ycso.accountlog.in Open in urlscan Pro
35.167.36.78  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response ycso.accountlog.in/	6 KB 2 KB	740ms 351ms	Document text/html	35.167.36.78 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ycso.accountlog.in/?rid=QRbuqzJ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.167.36.78 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-167-36-78.us-west-2.compute.amazonaws.com Software / Resource Hash 293b9e682b04ce848249881f59e62f1a184fbae3d73e551d18a4a83d4368ea2b Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers content-encoding gzip content-length 2029 content-type text/html; charset=utf-8 date Wed, 22 May 2024 21:24:31 GMT vary Accept-Encoding x-server gophish
GET H2	200	login.ltr.css secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/css/	27 KB 5 KB	99ms 18ms	Stylesheet text/css	2620:1ec:bdf::42 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/css/login.ltr.css Requested by Host: ycso.accountlog.in URL: https://ycso.accountlog.in/?rid=QRbuqzJ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::42 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash f902d8b3484872d0bb6fdb71084823e6363905e3f0ebaeeafa6cb373acd28350 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://ycso.accountlog.in/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Wed, 22 May 2024 21:24:32 GMT content-encoding gzip x-cache TCP_HIT x-cache-info L1_T2 x-fd-int-roxy-purgeid 50755578 content-length 4712 x-ms-lease-status unlocked last-modified Tue, 14 May 2019 21:45:43 GMT etag 0x8D6D8B583EB9BF4 x-azure-ref 20240522T212432Z-164d49668c6zjgp4eqazgn089c000000067g00000000deg4 content-type text/css x-ms-request-id f621222e-d01e-00a2-3880-acaba2000000 cache-control public, max-age=604800 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	jquery.1.5.1.min.js Show response secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/js/	85 KB 30 KB	100ms 20ms	Script application/x-javascript	2620:1ec:bdf::42 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/js/jquery.1.5.1.min.js Requested by Host: ycso.accountlog.in URL: https://ycso.accountlog.in/?rid=QRbuqzJ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::42 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash f0ecc5a8e657458720f3d97ab079570ce1f954f951fddc306cde4bc03151d590 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://ycso.accountlog.in/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Wed, 22 May 2024 21:24:32 GMT content-encoding gzip x-cache TCP_HIT x-cache-info L1_T2 x-fd-int-roxy-purgeid 50755578 content-length 30587 x-ms-lease-status unlocked last-modified Tue, 14 May 2019 21:45:47 GMT etag 0x8D6D8B58642FBE8 x-azure-ref 20240522T212432Z-164d49668c6zjgp4eqazgn089c000000067g00000000deg7 content-type application/x-javascript x-ms-request-id 7747f6f1-e01e-00e4-0aef-aa9f25000000 cache-control public, max-age=604800 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	aad.login.js Show response secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/js/	126 KB 28 KB	90ms 10ms	Script application/x-javascript	2620:1ec:bdf::42 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/js/aad.login.js Requested by Host: ycso.accountlog.in URL: https://ycso.accountlog.in/?rid=QRbuqzJ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::42 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 0764cd74693cbf231ec1841cea80d3308cb39892dacdf906044ad6c0622cada2 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://ycso.accountlog.in/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Wed, 22 May 2024 21:24:32 GMT content-encoding gzip x-cache TCP_HIT x-cache-info L1_T2 x-fd-int-roxy-purgeid 50755578 content-length 28486 x-ms-lease-status unlocked last-modified Tue, 14 May 2019 21:45:47 GMT etag 0x8D6D8B586412715 x-azure-ref 20240522T212432Z-164d49668c6zjgp4eqazgn089c000000067g00000000deg6 content-type application/x-javascript x-ms-request-id 677eebcf-f01e-0033-33ad-aace10000000 cache-control public, max-age=604800 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	jquery.easing.1.3.js Show response secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/js/	9 KB 3 KB	90ms 10ms	Script application/x-javascript	2620:1ec:bdf::42 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://secure.aadcdn.microsoftonline-p.com/aad/20.200.19625/js/jquery.easing.1.3.js Requested by Host: ycso.accountlog.in URL: https://ycso.accountlog.in/?rid=QRbuqzJ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::42 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e9f76a23a17184eec1ee54b5fa9d25ae90439b9f8edf31391ee19332010fb698 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://ycso.accountlog.in/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Wed, 22 May 2024 21:24:32 GMT content-encoding gzip x-cache TCP_HIT x-cache-info L1_T2 x-fd-int-roxy-purgeid 50755578 content-length 2264 x-ms-lease-status unlocked last-modified Tue, 14 May 2019 21:45:47 GMT etag 0x8D6D8B58646305E x-azure-ref 20240522T212432Z-164d49668c6zjgp4eqazgn089c000000067g00000000deg5 content-type application/x-javascript x-ms-request-id 1befc0e6-c01e-00cc-72ef-aafe8d000000 cache-control public, max-age=604800 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	logo.png web.archive.org/web/20201012165953/https://secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/office365/	4 KB 7 KB	685ms 153ms	Image image/png	207.241.237.3 INTERNET-ARCHIVE
General Check archive.org Show headers Download Go to Show image Full URL https://web.archive.org/web/20201012165953/https://secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/office365/logo.png Requested by Host: ycso.accountlog.in URL: https://ycso.accountlog.in/?rid=QRbuqzJ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 207.241.237.3 , United States, ASN7941 (INTERNET-ARCHIVE, US), Reverse DNS Software nginx / Resource Hash fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603 Security Headers Name Value Content-Security-Policy default-src 'self' 'unsafe-eval' 'unsafe-inline' data: blob: archive.org web.archive.org web-static.archive.org wayback-api.archive.org analytics.archive.org pragma.archivelab.org Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://ycso.accountlog.in/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 22 May 2024 21:24:32 GMT content-security-policy default-src 'self' 'unsafe-eval' 'unsafe-inline' data: blob: archive.org web.archive.org web-static.archive.org wayback-api.archive.org analytics.archive.org pragma.archivelab.org x-archive-orig-last-modified Tue, 14 May 2019 21:52:11 GMT x-rl 0 x-app-server wwwb-app219 x-location All x-nid - memento-datetime Mon, 12 Oct 2020 16:59:53 GMT server-timing captures_list;dur=1.844987, exclusion.robots;dur=0.220430, exclusion.robots.policy;dur=0.208050, esindex;dur=0.018171, cdx.remote;dur=17.945472, LoadShardBlock;dur=259.670882, PetaboxLoader3.datanode;dur=99.351837, PetaboxLoader3.resolve;dur=221.491888, load_resource;dur=112.645335, loaddict;dur=26.948805 content-length 4585 x-archive-src archiveteam_googlesites_20201012170110_dca7913d/googlesites_20201012170110_dca7913d.1602464829.megawarc.warc.zst x-ts 200 x-archive-guessed-content-type image/png x-archive-orig-access-control-allow-origin * server nginx referrer-policy no-referrer-when-downgrade x-tr 432 x-na 0 x-archive-orig-cache-control public, max-age=509449 content-type image/png x-archive-orig-strict-transport-security max-age=31536000 cache-control max-age=1800 x-page-cache HIT permissions-policy interest-cohort=() x-archive-orig-connection keep-alive x-archive-orig-date Mon, 12 Oct 2020 16:59:53 GMT x-archive-orig-content-length 4585 link <https://secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/office365/logo.png>; rel="original", <https://web.archive.org/web/timemap/link/https://secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/office365/logo.png>; rel="timemap"; type="application/link-format", <https://web.archive.org/web/https://secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/office365/logo.png>; rel="timegate", <https://web.archive.org/web/20131023134645/https://secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/Office365/logo.png>; rel="first memento"; datetime="Wed, 23 Oct 2013 13:46:45 GMT", <https://web.archive.org/web/20200605032531/https://secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/Office365/logo.png>; rel="prev memento"; datetime="Fri, 05 Jun 2020 03:25:31 GMT", <https://web.archive.org/web/20201012165953/https://secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/office365/logo.png>; rel="memento"; datetime="Mon, 12 Oct 2020 16:59:53 GMT", <https://web.archive.org/web/20211031120832/https://secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/office365/logo.png>; rel="next memento"; datetime="Sun, 31 Oct 2021 12:08:32 GMT", <https://web.archive.org/web/20240416045508/https://secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/office365/logo.png>; rel="last memento"; datetime="Tue, 16 Apr 2024 04:55:08 GMT" accept-ranges bytes
GET H2	200	background-outer.jpg www.yumacountysheriff.org/picts/brown/	241 KB 241 KB	530ms 181ms	Image image/jpeg	34.232.176.147 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://www.yumacountysheriff.org/picts/brown/background-outer.jpg Requested by Host: ycso.accountlog.in URL: https://ycso.accountlog.in/?rid=QRbuqzJ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.232.176.147 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS cpanel290.turbify.biz Software LiteSpeed / Resource Hash 028d975fff422466dadbeb4ac1aa77638b006339054d261b34caaeefeea788d0 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://ycso.accountlog.in/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 22 May 2024 21:24:32 GMT last-modified Wed, 21 Jun 2023 19:39:52 GMT server LiteSpeed content-type image/jpeg cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 246552 expires Wed, 29 May 2024 21:24:32 GMT
GET H2	200	favicon.ico www.yumacountyaz.gov/	1 KB 823 B	64ms 22ms	Other image/x-icon	2606:4700:4400::6812:247d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.yumacountyaz.gov/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:247d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 90d6a6fbe885cf82aed314001b79fefd9a3b21a9654962f50f1033ff7cacbc6f Security Headers Name Value Strict-Transport-Security max-age=31536000; X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://ycso.accountlog.in/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 22 May 2024 21:24:32 GMT strict-transport-security max-age=31536000; content-encoding gzip cf-cache-status HIT age 1977 server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1716411095586_389224198_1702537401_39_5509_0_22_15";dur=1 content-length 211 x-xss-protection 1; mode=block last-modified Wed, 07 Dec 2016 18:28:32 GMT server cloudflare etag 636167321120000000 expect-ct max-age=31536000 vary Accept-Encoding content-type image/x-icon cache-control public, max-age=345568 granicusserver mse2p-viscmsga5 accept-ranges bytes cf-ray 887fdfaa0e2937e3-FRA expires Sun, 26 May 2024 21:24:00 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

36 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| ErrorCodes object| Constants object| Context object| Background object| Logo object| Instrument object| User object| tenant_info function| pageOnReady object| Util object| PostType object| LoginOption object| Post function| origHide function| origShow function| origAddClass function| origRemoveClass object| Support object| users object| Tiles object| HIP object| EmailDiscovery object| ProofUp object| StrongAuthCheck object| ThirdPartyCookieStates object| TenantBranding object| MSLogin object| jQuery151016669784240986507 object| HIP_MODE object| MSStrongAuth object| MSLogout object| body string| alt_logo_image string| alt_background_image

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.yumacountyaz.gov/	1970-01-20 20:46:54	Name: __cf_bm Value: y.U8Os.CYGSlJQyGi3PH.QZK0WXr9TTcu6OoMXCbLUc-1716413072-1.0.1.1-0zKH7dFwOYP3XFJ3VAtwTJNPA76msR.mZ0LqE8wBOJck74iBRWJSjwVF_bMLjOhKkDGIFpseL7PSmvH9_r7oeg

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://ycso.accountlog.in/?rid=QRbuqzJ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
other	warning	URL: https://ycso.accountlog.in/?rid=QRbuqzJ Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

secure.aadcdn.microsoftonline-p.com
web.archive.org
www.yumacountyaz.gov
www.yumacountysheriff.org
ycso.accountlog.in
207.241.237.3
2606:4700:4400::6812:247d
2620:1ec:bdf::42
34.232.176.147
35.167.36.78
028d975fff422466dadbeb4ac1aa77638b006339054d261b34caaeefeea788d0
0764cd74693cbf231ec1841cea80d3308cb39892dacdf906044ad6c0622cada2
293b9e682b04ce848249881f59e62f1a184fbae3d73e551d18a4a83d4368ea2b
90d6a6fbe885cf82aed314001b79fefd9a3b21a9654962f50f1033ff7cacbc6f
e9f76a23a17184eec1ee54b5fa9d25ae90439b9f8edf31391ee19332010fb698
f0ecc5a8e657458720f3d97ab079570ce1f954f951fddc306cde4bc03151d590
f902d8b3484872d0bb6fdb71084823e6363905e3f0ebaeeafa6cb373acd28350
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603