urlscan.io logo urlscan.io
SecurityTrails logo

l0g1n-microso.ftonlineportal.com Open in urlscan Pro
206.188.196.225  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://l0g1n-microso.ftonlineportal.com/o365
Effective URL: https://l0g1n-microso.ftonlineportal.com/o365
Submission: On November 27 via manual from US — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 11 HTTP transactions. The main IP is 206.188.196.225, located in Amsterdam, Netherlands and belongs to BLNWX, US. The main domain is l0g1n-microso.ftonlineportal.com.
TLS certificate: Issued by R3 on November 27th 2023. Valid for: 3 months.
This is the only time l0g1n-microso.ftonlineportal.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 206.188.196.225 399629 (BLNWX)
1 3 2606:4700::68... 13335 (CLOUDFLAR...)
6 104.19.218.90 13335 (CLOUDFLAR...)
1 1 108.157.4.79 16509 (AMAZON-02)
1 18.66.248.81 16509 (AMAZON-02)
1 104.19.219.90 13335 (CLOUDFLAR...)
11 6
1    206.188.196.225 (Amsterdam, Netherlands)

ASN399629 (BLNWX, US)
l0g1n-microso.ftonlineportal.com
3    2606:4700::6811:3b8 (United States)

ASN13335 (CLOUDFLARENET, US)
challenges.cloudflare.com
6    104.19.218.90 (None, )

ASN13335 (CLOUDFLARENET, US)
js.hcaptcha.com
newassets.hcaptcha.com
api2.hcaptcha.com
1    108.157.4.79 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-157-4-79.dus51.r.cloudfront.net
findicons.com
1    18.66.248.81 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-248-81.dus51.r.cloudfront.net
images.freeimages.com
1    104.19.219.90 (None, )

ASN13335 (CLOUDFLARENET, US)
newassets.hcaptcha.com
Apex Domain
Subdomains		 Transfer
7 hcaptcha.com
js.hcaptcha.com — Cisco Umbrella Rank: 10111
newassets.hcaptcha.com — Cisco Umbrella Rank: 9862
api2.hcaptcha.com — Cisco Umbrella Rank: 19810
494 KB
3 cloudflare.com
challenges.cloudflare.com — Cisco Umbrella Rank: 6439
12 KB
1 freeimages.com
images.freeimages.com — Cisco Umbrella Rank: 155176
770 B
1 findicons.com
findicons.com — Cisco Umbrella Rank: 464214
308 B
1 ftonlineportal.com
l0g1n-microso.ftonlineportal.com
23 KB
11 5
Domain Requested by
5 newassets.hcaptcha.com js.hcaptcha.com
newassets.hcaptcha.com
3 challenges.cloudflare.com 1 redirects l0g1n-microso.ftonlineportal.com
challenges.cloudflare.com
1 api2.hcaptcha.com newassets.hcaptcha.com
1 images.freeimages.com l0g1n-microso.ftonlineportal.com
1 findicons.com 1 redirects
1 js.hcaptcha.com l0g1n-microso.ftonlineportal.com
1 l0g1n-microso.ftonlineportal.com
11 7

This site contains no links.

Subject Issuer Validity Valid
*.ftonlineportal.com
R3		 2023-11-27 -
2024-02-25		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-04-15 -
2024-04-14		 a year crt.sh
challenges.cloudflare.com
Cloudflare Inc ECC CA-3		 2023-08-18 -
2024-08-17		 a year crt.sh

This page contains 4 frames:

Primary Page: https://l0g1n-microso.ftonlineportal.com/o365
Frame ID: 62B56986CEF0A242DB031F68F3E31947
Requests: 4 HTTP requests in this frame

Frame: https://newassets.hcaptcha.com/captcha/v1/655b55f/static/hcaptcha.html
Frame ID: EEA47BC571FA3BD7142901054DD41E7C
Requests: 4 HTTP requests in this frame

Frame: https://newassets.hcaptcha.com/captcha/v1/655b55f/static/hcaptcha.html
Frame ID: EF01B1E61E7525D9A9EC3979B037DB74
Requests: 3 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/yk9t7/0x4AAAAAAANtogG9tzJypB5g/auto/normal
Frame ID: ED83D126D9B7987F667734259EEEEC97
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Just a moment...

Page Statistics

11
Requests

82 %
HTTPS

17 %
IPv6

5
Domains

7
Subdomains

6
IPs

3
Countries

528 kB
Transfer

1534 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP 302
  • https://challenges.cloudflare.com/turnstile/v0/g/9914b343/api.js?onload=onloadTurnstileCallback
Request Chain 2
  • https://findicons.com/files/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png HTTP 301
  • https://images.freeimages.com/fic/images/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png?ref=findicons

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request o365
l0g1n-microso.ftonlineportal.com/ 		22 KB
23 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://l0g1n-microso.ftonlineportal.com/o365
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
206.188.196.225 Amsterdam, Netherlands, ASN399629 (BLNWX, US),
Reverse DNS
Software
/
Resource Hash
8b685531d15e8f49b93c9243be40a66f9287723eed7ad0ddfc732ae081ac8623

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

Connection
close
Content-Type
text/html
Transfer-Encoding
chunked
api.js
challenges.cloudflare.com/turnstile/v0/g/9914b343/
Redirect Chain
  • https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
  • https://challenges.cloudflare.com/turnstile/v0/g/9914b343/api.js?onload=onloadTurnstileCallback
33 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/turnstile/v0/g/9914b343/api.js?onload=onloadTurnstileCallback
Requested by
Host: l0g1n-microso.ftonlineportal.com
URL: https://l0g1n-microso.ftonlineportal.com/o365
Protocol
H2
Server
2606:4700::6811:3b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
51cd12da61a7401c73472b2ac77067adfa30e9fc0545b4b7c240e9154e011fc7

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://l0g1n-microso.ftonlineportal.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 21:15:38 GMT
content-encoding
br
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=31536000
cf-ray
82cd633e58b60be4-AMS
alt-svc
h3=":443"; ma=86400

Redirect headers

date
Mon, 27 Nov 2023 21:15:38 GMT
server
cloudflare
vary
accept-encoding
location
/turnstile/v0/g/9914b343/api.js?onload=onloadTurnstileCallback
access-control-allow-origin
*
cache-control
max-age=300, public
cf-ray
82cd633e18880be4-AMS
alt-svc
h3=":443"; ma=86400
api.js
js.hcaptcha.com/1/ 		325 KB
92 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hcaptcha.com/1/api.js
Requested by
Host: l0g1n-microso.ftonlineportal.com
URL: https://l0g1n-microso.ftonlineportal.com/o365
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.218.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f6e6e1df2e07020319cbd42cba58ef4393444f0385116d67956d2fc952b8dc71
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://l0g1n-microso.ftonlineportal.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 21:15:38 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 1cd1c24523b61d46b093d317bb196d92.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-content-type-options
nosniff
x-amz-version-id
5FnxbPp3kmllWiwzHlYY6CtZnWmf9seY
age
0
x-amz-cf-pop
AMS1-P3
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Wed, 22 Nov 2023 14:02:49 GMT
server
cloudflare
etag
W/"36a8ccb657cf281e4537c2935800b1c6"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=300
cf-ray
82cd633e2bdab957-AMS
x-amz-cf-id
8onGRazPDgYcQTyQsZyRCr0DPjk-w03XkyTCU7Cgcc0swq7DSVTowA==
microsoft_new_logo_alt.png
images.freeimages.com/fic/images/icons/2796/metro_uinvert_dock/64/
Redirect Chain
  • https://findicons.com/files/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png
  • https://images.freeimages.com/fic/images/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png?ref=findicons
254 B
770 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.freeimages.com/fic/images/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png?ref=findicons
Requested by
Host: l0g1n-microso.ftonlineportal.com
URL: https://l0g1n-microso.ftonlineportal.com/o365
Protocol
H2
Server
18.66.248.81 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-248-81.dus51.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2267d1822dbefc10c25e17d1fa4a6d9331e5a126e2483c5aff542d6107ebca36
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://l0g1n-microso.ftonlineportal.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 18:28:46 GMT
via
1.1 8e487d5d50ba943ec340041b0945bbf4.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
DUS51-P1
age
10013
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
254
x-xss-protection
1; mode=block
referrer-policy
origin
last-modified
Tue, 20 Dec 2022 05:17:19 GMT
server
AmazonS3
etag
"57ab754695eb0a2c74201ecd6948c12f"
x-frame-options
DENY
content-type
image/png
cache-control
max-age=31536000
accept-ranges
bytes
x-amz-cf-id
5FLtM3y8e3r3iJ7NQd7fjEkcVkdpyi7KzlCvXzT5Yi6y8X85CMXsCw==

Redirect headers

date
Mon, 30 Jan 2023 15:44:05 GMT
via
1.1 374989d04bb9f7efef831637d8f4b234.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
DUS51-P2
age
26026293
x-cache
Hit from cloudfront
location
https://images.freeimages.com/fic/images/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png?ref=findicons
content-length
0
x-amz-cf-id
kaj9poAwnMyboViPDhgCzKmsMOuUxp9UfJF9ZW79Kgme1oKD7zmzpg==
hcaptcha.html
newassets.hcaptcha.com/captcha/v1/655b55f/static/ Frame EEA4 		2 KB
765 B 		Document
General
Check archive.org
Download Go to
Full URL
https://newassets.hcaptcha.com/captcha/v1/655b55f/static/hcaptcha.html
Requested by
Host: js.hcaptcha.com
URL: https://js.hcaptcha.com/1/api.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.218.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
40d5b53e88169e8ae76aa187e5a60ea486f2e093341bb8ede2d9510dba9040ac
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://l0g1n-microso.ftonlineportal.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

access-control-allow-origin
*
age
699
alt-svc
h3=":443"; ma=86400
cache-control
max-age=1209600
cf-cache-status
HIT
cf-ray
82cd633eccafb957-AMS
content-encoding
br
content-type
text/html
cross-origin-embedder-policy
credentialless
cross-origin-resource-policy
cross-origin
date
Mon, 27 Nov 2023 21:15:38 GMT
last-modified
Wed, 22 Nov 2023 14:02:49 GMT
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
via
1.1 8dea89f951a7387e4ebbfe70f982f4a4.cloudfront.net (CloudFront)
x-amz-cf-id
VwQNfMdd2k1njEvwBMoDJOCX4gNK44zf48Te7fP4oMSNmGBngzCHYw==
x-amz-cf-pop
AMS1-P3
x-amz-server-side-encryption
AES256
x-amz-version-id
.9V5m1PcKrHeFaOd8nIRgLn.cGkj.SzG
x-cache
Hit from cloudfront
x-content-type-options
nosniff
hcaptcha.html
newassets.hcaptcha.com/captcha/v1/655b55f/static/ Frame EF01 		2 KB
938 B 		Document
General
Check archive.org
Download Go to
Full URL
https://newassets.hcaptcha.com/captcha/v1/655b55f/static/hcaptcha.html
Requested by
Host: js.hcaptcha.com
URL: https://js.hcaptcha.com/1/api.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.218.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
40d5b53e88169e8ae76aa187e5a60ea486f2e093341bb8ede2d9510dba9040ac
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://l0g1n-microso.ftonlineportal.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

access-control-allow-origin
*
age
699
alt-svc
h3=":443"; ma=86400
cache-control
max-age=1209600
cf-cache-status
HIT
cf-ray
82cd633eccadb957-AMS
content-encoding
br
content-type
text/html
cross-origin-embedder-policy
credentialless
cross-origin-resource-policy
cross-origin
date
Mon, 27 Nov 2023 21:15:38 GMT
last-modified
Wed, 22 Nov 2023 14:02:49 GMT
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
via
1.1 8dea89f951a7387e4ebbfe70f982f4a4.cloudfront.net (CloudFront)
x-amz-cf-id
VwQNfMdd2k1njEvwBMoDJOCX4gNK44zf48Te7fP4oMSNmGBngzCHYw==
x-amz-cf-pop
AMS1-P3
x-amz-server-side-encryption
AES256
x-amz-version-id
.9V5m1PcKrHeFaOd8nIRgLn.cGkj.SzG
x-cache
Hit from cloudfront
x-content-type-options
nosniff
normal
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/yk9t7/0x4AAAAAAANtogG9tzJypB5g/auto/ Frame ED83 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/yk9t7/0x4AAAAAAANtogG9tzJypB5g/auto/normal
Requested by
Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:3b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'

Request headers

Referer
https://l0g1n-microso.ftonlineportal.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
82cd633ecf5ab96e-AMS
content-encoding
br
content-security-policy
frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'
content-type
text/html; charset=UTF-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
cross-origin
date
Mon, 27 Nov 2023 21:15:38 GMT
document-policy
js-profiling
origin-agent-cluster
?1
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy
same-origin
server
cloudflare
hcaptcha.js
newassets.hcaptcha.com/captcha/v1/655b55f/ Frame EF01 		325 KB
91 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://newassets.hcaptcha.com/captcha/v1/655b55f/hcaptcha.js
Requested by
Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/655b55f/static/hcaptcha.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.218.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f6e6e1df2e07020319cbd42cba58ef4393444f0385116d67956d2fc952b8dc71
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://newassets.hcaptcha.com/captcha/v1/655b55f/static/hcaptcha.html
Origin
https://newassets.hcaptcha.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 21:15:38 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 1cd1c24523b61d46b093d317bb196d92.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-content-type-options
nosniff
x-amz-version-id
5FnxbPp3kmllWiwzHlYY6CtZnWmf9seY
age
715
x-amz-cf-pop
AMS1-P3
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Wed, 22 Nov 2023 14:02:49 GMT
server
cloudflare
etag
W/"36a8ccb657cf281e4537c2935800b1c6"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=1209600
cf-ray
82cd633f1d11b957-AMS
x-amz-cf-id
8onGRazPDgYcQTyQsZyRCr0DPjk-w03XkyTCU7Cgcc0swq7DSVTowA==
hcaptcha.js
newassets.hcaptcha.com/captcha/v1/655b55f/ Frame EEA4 		325 KB
91 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://newassets.hcaptcha.com/captcha/v1/655b55f/hcaptcha.js
Requested by
Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/655b55f/static/hcaptcha.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.218.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f6e6e1df2e07020319cbd42cba58ef4393444f0385116d67956d2fc952b8dc71
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://newassets.hcaptcha.com/captcha/v1/655b55f/static/hcaptcha.html
Origin
https://newassets.hcaptcha.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 21:15:38 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 1cd1c24523b61d46b093d317bb196d92.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-content-type-options
nosniff
x-amz-version-id
5FnxbPp3kmllWiwzHlYY6CtZnWmf9seY
age
715
x-amz-cf-pop
AMS1-P3
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Wed, 22 Nov 2023 14:02:49 GMT
server
cloudflare
etag
W/"36a8ccb657cf281e4537c2935800b1c6"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=1209600
cf-ray
82cd633f1d1fb957-AMS
x-amz-cf-id
8onGRazPDgYcQTyQsZyRCr0DPjk-w03XkyTCU7Cgcc0swq7DSVTowA==
truncated
/ Frame EF01 		798 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
57cafa49fb677c3f09d6e90b051917d10e7bb54e83102a25f3d32b06e8fa59a7

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type
image/png
checksiteconfig
api2.hcaptcha.com/ Frame EEA4 		700 B
982 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api2.hcaptcha.com/checksiteconfig?v=655b55f&host=l0g1n-microso.ftonlineportal.com&sitekey=234adb2f-52ba-4697-82fa-abecbb14b173&sc=1&swa=1&spst=1
Requested by
Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/655b55f/hcaptcha.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.218.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2eea3d2c78adcc42b7860e399dc98d0b3752dd92d978966753dcb8743910f975
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept
application/json
Referer
https://newassets.hcaptcha.com/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 27 Nov 2023 21:15:38 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
content-encoding
br
server
cloudflare
vary
Origin, Accept-Encoding
access-control-allow-methods
GET, HEAD, POST, OPTIONS
content-type
application/json
access-control-allow-origin
https://newassets.hcaptcha.com
access-control-allow-credentials
true
cf-ray
82cd633faddbb957-AMS
access-control-allow-headers
Cache-Control, Content-Type, DNT, Referer, User-Agent, challenge-bypass-token, cf-chl-bypass, challenge-bypass-token, challenge-bypass-host, challenge-bypass-path
alt-svc
h3=":443"; ma=86400
hsw.js
newassets.hcaptcha.com/c/a4633b2/ Frame EEA4 		498 KB
216 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://newassets.hcaptcha.com/c/a4633b2/hsw.js
Requested by
Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/655b55f/hcaptcha.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
417d4b795ea27e27ff37031b60c2d7a943d8d0f061d18f5928d67ae8bf38880f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://newassets.hcaptcha.com/captcha/v1/655b55f/static/hcaptcha.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Mon, 27 Nov 2023 21:15:38 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 69b7884048ebe8b1ecf8d8ec9d39c85c.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-content-type-options
nosniff
x-amz-version-id
wTFeyMTTWqrod_6yh9_XKvGQOpUz3Amq
age
4327
x-amz-cf-pop
AMS1-P3
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Fri, 24 Nov 2023 22:06:59 GMT
server
cloudflare
etag
W/"eaa2b83870d82556d390e46c87a90718"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3024000
cf-ray
82cd63401d7f66ea-AMS
x-amz-cf-id
SiiBYQIgJiUq7Y10mADOKw4tpi_7k9Q9VOfqhHxCchLzaWCdfw5_xw==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| documentPictureInPicture function| verifyCallback_CF function| verifyCallback_hCaptcha function| validateElement function| refreshCallBack function| switchToSecondCaptcha function| onloadTurnstileCallback function| incrementLoader object| Raven object| hcaptcha object| grecaptcha object| turnstile number| ticker

2 Cookies

Domain/Path Name / Value
.ftonlineportal.com/ Name: zIVE
Value: c68647d15579bd20347624b56104b1f113ad3d02b7ed0ff1ec96d7b3318c45fd
api2.hcaptcha.com/ Name: __cflb
Value: 04dTobrcPfCH2Cv1uxYioAFTikqddqvQ92JJdVdhDP