login.microsoftonline.de
Open in
urlscan Pro
51.5.145.223
Malicious Activity!
Public Scan
Effective URL: https://login.microsoftonline.de/e4bd8287-ab2f-445c-8bde-fe5c68d99b00/oauth2/v2.0/authorize?client_id=0ff4134b-a50b-43e6-85f1-ff0...
Submission: On April 12 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by D-TRUST SSL Class 3 CA 1 2009 on February 11th 2021. Valid for: a year.
This is the only time login.microsoftonline.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 157.90.5.43 157.90.5.43 | 24940 (HETZNER-AS) (HETZNER-AS) | |
2 | 51.5.145.223 51.5.145.223 | 200517 (MS-DEUTSC...) (MS-DEUTSCHLAND) | |
1 | 20.190.159.136 20.190.159.136 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
7 | 152.199.23.37 152.199.23.37 | 15133 (EDGECAST) (EDGECAST) | |
2 | 152.199.23.72 152.199.23.72 | 15133 (EDGECAST) (EDGECAST) | |
12 | 4 |
ASN24940 (HETZNER-AS, DE)
PTR: static.43.5.90.157.clients.your-server.de
auth.dev.lition.de |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
msftauth.net
aadcdn.msftauth.net |
184 KB |
2 |
msauthimages.net
aadcdn.msauthimages.net |
282 KB |
2 |
microsoftonline.de
login.microsoftonline.de |
101 KB |
2 |
lition.de
2 redirects
auth.dev.lition.de |
546 B |
1 |
live.com
login.live.com |
|
12 | 5 |
Domain | Requested by | |
---|---|---|
7 | aadcdn.msftauth.net |
login.microsoftonline.de
|
2 | aadcdn.msauthimages.net |
login.microsoftonline.de
|
2 | login.microsoftonline.de |
login.microsoftonline.de
|
2 | auth.dev.lition.de | 2 redirects |
1 | login.live.com |
login.microsoftonline.de
|
12 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.microsoft.com |
privacy.microsoft.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
login.microsoftonline.de D-TRUST SSL Class 3 CA 1 2009 |
2021-02-11 - 2022-02-11 |
a year | crt.sh |
graph.windows.net DigiCert SHA2 Secure Server CA |
2021-03-04 - 2022-03-04 |
a year | crt.sh |
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA |
2020-07-09 - 2021-07-09 |
a year | crt.sh |
aadcdn.msauthimages.net Microsoft Azure TLS Issuing CA 06 |
2020-09-03 - 2021-08-29 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://login.microsoftonline.de/e4bd8287-ab2f-445c-8bde-fe5c68d99b00/oauth2/v2.0/authorize?client_id=0ff4134b-a50b-43e6-85f1-ff019612ea65&nonce=uuDNwO5RPu5hAnY79Vx1CVTEHXertWlY&redirect_uri=https%3A%2F%2Fauth.dev.lition.de%2Fauth%2Foauth2%2Fazure%2Fauthorization-code-callback&response_type=code&scope=openid+email+profile&state=af49d23b-3969-4277-b3b1-36c3c0e7da0c&sso_reload=true
Frame ID: 7DA3426A11BDAEE98A4F447832052F5B
Requests: 12 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://auth.dev.lition.de/
HTTP 302
https://auth.dev.lition.de/auth/oauth2/azure?redirect_url=https%3A%2F%2Fauth.dev.lition.de%2F HTTP 302
https://login.microsoftonline.de/e4bd8287-ab2f-445c-8bde-fe5c68d99b00/oauth2/v2.0/authorize?client_id=0ff4134... Page URL
- https://login.microsoftonline.de/e4bd8287-ab2f-445c-8bde-fe5c68d99b00/oauth2/v2.0/authorize?client_id=0ff4134... Page URL
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Terms of use
Search URL Search Domain Scan URL
Title: Privacy & cookies
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://auth.dev.lition.de/
HTTP 302
https://auth.dev.lition.de/auth/oauth2/azure?redirect_url=https%3A%2F%2Fauth.dev.lition.de%2F HTTP 302
https://login.microsoftonline.de/e4bd8287-ab2f-445c-8bde-fe5c68d99b00/oauth2/v2.0/authorize?client_id=0ff4134b-a50b-43e6-85f1-ff019612ea65&nonce=uuDNwO5RPu5hAnY79Vx1CVTEHXertWlY&redirect_uri=https%3A%2F%2Fauth.dev.lition.de%2Fauth%2Foauth2%2Fazure%2Fauthorization-code-callback&response_type=code&scope=openid+email+profile&state=af49d23b-3969-4277-b3b1-36c3c0e7da0c Page URL
- https://login.microsoftonline.de/e4bd8287-ab2f-445c-8bde-fe5c68d99b00/oauth2/v2.0/authorize?client_id=0ff4134b-a50b-43e6-85f1-ff019612ea65&nonce=uuDNwO5RPu5hAnY79Vx1CVTEHXertWlY&redirect_uri=https%3A%2F%2Fauth.dev.lition.de%2Fauth%2Foauth2%2Fazure%2Fauthorization-code-callback&response_type=code&scope=openid+email+profile&state=af49d23b-3969-4277-b3b1-36c3c0e7da0c&sso_reload=true Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://auth.dev.lition.de/ HTTP 302
- https://auth.dev.lition.de/auth/oauth2/azure?redirect_url=https%3A%2F%2Fauth.dev.lition.de%2F HTTP 302
- https://login.microsoftonline.de/e4bd8287-ab2f-445c-8bde-fe5c68d99b00/oauth2/v2.0/authorize?client_id=0ff4134b-a50b-43e6-85f1-ff019612ea65&nonce=uuDNwO5RPu5hAnY79Vx1CVTEHXertWlY&redirect_uri=https%3A%2F%2Fauth.dev.lition.de%2Fauth%2Foauth2%2Fazure%2Fauthorization-code-callback&response_type=code&scope=openid+email+profile&state=af49d23b-3969-4277-b3b1-36c3c0e7da0c
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Cookie set
authorize
login.microsoftonline.de/e4bd8287-ab2f-445c-8bde-fe5c68d99b00/oauth2/v2.0/ Redirect Chain
|
146 KB 53 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
Cookie set
authorize
login.microsoftonline.de/e4bd8287-ab2f-445c-8bde-fe5c68d99b00/oauth2/v2.0/ |
183 KB 48 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Me.htm
login.live.com/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ConvergedLogin_PCore_4rDcu3CeBBnX_W5sFR0hMw2.js
aadcdn.msftauth.net/shared/1.0/content/js/ |
430 KB 118 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msftauth.net/shared/1.0/content/images/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
converged.v2.login.min_kb8fbtudybay5t8ts3k87g2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
0 19 KB |
Other
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ux.converged.login.strings-en.min_r8qeyuqc-ou9fp3gsplqeq2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
0 12 KB |
Other
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
illustration
aadcdn.msauthimages.net/c1c6b6c8-hkcimxmtg-q7ue5yn1athu5psrxanyol-l2mxqvqdfe/logintenantbranding/0/ |
278 KB 278 KB |
Image
image/* |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bannerlogo
aadcdn.msauthimages.net/c1c6b6c8-hkcimxmtg-q7ue5yn1athu5psrxanyol-l2mxqvqdfe/logintenantbranding/0/ |
4 KB 4 KB |
Image
image/* |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
signin-options_4e48046ce74f4b89d45037c90576bfac.svg
aadcdn.msftauth.net/shared/1.0/content/images/ |
2 KB 795 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
converged.v2.login.min_kb8fbtudybay5t8ts3k87g2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
105 KB 19 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ux.converged.login.strings-en.min_r8qeyuqc-ou9fp3gsplqeq2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
42 KB 12 KB |
Fetch
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)25 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B object| ServerData object| webpackJsonp object| ko object| PROOF object| StringRepository boolean| __ConvergedLogin_PCore boolean| __6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.login.microsoftonline.de/ | Name: brcap Value: 0 |
|
login.microsoftonline.de/ | Name: buid Value: 0.AAAAh4K95C-rXESL3v5caNmbAEsT9A8LpeZDhfH_AZYS6mVLAAA.AQABAAEAAQByZhIlaikjSaFnkhUEQoZXl2ypfRUbmqux2fBzwUCu3U4jJhiUusAo3OVhCaj_X3f8MsGiDxYPC7F625DHxYcqvTQyL6EVUWnDAvX807LxdEBWgG2WMkJR2cJwFuP9YkcgAA |
|
login.microsoftonline.de/ | Name: fpc Value: AnzS6Qe7aGFPj1ksF0MFUKJqwDHUAQAAAHE-BtgOAAAA |
|
login.microsoftonline.de/ | Name: SSOCOOKIEPULLED Value: 1 |
|
.login.microsoftonline.de/ | Name: esctx Value: AQABAAAAAQByZhIlaikjSaFnkhUEQoZXpphBUFSO9nw_Mf_-w7wmw0ZLcQRJ91N2jbdTOpfLmnxpqDNgSNKxYzFTu1fS3fZRMnFrABCe8gQ0_d1mX5IWEhap5mTQ7hlS9em85qGxszfTSquUmNY1W446-j_0OqjV5dUusFCyubnPVjJcAbZ4t0LV0OYfcBO5oE6vuLdLxukgAA |
|
.login.microsoftonline.de/ | Name: AADSSO Value: NA|NoExtension |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains |
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msauthimages.net
aadcdn.msftauth.net
auth.dev.lition.de
login.live.com
login.microsoftonline.de
152.199.23.37
152.199.23.72
157.90.5.43
20.190.159.136
51.5.145.223
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
1b31b0ffabf72e2545aaad397417ba58f66eb3d57a232e115085136a497ffb34
21ebac5a95ef2d51efecac34814cf3c78aeef869e60ac4a09d98533035013292
27a4d381add738c4e11b4938510d5123ed0450d6422baa350f107e091b8fb1b0
395c1b77802b99fb2c88dc55705a8391a1f3611fadd4cadf8ec3d58bbd2867c7
859792213b82a19fc7ef5f96b60f8f3248bc692e35d3d12d95856b4ebbab373b
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
96dbae95d374b139c6abe1863b8ced632f56d59ce6badbc3eab8bdea0dcef1ab
cb126357ef7a354db9e774c80a5daba4d8e5f96a4a8281583dae8320a0cc7f88
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855