login.microsoftonli.ptfg.pro

Summary

This website contacted 6 IPs in 4 countries across 3 domains to perform 5 HTTP transactions. The main IP is 91.218.67.113, located in Germany and belongs to SYNLINQ synlinq.de, DE. The main domain is login.microsoftonli.ptfg.pro.
TLS certificate: Issued by R3 on July 26th 2023. Valid for: 3 months.

This is the only time login.microsoftonli.ptfg.pro was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	194.68.32.238 194.68.32.238	9009 (M247) (M247)
1	89.31.121.124 89.31.121.124	9009 (M247) (M247)
1	91.218.67.113 91.218.67.113	44486 (SYNLINQ s...) (SYNLINQ synlinq.de)
1 1	2606:4700:20:... 2606:4700:20::681a:51e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:400... 2a04:4e42:400::347	54113 (FASTLY) (FASTLY)
1	163.181.92.238 163.181.92.238	() ()
5	6

1 194.68.32.238 (Oslo, Norway)

ASN9009 (M247, RO)
PTR: 238.32.68.194.in-addr.arpa

194.68.32.238	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 89.31.121.124 (Belgrade, Serbia)

ASN9009 (M247, RO)
PTR: hyg0.al-fatahs.com

89.31.121.124	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.218.67.113 (Germany)

ASN44486 (SYNLINQ synlinq.de, DE)

login.microsoftonli.ptfg.pro	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:51e (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

picsum.photos	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::347 (United States)

ASN54113 (FASTLY, US)

fastly.picsum.photos	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 163.181.92.238 (None, )

ASN- ()

cstaticdun.126.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	picsum.photos 1 redirects picsum.photos — Cisco Umbrella Rank: 62073 fastly.picsum.photos — Cisco Umbrella Rank: 110606	9 KB
1	126.net cstaticdun.126.net	12 KB
1	ptfg.pro login.microsoftonli.ptfg.pro	11 KB
5	3

	Domain	Requested by
1	cstaticdun.126.net	login.microsoftonli.ptfg.pro
1	fastly.picsum.photos	login.microsoftonli.ptfg.pro
1	picsum.photos	1 redirects
1	login.microsoftonli.ptfg.pro
5	4

This site contains no links.

Subject Issuer	Validity	Valid
login.microsoftonli.ptfg.pro R3	`2023-07-26` - `2023-10-24`	3 months	crt.sh
*.126.net TrustAsia RSA OV TLS CA G2	`2022-11-28` - `2023-12-08`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://login.microsoftonli.ptfg.pro/KKwlePbF
Frame ID: 143A8686F1987356039A2E8CA04761D0
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Captcha

Page Statistics

5
Requests

40 %
HTTPS

33 %
IPv6

3
Domains

4
Subdomains

6
IPs

4
Countries

32 kB
Transfer

32 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

https://picsum.photos/300/150/?image=565 HTTP 302
https://fastly.picsum.photos/id/565/300/150.jpg?hmac=0UaHlsbIg19O8QAcEJbjofTgJl3Y5D1PxRMXzY6VCgo

5 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	8687474703a2f2f313439353233343934302f35333232352f627269616e2e666f73746572407361702e636f6d 194.68.32.238/9146/	0 264 B	66ms 34ms	Document text/html	194.68.32.238 M247
General Check archive.org Show headers Download Go to Full URL http://194.68.32.238/9146/8687474703a2f2f313439353233343934302f35333232352f627269616e2e666f73746572407361702e636f6d Protocol HTTP/1.1 Server 194.68.32.238 Oslo, Norway, ASN9009 (M247, RO), Reverse DNS 238.32.68.194.in-addr.arpa Software Apache/2.4.41 (Ubuntu) / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Content-Length 0 Content-Type text/html; charset=UTF-8 Date Mon, 07 Aug 2023 15:02:45 GMT Keep-Alive timeout=5, max=100 Server Apache/2.4.41 (Ubuntu) refresh 0;url=http://1495234940/53225/brian.foster@sap.com
GET H/1.1	200 OK	brian.foster@sap.com 89.31.121.124/53225/	0 286 B	52ms 26ms	Document text/html	89.31.121.124 M247
General Check archive.org Show headers Download Go to Full URL http://89.31.121.124/53225/brian.foster@sap.com Protocol HTTP/1.1 Server 89.31.121.124 Belgrade, Serbia, ASN9009 (M247, RO), Reverse DNS hyg0.al-fatahs.com Software Apache/2.4.41 (Ubuntu) / Resource Hash Request headers Referer http://194.68.32.238/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Content-Length 0 Content-Type text/html; charset=UTF-8 Date Mon, 07 Aug 2023 15:02:45 GMT Keep-Alive timeout=5, max=100 Server Apache/2.4.41 (Ubuntu) refresh 0;url=https://login.microsoftonli.ptfg.pro/KKwlePbF#brian.foster@sap.com
GET H/1.1	200 OK	Primary Request KKwlePbF Show response login.microsoftonli.ptfg.pro/	11 KB 11 KB	69ms 14ms	Document text/html	91.218.67.113 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://login.microsoftonli.ptfg.pro/KKwlePbF Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.218.67.113 , Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS Software / Resource Hash `cefcd899c4f0237e5e93a89e9dadd8d4a27de7f819ad10c2134162ea122c3c24` Request headers Referer http://89.31.121.124/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection close Content-Type text/html Transfer-Encoding chunked
GET H2	200	150.jpg fastly.picsum.photos/id/565/300/ Redirect Chain https://picsum.photos/300/150/?image=565 https://fastly.picsum.photos/id/565/300/150.jpg?hmac=0UaHlsbIg19O8QAcEJbjofTgJl3Y5D1PxRMXzY6VCgo	8 KB 9 KB	211ms 81ms	Image image/jpeg	2a04:4e42:400::347 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://fastly.picsum.photos/id/565/300/150.jpg?hmac=0UaHlsbIg19O8QAcEJbjofTgJl3Y5D1PxRMXzY6VCgo Requested by Host: login.microsoftonli.ptfg.pro URL: https://login.microsoftonli.ptfg.pro/KKwlePbF Protocol H2 Server 2a04:4e42:400::347 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash `5ed21bdc702429ec73b39c26f94d8bd24b74a68145fd6405a9f84d4f58184d8b` Request headers accept-language de-DE,de;q=0.9 Referer https://login.microsoftonli.ptfg.pro/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers x-cache-hits 0 date Mon, 07 Aug 2023 15:02:45 GMT via 1.1 varnish age 0 x-cache MISS content-disposition inline; filename="565-300x150.jpg" content-length 8620 x-served-by cache-fra-eddf8230074-FRA x-timer S1691420566.781587,VS0,VE52 vary Origin content-type image/jpeg access-control-allow-origin * access-control-expose-headers Content-Type, Picsum-Id cache-control public, max-age=2592000, stale-while-revalidate=60, stale-if-error=43200, immutable accept-ranges bytes timing-allow-origin * picsum-id 565 Redirect headers date Mon, 07 Aug 2023 15:02:45 GMT strict-transport-security max-age=15552000 x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N%2BG1cE5oTx7VD%2FZB67Js%2Bt24m%2F%2BdlDnopse96fKr3wo3F9cswUO7qBUGvs79vLAaGSmV31a7S6UY8InmhIWBaQvz43wDXZw5NBBtNTpNxjJvZg%2FIqn%2FxJYxLvF88cgGM5%2FrmvRvCZGEvMrI%3D"}],"group":"cf-nel","max_age":604800} location https://fastly.picsum.photos/id/565/300/150.jpg?hmac=0UaHlsbIg19O8QAcEJbjofTgJl3Y5D1PxRMXzY6VCgo access-control-allow-origin * cache-control private, no-cache, no-store, must-revalidate cf-ray 7f306706fbaf1a7d-FRA alt-svc h3=":443"; ma=86400 content-length 0
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Content-Type image/svg+xml
GET H/1.1	200 OK	icon_light.f13cff3.png cstaticdun.126.net//2.6.3/images/	11 KB 12 KB	4989ms 226ms	Image image/png	163.181.92.238
General Check archive.org Show headers Download Go to Show image Full URL https://cstaticdun.126.net//2.6.3/images/icon_light.f13cff3.png Requested by Host: login.microsoftonli.ptfg.pro URL: https://login.microsoftonli.ptfg.pro/KKwlePbF Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 163.181.92.238 -, , ASN (), Reverse DNS Software Tengine / Resource Hash `5dc5e0940d0c1e5a92461ca192fd6993bb7d492a04e125d36c7e793c20d1e401` Request headers accept-language de-DE,de;q=0.9 Referer https://login.microsoftonli.ptfg.pro/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Date Mon, 07 Aug 2023 15:02:37 GMT Via cache53.l2nu20-8[0,0,304-0,H], cache49.l2nu20-8[1,0], cache20.l2hk2[29,29,304-0,H], cache26.l2hk2[31,0], cache8.l2de2[213,213,304-0,H], cache6.l2de2[214,0], ens-cache12.de5[216,216,200-0,H], ens-cache9.de5[218,0] Age 13 X-Swift-CacheTime 47 X-Cache HIT TCP_REFRESH_HIT dirn:12:466257955 Connection keep-alive X-Swift-SaveTime Mon, 07 Aug 2023 15:02:50 GMT Content-Length 11413 Last-Modified Mon, 07 Nov 2022 05:53:30 GMT Server Tengine Ali-Swift-Global-Savetime 1691420557 Content-Type image/png Access-Control-Allow-Origin * Access-Control-Allow-Methods GET,POST,OPTIONS,HEAD Access-Control-Expose-Headers * Cache-Control max-age=43200 Accept-Ranges bytes Timing-Allow-Origin , EagleId a3b55c9d16914205703215681e Expires Tue, 06 Jun 2023 00:55:01 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _createClass function| _classCallCheck function| cleanMsg object| jigsaw

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.ptfg.pro/	1970-01-20 13:50:24	Name: 654f-a2ae Value: 12fbdcb62779c15575b703d0b74d5cfbc505ad5869e07073b3f2608bb259d6da

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cstaticdun.126.net
fastly.picsum.photos
login.microsoftonli.ptfg.pro
picsum.photos
163.181.92.238
194.68.32.238
2606:4700:20::681a:51e
2a04:4e42:400::347
89.31.121.124
91.218.67.113
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
5dc5e0940d0c1e5a92461ca192fd6993bb7d492a04e125d36c7e793c20d1e401
5ed21bdc702429ec73b39c26f94d8bd24b74a68145fd6405a9f84d4f58184d8b
cefcd899c4f0237e5e93a89e9dadd8d4a27de7f819ad10c2134162ea122c3c24

login.microsoftonli.ptfg.pro Open in urlscan Pro 91.218.67.113 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

5 Requests

40 %HTTPS

33 %IPv6

3 Domains

4 Subdomains

6 IPs

4 Countries

32 kBTransfer

32 kBSize

1 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Indicators

login.microsoftonli.ptfg.pro Open in urlscan Pro
91.218.67.113 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

40 %
HTTPS

33 %
IPv6

3
Domains

4
Subdomains

6
IPs

4
Countries

32 kB
Transfer

32 kB
Size

1
Cookies

5 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!