login-auth-2db5.microsoft365officeonline.workers.dev

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 3 HTTP transactions. The main IP is 172.67.159.190, located in United States and belongs to CLOUDFLARENET, US. The main domain is login-auth-2db5.microsoft365officeonline.workers.dev.
TLS certificate: Issued by WE1 on July 7th 2024. Valid for: 3 months.

This is the only time login-auth-2db5.microsoft365officeonline.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	172.67.159.190 172.67.159.190	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:303... 2606:4700:3031::ac43:c627	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	23.218.94.213 23.218.94.213	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	4

1 172.67.159.190 (United States)

ASN13335 (CLOUDFLARENET, US)

login-auth-2db5.microsoft365officeonline.workers.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3031::ac43:c627 (United States)

ASN13335 (CLOUDFLARENET, US)

9i82qjhn-agxy-4fzs-8vtt-86x2um0xxigs.cdn-pages.biz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.218.94.213 (Leonia, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-218-94-213.deploy.static.akamaitechnologies.com

img6.wsimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	wsimg.com img6.wsimg.com — Cisco Umbrella Rank: 69667	92 KB
1	cdn-pages.biz 9i82qjhn-agxy-4fzs-8vtt-86x2um0xxigs.cdn-pages.biz	223 KB
1	workers.dev login-auth-2db5.microsoft365officeonline.workers.dev	854 B
3	3

	Domain	Requested by
1	img6.wsimg.com
1	9i82qjhn-agxy-4fzs-8vtt-86x2um0xxigs.cdn-pages.biz	login-auth-2db5.microsoft365officeonline.workers.dev
1	login-auth-2db5.microsoft365officeonline.workers.dev
3	3

This site contains links to these domains. Also see Links.

Domain
login.live.com
www.microsoft.com
privacy.microsoft.com

Subject Issuer	Validity	Valid
microsoft365officeonline.workers.dev WE1	`2024-07-07` - `2024-10-05`	3 months	crt.sh
cdn-pages.biz WE1	`2024-08-29` - `2024-11-27`	3 months	crt.sh
*.wsimg.com Starfield Secure Certificate Authority - G2	`2023-09-19` - `2024-10-20`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://login-auth-2db5.microsoft365officeonline.workers.dev/
Frame ID: CE1E2B9BC9F01474CE744CC12B7F83E1
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your account

Page Statistics

3
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

316 kB
Transfer

1129 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://login.live.com/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2fwww.office.com%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2fwww.office.com%2flandingv2&response_type=code+id_token&state=jSpBz0HkjUCYM4hj4Fiie1d8GPQe5c5e347tiBNWTx8bwciKJsN5i_3McWwLzu8c8jJQOUPzGbN9OstJmH6q2ZW0qSYB6NG_1RmO9JVdGubZbp3vQw1ndjtRcOJRLRo6fQVQVrXdzSnDFsgogy740NYt3diJBqJW3iHonYWIUifn6aOyGPA5Xur98gyBi-DviiySl8ZXln2BL9bZz7xZVEe9zTyzEchRYex6d9TT29MLqJOKlxY_QuHGF7SsDgfv0mu8M0OwYJywYQOhUdKktA&response_mode=form_post&nonce=638152134441884129.YTRkNjUxYWUtNzg5Mi00NzNmLWJhMGUtZjhmYjRjNTk1ODk5MDNiMGNkY2EtN2Q1MS00ZWI0LWIwZjQtYTRmODJjMTliOGI4&x-client-SKU=ID_NET6_0&x-client-Ver=6.26.1.0&uaid=0c89f413dcba4a448f8836ccbe457a04&msproxy=1&issuer=mso&tenant=common&ui_locales=en-US&signup=1&lw=1&fl=easi2&epct=PAQABAAEAAAD--DLA3VO7QrddgJg7WevrvkTHlhgjepzG5TjXlBVjCdYDbAARZk-gKjkl0qhXxL14HybR18Ag6XaNUZCV3wThdLEglrjcKeLJL1hm6AqcAuwgMQubsc8gYq4E06aoZL8Z12L66WSnOO9PxgtaISUecTaJu0hv6fnCWtf2d1zf72JLBk8HtR7Xiz3C3WgsCUMJm0x4uy5nYRK8h38LdnDRFJeZBN92AibovKnMqbpGziAA&jshs=0
Title: Create one!

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-US/servicesagreement/
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/en-US/privacystatement
Title: Privacy & cookies

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request / Show response login-auth-2db5.microsoft365officeonline.workers.dev/	819 B 854 B	222ms 195ms	Document text/html	172.67.159.190 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://login-auth-2db5.microsoft365officeonline.workers.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.159.190 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `7095d6c2d8184482c521c5f2b2a573f5f5a228b8bbcfeec601fa13ae699e87fb` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cf-ray 8bbd7f8f1bb32626-NRT content-encoding br content-type text/html;charset=UTF-8 date Sat, 31 Aug 2024 13:51:57 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kr6eFgPdXwZsmTWb5yqmBOzvNawW%2FTIbMezq8hdWyotSUrz%2FInX8InieozwpBpvJ8%2FrVlYYoHGYoDohNkYeVMCBMZY%2Bg5xESz%2BtTB9qS28%2F6ILB0oUT7OOn7Ts0CGuodPALJ6GFcukAJJ3O8JQTDS1UxNKogwuKI0itCmtU39dQ9%2BinCZU1t"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H2	200	5a923b0e-e58e-411c-9078-d0edb43e0d28.js Show response 9i82qjhn-agxy-4fzs-8vtt-86x2um0xxigs.cdn-pages.biz/7g97zq9x-ubgy-4gfl-b3cc-tj7zzuys0scv/8f81db691e7943ff80c43802a534cf89/k/	1 MB 223 KB	680ms 636ms	Script text/javascript	2606:4700:3031::ac43:c627 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://9i82qjhn-agxy-4fzs-8vtt-86x2um0xxigs.cdn-pages.biz/7g97zq9x-ubgy-4gfl-b3cc-tj7zzuys0scv/8f81db691e7943ff80c43802a534cf89/k/5a923b0e-e58e-411c-9078-d0edb43e0d28.js Requested by Host: login-auth-2db5.microsoft365officeonline.workers.dev URL: https://login-auth-2db5.microsoft365officeonline.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:c627 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `9a26380cf87e420eb90b2fdeb0170444d7d8185d8d658e00fa204dbeadbd6593` Request headers Referer https://login-auth-2db5.microsoft365officeonline.workers.dev/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Sat, 31 Aug 2024 13:51:58 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"eyJkYXRhIjp7InR5cGUiOiJCdWZ" vary Accept-Encoding access-control-allow-methods GET, HEAD, POST, OPTIONS content-type text/javascript access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R42utSmliCFjhs22DbSwvI97HdVXlJmEHdMXniHcnQSJC1u3Mm3eTvQZZvePaXVPvLAx28O7m5gTVaKxDVXPO3EQ89AVpn0NPj0aX1UNs8IcrcE2mhw2pXUebp1wP5fxpulXezOm6QaQmJvzLXlS0OeoFsXVmTAO044a%2FHFRM07Uq9EQYQ2hOBDngQFoKHzjwA%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control public, max-age=86400, stale-while-revalidate=86400 cf-ray 8bbd7f909e00261e-NRT access-control-allow-headers Content-Type alt-svc h3=":443"; ma=86400 expires Sun, 01 Sep 2024 13:51:57 GMT
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68` Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	GDSherpa-vf2.woff2 img6.wsimg.com/ux-assets/@ux/fonts/4.1.0/	91 KB 92 KB	610ms 575ms	Font font/woff2	23.218.94.213 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://img6.wsimg.com/ux-assets/@ux/fonts/4.1.0/GDSherpa-vf2.woff2 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.218.94.213 Leonia, United States, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-218-94-213.deploy.static.akamaitechnologies.com Software / Resource Hash `6528a0bf9a836a53dfd8536e1786ba6831c9d1faa74967126fddf5b2081b858c` Request headers Referer https://login-auth-2db5.microsoft365officeonline.workers.dev/ Origin https://login-auth-2db5.microsoft365officeonline.workers.dev User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers x-amz-version-id 2PSwXT.vxHAR9Lk.1IVm6G9P2Lk5eKP0 date Sat, 31 Aug 2024 13:51:58 GMT x-amz-request-id GJWGT2YTYMY4JKFZ x-amz-server-side-encryption AES256 server-timing cdn-cache; desc=MISS, edge; dur=5, origin; dur=565, ak_p; desc="1725112318319_400020949_93892741_57027_1715_1_5_255";dur=1 content-length 93276 x-amz-id-2 osKUWoidlLzbj3L+Fu71C/5fjPbhKS/tuwxHCEeoJPl3lps0OGHkYGmW9m0wobyOfILCkNJYw0TBXRzO5tHzYQ== last-modified Thu, 19 Jan 2023 18:23:07 GMT etag "bcd7983ea5aa57c55f6758b4977983cb" vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method access-control-allow-methods GET, HEAD content-type font/woff2 access-control-allow-origin * cache-control public, max-age=2592000 accept-ranges bytes timing-allow-origin *
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93` Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| a0_0x4091 function| a0_0x481b function| pushSubmit

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9i82qjhn-agxy-4fzs-8vtt-86x2um0xxigs.cdn-pages.biz
img6.wsimg.com
login-auth-2db5.microsoft365officeonline.workers.dev
172.67.159.190
23.218.94.213
2606:4700:3031::ac43:c627
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
6528a0bf9a836a53dfd8536e1786ba6831c9d1faa74967126fddf5b2081b858c
7095d6c2d8184482c521c5f2b2a573f5f5a228b8bbcfeec601fa13ae699e87fb
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
9a26380cf87e420eb90b2fdeb0170444d7d8185d8d658e00fa204dbeadbd6593

login-auth-2db5.microsoft365officeonline.workers.dev Open in urlscan Pro 172.67.159.190 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

3 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

4 IPs

1 Countries

316 kBTransfer

1129 kBSize

0 Cookies

3 Outgoing links

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

login-auth-2db5.microsoft365officeonline.workers.dev Open in urlscan Pro
172.67.159.190 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

316 kB
Transfer

1129 kB
Size

0
Cookies

3 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!