securitos.rnicrosoft.me Open in urlscan Pro
195.81.120.238  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response securitos.rnicrosoft.me/	2 KB 1 KB	212ms 176ms	Document text/html	195.81.120.238 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL http://securitos.rnicrosoft.me/?rid=N95kHqz Protocol HTTP/1.1 Server 195.81.120.238 Ypres, Belgium, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS Software / Resource Hash 70efe89aad3f637c0fe0cdb37bcf0115c7996db0809cf222452e6ed0e15a3fce Request headers Host securitos.rnicrosoft.me Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 12 Jul 2021 12:29:58 GMT Content-Encoding gzip Content-Type text/html; charset=utf-8 Vary Accept-Encoding X-Server gophish Content-Length 960
GET H2	200	css fonts.googleapis.com/	2 KB 636 B	16ms 15ms	Stylesheet text/css	2a00:1450:4001:82f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:300 Requested by Host: securitos.rnicrosoft.me URL: http://securitos.rnicrosoft.me/?rid=N95kHqz Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 3e74a4ef70abf935fa8800498b5d751663e3511bbee1e3f21d0e445f7883e437 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Mon, 12 Jul 2021 11:13:27 GMT server ESF date Mon, 12 Jul 2021 12:29:58 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Mon, 12 Jul 2021 12:29:58 GMT
GET H2	200	logo.svg phishing.responsum.eu/campaign/microsoft-landingpage/	4 KB 4 KB	166ms 63ms	Image image/svg+xml	195.81.120.238 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Show image Full URL https://phishing.responsum.eu/campaign/microsoft-landingpage/logo.svg Requested by Host: securitos.rnicrosoft.me URL: http://securitos.rnicrosoft.me/?rid=N95kHqz Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 195.81.120.238 Ypres, Belgium, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS Software / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Referer http://securitos.rnicrosoft.me/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 12 Jul 2021 12:29:58 GMT last-modified Wed, 10 Feb 2021 17:01:34 GMT accept-language bytes etag "e43-5bafe5af4b780" content-length 3651 content-type image/svg+xml
GET H2	200	background.jpg phishing.responsum.eu/campaign/microsoft-landingpage/	652 KB 653 KB	194ms 92ms	Image image/jpeg	195.81.120.238 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Show image Full URL https://phishing.responsum.eu/campaign/microsoft-landingpage/background.jpg Requested by Host: securitos.rnicrosoft.me URL: http://securitos.rnicrosoft.me/?rid=N95kHqz Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 195.81.120.238 Ypres, Belgium, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS Software / Resource Hash aaa82b0099668d73ebb7c7d735ea38fe76ce8afab2bb73ab14cd18b3990d0a93 Request headers Referer http://securitos.rnicrosoft.me/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 12 Jul 2021 12:29:58 GMT last-modified Thu, 14 Jan 2021 17:24:56 GMT accept-language bytes etag "a2ecb-5b8df88ce6a00" content-length 667339 content-type image/jpeg
GET H2	200	KFOlCnqEu92Fr1MmSU5fBBc4.woff2 fonts.gstatic.com/s/roboto/v27/	15 KB 15 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:803::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmSU5fBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:300 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin http://securitos.rnicrosoft.me Referer https://fonts.googleapis.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 06 Jul 2021 08:57:53 GMT x-content-type-options nosniff age 531125 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15732 x-xss-protection 0 last-modified Mon, 05 Apr 2021 21:10:39 GMT server sffe content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 06 Jul 2022 08:57:53 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
phishing.responsum.eu
securitos.rnicrosoft.me
195.81.120.238
2a00:1450:4001:803::2003
2a00:1450:4001:82f::200a
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
3e74a4ef70abf935fa8800498b5d751663e3511bbee1e3f21d0e445f7883e437
70efe89aad3f637c0fe0cdb37bcf0115c7996db0809cf222452e6ed0e15a3fce
aaa82b0099668d73ebb7c7d735ea38fe76ce8afab2bb73ab14cd18b3990d0a93