qs-csat-cis.azurewebsites.net Open in urlscan Pro
168.63.5.231 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://qs-csat-cis.azurewebsites.net/#/login
Effective URL:
https://qs-csat-cis.azurewebsites.net/
Submission: On June 24 via manual (June 24th 2022, 1:01:14 pm UTC) from SG — Scanned from NL

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 13 HTTP transactions. The main IP is 168.63.5.231, located in Amsterdam, Netherlands and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is qs-csat-cis.azurewebsites.net.
TLS certificate: Issued by Microsoft Azure TLS Issuing CA 01 on March 14th 2022. Valid for: a year.

This is the only time qs-csat-cis.azurewebsites.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
10	168.63.5.231 168.63.5.231	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:5614	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.89.8.132 104.89.8.132	16625 (AKAMAI-AS) (AKAMAI-AS)
13	4

10 168.63.5.231 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

qs-csat-cis.azurewebsites.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
getlatestversion.azurewebsites.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5614 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.89.8.132 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-89-8-132.deploy.static.akamaitechnologies.com

static2.sharepointonline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	azurewebsites.net qs-csat-cis.azurewebsites.net getlatestversion.azurewebsites.net	2 MB
1	sharepointonline.com static2.sharepointonline.com — Cisco Umbrella Rank: 2312	36 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 429	20 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 231	3 KB
13	4

	Domain	Requested by
9	qs-csat-cis.azurewebsites.net	qs-csat-cis.azurewebsites.net
1	getlatestversion.azurewebsites.net	qs-csat-cis.azurewebsites.net
1	static2.sharepointonline.com	qs-csat-cis.azurewebsites.net
1	cdn.jsdelivr.net	qs-csat-cis.azurewebsites.net
1	cdnjs.cloudflare.com	qs-csat-cis.azurewebsites.net
13	5

This site contains no links.

Subject Issuer	Validity	Valid
*.azurewebsites.net Microsoft Azure TLS Issuing CA 01	`2022-03-14` - `2023-03-09`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-09-21` - `2022-09-20`	a year	crt.sh
*.sharepointonline.com Microsoft RSA TLS CA 01	`2022-04-26` - `2023-04-26`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://qs-csat-cis.azurewebsites.net/
Frame ID: 34374766AEA5F3A3D701CC5F65B0B7DA
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

CSAT

Detected technologies

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

13
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

5
Subdomains

4
IPs

3
Countries

2161 kB
Transfer

6074 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
qs-csat-cis.azurewebsites.net/ 3 KB
3 KB 91ms
34ms Document
text/html 168.63.5.231
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://qs-csat-cis.azurewebsites.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 168.63.5.231 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 8c66248d0963818e3752c33f310a7c1bc751d3ec2e6613079e71d1e6dd31e503

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 2011
Content-Type: text/html
Date: Fri, 24 Jun 2022 13:01:07 GMT
ETag: "1d8137fe3bcb5f0"
Last-Modified: Thu, 27 Jan 2022 13:15:01 GMT
Server: Microsoft-IIS/10.0
Vary: Accept-Encoding
X-Powered-By: ASP.NET

GET
H/1.1 200
OK fabric.min.css
qs-csat-cis.azurewebsites.net/css/ 270 KB
41 KB 21ms
21ms Stylesheet
text/css 168.63.5.231
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://qs-csat-cis.azurewebsites.net/css/fabric.min.css
Requested by: Host: qs-csat-cis.azurewebsites.net
URL: https://qs-csat-cis.azurewebsites.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 168.63.5.231 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: a0a4a2aef0de563eabeb4c13b672b2865b285dc2e878411e8f24c6b339ab4310

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://qs-csat-cis.azurewebsites.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 24 Jun 2022 13:01:07 GMT
Content-Encoding: gzip
ETag: "1d7bbfa8b0b81b0"
Last-Modified: Fri, 08 Oct 2021 04:11:18 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: text/css
Transfer-Encoding: chunked
Accept-Ranges: bytes

GET
H/1.1 200
OK 2.fe0b2838.chunk.css
qs-csat-cis.azurewebsites.net/static/css/ 99 KB
23 KB 73ms
39ms Stylesheet
text/css 168.63.5.231
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://qs-csat-cis.azurewebsites.net/static/css/2.fe0b2838.chunk.css
Requested by: Host: qs-csat-cis.azurewebsites.net
URL: https://qs-csat-cis.azurewebsites.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 168.63.5.231 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: d1583bc35aa31eeb2ec76a80c979ffe6e640dd963106b23e8fd64c52fefc6d81

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://qs-csat-cis.azurewebsites.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 24 Jun 2022 13:01:07 GMT
Content-Encoding: gzip
ETag: "1d8137fe3bd3505"
Last-Modified: Thu, 27 Jan 2022 13:15:01 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: text/css
Transfer-Encoding: chunked
Accept-Ranges: bytes

GET
H/1.1 200
OK main.d4bfacad.chunk.css
qs-csat-cis.azurewebsites.net/static/css/ 78 KB
20 KB 101ms
65ms Stylesheet
text/css 168.63.5.231
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://qs-csat-cis.azurewebsites.net/static/css/main.d4bfacad.chunk.css
Requested by: Host: qs-csat-cis.azurewebsites.net
URL: https://qs-csat-cis.azurewebsites.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 168.63.5.231 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: cab84410229e81e3f6333968ed673a094fc9c227e6e71a21fade87e5b28d188d

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://qs-csat-cis.azurewebsites.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 24 Jun 2022 13:01:07 GMT
Content-Encoding: gzip
ETag: "1d8137fe3bd8f10"
Last-Modified: Thu, 27 Jan 2022 13:15:01 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: text/css
Transfer-Encoding: chunked
Accept-Ranges: bytes

GET
H/1.1 200
OK backspace-disabler.min.js Show response
qs-csat-cis.azurewebsites.net/js/ 782 B
1 KB 72ms
36ms Script
application/javascript 168.63.5.231
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://qs-csat-cis.azurewebsites.net/js/backspace-disabler.min.js
Requested by: Host: qs-csat-cis.azurewebsites.net
URL: https://qs-csat-cis.azurewebsites.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 168.63.5.231 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 46ad423cf733aefbe3f5c0b10802fd6483ef12123e068fc5e1b53550a840b448

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://qs-csat-cis.azurewebsites.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 24 Jun 2022 13:01:07 GMT
Content-Encoding: gzip
ETag: "1d7bbfa8b0fb40e"
Last-Modified: Fri, 08 Oct 2021 04:11:18 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 610

GET
H2 200 rgbcolor.min.js Show response
cdnjs.cloudflare.com/ajax/libs/canvg/1.4/ 5 KB
3 KB 81ms
28ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/canvg/1.4/rgbcolor.min.js

Requested by

Host: qs-csat-cis.azurewebsites.net
URL: https://qs-csat-cis.azurewebsites.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e492458614af605026f47dc1921481c653bad4f140230b5afb6334ca1c9d1dd2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://qs-csat-cis.azurewebsites.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 24 Jun 2022 13:01:08 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 104024
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1950
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:09:06 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e22-126c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8aHU5c%2BQnMccN%2BhfXKAOLkuoVmqVoZjZm6rxbH0RAOfpaBnEcs2yIHNrjfAuhkC2E9qeHq16i2HfNuWEIldE7II60hd90UOz02Xy6kmPeGvNakYxTl4nxJOSRNjs4V3v9HakGFXMmB4%2BogweNvp9bQC5"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 7205a67e7d85bbad-FRA
expires: Wed, 14 Jun 2023 13:01:08 GMT

GET
H2 200 canvg.min.js Show response
cdn.jsdelivr.net/npm/canvg/dist/browser/ 74 KB
20 KB 83ms
31ms Script
application/javascript 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/canvg/dist/browser/canvg.min.js

Requested by

Host: qs-csat-cis.azurewebsites.net
URL: https://qs-csat-cis.azurewebsites.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3226e7ec1c9827829494460fd12f28a89fbd59b03cfc83caf1ff79c9de9a4887

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://qs-csat-cis.azurewebsites.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Fri, 24 Jun 2022 13:01:08 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 41238
x-jsd-version: 2.0.0
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19169-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"1292e-bHske1iD8tcSOx+eEoCJsr69QZ8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AHD6wxVZ5ilU1L%2FbGWCiBtB8GiO0%2FfqekZfNSRUz8JOdF4Zr8FR2TKF6cRygmDT0GUg1raH1cwDsbI3Dtxyb5snsi6sqbYhPJXzHHBwhIOQLM2GVtsYsrfcDYC0IHGO9anrkfZ3MepF83VXqTSU%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
cf-ray: 7205a67e7e299b71-FRA

GET
H/1.1 200
OK 2.bda7063d.chunk.js Show response
qs-csat-cis.azurewebsites.net/static/js/ 3 MB
967 KB 105ms
68ms Script
application/javascript 168.63.5.231
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://qs-csat-cis.azurewebsites.net/static/js/2.bda7063d.chunk.js
Requested by: Host: qs-csat-cis.azurewebsites.net
URL: https://qs-csat-cis.azurewebsites.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 168.63.5.231 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 70abe0d1f5802be870b003638fb1d69eb08c45a922d068a697b9f4f4987d6b85

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://qs-csat-cis.azurewebsites.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 24 Jun 2022 13:01:07 GMT
Content-Encoding: gzip
ETag: "1d8137fe397c0b1"
Last-Modified: Thu, 27 Jan 2022 13:15:01 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript
Transfer-Encoding: chunked
Accept-Ranges: bytes

GET
H/1.1 200
OK main.30e066ee.chunk.js Show response
qs-csat-cis.azurewebsites.net/static/js/ 2 MB
752 KB 66ms
25ms Script
application/javascript 168.63.5.231
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://qs-csat-cis.azurewebsites.net/static/js/main.30e066ee.chunk.js
Requested by: Host: qs-csat-cis.azurewebsites.net
URL: https://qs-csat-cis.azurewebsites.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 168.63.5.231 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 4cb7a481bf69ef1875eb0d1cf3399631ef23150689fc0791368a152b3e7e8865

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://qs-csat-cis.azurewebsites.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 24 Jun 2022 13:01:07 GMT
Content-Encoding: gzip
ETag: "1d8137fe39aba74"
Last-Modified: Thu, 27 Jan 2022 13:15:01 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript
Transfer-Encoding: chunked
Accept-Ranges: bytes

GET
H/1.1 200
OK 0.jpg
qs-csat-cis.azurewebsites.net/images/ 291 KB
292 KB 19ms
19ms Image
image/jpeg 168.63.5.231
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qs-csat-cis.azurewebsites.net/images/0.jpg
Requested by: Host: qs-csat-cis.azurewebsites.net
URL: https://qs-csat-cis.azurewebsites.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 168.63.5.231 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://qs-csat-cis.azurewebsites.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 24 Jun 2022 13:01:08 GMT
Last-Modified: Fri, 08 Oct 2021 04:11:18 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "1d7bbfa8b0b3b79"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 298105

GET
H2 200 segoeui-regular.woff2
static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/ 35 KB
36 KB 115ms
22ms Font
application/font-woff2 104.89.8.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-regular.woff2
Requested by: Host: qs-csat-cis.azurewebsites.net
URL: https://qs-csat-cis.azurewebsites.net/css/fabric.min.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.89.8.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-89-8-132.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 94ef87ee295c67526205d67124f404e246226105e939e14c435a20c29a956f49

Request headers

Referer: https://qs-csat-cis.azurewebsites.net/
Origin: https://qs-csat-cis.azurewebsites.net
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Fri, 24 Jun 2022 13:01:09 GMT
last-modified: Thu, 02 Nov 2017 17:22:02 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5: hl8dtlRfyUovRETdYOe7xg==
etag: 0x8D522163B704E10
content-type: application/font-woff2
access-control-allow-origin: *
x-ms-request-id: 5987c1a9-701e-001f-6c1a-ddc6c2000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=15205785
x-ms-version: 2009-09-19
content-length: 36344

GET
H/1.1 200
OK logo-blue.svg
qs-csat-cis.azurewebsites.net/images/ 2 KB
3 KB 19ms
19ms Image
image/svg+xml 168.63.5.231
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qs-csat-cis.azurewebsites.net/images/logo-blue.svg
Requested by: Host: qs-csat-cis.azurewebsites.net
URL: https://qs-csat-cis.azurewebsites.net/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 168.63.5.231 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 1a0662f8397de5e0524cd7d74aab5e7be30c3fe9d53ce58c165b7c329692d061

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://qs-csat-cis.azurewebsites.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Fri, 24 Jun 2022 13:01:08 GMT
Last-Modified: Fri, 08 Oct 2021 04:11:18 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "1d7bbfa8b0fbe33"
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 2355

GET
H/1.1 200
OK GetTheLastestVersion Show response
getlatestversion.azurewebsites.net/api/ 23 B
431 B 151ms
30ms XHR
text/plain 168.63.5.231
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://getlatestversion.azurewebsites.net/api/GetTheLastestVersion
Requested by: Host: qs-csat-cis.azurewebsites.net
URL: https://qs-csat-cis.azurewebsites.net/static/js/2.bda7063d.chunk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 168.63.5.231 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 3f13b9361cd0a31bfe7f84678b3690f417ae71c7c2d47d4915a218cb412f115b

Request headers

Accept: application/json, text/plain, */*
Referer: https://qs-csat-cis.azurewebsites.net/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 24 Jun 2022 13:01:08 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
Content-Type: text/plain; charset=utf-8
Vary: Accept-Encoding
Request-Context: appId=cid-v1:3e4f332f-94d4-4359-9fff-a3c05e4bbfe7

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.qs-csat-cis.azurewebsites.net/	1969-12-31 23:59:59	Name: ARRAffinity Value: a76a50ba664d5f979a92b87fa96814a39a02ad08ea740b7ba12f9ace3807d7f7
			.qs-csat-cis.azurewebsites.net/	1969-12-31 23:59:59	Name: ARRAffinitySameSite Value: a76a50ba664d5f979a92b87fa96814a39a02ad08ea740b7ba12f9ace3807d7f7

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
cdnjs.cloudflare.com
getlatestversion.azurewebsites.net
qs-csat-cis.azurewebsites.net
static2.sharepointonline.com
104.89.8.132
168.63.5.231
2606:4700::6810:5614
2606:4700::6811:180e
1a0662f8397de5e0524cd7d74aab5e7be30c3fe9d53ce58c165b7c329692d061
3226e7ec1c9827829494460fd12f28a89fbd59b03cfc83caf1ff79c9de9a4887
3f13b9361cd0a31bfe7f84678b3690f417ae71c7c2d47d4915a218cb412f115b
46ad423cf733aefbe3f5c0b10802fd6483ef12123e068fc5e1b53550a840b448
4cb7a481bf69ef1875eb0d1cf3399631ef23150689fc0791368a152b3e7e8865
62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214
70abe0d1f5802be870b003638fb1d69eb08c45a922d068a697b9f4f4987d6b85
8c66248d0963818e3752c33f310a7c1bc751d3ec2e6613079e71d1e6dd31e503
94ef87ee295c67526205d67124f404e246226105e939e14c435a20c29a956f49
a0a4a2aef0de563eabeb4c13b672b2865b285dc2e878411e8f24c6b339ab4310
cab84410229e81e3f6333968ed673a094fc9c227e6e71a21fade87e5b28d188d
d1583bc35aa31eeb2ec76a80c979ffe6e640dd963106b23e8fd64c52fefc6d81
e492458614af605026f47dc1921481c653bad4f140230b5afb6334ca1c9d1dd2

qs-csat-cis.azurewebsites.net Open in urlscan Pro 168.63.5.231 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

50 %IPv6

4 Domains

5 Subdomains

4 IPs

3 Countries

2161 kBTransfer

6074 kBSize

2 Cookies

0 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

28 JavaScript Global Variables

2 Cookies

Indicators

qs-csat-cis.azurewebsites.net Open in urlscan Pro
168.63.5.231 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

5
Subdomains

4
IPs

3
Countries

2161 kB
Transfer

6074 kB
Size

2
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!