Submitted URL: http://logon.undp.org.adfs.ls.client-request-id.session-services.com/
Effective URL: https://logon.undp.org/adfs/ls/?client-request-id=ecf512c8-2e00-4161-8c9d-9b79a1ed3d0e&username=&wa=wsignin1.0&wtrealm=...
Submission: On May 07 via manual from US

Summary

This website contacted 3 IPs in 4 countries across 5 domains to perform 18 HTTP transactions. The main IP is 40.74.19.25, located in Amsterdam, Netherlands and belongs to MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US. The main domain is logon.undp.org.
TLS certificate: Issued by COMODO RSA Organization Validation Se... on June 14th 2018. Valid for: 2 years.
This is the only time logon.undp.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
14 111.90.142.105 45839 (SHINJIRU-...)
1 1 40.97.116.82 8075 (MICROSOFT...)
1 1 2603:1026:5::2 8075 (MICROSOFT...)
2 2 2603:1026:6:4... 8075 (MICROSOFT...)
1 1 40.126.9.67 8075 (MICROSOFT...)
3 40.74.19.25 8075 (MICROSOFT...)
18 3
Domain Requested by
14 logon.undp.org.adfs.ls.client-request-id.session-services.com logon.undp.org.adfs.ls.client-request-id.session-services.com
3 logon.undp.org logon.undp.org.adfs.ls.client-request-id.session-services.com
logon.undp.org
2 outlook.office365.com 2 redirects
1 login.microsoftonline.com 1 redirects
1 www.outlook.com 1 redirects
1 outlook.com 1 redirects
18 6

This site contains links to these domains. Also see Links.

Domain
idm.undp.org
Subject Issuer Validity Valid
logon.undp.org.adfs.ls.client-request-id.session-services.com
Let's Encrypt Authority X3
2019-04-05 -
2019-07-04
3 months crt.sh
logon.undp.org
COMODO RSA Organization Validation Secure Server CA
2018-06-14 -
2020-06-13
2 years crt.sh

This page contains 1 frames:

Primary Page: https://logon.undp.org/adfs/ls/?client-request-id=ecf512c8-2e00-4161-8c9d-9b79a1ed3d0e&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQIIAY1Ru2rbUAD1tWzFMX2E0KFjKB1KQdK9kq5eJYMfcaBxSWIsjLMYWb7XUiz7KrIUR_6CDB0ypxTajh4zlX5Bm8nQLV9QSgulUOjQoTJdOuYMhwNnOY-nHBKR9Rj-gyysWICUIsElK_Ufos3yxsfNX99yolN5-fpV-vb79r1LUEomg1Bk0XABHnlxHE4tSWJJHDA2EhmlvksUDYsuG0ts5kjvAVgCsMjrmqKZsm4iqKmmbhjIhKLqGNBUNEVQsEYFVXeo4JAskmZQt09lnNnoJn9_v5LEnrwiFvlz8jO_Tlk07oVsGl9yQb0bP6-zyrBeqVbnc7WxVz3cozYeGLX-7tmBZxLs4_aLrtOVjwLbT1m7Zo_aoX1s7_edzrg967TYbOeYTVFDTmAI3VE1Racn0Gy4SkuLkh3DDtSop8jqPOgtuFvtdsXxWf0xm1xzPAvJxB8sC-Br4Q4sWqVSeePuw-JW7ncBvCtm-77584ylT85rV5_Rp-ViLXddlE6hnsX27ROpiVFKPP1sqnUmQxKmTWlXGUSzw7Dpk9aBFxrb2EIXPLjg-S88-MGD87Xch_VbvHJTfiBDZAoQC1DfgsjCuqXio781
Frame ID: 40B38E4379A8C2FA8592D6176A0E6FD1
Requests: 18 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://logon.undp.org.adfs.ls.client-request-id.session-services.com/ Page URL
  2. https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null Page URL
  3. https://outlook.com/undp.org HTTP 301
    https://www.outlook.com/undp.org HTTP 301
    https://outlook.office365.com/undp.org HTTP 302
    https://outlook.office365.com/owa/undp.org HTTP 302
    https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redir... HTTP 302
    https://logon.undp.org/adfs/ls/?client-request-id=ecf512c8-2e00-4161-8c9d-9b79a1ed3d0e&username=&wa... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^LiteSpeed$/i

Page Statistics

18
Requests

67 %
HTTPS

33 %
IPv6

5
Domains

6
Subdomains

3
IPs

4
Countries

306 kB
Transfer

466 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://logon.undp.org.adfs.ls.client-request-id.session-services.com/ Page URL
  2. https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null Page URL
  3. https://outlook.com/undp.org HTTP 301
    https://www.outlook.com/undp.org HTTP 301
    https://outlook.office365.com/undp.org HTTP 302
    https://outlook.office365.com/owa/undp.org HTTP 302
    https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=ecf512c8-2e00-4161-8c9d-9b79a1ed3d0e&protectedtoken=true&domain_hint=undp.org&nonce=636927910649788190.4a809363-356f-47af-ae02-68fcbf25a801&state=DYtJDoAgDABBzz4FKBQKfU5d8CbGxPh9e5i5TMYaY2ZlUiyoTCUkTpUjUObaWmTwWRowEjos1F2u0p0ckBy1vq09Fc3R6ruE8Ul4r_324zl_ HTTP 302
    https://logon.undp.org/adfs/ls/?client-request-id=ecf512c8-2e00-4161-8c9d-9b79a1ed3d0e&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQIIAY1Ru2rbUAD1tWzFMX2E0KFjKB1KQdK9kq5eJYMfcaBxSWIsjLMYWb7XUiz7KrIUR_6CDB0ypxTajh4zlX5Bm8nQLV9QSgulUOjQoTJdOuYMhwNnOY-nHBKR9Rj-gyysWICUIsElK_Ufos3yxsfNX99yolN5-fpV-vb79r1LUEomg1Bk0XABHnlxHE4tSWJJHDA2EhmlvksUDYsuG0ts5kjvAVgCsMjrmqKZsm4iqKmmbhjIhKLqGNBUNEVQsEYFVXeo4JAskmZQt09lnNnoJn9_v5LEnrwiFvlz8jO_Tlk07oVsGl9yQb0bP6-zyrBeqVbnc7WxVz3cozYeGLX-7tmBZxLs4_aLrtOVjwLbT1m7Zo_aoX1s7_edzrg967TYbOeYTVFDTmAI3VE1Racn0Gy4SkuLkh3DDtSop8jqPOgtuFvtdsXxWf0xm1xzPAvJxB8sC-Br4Q4sWqVSeePuw-JW7ncBvCtm-77584ylT85rV5_Rp-ViLXddlE6hnsX27ROpiVFKPP1sqnUmQxKmTWlXGUSzw7Dpk9aBFxrb2EIXPLjg-S88-MGD87Xch_VbvHJTfiBDZAoQC1DfgsjCuqXio781 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
logon.undp.org.adfs.ls.client-request-id.session-services.com/
2 KB
939 B
Document
General
Full URL
http://logon.undp.org.adfs.ls.client-request-id.session-services.com/
Protocol
HTTP/1.1
Server
111.90.142.105 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
beaver15.steeldns.com
Software
LiteSpeed / PHP/7.0.33
Resource Hash
ca7588d24aadc1190962ce1f61aa33eb270494fbc16dde6c7b9e7978c8579b68

Request headers

Host
logon.undp.org.adfs.ls.client-request-id.session-services.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-Powered-By
PHP/7.0.33
Content-Type
text/html; charset=UTF-8
Content-Length
706
Content-Encoding
gzip
Vary
Accept-Encoding
Date
Tue, 07 May 2019 01:57:39 GMT
Server
LiteSpeed
Connection
Keep-Alive
style.css
logon.undp.org.adfs.ls.client-request-id.session-services.com/css/
519 B
582 B
Stylesheet
General
Full URL
http://logon.undp.org.adfs.ls.client-request-id.session-services.com/css/style.css
Requested by
Host: logon.undp.org.adfs.ls.client-request-id.session-services.com
URL: http://logon.undp.org.adfs.ls.client-request-id.session-services.com/
Protocol
HTTP/1.1
Server
111.90.142.105 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
beaver15.steeldns.com
Software
LiteSpeed /
Resource Hash
f464aa1c2139d184500af4b201e606b803750cd153fb9f7a2b6062886543fd96

Request headers

Referer
http://logon.undp.org.adfs.ls.client-request-id.session-services.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 07 May 2019 01:57:39 GMT
Content-Encoding
gzip
Last-Modified
Fri, 05 Apr 2019 04:24:58 GMT
Server
LiteSpeed
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
244
Expires
Tue, 14 May 2019 01:57:39 GMT
form.css
logon.undp.org.adfs.ls.client-request-id.session-services.com/css/
637 B
532 B
Stylesheet
General
Full URL
http://logon.undp.org.adfs.ls.client-request-id.session-services.com/css/form.css
Requested by
Host: logon.undp.org.adfs.ls.client-request-id.session-services.com
URL: http://logon.undp.org.adfs.ls.client-request-id.session-services.com/
Protocol
HTTP/1.1
Server
111.90.142.105 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
beaver15.steeldns.com
Software
LiteSpeed /
Resource Hash
26a4e958cac76561481745941b58680f6cce2b60f9c24f1fbcc53c188be7bda7

Request headers

Referer
http://logon.undp.org.adfs.ls.client-request-id.session-services.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 07 May 2019 01:57:40 GMT
Content-Encoding
gzip
Last-Modified
Fri, 05 Apr 2019 04:24:57 GMT
Server
LiteSpeed
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
194
Expires
Tue, 14 May 2019 01:57:40 GMT
jquery-1.12.2.min.js
logon.undp.org.adfs.ls.client-request-id.session-services.com/jquery/
95 KB
33 KB
Script
General
Full URL
http://logon.undp.org.adfs.ls.client-request-id.session-services.com/jquery/jquery-1.12.2.min.js
Requested by
Host: logon.undp.org.adfs.ls.client-request-id.session-services.com
URL: http://logon.undp.org.adfs.ls.client-request-id.session-services.com/
Protocol
HTTP/1.1
Server
111.90.142.105 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
beaver15.steeldns.com
Software
LiteSpeed /
Resource Hash
95914789b5f3307a3718679e867d61b9d4c03f749cd2e2970570331d7d6c8ed9

Request headers

Referer
http://logon.undp.org.adfs.ls.client-request-id.session-services.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 07 May 2019 01:57:40 GMT
Content-Encoding
gzip
Last-Modified
Fri, 05 Apr 2019 04:24:20 GMT
Server
LiteSpeed
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
33842
Expires
Tue, 14 May 2019 01:57:40 GMT
jquery.vegas.js
logon.undp.org.adfs.ls.client-request-id.session-services.com/jquery/
11 KB
3 KB
Script
General
Full URL
http://logon.undp.org.adfs.ls.client-request-id.session-services.com/jquery/jquery.vegas.js
Requested by
Host: logon.undp.org.adfs.ls.client-request-id.session-services.com
URL: http://logon.undp.org.adfs.ls.client-request-id.session-services.com/
Protocol
HTTP/1.1
Server
111.90.142.105 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
beaver15.steeldns.com
Software
LiteSpeed /
Resource Hash
050ed368c40670383f9861b929cf75fc55bb7962ce87fc0b61f76cbe15f5986f

Request headers

Referer
http://logon.undp.org.adfs.ls.client-request-id.session-services.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 07 May 2019 01:57:40 GMT
Content-Encoding
gzip
Last-Modified
Fri, 05 Apr 2019 04:24:28 GMT
Server
LiteSpeed
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
2411
Expires
Tue, 14 May 2019 01:57:40 GMT
jquery-migrate-1.4.0.min.js
logon.undp.org.adfs.ls.client-request-id.session-services.com/jquery/
0
0

indexc.php
logon.undp.org.adfs.ls.client-request-id.session-services.com/
6 KB
2 KB
Document
General
Full URL
https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null
Requested by
Host: logon.undp.org.adfs.ls.client-request-id.session-services.com
URL: http://logon.undp.org.adfs.ls.client-request-id.session-services.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
111.90.142.105 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
beaver15.steeldns.com
Software
LiteSpeed / PHP/7.0.33
Resource Hash
efcec7a972147e788b378724ec9c31538ea031a347747a86e08693261756cb70

Request headers

:method
GET
:authority
logon.undp.org.adfs.ls.client-request-id.session-services.com
:scheme
https
:path
/indexc.php?dd=&dl=null
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
http://logon.undp.org.adfs.ls.client-request-id.session-services.com/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://logon.undp.org.adfs.ls.client-request-id.session-services.com/

Response headers

status
200
x-powered-by
PHP/7.0.33
content-type
text/html; charset=UTF-8
content-length
2031
content-encoding
br
vary
Accept-Encoding
date
Tue, 07 May 2019 01:57:41 GMT
server
LiteSpeed
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
style.css
logon.undp.org.adfs.ls.client-request-id.session-services.com/css/
519 B
307 B
Stylesheet
General
Full URL
https://logon.undp.org.adfs.ls.client-request-id.session-services.com/css/style.css
Requested by
Host: logon.undp.org.adfs.ls.client-request-id.session-services.com
URL: https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
111.90.142.105 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
beaver15.steeldns.com
Software
LiteSpeed /
Resource Hash
f464aa1c2139d184500af4b201e606b803750cd153fb9f7a2b6062886543fd96

Request headers

Referer
https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 07 May 2019 01:57:41 GMT
content-encoding
br
last-modified
Fri, 05 Apr 2019 04:24:58 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
189
expires
Tue, 14 May 2019 01:57:41 GMT
form.css
logon.undp.org.adfs.ls.client-request-id.session-services.com/css/
637 B
209 B
Stylesheet
General
Full URL
https://logon.undp.org.adfs.ls.client-request-id.session-services.com/css/form.css
Requested by
Host: logon.undp.org.adfs.ls.client-request-id.session-services.com
URL: https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
111.90.142.105 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
beaver15.steeldns.com
Software
LiteSpeed /
Resource Hash
26a4e958cac76561481745941b58680f6cce2b60f9c24f1fbcc53c188be7bda7

Request headers

Referer
https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 07 May 2019 01:57:41 GMT
content-encoding
br
last-modified
Fri, 05 Apr 2019 04:24:57 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
143
expires
Tue, 14 May 2019 01:57:41 GMT
jquery-1.11.1.min.js
logon.undp.org.adfs.ls.client-request-id.session-services.com/
94 KB
32 KB
Script
General
Full URL
https://logon.undp.org.adfs.ls.client-request-id.session-services.com/jquery-1.11.1.min.js
Requested by
Host: logon.undp.org.adfs.ls.client-request-id.session-services.com
URL: https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
111.90.142.105 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
beaver15.steeldns.com
Software
LiteSpeed /
Resource Hash
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

Referer
https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 07 May 2019 01:57:41 GMT
content-encoding
br
last-modified
Fri, 05 Apr 2019 04:23:41 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
32330
expires
Tue, 14 May 2019 01:57:41 GMT
RSA.js
logon.undp.org.adfs.ls.client-request-id.session-services.com/
15 KB
4 KB
Script
General
Full URL
https://logon.undp.org.adfs.ls.client-request-id.session-services.com/RSA.js
Requested by
Host: logon.undp.org.adfs.ls.client-request-id.session-services.com
URL: https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
111.90.142.105 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
beaver15.steeldns.com
Software
LiteSpeed /
Resource Hash
be727537e7ee65c72af89cdc0e289046a4f50693b5cbecf470887b107e98c3eb

Request headers

Referer
https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 07 May 2019 01:57:41 GMT
content-encoding
br
last-modified
Fri, 05 Apr 2019 04:23:44 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
4092
expires
Tue, 14 May 2019 01:57:41 GMT
jquery.vegas.js
logon.undp.org.adfs.ls.client-request-id.session-services.com/jquery/
11 KB
2 KB
Script
General
Full URL
https://logon.undp.org.adfs.ls.client-request-id.session-services.com/jquery/jquery.vegas.js
Requested by
Host: logon.undp.org.adfs.ls.client-request-id.session-services.com
URL: https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
111.90.142.105 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
beaver15.steeldns.com
Software
LiteSpeed /
Resource Hash
050ed368c40670383f9861b929cf75fc55bb7962ce87fc0b61f76cbe15f5986f

Request headers

Referer
https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 07 May 2019 01:57:41 GMT
content-encoding
br
last-modified
Fri, 05 Apr 2019 04:24:28 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
2226
expires
Tue, 14 May 2019 01:57:41 GMT
jquery-migrate-1.2.1.min.js
logon.undp.org.adfs.ls.client-request-id.session-services.com/
7 KB
3 KB
Script
General
Full URL
https://logon.undp.org.adfs.ls.client-request-id.session-services.com/jquery-migrate-1.2.1.min.js
Requested by
Host: logon.undp.org.adfs.ls.client-request-id.session-services.com
URL: https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
111.90.142.105 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
beaver15.steeldns.com
Software
LiteSpeed /
Resource Hash
1e67d8dbcca1f6fd94e077c85c2fb40fa1c2756c99238daa8da882144260a68d

Request headers

Referer
https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 07 May 2019 01:57:41 GMT
content-encoding
br
last-modified
Fri, 05 Apr 2019 04:23:39 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
2876
expires
Tue, 14 May 2019 01:57:41 GMT
btn.png
logon.undp.org.adfs.ls.client-request-id.session-services.com/img/
469 B
541 B
Image
General
Full URL
https://logon.undp.org.adfs.ls.client-request-id.session-services.com/img/btn.png
Requested by
Host: logon.undp.org.adfs.ls.client-request-id.session-services.com
URL: https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
111.90.142.105 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
beaver15.steeldns.com
Software
LiteSpeed /
Resource Hash
0a840a7827b7cfe56d8312470d5ea5a7a6125639e05e756ebbb019008bc84435

Request headers

Referer
https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 07 May 2019 01:57:41 GMT
last-modified
Fri, 05 Apr 2019 04:23:52 GMT
server
LiteSpeed
content-type
image/png
status
200
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
469
expires
Tue, 14 May 2019 01:57:41 GMT
nestatic.php
logon.undp.org.adfs.ls.client-request-id.session-services.com/
4 B
69 B
Image
General
Full URL
https://logon.undp.org.adfs.ls.client-request-id.session-services.com/nestatic.php?id=
Requested by
Host: logon.undp.org.adfs.ls.client-request-id.session-services.com
URL: https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
111.90.142.105 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
beaver15.steeldns.com
Software
LiteSpeed / PHP/7.0.33
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 07 May 2019 01:57:42 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/7.0.33
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
status
200
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
8
Primary Request /
logon.undp.org/adfs/ls/
Redirect Chain
  • https://outlook.com/undp.org
  • https://www.outlook.com/undp.org
  • https://outlook.office365.com/undp.org
  • https://outlook.office365.com/owa/undp.org
  • https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-0...
  • https://logon.undp.org/adfs/ls/?client-request-id=ecf512c8-2e00-4161-8c9d-9b79a1ed3d0e&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQIIA...
18 KB
18 KB
Document
General
Full URL
https://logon.undp.org/adfs/ls/?client-request-id=ecf512c8-2e00-4161-8c9d-9b79a1ed3d0e&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQIIAY1Ru2rbUAD1tWzFMX2E0KFjKB1KQdK9kq5eJYMfcaBxSWIsjLMYWb7XUiz7KrIUR_6CDB0ypxTajh4zlX5Bm8nQLV9QSgulUOjQoTJdOuYMhwNnOY-nHBKR9Rj-gyysWICUIsElK_Ufos3yxsfNX99yolN5-fpV-vb79r1LUEomg1Bk0XABHnlxHE4tSWJJHDA2EhmlvksUDYsuG0ts5kjvAVgCsMjrmqKZsm4iqKmmbhjIhKLqGNBUNEVQsEYFVXeo4JAskmZQt09lnNnoJn9_v5LEnrwiFvlz8jO_Tlk07oVsGl9yQb0bP6-zyrBeqVbnc7WxVz3cozYeGLX-7tmBZxLs4_aLrtOVjwLbT1m7Zo_aoX1s7_edzrg967TYbOeYTVFDTmAI3VE1Racn0Gy4SkuLkh3DDtSop8jqPOgtuFvtdsXxWf0xm1xzPAvJxB8sC-Br4Q4sWqVSeePuw-JW7ncBvCtm-77584ylT85rV5_Rp-ViLXddlE6hnsX27ROpiVFKPP1sqnUmQxKmTWlXGUSzw7Dpk9aBFxrb2EIXPLjg-S88-MGD87Xch_VbvHJTfiBDZAoQC1DfgsjCuqXio781
Requested by
Host: logon.undp.org.adfs.ls.client-request-id.session-services.com
URL: https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.74.19.25 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
33406c206dfb5dd0dfb206460175528e25eebe7cc6483e45cfaa0995cb6e4324
Security Headers
Name Value
X-Frame-Options DENY

Request headers

Host
logon.undp.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://logon.undp.org.adfs.ls.client-request-id.session-services.com/indexc.php?dd=&dl=null

Response headers

Cache-Control
no-cache,no-store
Pragma
no-cache
Content-Length
18215
Content-Type
text/html; charset=utf-8
Expires
-1
Server
Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
x-frame-options
DENY
Date
Tue, 07 May 2019 01:57:45 GMT

Redirect headers

Cache-Control
no-cache, no-store
Pragma
no-cache
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Expires
-1
Location
https://logon.undp.org/adfs/ls/?client-request-id=ecf512c8-2e00-4161-8c9d-9b79a1ed3d0e&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQIIAY1Ru2rbUAD1tWzFMX2E0KFjKB1KQdK9kq5eJYMfcaBxSWIsjLMYWb7XUiz7KrIUR_6CDB0ypxTajh4zlX5Bm8nQLV9QSgulUOjQoTJdOuYMhwNnOY-nHBKR9Rj-gyysWICUIsElK_Ufos3yxsfNX99yolN5-fpV-vb79r1LUEomg1Bk0XABHnlxHE4tSWJJHDA2EhmlvksUDYsuG0ts5kjvAVgCsMjrmqKZsm4iqKmmbhjIhKLqGNBUNEVQsEYFVXeo4JAskmZQt09lnNnoJn9_v5LEnrwiFvlz8jO_Tlk07oVsGl9yQb0bP6-zyrBeqVbnc7WxVz3cozYeGLX-7tmBZxLs4_aLrtOVjwLbT1m7Zo_aoX1s7_edzrg967TYbOeYTVFDTmAI3VE1Racn0Gy4SkuLkh3DDtSop8jqPOgtuFvtdsXxWf0xm1xzPAvJxB8sC-Br4Q4sWqVSeePuw-JW7ncBvCtm-77584ylT85rV5_Rp-ViLXddlE6hnsX27ROpiVFKPP1sqnUmQxKmTWlXGUSzw7Dpk9aBFxrb2EIXPLjg-S88-MGD87Xch_VbvHJTfiBDZAoQC1DfgsjCuqXio781
Vary
Accept-Encoding
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
x-ms-request-id
6f3bfca0-2879-4388-b2d3-31c9d0aa0700
P3P
CP="DSP CUR OTPi IND OTRi ONL FIN"
Set-Cookie
buid=AQABAAEAAADCoMpjJXrxTq9VG9te-7FXz1Ohc7x3IkM58qzOdd6M3hOMZiqrSyctGanEvpd7qfY2-ks-SETBD8f90sqs0rDUD-fb0nqETqmLDnGfdpREGGblWbwmRY2Dk6Ct0fkh6LcgAA; expires=Thu, 06-Jun-2019 01:57:45 GMT; path=/; secure; HttpOnly fpc=Ao3GPSyhgxhNi3Zfnlj5kuU-NjKRAQAAABndYtQOAAAA; expires=Thu, 06-Jun-2019 01:57:45 GMT; path=/; secure; HttpOnly esctx=AQABAAAAAADCoMpjJXrxTq9VG9te-7FXuNsj3FW-4QXBl2XdJI0uSjfXij49z_95wxWobVKRnlLV0zSeBGgtj6WuhqrkYf91cn2H-2K1EeSoCfLqTTX4B9eA9xRMMc7IxRoult0OqJkWwzaR0HDXlSeZusO4Vc5dr6SlNF4RlqKaEpzO_QuadKUL9zmR9dvn8bPAonl5H5YgAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly x-ms-gateway-slice=prod; path=/; secure; HttpOnly stsservicecookie=ests; path=/; secure; HttpOnly
Date
Tue, 07 May 2019 01:57:44 GMT
Content-Length
758
style.css
logon.undp.org/adfs/portal/css/
8 KB
8 KB
Stylesheet
General
Full URL
https://logon.undp.org/adfs/portal/css/style.css?id=0A13280A86E7DFA6949BD016EA848912FCAFC05E88CBEDF538AC325B27041205
Requested by
Host: logon.undp.org
URL: https://logon.undp.org/adfs/ls/?client-request-id=ecf512c8-2e00-4161-8c9d-9b79a1ed3d0e&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQIIAY1Ru2rbUAD1tWzFMX2E0KFjKB1KQdK9kq5eJYMfcaBxSWIsjLMYWb7XUiz7KrIUR_6CDB0ypxTajh4zlX5Bm8nQLV9QSgulUOjQoTJdOuYMhwNnOY-nHBKR9Rj-gyysWICUIsElK_Ufos3yxsfNX99yolN5-fpV-vb79r1LUEomg1Bk0XABHnlxHE4tSWJJHDA2EhmlvksUDYsuG0ts5kjvAVgCsMjrmqKZsm4iqKmmbhjIhKLqGNBUNEVQsEYFVXeo4JAskmZQt09lnNnoJn9_v5LEnrwiFvlz8jO_Tlk07oVsGl9yQb0bP6-zyrBeqVbnc7WxVz3cozYeGLX-7tmBZxLs4_aLrtOVjwLbT1m7Zo_aoX1s7_edzrg967TYbOeYTVFDTmAI3VE1Racn0Gy4SkuLkh3DDtSop8jqPOgtuFvtdsXxWf0xm1xzPAvJxB8sC-Br4Q4sWqVSeePuw-JW7ncBvCtm-77584ylT85rV5_Rp-ViLXddlE6hnsX27ROpiVFKPP1sqnUmQxKmTWlXGUSzw7Dpk9aBFxrb2EIXPLjg-S88-MGD87Xch_VbvHJTfiBDZAoQC1DfgsjCuqXio781
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.74.19.25 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
0a13280a86e7dfa6949bd016ea848912fcafc05e88cbedf538ac325b27041205

Request headers

Referer
https://logon.undp.org/adfs/ls/?client-request-id=ecf512c8-2e00-4161-8c9d-9b79a1ed3d0e&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQIIAY1Ru2rbUAD1tWzFMX2E0KFjKB1KQdK9kq5eJYMfcaBxSWIsjLMYWb7XUiz7KrIUR_6CDB0ypxTajh4zlX5Bm8nQLV9QSgulUOjQoTJdOuYMhwNnOY-nHBKR9Rj-gyysWICUIsElK_Ufos3yxsfNX99yolN5-fpV-vb79r1LUEomg1Bk0XABHnlxHE4tSWJJHDA2EhmlvksUDYsuG0ts5kjvAVgCsMjrmqKZsm4iqKmmbhjIhKLqGNBUNEVQsEYFVXeo4JAskmZQt09lnNnoJn9_v5LEnrwiFvlz8jO_Tlk07oVsGl9yQb0bP6-zyrBeqVbnc7WxVz3cozYeGLX-7tmBZxLs4_aLrtOVjwLbT1m7Zo_aoX1s7_edzrg967TYbOeYTVFDTmAI3VE1Racn0Gy4SkuLkh3DDtSop8jqPOgtuFvtdsXxWf0xm1xzPAvJxB8sC-Br4Q4sWqVSeePuw-JW7ncBvCtm-77584ylT85rV5_Rp-ViLXddlE6hnsX27ROpiVFKPP1sqnUmQxKmTWlXGUSzw7Dpk9aBFxrb2EIXPLjg-S88-MGD87Xch_VbvHJTfiBDZAoQC1DfgsjCuqXio781
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 07 May 2019 01:57:45 GMT
Server
Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
Content-Type
text/css
ETag
0A13280A86E7DFA6949BD016EA848912FCAFC05E88CBEDF538AC325B27041205
Content-Length
8144
Expires
Thu, 06 Jun 2019 01:57:45 GMT
illustration.jpg
logon.undp.org/adfs/portal/illustration/
197 KB
198 KB
Image
General
Full URL
https://logon.undp.org/adfs/portal/illustration/illustration.jpg?id=B2EC1B27321F05546E996C4A95E20E8E1EB4A120F06DAE1D7CB5881FE3A82EED
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.74.19.25 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
b2ec1b27321f05546e996c4a95e20e8e1eb4a120f06dae1d7cb5881fe3a82eed

Request headers

Referer
https://logon.undp.org/adfs/ls/?client-request-id=ecf512c8-2e00-4161-8c9d-9b79a1ed3d0e&username=&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQIIAY1Ru2rbUAD1tWzFMX2E0KFjKB1KQdK9kq5eJYMfcaBxSWIsjLMYWb7XUiz7KrIUR_6CDB0ypxTajh4zlX5Bm8nQLV9QSgulUOjQoTJdOuYMhwNnOY-nHBKR9Rj-gyysWICUIsElK_Ufos3yxsfNX99yolN5-fpV-vb79r1LUEomg1Bk0XABHnlxHE4tSWJJHDA2EhmlvksUDYsuG0ts5kjvAVgCsMjrmqKZsm4iqKmmbhjIhKLqGNBUNEVQsEYFVXeo4JAskmZQt09lnNnoJn9_v5LEnrwiFvlz8jO_Tlk07oVsGl9yQb0bP6-zyrBeqVbnc7WxVz3cozYeGLX-7tmBZxLs4_aLrtOVjwLbT1m7Zo_aoX1s7_edzrg967TYbOeYTVFDTmAI3VE1Racn0Gy4SkuLkh3DDtSop8jqPOgtuFvtdsXxWf0xm1xzPAvJxB8sC-Br4Q4sWqVSeePuw-JW7ncBvCtm-77584ylT85rV5_Rp-ViLXddlE6hnsX27ROpiVFKPP1sqnUmQxKmTWlXGUSzw7Dpk9aBFxrb2EIXPLjg-S88-MGD87Xch_VbvHJTfiBDZAoQC1DfgsjCuqXio781
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 07 May 2019 01:57:45 GMT
Server
Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
Content-Type
image/jpg
ETag
B2EC1B27321F05546E996C4A95E20E8E1EB4A120F06DAE1D7CB5881FE3A82EED
Content-Length
202041
Expires
Thu, 06 Jun 2019 01:57:45 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
logon.undp.org.adfs.ls.client-request-id.session-services.com
URL
http://logon.undp.org.adfs.ls.client-request-id.session-services.com/jquery/jquery-migrate-1.4.0.min.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| LoginErrors number| maxPasswordLength function| InputUtil function| SelectOption function| Login undefined| emails undefined| msViewportStyle undefined| viewport function| getStyle function| computeLoadIllustration function| SetIllustrationImage

0 Cookies