headset.my Open in urlscan Pro
103.8.27.236 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://headset.my/image/office/index.php?email=bcontreras@firstmerc.com
Effective URL:
http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13I...
Submission: On May 12 via automatic, source openphish (May 12th 2017, 1:54:57 pm UTC)

Summary HTTP 12 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 12 HTTP transactions. The main IP is 103.8.27.236, located in Malaysia and belongs to SKSATECH1-MY SKSA TECHNOLOGY SDN BHD, MY. The main domain is headset.my.

This is the only time headset.my was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online) Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
10	103.8.27.236 103.8.27.236	132241 (SKSATECH1...) (SKSATECH1-MY SKSA TECHNOLOGY SDN BHD)
2	2a02:26f0:78:... 2a02:26f0:78:18d::fb1	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
12	2

10 103.8.27.236 (Malaysia)

ASN132241 (SKSATECH1-MY SKSA TECHNOLOGY SDN BHD, MY)
PTR: sliver.com.my

headset.my	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:78:18d::fb1 (European Union)

ASN20940 (AKAMAI-ASN1, US)

secure.aadcdn.microsoftonline-p.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	headset.my headset.my	553 KB
2	microsoftonline-p.com secure.aadcdn.microsoftonline-p.com	4 KB
12	2

	Domain	Requested by
10	headset.my	headset.my
2	secure.aadcdn.microsoftonline-p.com	headset.my
12	2

This site contains links to these domains. Also see Links.

Domain
login.live.com

Subject Issuer	Validity	Valid
secure.aadcdn.microsoftonline-p.com Symantec Class 3 Secure Server CA - G4	`2016-09-01` - `2017-09-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
Frame ID: 3720.1
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

12
Requests

17 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

557 kB
Transfer

563 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://login.live.com/login.srf?wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQIIAdNiNtQztFIxgAAjXRCpa5CWZqibnApiIYEiIS6B3HmzC6TX33Dd03tIYPmJcN9VjEoZJSUFxVb6-vmlJTn5-dl6-Wlpmcmpxmamesn5ufr55Yn6OxgZLzAyrmIyNzM2M7I0N7AwNrC0MDUwMjYw1zNItLQ0S0xK1jUxNTPVNTGzNNJNMrFI0k22NDQ2TjExMU1KTLrFxO_vWFqSYQQi8osyq1I_MXGm5RflxhfkF5fMYmYF27KKmShfbGJmA7orNz_vFDNbfkFqXmbKBRbGVyw8BsxWHBxsAowSDAoMP1gYF7ECfctwfEPjS94mt91vln1ljdVnOMWqn17kHlWZ6aUd6m4YmOThHJpZ7hNslOKSpZ9WbmzmVelobpQdYGliEZXl62trbGU4gY1xAhvbLk4iQgkA0&id=&uaid=709b9e6daf1b45d8bc8dc210a7c8574d&pcexp=false&popupui=
Title: Sign in with a Microsoft account

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request Sign-in.php Show response
headset.my/image/office/
Redirect Chain

http://headset.my/image/office/index.php?email=bcontreras@firstmerc.com
http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1...

29 KB
29 KB

285ms
285ms

Document
text/html

103.8.27.236
SKSATECH1-MY SKSA...

General

Check archive.org

Show headers Download Go to

Full URL: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Server: 103.8.27.236 , Malaysia, ASN132241 (SKSATECH1-MY SKSA TECHNOLOGY SDN BHD, MY),
Reverse DNS: sliver.com.my
Software: Apache / PHP/5.4.35
Resource Hash: eb1e1fe771cdf281f19837e7b93b6b374f1263925da173ae44006ec8c4317a9a

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: headset.my
Accept-Language: en-US,en;q=0.8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Fri, 12 May 2017 13:54:43 GMT
Server: Apache
Connection: close
X-Powered-By: PHP/5.4.35
Transfer-Encoding: chunked
Content-Type: text/html

Redirect headers

Location: Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1' >
Date: Fri, 12 May 2017 13:54:43 GMT
Server: Apache
Connection: close
X-Powered-By: PHP/5.4.35
Content-Length: 0
Content-Type: text/html

GET
H/1.1 200
OK login.css
headset.my/image/office/files/ 21 KB
21 KB 515ms
257ms Stylesheet
text/css 103.8.27.236
SKSATECH1-MY SKSA...

General

Check archive.org

Show headers Download Go to

Full URL: http://headset.my/image/office/files/login.css
Requested by: Host: headset.my
URL: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Server: 103.8.27.236 , Malaysia, ASN132241 (SKSATECH1-MY SKSA TECHNOLOGY SDN BHD, MY),
Reverse DNS: sliver.com.my
Software: Apache /
Resource Hash: b849c8da2fb4163b99fb3e45081f8622cba52359d9d68749aa0a6a1db7d7e97f

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: headset.my
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
Connection: keep-alive
Cache-Control: no-cache
Referer: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Fri, 12 May 2017 13:54:43 GMT
Last-Modified: Sat, 06 May 2017 16:00:34 GMT
Server: Apache
Connection: close
Accept-Ranges: bytes
Content-Length: 21886
Content-Type: text/css

GET
H/1.1 200
OK login_hover.css
headset.my/image/office/files/ 89 B
89 B 523ms
264ms Stylesheet
text/css 103.8.27.236
SKSATECH1-MY SKSA...

General

Check archive.org

Show headers Download Go to

Full URL: http://headset.my/image/office/files/login_hover.css
Requested by: Host: headset.my
URL: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Server: 103.8.27.236 , Malaysia, ASN132241 (SKSATECH1-MY SKSA TECHNOLOGY SDN BHD, MY),
Reverse DNS: sliver.com.my
Software: Apache /
Resource Hash: 91c2b74542e11d0278e02715a980b39582eae2e3b519ddd2d4f9ca939e58109c

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: headset.my
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
Connection: keep-alive
Cache-Control: no-cache
Referer: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Fri, 12 May 2017 13:54:43 GMT
Last-Modified: Sat, 06 May 2017 16:00:34 GMT
Server: Apache
Connection: close
Accept-Ranges: bytes
Content-Length: 89
Content-Type: text/css

GET
H/1.1 200
OK jquery.js Show response
headset.my/image/office/files/ 108 KB
108 KB 524ms
265ms Script
application/javascript 103.8.27.236
SKSATECH1-MY SKSA...

General

Check archive.org

Show headers Download Go to

Full URL: http://headset.my/image/office/files/jquery.js
Requested by: Host: headset.my
URL: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Server: 103.8.27.236 , Malaysia, ASN132241 (SKSATECH1-MY SKSA TECHNOLOGY SDN BHD, MY),
Reverse DNS: sliver.com.my
Software: Apache /
Resource Hash: 080ff245615e719959bc5537e164ac4495c4b8036462dfee2076dd92f22c8491

Request headers

Pragma: no-cache
Origin: http://headset.my
Accept-Encoding: gzip, deflate, sdch
Host: headset.my
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: */*
Referer: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Referer: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
Origin: http://headset.my

Response headers

Date: Fri, 12 May 2017 13:54:43 GMT
Last-Modified: Sat, 06 May 2017 16:00:36 GMT
Server: Apache
Connection: close
Accept-Ranges: bytes
Content-Length: 110256
Content-Type: application/javascript

GET
H/1.1 200
OK aad.js Show response
headset.my/image/office/files/ 174 KB
174 KB 539ms
274ms Script
application/javascript 103.8.27.236
SKSATECH1-MY SKSA...

General

Check archive.org

Show headers Download Go to

Full URL: http://headset.my/image/office/files/aad.js
Requested by: Host: headset.my
URL: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Server: 103.8.27.236 , Malaysia, ASN132241 (SKSATECH1-MY SKSA TECHNOLOGY SDN BHD, MY),
Reverse DNS: sliver.com.my
Software: Apache /
Resource Hash: 784272794b86d17613d2311fa54eab23d223252eebe139ce8113eaca26a03f86

Request headers

Pragma: no-cache
Origin: http://headset.my
Accept-Encoding: gzip, deflate, sdch
Host: headset.my
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: */*
Referer: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Referer: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
Origin: http://headset.my

Response headers

Date: Fri, 12 May 2017 13:54:43 GMT
Last-Modified: Sat, 06 May 2017 16:00:36 GMT
Server: Apache
Connection: close
Accept-Ranges: bytes
Content-Length: 178334
Content-Type: application/javascript

GET
H/1.1 200
OK heroillustration.jpg
headset.my/image/office/files/ 199 KB
199 KB 607ms
257ms Image
image/jpeg 103.8.27.236
SKSATECH1-MY SKSA...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://headset.my/image/office/files/heroillustration.jpg
Requested by: Host: headset.my
URL: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Server: 103.8.27.236 , Malaysia, ASN132241 (SKSATECH1-MY SKSA TECHNOLOGY SDN BHD, MY),
Reverse DNS: sliver.com.my
Software: Apache /
Resource Hash: 7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: headset.my
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
Connection: keep-alive
Cache-Control: no-cache
Referer: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Fri, 12 May 2017 13:54:45 GMT
Last-Modified: Sat, 06 May 2017 16:00:34 GMT
Server: Apache
Connection: close
Accept-Ranges: bytes
Content-Length: 203294
Content-Type: image/jpeg

GET
H/1.1 200
OK bannerlogo.png
headset.my/image/office/files/ 4 KB
4 KB 528ms
264ms Image
image/png 103.8.27.236
SKSATECH1-MY SKSA...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://headset.my/image/office/files/bannerlogo.png
Requested by: Host: headset.my
URL: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Server: 103.8.27.236 , Malaysia, ASN132241 (SKSATECH1-MY SKSA TECHNOLOGY SDN BHD, MY),
Reverse DNS: sliver.com.my
Software: Apache /
Resource Hash: fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: headset.my
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
Connection: keep-alive
Cache-Control: no-cache
Referer: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Fri, 12 May 2017 13:54:45 GMT
Last-Modified: Sat, 06 May 2017 16:00:34 GMT
Server: Apache
Connection: close
Accept-Ranges: bytes
Content-Length: 4585
Content-Type: image/png

GET
H/1.1 200
OK microsoft_logo.png
headset.my/image/office/files/ 1 KB
1 KB 563ms
259ms Image
image/png 103.8.27.236
SKSATECH1-MY SKSA...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://headset.my/image/office/files/microsoft_logo.png
Requested by: Host: headset.my
URL: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Server: 103.8.27.236 , Malaysia, ASN132241 (SKSATECH1-MY SKSA TECHNOLOGY SDN BHD, MY),
Reverse DNS: sliver.com.my
Software: Apache /
Resource Hash: f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: headset.my
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
Connection: keep-alive
Cache-Control: no-cache
Referer: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Fri, 12 May 2017 13:54:45 GMT
Last-Modified: Sat, 06 May 2017 16:00:34 GMT
Server: Apache
Connection: close
Accept-Ranges: bytes
Content-Length: 1057
Content-Type: image/png

GET
H/1.1 200
OK login_hover.min.css
secure.aadcdn.microsoftonline-p.com/ests/2.1.5898.9/content/cdnbundles/ 89 B
82 B 28ms
7ms Stylesheet
text/css 2a02:26f0:78:18d::fb1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.aadcdn.microsoftonline-p.com/ests/2.1.5898.9/content/cdnbundles/login_hover.min.css

Requested by

Host: headset.my
URL: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:78:18d::fb1 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

91c2b74542e11d0278e02715a980b39582eae2e3b519ddd2d4f9ca939e58109c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: secure.aadcdn.microsoftonline-p.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
Connection: keep-alive
Cache-Control: no-cache
Referer: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Fri, 12 May 2017 13:54:44 GMT
Content-Encoding: gzip
Last-Modified: Thu, 27 Apr 2017 19:35:35 GMT
Content-MD5: k+LdzPr5J17LuCAOBMVTBQ==
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=433664
Strict-Transport-Security: max-age=31536000
Content-Length: 82

GET
H/1.1 200
OK watson.min.js Show response
secure.aadcdn.microsoftonline-p.com/ests/2.1.5898.9/content/cdnbundles/ 10 KB
4 KB 7ms
6ms Script
application/x-javascript 2a02:26f0:78:18d::fb1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.aadcdn.microsoftonline-p.com/ests/2.1.5898.9/content/cdnbundles/watson.min.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:78:18d::fb1 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

ca5896e71cda62c2be576048f73ca40094592f9fd2a62f7c2b4d8c94b03191e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: secure.aadcdn.microsoftonline-p.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: */*
Referer: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
Connection: keep-alive
Cache-Control: no-cache
Referer: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Fri, 12 May 2017 13:54:45 GMT
Content-Encoding: gzip
Last-Modified: Thu, 27 Apr 2017 19:35:38 GMT
Content-MD5: lHRm5RF8WrsErKEDEGrsaQ==
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=230736
Strict-Transport-Security: max-age=31536000
Content-Length: 4155

POST
H/1.1 404
Not Found watson Show response
headset.my/common/handlers/ 339 B
339 B 378ms
259ms XHR
text/html 103.8.27.236
SKSATECH1-MY SKSA...

General

Check archive.org

Show headers Download Go to

Full URL: http://headset.my/common/handlers/watson
Requested by: Host: headset.my
URL: http://headset.my/image/office/files/jquery.js
Protocol: HTTP/1.1
Server: 103.8.27.236 , Malaysia, ASN132241 (SKSATECH1-MY SKSA TECHNOLOGY SDN BHD, MY),
Reverse DNS: sliver.com.my
Software: Apache /
Resource Hash: 3cb91af5955f00cf410171585155849b24e2f30eedb105867cb4352cb54169f9

Request headers

Origin: http://headset.my
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8
client-request-id: 709b9e6d-af1b-45d8-bc8d-c210a7c8574d
canary: AQABAAAAAABnfiG-mA6NTae7CdWW7QfdIvisIZTKrlzexJxUZIyvWU6djUDBmL2cFLnOuC0FTO2-fLXMPoP1cpVqzfcgl2ghAsWPsIETuS80xCJcWu9KyrCMf5xQh-47oH18j1hUUDGMNUvRya5Zn9aUb_tPoE4i5b6JDl8f3P7cgTNpurC8eqvVlhDHO9ivUwSH1SGO4d4_j_US6Ep6fIC5ALiLMFWRlpKOywI8grRLvHA3oTv0ACAA
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Content-Length: 3404
hpgact: 1800
Pragma: no-cache
Host: headset.my
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Content-Type: application/json; charset=UTF-8
hpgid: 1002
Accept: application/json
Cache-Control: no-cache
Referer: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
Origin: http://headset.my
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
client-request-id: 709b9e6d-af1b-45d8-bc8d-c210a7c8574d
canary: AQABAAAAAABnfiG-mA6NTae7CdWW7QfdIvisIZTKrlzexJxUZIyvWU6djUDBmL2cFLnOuC0FTO2-fLXMPoP1cpVqzfcgl2ghAsWPsIETuS80xCJcWu9KyrCMf5xQh-47oH18j1hUUDGMNUvRya5Zn9aUb_tPoE4i5b6JDl8f3P7cgTNpurC8eqvVlhDHO9ivUwSH1SGO4d4_j_US6Ep6fIC5ALiLMFWRlpKOywI8grRLvHA3oTv0ACAA
Content-Type: application/json; charset=UTF-8
hpgid: 1002
Accept: application/json
Referer: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
X-Requested-With: XMLHttpRequest
hpgact: 1800

Response headers

Date: Fri, 12 May 2017 13:54:45 GMT
Server: Apache
Connection: close
Content-Length: 339
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK favicon_a.ico
headset.my/image/office/files/ 17 KB
17 KB 520ms
260ms Other
image/x-icon 103.8.27.236
SKSATECH1-MY SKSA...

General

Check archive.org

Show headers Download Go to

Full URL: http://headset.my/image/office/files/favicon_a.ico
Protocol: HTTP/1.1
Server: 103.8.27.236 , Malaysia, ASN132241 (SKSATECH1-MY SKSA TECHNOLOGY SDN BHD, MY),
Reverse DNS: sliver.com.my
Software: Apache /
Resource Hash: 90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: headset.my
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
Cookie: testcookie=testcookie
Connection: keep-alive
Cache-Control: no-cache
Referer: http://headset.my/image/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YmNvbnRyZXJhc0BmaXJzdG1lcmMuY29t&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Fri, 12 May 2017 13:54:46 GMT
Last-Modified: Sat, 06 May 2017 11:21:32 GMT
Server: Apache
Connection: close
Accept-Ranges: bytes
Content-Length: 17174
Content-Type: image/x-icon

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online) Microsoft (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			headset.my/image/office	1970-01-01 00:00:00	Name: testcookie Value: testcookie

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

headset.my
secure.aadcdn.microsoftonline-p.com
103.8.27.236
2a02:26f0:78:18d::fb1
080ff245615e719959bc5537e164ac4495c4b8036462dfee2076dd92f22c8491
3cb91af5955f00cf410171585155849b24e2f30eedb105867cb4352cb54169f9
784272794b86d17613d2311fa54eab23d223252eebe139ce8113eaca26a03f86
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
91c2b74542e11d0278e02715a980b39582eae2e3b519ddd2d4f9ca939e58109c
b849c8da2fb4163b99fb3e45081f8622cba52359d9d68749aa0a6a1db7d7e97f
ca5896e71cda62c2be576048f73ca40094592f9fd2a62f7c2b4d8c94b03191e3
eb1e1fe771cdf281f19837e7b93b6b374f1263925da173ae44006ec8c4317a9a
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603

headset.my Open in urlscan Pro 103.8.27.236 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

12 Requests

17 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

557 kBTransfer

563 kBSize

1 Cookies

1 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

Indicators

headset.my Open in urlscan Pro
103.8.27.236 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

17 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

557 kB
Transfer

563 kB
Size

1
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!