZTUyLWIxM2YtZmVlYTMwYjk1NmFm&redirect_uri=https%3a%2f%2fwww.office.com%2f&ui_locales=en-US&mkt=en-US&client-request&invoice=js/?invoice=js/?invoice=js/?invoice=
Frame ID: 69099F1A5F3920D4F765D0AEDB96FEFD
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign in to your account

Page URL History Show full URLs

  1. http://invoice.easypayouttrade.us/invoice?invoice=js/?invoice=js/?invoice=js/?invoice= HTTP 307
    https://invoice.easypayouttrade.us/invoice?invoice=js/?invoice=js/?invoice=js/?invoice= HTTP 301
    https://invoice.easypayouttrade.us/invoice/?invoice=js/?invoice=js/?invoice=js/?invoice= HTTP 302
    https://invoice.easypayouttrade.us/invoice/js/?invoice=js/?invoice=js/?invoice=js/?invoice= HTTP 302
    https://invoice.easypayouttrade.us/invoice/js/invoice.microsoftonline.com/?client_id=426-35363201d503&response_... Page URL

Page Statistics

6
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

410 kB
Transfer

410 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://invoice.easypayouttrade.us/invoice?invoice=js/?invoice=js/?invoice=js/?invoice= HTTP 307
    https://invoice.easypayouttrade.us/invoice?invoice=js/?invoice=js/?invoice=js/?invoice= HTTP 301
    https://invoice.easypayouttrade.us/invoice/?invoice=js/?invoice=js/?invoice=js/?invoice= HTTP 302
    https://invoice.easypayouttrade.us/invoice/js/?invoice=js/?invoice=js/?invoice=js/?invoice= HTTP 302
    https://invoice.easypayouttrade.us/invoice/js/invoice.microsoftonline.com/?client_id=426-35363201d503&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%3dVbsQaWL6xMRpquRs72kLy51ftN9Eg0XT1cYWgjpVAG6yxgoS3PwxFG-Dn8XGtPuKmPawM9sjKIs7hMCSGi9VffcSyyI3tcWKqP8BrSB8OYSwq1dEOsbvOxjI3K5UwMkh&nonce=636606385551308369.YjhhMTlkOTktZmU0NS00MTcwLWEyYjMtZThmYzZjOTJmZTlmM2Y0YzAwNTctMDUzYy00ZTUyLWIxM2YtZmVlYTMwYjk1NmFm&redirect_uri=https%3a%2f%2fwww.office.com%2f&ui_locales=en-US&mkt=en-US&client-request&invoice=js/?invoice=js/?invoice=js/?invoice= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
invoice.easypayouttrade.us/invoice/js/invoice.microsoftonline.com/
Redirect Chain
  • http://invoice.easypayouttrade.us/invoice?invoice=js/?invoice=js/?invoice=js/?invoice=
  • https://invoice.easypayouttrade.us/invoice?invoice=js/?invoice=js/?invoice=js/?invoice=
  • https://invoice.easypayouttrade.us/invoice/?invoice=js/?invoice=js/?invoice=js/?invoice=
  • https://invoice.easypayouttrade.us/invoice/js/?invoice=js/?invoice=js/?invoice=js/?invoice=
  • https://invoice.easypayouttrade.us/invoice/js/invoice.microsoftonline.com/?client_id=426-35363201d503&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.Au...
110 KB
110 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://invoice.easypayouttrade.us/invoice/js/invoice.microsoftonline.com/?client_id=426-35363201d503&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%3dVbsQaWL6xMRpquRs72kLy51ftN9Eg0XT1cYWgjpVAG6yxgoS3PwxFG-Dn8XGtPuKmPawM9sjKIs7hMCSGi9VffcSyyI3tcWKqP8BrSB8OYSwq1dEOsbvOxjI3K5UwMkh&nonce=636606385551308369.YjhhMTlkOTktZmU0NS00MTcwLWEyYjMtZThmYzZjOTJmZTlmM2Y0YzAwNTctMDUzYy00ZTUyLWIxM2YtZmVlYTMwYjk1NmFm&redirect_uri=https%3a%2f%2fwww.office.com%2f&ui_locales=en-US&mkt=en-US&client-request&invoice=js/?invoice=js/?invoice=js/?invoice=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
198.177.123.49 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
able-defense.quarantine-pnap-vlan53.web-hosting.com
Software
Apache /
Resource Hash
c1c865f584d209cbfd98f054e25c705d0df8e6b423f909370dd49cd415903d29

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Thu, 25 Jul 2024 21:48:15 GMT
Keep-Alive
timeout=5, max=97
Server
Apache
Transfer-Encoding
chunked

Redirect headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Thu, 25 Jul 2024 21:48:15 GMT
Keep-Alive
timeout=5, max=98
Location
invoice.microsoftonline.com/?client_id=426-35363201d503&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%3dVbsQaWL6xMRpquRs72kLy51ftN9Eg0XT1cYWgjpVAG6yxgoS3PwxFG-Dn8XGtPuKmPawM9sjKIs7hMCSGi9VffcSyyI3tcWKqP8BrSB8OYSwq1dEOsbvOxjI3K5UwMkh&nonce=636606385551308369.YjhhMTlkOTktZmU0NS00MTcwLWEyYjMtZThmYzZjOTJmZTlmM2Y0YzAwNTctMDUzYy00ZTUyLWIxM2YtZmVlYTMwYjk1NmFm&redirect_uri=https%3a%2f%2fwww.office.com%2f&ui_locales=en-US&mkt=en-US&client-request&invoice=js/?invoice=js/?invoice=js/?invoice=
Server
Apache
Transfer-Encoding
chunked
0-small.jpg
secure.aadcdn.microsoftonline-p.com/ests/2.1.7527.7/content/images/backgrounds/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.7527.7/content/images/backgrounds/0-small.jpg?x=138bcee624fa04ef9b75e86211a9fe0d
Requested by
Host: invoice.easypayouttrade.us
URL: https://invoice.easypayouttrade.us/invoice/js/invoice.microsoftonline.com/?client_id=426-35363201d503&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%3dVbsQaWL6xMRpquRs72kLy51ftN9Eg0XT1cYWgjpVAG6yxgoS3PwxFG-Dn8XGtPuKmPawM9sjKIs7hMCSGi9VffcSyyI3tcWKqP8BrSB8OYSwq1dEOsbvOxjI3K5UwMkh&nonce=636606385551308369.YjhhMTlkOTktZmU0NS00MTcwLWEyYjMtZThmYzZjOTJmZTlmM2Y0YzAwNTctMDUzYy00ZTUyLWIxM2YtZmVlYTMwYjk1NmFm&redirect_uri=https%3a%2f%2fwww.office.com%2f&ui_locales=en-US&mkt=en-US&client-request&invoice=js/?invoice=js/?invoice=js/?invoice=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://invoice.easypayouttrade.us/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 25 Jul 2024 21:48:16 GMT
x-content-type-options
nosniff
x-cache
TCP_HIT
x-cache-info
L1_T2
x-fd-int-roxy-purgeid
0
content-length
3006
x-ms-lease-status
unlocked
last-modified
Sat, 18 May 2019 16:17:12 GMT
etag
0x8D6DBAC494506D5
x-azure-ref
20240725T214816Z-1574c8b9bc8pttrj7vc8sf1y7g00000000g000000000a9ed
content-type
image/jpeg
x-ms-request-id
18fc2a59-101e-0076-235d-de1bf3000000
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes
0.jpg
secure.aadcdn.microsoftonline-p.com/ests/2.1.7527.7/content/images/backgrounds/ 		277 KB
277 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.7527.7/content/images/backgrounds/0.jpg?x=a5dbd4393ff6a725c7e62b61df7e72f0
Requested by
Host: invoice.easypayouttrade.us
URL: https://invoice.easypayouttrade.us/invoice/js/invoice.microsoftonline.com/?client_id=426-35363201d503&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%3dVbsQaWL6xMRpquRs72kLy51ftN9Eg0XT1cYWgjpVAG6yxgoS3PwxFG-Dn8XGtPuKmPawM9sjKIs7hMCSGi9VffcSyyI3tcWKqP8BrSB8OYSwq1dEOsbvOxjI3K5UwMkh&nonce=636606385551308369.YjhhMTlkOTktZmU0NS00MTcwLWEyYjMtZThmYzZjOTJmZTlmM2Y0YzAwNTctMDUzYy00ZTUyLWIxM2YtZmVlYTMwYjk1NmFm&redirect_uri=https%3a%2f%2fwww.office.com%2f&ui_locales=en-US&mkt=en-US&client-request&invoice=js/?invoice=js/?invoice=js/?invoice=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://invoice.easypayouttrade.us/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 25 Jul 2024 21:48:16 GMT
x-content-type-options
nosniff
x-cache
TCP_HIT
x-cache-info
L1_T2
x-fd-int-roxy-purgeid
0
content-length
283351
x-ms-lease-status
unlocked
last-modified
Sat, 18 May 2019 16:17:36 GMT
etag
0x8D6DBAC57703F9E
x-azure-ref
20240725T214816Z-1574c8b9bc8pttrj7vc8sf1y7g00000000g000000000a9eb
content-type
image/jpeg
x-ms-request-id
c0319926-b01e-00c6-1281-de5a3a000000
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes
microsoft_logo.svg
secure.aadcdn.microsoftonline-p.com/ests/2.1.7527.7/content/images/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.7527.7/content/images/microsoft_logo.svg?x=ee5c8d9fb6248c938fd0dc19370e90bd
Requested by
Host: invoice.easypayouttrade.us
URL: https://invoice.easypayouttrade.us/invoice/js/invoice.microsoftonline.com/?client_id=426-35363201d503&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%3dVbsQaWL6xMRpquRs72kLy51ftN9Eg0XT1cYWgjpVAG6yxgoS3PwxFG-Dn8XGtPuKmPawM9sjKIs7hMCSGi9VffcSyyI3tcWKqP8BrSB8OYSwq1dEOsbvOxjI3K5UwMkh&nonce=636606385551308369.YjhhMTlkOTktZmU0NS00MTcwLWEyYjMtZThmYzZjOTJmZTlmM2Y0YzAwNTctMDUzYy00ZTUyLWIxM2YtZmVlYTMwYjk1NmFm&redirect_uri=https%3a%2f%2fwww.office.com%2f&ui_locales=en-US&mkt=en-US&client-request&invoice=js/?invoice=js/?invoice=js/?invoice=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://invoice.easypayouttrade.us/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 25 Jul 2024 21:48:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cache
TCP_HIT
x-cache-info
L1_T2
x-fd-int-roxy-purgeid
0
content-length
1435
x-ms-lease-status
unlocked
last-modified
Sat, 18 May 2019 16:17:16 GMT
etag
0x8D6DBAC4B7E3012
x-azure-ref
20240725T214816Z-1574c8b9bc8pttrj7vc8sf1y7g00000000g000000000a9ec
content-type
image/svg+xml
x-ms-request-id
05a0b768-201e-0052-0c27-deed53000000
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes
picker_account_aad.svg
secure.aadcdn.microsoftonline-p.com/ests/2.1.7527.7/content/images/ 		756 B
801 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.7527.7/content/images/picker_account_aad.svg?x=9de70d1c5191d1852a0d5aac28b44a6c
Requested by
Host: invoice.easypayouttrade.us
URL: https://invoice.easypayouttrade.us/invoice/js/invoice.microsoftonline.com/?client_id=426-35363201d503&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%3dVbsQaWL6xMRpquRs72kLy51ftN9Eg0XT1cYWgjpVAG6yxgoS3PwxFG-Dn8XGtPuKmPawM9sjKIs7hMCSGi9VffcSyyI3tcWKqP8BrSB8OYSwq1dEOsbvOxjI3K5UwMkh&nonce=636606385551308369.YjhhMTlkOTktZmU0NS00MTcwLWEyYjMtZThmYzZjOTJmZTlmM2Y0YzAwNTctMDUzYy00ZTUyLWIxM2YtZmVlYTMwYjk1NmFm&redirect_uri=https%3a%2f%2fwww.office.com%2f&ui_locales=en-US&mkt=en-US&client-request&invoice=js/?invoice=js/?invoice=js/?invoice=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://invoice.easypayouttrade.us/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 25 Jul 2024 21:48:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cache
TCP_HIT
x-cache-info
L1_T2
x-fd-int-roxy-purgeid
0
content-length
394
x-ms-lease-status
unlocked
last-modified
Sat, 18 May 2019 16:17:12 GMT
etag
0x8D6DBAC48F204B3
x-azure-ref
20240725T214816Z-1574c8b9bc8pttrj7vc8sf1y7g00000000g000000000a9ee
content-type
image/svg+xml
x-ms-request-id
5bc386e9-401e-006b-2728-de164f000000
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes
favicon_a.ico
secure.aadcdn.microsoftonline-p.com/ests/2.1.7527.7/content/images/ 		17 KB
17 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.7527.7/content/images/favicon_a.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://invoice.easypayouttrade.us/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 25 Jul 2024 21:48:16 GMT
x-content-type-options
nosniff
x-cache
TCP_HIT
x-cache-info
L1_T2
x-fd-int-roxy-purgeid
0
content-length
17174
x-ms-lease-status
unlocked
last-modified
Sat, 18 May 2019 16:17:08 GMT
etag
0x8D6DBAC46C1B49C
x-azure-ref
20240725T214816Z-1574c8b9bc8pttrj7vc8sf1y7g00000000g000000000a9en
content-type
image/x-icon
x-ms-request-id
3cfb069d-c01e-00f3-6885-de362e000000
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| speak object| $Debug object| $Do

0 Cookies