outlook.com.loglive.co

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 6 HTTP transactions. The main IP is 194.48.152.21, located in Russian Federation and belongs to AS-MAROSNET Moscow, Russia, RU. The main domain is outlook.com.loglive.co.
TLS certificate: Issued by Let's Encrypt Authority X3 on September 15th 2019. Valid for: 3 months.

This is the only time outlook.com.loglive.co was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	194.48.152.21 194.48.152.21	48666 (AS-MAROSN...) (AS-MAROSNET Moscow)
1	2606:4700:30:... 2606:4700:30::681b:8f9c	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
4	51.15.123.120 51.15.123.120	12876 (AS12876) (AS12876)
6	3

1 194.48.152.21 (Russian Federation)

ASN48666 (AS-MAROSNET Moscow, Russia, RU)

outlook.com.loglive.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:30::681b:8f9c (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

rawgit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 51.15.123.120 (Netherlands)

ASN12876 (AS12876, FR)
PTR: 120-123-15-51.rev.cloud.scaleway.com

s7.postimg.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	postimg.cc s7.postimg.cc	120 KB
1	rawgit.com rawgit.com	15 KB
1	loglive.co outlook.com.loglive.co	2 KB
6	3

	Domain	Requested by
4	s7.postimg.cc	outlook.com.loglive.co
1	rawgit.com	outlook.com.loglive.co
1	outlook.com.loglive.co
6	3

This site contains links to these domains. Also see Links.

Domain
www.outlook.com

Subject Issuer	Validity	Valid
outlook.com.loglive.co Let's Encrypt Authority X3	`2019-09-15` - `2019-12-14`	3 months	crt.sh
sni48800.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-09-04` - `2020-03-12`	6 months	crt.sh
postimg.cc Let's Encrypt Authority X3	`2019-09-06` - `2019-12-05`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://outlook.com.loglive.co/
Frame ID: 9B429FB06B9AB5F38397585FFF76EDB2
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

6
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

137 kB
Transfer

209 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.outlook.com/
Title: Forgot my password

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
outlook.com.loglive.co/ 5 KB
2 KB 391ms
63ms Document
text/html 194.48.152.21
AS-MAROSNET Moscow

General

Check archive.org

Show headers Download Go to

Full URL: https://outlook.com.loglive.co/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 194.48.152.21 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU),
Reverse DNS
Software: Apache/2.4.34 (Ubuntu) /
Resource Hash: 15efbc70c9ab376c8e21cf67b19664ad21dd79c660965b5f9a5ab08580ac4a92

Request headers

Host: outlook.com.loglive.co
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: none
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1

Response headers

Date: Sun, 15 Sep 2019 09:03:28 GMT
Server: Apache/2.4.34 (Ubuntu)
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1555
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H2 200 Converged1033.css
rawgit.com/Tarsotelvab/Hotmail.github.io/master/ 85 KB
15 KB 397ms
359ms Stylesheet
text/css 2606:4700:30::681b:8f9c
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://rawgit.com/Tarsotelvab/Hotmail.github.io/master/Converged1033.css

Requested by

Host: outlook.com.loglive.co
URL: https://outlook.com.loglive.co/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:30::681b:8f9c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d43049cccf6f28ee913aac1cfd163b4bb24e9aacfcbbbdc43915b6ef48dffa2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://outlook.com.loglive.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 15 Sep 2019 09:03:28 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
status: 200
vary: Accept-Encoding
rawgit-cache-status: MISS
x-robots-tag: none
content-type: text/css;charset=utf-8
server: cloudflare
etag: W/"b6dc707616e16d0be73ec6d143136dc726e9bc4d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; preload
sunset: Tue, 01 Oct 2019 00:00:00 GMT
access-control-allow-origin: *
cache-control: max-age=3600, s-maxage=300
cf-ray: 51696d7a38b259fa-VIE
link: <https://rawgit.com/>; rel="sunset"; title="RawGit will soon shut down. Please stop using it."

GET
H2 200 microsoft_logo.png
s7.postimg.cc/5fiq37hyz/ 1 KB
1 KB 222ms
183ms Image
image/png 51.15.123.120
AS12876

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s7.postimg.cc/5fiq37hyz/microsoft_logo.png
Requested by: Host: outlook.com.loglive.co
URL: https://outlook.com.loglive.co/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.15.123.120 , Netherlands, ASN12876 (AS12876, FR),
Reverse DNS: 120-123-15-51.rev.cloud.scaleway.com
Software: nginx /
Resource Hash: 338d865cfc45ca4df2a2738c8ea139f16c22c3d2928e81044e9bb229a91af28d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://outlook.com.loglive.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 15 Sep 2019 09:03:28 GMT
last-modified: Sun, 15 Apr 2018 09:49:05 GMT
server: nginx
status: 200
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 1158
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 image.png
s7.postimg.cc/ddd54lfqz/ 1 KB
1 KB 220ms
180ms Image
image/png 51.15.123.120
AS12876

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s7.postimg.cc/ddd54lfqz/image.png
Requested by: Host: outlook.com.loglive.co
URL: https://outlook.com.loglive.co/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.15.123.120 , Netherlands, ASN12876 (AS12876, FR),
Reverse DNS: 120-123-15-51.rev.cloud.scaleway.com
Software: nginx /
Resource Hash: f60030d516d91c4ca92ff5e5af94449f6be06cc8d356a0f15e3c8d8fabe14b4f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://outlook.com.loglive.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 15 Sep 2019 09:03:28 GMT
last-modified: Sun, 15 Apr 2018 10:17:55 GMT
server: nginx
status: 200
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 1027
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 0-small.jpg
s7.postimg.cc/gk7oo4sgb/ 3 KB
3 KB 17ms
16ms Image
image/jpeg 51.15.123.120
AS12876

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s7.postimg.cc/gk7oo4sgb/0-small.jpg
Requested by: Host: outlook.com.loglive.co
URL: https://outlook.com.loglive.co/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.15.123.120 , Netherlands, ASN12876 (AS12876, FR),
Reverse DNS: 120-123-15-51.rev.cloud.scaleway.com
Software: nginx /
Resource Hash: f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://outlook.com.loglive.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 15 Sep 2019 09:03:28 GMT
last-modified: Sun, 15 Apr 2018 10:16:26 GMT
server: nginx
status: 200
access-control-allow-methods: GET, OPTIONS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 3006
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 image.jpg
s7.postimg.cc/l795ceisb/ 114 KB
114 KB 30ms
30ms Image
image/jpeg 51.15.123.120
AS12876

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s7.postimg.cc/l795ceisb/image.jpg
Requested by: Host: outlook.com.loglive.co
URL: https://outlook.com.loglive.co/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.15.123.120 , Netherlands, ASN12876 (AS12876, FR),
Reverse DNS: 120-123-15-51.rev.cloud.scaleway.com
Software: nginx /
Resource Hash: e78bcff5e11b03acf87f7aeb7ebde0f6eecc5e2b59c26581961427788b1c1b2b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://outlook.com.loglive.co/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 15 Sep 2019 09:03:28 GMT
last-modified: Sun, 15 Apr 2018 08:51:46 GMT
server: nginx
status: 200
access-control-allow-methods: GET, OPTIONS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 116692
expires: Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

outlook.com.loglive.co
rawgit.com
s7.postimg.cc
194.48.152.21
2606:4700:30::681b:8f9c
51.15.123.120
15efbc70c9ab376c8e21cf67b19664ad21dd79c660965b5f9a5ab08580ac4a92
338d865cfc45ca4df2a2738c8ea139f16c22c3d2928e81044e9bb229a91af28d
3d43049cccf6f28ee913aac1cfd163b4bb24e9aacfcbbbdc43915b6ef48dffa2
e78bcff5e11b03acf87f7aeb7ebde0f6eecc5e2b59c26581961427788b1c1b2b
f60030d516d91c4ca92ff5e5af94449f6be06cc8d356a0f15e3c8d8fabe14b4f
f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea

outlook.com.loglive.co Open in urlscan Pro 194.48.152.21 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

137 kBTransfer

209 kBSize

0 Cookies

1 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

Indicators

outlook.com.loglive.co Open in urlscan Pro
194.48.152.21 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

137 kB
Transfer

209 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!