logon.undp.org
Open in
urlscan Pro
40.74.19.25
Malicious Activity!
Public Scan
Effective URL: https://logon.undp.org/adfs/ls/?client-request-id=ecf512c8-2e00-4161-8c9d-9b79a1ed3d0e&username=&wa=wsignin1.0&wtrealm=...
Submission: On May 07 via manual from US
Summary
TLS certificate: Issued by COMODO RSA Organization Validation Se... on June 14th 2018. Valid for: 2 years.
This is the only time logon.undp.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
14 | 111.90.142.105 111.90.142.105 | 45839 (SHINJIRU-...) (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd) | |
1 1 | 40.97.116.82 40.97.116.82 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
1 1 | 2603:1026:5::2 2603:1026:5::2 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
2 2 | 2603:1026:6:4... 2603:1026:6:45::2 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
1 1 | 40.126.9.67 40.126.9.67 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
3 | 40.74.19.25 40.74.19.25 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
18 | 3 |
ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY)
PTR: beaver15.steeldns.com
logon.undp.org.adfs.ls.client-request-id.session-services.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
outlook.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
www.outlook.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
outlook.office365.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
login.microsoftonline.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
logon.undp.org |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
session-services.com
logon.undp.org.adfs.ls.client-request-id.session-services.com |
82 KB |
3 |
undp.org
logon.undp.org |
224 KB |
2 |
office365.com
2 redirects
outlook.office365.com |
6 KB |
2 |
outlook.com
2 redirects
outlook.com www.outlook.com |
900 B |
1 |
microsoftonline.com
1 redirects
login.microsoftonline.com |
2 KB |
18 | 5 |
Domain | Requested by | |
---|---|---|
14 | logon.undp.org.adfs.ls.client-request-id.session-services.com |
logon.undp.org.adfs.ls.client-request-id.session-services.com
|
3 | logon.undp.org |
logon.undp.org.adfs.ls.client-request-id.session-services.com
logon.undp.org |
2 | outlook.office365.com | 2 redirects |
1 | login.microsoftonline.com | 1 redirects |
1 | www.outlook.com | 1 redirects |
1 | outlook.com | 1 redirects |
18 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
idm.undp.org |
Subject Issuer | Validity | Valid | |
---|---|---|---|
logon.undp.org.adfs.ls.client-request-id.session-services.com Let's Encrypt Authority X3 |
2019-04-05 - 2019-07-04 |
3 months | crt.sh |
logon.undp.org COMODO RSA Organization Validation Secure Server CA |
2018-06-14 - 2020-06-13 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://logon.undp.org/adfs/ls/?client-request-id=ecf512c8-2e00-4161-8c9d-9b79a1ed3d0e&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQIIAY1Ru2rbUAD1tWzFMX2E0KFjKB1KQdK9kq5eJYMfcaBxSWIsjLMYWb7XUiz7KrIUR_6CDB0ypxTajh4zlX5Bm8nQLV9QSgulUOjQoTJdOuYMhwNnOY-nHBKR9Rj-gyysWICUIsElK_Ufos3yxsfNX99yolN5-fpV-vb79r1LUEomg1Bk0XABHnlxHE4tSWJJHDA2EhmlvksUDYsuG0ts5kjvAVgCsMjrmqKZsm4iqKmmbhjIhKLqGNBUNEVQsEYFVXeo4JAskmZQt09lnNnoJn9_v5LEnrwiFvlz8jO_Tlk07oVsGl9yQb0bP6-zyrBeqVbnc7WxVz3cozYeGLX-7tmBZxLs4_aLrtOVjwLbT1m7Zo_aoX1s7_edzrg967TYbOeYTVFDTmAI3VE1Racn0Gy4SkuLkh3DDtSop8jqPOgtuFvtdsXxWf0xm1xzPAvJxB8sC-Br4Q4sWqVSeePuw-JW7ncBvCtm-77584ylT85rV5_Rp-ViLXddlE6hnsX27ROpiVFKPP1sqnUmQxKmTWlXGUSzw7Dpk9aBFxrb2EIXPLjg-S88-MGD87Xch_VbvHJTfiBDZAoQC1DfgsjCuqXio781
Frame ID: 40B38E4379A8C2FA8592D6176A0E6FD1
Requests: 18 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://logon.undp.org.adfs.ls.client-request-id.session-services.com/ Page URL
- https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null Page URL
-
https://outlook.com/undp.org
HTTP 301
https://www.outlook.com/undp.org HTTP 301
https://outlook.office365.com/undp.org HTTP 302
https://outlook.office365.com/owa/undp.org HTTP 302
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redir... HTTP 302
https://logon.undp.org/adfs/ls/?client-request-id=ecf512c8-2e00-4161-8c9d-9b79a1ed3d0e&username=&wa... Page URL
Detected technologies
LiteSpeed (Web Servers) ExpandDetected patterns
- headers server /^LiteSpeed$/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Forgot Password?
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://logon.undp.org.adfs.ls.client-request-id.session-services.com/ Page URL
- https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null Page URL
-
https://outlook.com/undp.org
HTTP 301
https://www.outlook.com/undp.org HTTP 301
https://outlook.office365.com/undp.org HTTP 302
https://outlook.office365.com/owa/undp.org HTTP 302
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=ecf512c8-2e00-4161-8c9d-9b79a1ed3d0e&protectedtoken=true&domain_hint=undp.org&nonce=636927910649788190.4a809363-356f-47af-ae02-68fcbf25a801&state=DYtJDoAgDABBzz4FKBQKfU5d8CbGxPh9e5i5TMYaY2ZlUiyoTCUkTpUjUObaWmTwWRowEjos1F2u0p0ckBy1vq09Fc3R6ruE8Ul4r_324zl_ HTTP 302
https://logon.undp.org/adfs/ls/?client-request-id=ecf512c8-2e00-4161-8c9d-9b79a1ed3d0e&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQIIAY1Ru2rbUAD1tWzFMX2E0KFjKB1KQdK9kq5eJYMfcaBxSWIsjLMYWb7XUiz7KrIUR_6CDB0ypxTajh4zlX5Bm8nQLV9QSgulUOjQoTJdOuYMhwNnOY-nHBKR9Rj-gyysWICUIsElK_Ufos3yxsfNX99yolN5-fpV-vb79r1LUEomg1Bk0XABHnlxHE4tSWJJHDA2EhmlvksUDYsuG0ts5kjvAVgCsMjrmqKZsm4iqKmmbhjIhKLqGNBUNEVQsEYFVXeo4JAskmZQt09lnNnoJn9_v5LEnrwiFvlz8jO_Tlk07oVsGl9yQb0bP6-zyrBeqVbnc7WxVz3cozYeGLX-7tmBZxLs4_aLrtOVjwLbT1m7Zo_aoX1s7_edzrg967TYbOeYTVFDTmAI3VE1Racn0Gy4SkuLkh3DDtSop8jqPOgtuFvtdsXxWf0xm1xzPAvJxB8sC-Br4Q4sWqVSeePuw-JW7ncBvCtm-77584ylT85rV5_Rp-ViLXddlE6hnsX27ROpiVFKPP1sqnUmQxKmTWlXGUSzw7Dpk9aBFxrb2EIXPLjg-S88-MGD87Xch_VbvHJTfiBDZAoQC1DfgsjCuqXio781 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
logon.undp.org.adfs.ls.client-request-id.session-services.com/ |
2 KB 939 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
logon.undp.org.adfs.ls.client-request-id.session-services.com/css/ |
519 B 582 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
form.css
logon.undp.org.adfs.ls.client-request-id.session-services.com/css/ |
637 B 532 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.12.2.min.js
logon.undp.org.adfs.ls.client-request-id.session-services.com/jquery/ |
95 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.vegas.js
logon.undp.org.adfs.ls.client-request-id.session-services.com/jquery/ |
11 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
jquery-migrate-1.4.0.min.js
logon.undp.org.adfs.ls.client-request-id.session-services.com/jquery/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
indexc.php
logon.undp.org.adfs.ls.client-request-id.session-services.com/ |
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
logon.undp.org.adfs.ls.client-request-id.session-services.com/css/ |
519 B 307 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
form.css
logon.undp.org.adfs.ls.client-request-id.session-services.com/css/ |
637 B 209 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.11.1.min.js
logon.undp.org.adfs.ls.client-request-id.session-services.com/ |
94 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
RSA.js
logon.undp.org.adfs.ls.client-request-id.session-services.com/ |
15 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.vegas.js
logon.undp.org.adfs.ls.client-request-id.session-services.com/jquery/ |
11 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-migrate-1.2.1.min.js
logon.undp.org.adfs.ls.client-request-id.session-services.com/ |
7 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
btn.png
logon.undp.org.adfs.ls.client-request-id.session-services.com/img/ |
469 B 541 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nestatic.php
logon.undp.org.adfs.ls.client-request-id.session-services.com/ |
4 B 69 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
logon.undp.org/adfs/ls/ Redirect Chain
|
18 KB 18 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
logon.undp.org/adfs/portal/css/ |
8 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
illustration.jpg
logon.undp.org/adfs/portal/illustration/ |
197 KB 198 KB |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- logon.undp.org.adfs.ls.client-request-id.session-services.com
- URL
- http://logon.undp.org.adfs.ls.client-request-id.session-services.com/jquery/jquery-migrate-1.4.0.min.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| LoginErrors number| maxPasswordLength function| InputUtil function| SelectOption function| Login undefined| emails undefined| msViewportStyle undefined| viewport function| getStyle function| computeLoadIllustration function| SetIllustrationImage0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
login.microsoftonline.com
logon.undp.org
logon.undp.org.adfs.ls.client-request-id.session-services.com
outlook.com
outlook.office365.com
www.outlook.com
logon.undp.org.adfs.ls.client-request-id.session-services.com
111.90.142.105
2603:1026:5::2
2603:1026:6:45::2
40.126.9.67
40.74.19.25
40.97.116.82
050ed368c40670383f9861b929cf75fc55bb7962ce87fc0b61f76cbe15f5986f
0a13280a86e7dfa6949bd016ea848912fcafc05e88cbedf538ac325b27041205
0a840a7827b7cfe56d8312470d5ea5a7a6125639e05e756ebbb019008bc84435
1e67d8dbcca1f6fd94e077c85c2fb40fa1c2756c99238daa8da882144260a68d
26a4e958cac76561481745941b58680f6cce2b60f9c24f1fbcc53c188be7bda7
33406c206dfb5dd0dfb206460175528e25eebe7cc6483e45cfaa0995cb6e4324
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
95914789b5f3307a3718679e867d61b9d4c03f749cd2e2970570331d7d6c8ed9
b2ec1b27321f05546e996c4a95e20e8e1eb4a120f06dae1d7cb5881fe3a82eed
be727537e7ee65c72af89cdc0e289046a4f50693b5cbecf470887b107e98c3eb
ca7588d24aadc1190962ce1f61aa33eb270494fbc16dde6c7b9e7978c8579b68
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
efcec7a972147e788b378724ec9c31538ea031a347747a86e08693261756cb70
f464aa1c2139d184500af4b201e606b803750cd153fb9f7a2b6062886543fd96