theawareindian.net
Open in
urlscan Pro
173.254.79.114
Malicious Activity!
Public Scan
Submitted URL: http://theawareindian.net/authntcate/offfice/
Effective URL: http://theawareindian.net/authntcate/offfice/e37b8b1a9b2d80688cdcc51f1968ec7f/B/?7468656177617265696e6469616e2e6e6574?sess...
Submission: On June 10 via manual from BE — Scanned from DE
Effective URL: http://theawareindian.net/authntcate/offfice/e37b8b1a9b2d80688cdcc51f1968ec7f/B/?7468656177617265696e6469616e2e6e6574?sess...
Submission: On June 10 via manual from BE — Scanned from DE
Summary
This website contacted 3 IPs
in 3 countries
across 3 domains to perform 18 HTTP transactions.
The main IP is 173.254.79.114, located in
United States and
belongs to UNIFIEDLAYER-AS-1, US.
The main domain is theawareindian.net.
This is the only time theawareindian.net was scanned on urlscan.io!
This is the only time theawareindian.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 3 16 | 173.254.79.114 173.254.79.114 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
| 4 | 2a02:26f0:b60... 2a02:26f0:b600:198::35c1 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:2a | 20446 (STACKPATH...) (STACKPATH-CDN) | |
| 18 | 3 |
16
173.254.79.114
(United States)
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 173-254-79-114.unifiedlayer.com
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 173-254-79-114.unifiedlayer.com
| theawareindian.net |
4
2a02:26f0:b600:198::35c1
(Milan, Italy)
ASN20940 (AKAMAI-ASN1, NL)
ASN20940 (AKAMAI-ASN1, NL)
| secure.aadcdn.microsoftonline-p.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 16 |
theawareindian.net
3 redirects
theawareindian.net |
126 KB |
| 4 |
microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com — Cisco Umbrella Rank: 10182 |
283 KB |
| 1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 637 |
30 KB |
| 18 | 3 |
| Domain | Requested by | |
|---|---|---|
| 16 | theawareindian.net |
3 redirects
theawareindian.net
|
| 4 | secure.aadcdn.microsoftonline-p.com |
theawareindian.net
|
| 1 | code.jquery.com |
theawareindian.net
|
| 18 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| login.microsoftonline.com |
| login.live.com |
| www.microsoft.com |
| privacy.microsoft.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| secure.aadcdn.microsoftonline-p.com Microsoft RSA TLS CA 02 |
2021-11-18 - 2022-11-18 |
a year | crt.sh |
| *.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-14 - 2022-08-14 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
http://theawareindian.net/authntcate/offfice/e37b8b1a9b2d80688cdcc51f1968ec7f/B/?7468656177617265696e6469616e2e6e6574?session_is_registered
Frame ID: DE1C72B42C6EE65AE0E41B810A3FE9DA
Requests: 7 HTTP requests in this frame
Frame:
http://theawareindian.net/authntcate/offfice/e37b8b1a9b2d80688cdcc51f1968ec7f/B/Sign%20in%20to%20your%20account_files/prefetch(1).html
Frame ID: 85C49A8D3B439E72AC9843E3602197AC
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
Sign in to your accountPage URL History Show full URLs
-
http://theawareindian.net/authntcate/offfice/
HTTP 302
http://theawareindian.net/authntcate/offfice/e37b8b1a9b2d80688cdcc51f1968ec7f HTTP 301
http://theawareindian.net/authntcate/offfice/e37b8b1a9b2d80688cdcc51f1968ec7f/ HTTP 302
http://theawareindian.net/authntcate/offfice/e37b8b1a9b2d80688cdcc51f1968ec7f/B/?7468656177617265696e6... Page URL
Detected technologies
WordPress
(CMS)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- /wp-(?:content|includes)/
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jQuery Migrate
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
URL: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381
Title: Can’t access your account?
Title: Can’t access your account?
Search URL Search Domain Scan URL
URL: https://login.live.com/oauth20_authorize.srf?response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&scope=openid+profile+email+offline_access&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2&state=rQIIAXWSvW_TUBTF4yQNbUFQISQYOzCBnDw_fySO6FBa10mJ7eDYbe0lch1_vPgzzmtD8hewIHVgyoiEkCompgqE2DtVgqmsDKgSEuqAGHHZu9zlnvPT1Tn3UYmqUs2HDM2wVn2fJ3mLo0mGpwBpMZAjaZbmaAioAQvo7O7yCn7_bfDlz5PWqx83OxeXXz_PiaV-iA6dqp1Ex8R9H-N03KzVJpNJNXFdZP9f1E4I4owgfhLEvLjgxKTeOy6OOZqr0wwHGzkZ8hTL81VJU31F1BlppmNpaCIZASBDadbRPEYaPseSqENZG0TGrhlKkc4YQ4NVNHuibOrY3PQjZQMAU9xCnd2tUM4ZirjjS8NgasyEmRzp1HnxjrJ-gH14NZIMzZzL4pKbZFE_TcZ4XnpHKKkTtwcbSRw7Nq5eyZwYI9vCKIm7WZI6GUbOeG19pMrtIdWyOLMnM17Q7wUvAiBEIHGV0GcTdUcwxWA6MjqjtjXaZ7czlTPAVEtFlA1Zi0dhx33ma3AjxDgwaS-Y2pks7AZ9k2SpzfWOZMFofEin5N5TXoVC2240WNM88Dx3ND3oWuGHUiWPNUri09Lt_KgYDVbTLHFR6JyViYvyLVBqLi5WVogHhdXC3zLxZiFv7pfhfpLMSHzLf--VXp8UThdqj1HosQGkodYdCPyeJCn1yFNVn-tS261tpiVwymTMN0A3ZtaYJnVUIY4qld-V4ssbhY9L13V9vnwv_5cGCXgSsquAb1K5tW7-Aw2&estsfed=1&uaid=64d4ac74f6bf483c8de40b4ceaf2d3bd&signup=1&lw=1&fl=easi2&fci=4345a7b9-9a63-4910-a426-35363201d503&mkt=en-US
Title: Create one!
Title: Create one!
Search URL Search Domain Scan URL
URL: https://www.microsoft.com/en-US/servicesagreement/
Title: Terms of use
Title: Terms of use
Search URL Search Domain Scan URL
URL: https://privacy.microsoft.com/en-US/privacystatement
Title: Privacy & cookies
Title: Privacy & cookies
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://theawareindian.net/authntcate/offfice/
HTTP 302
http://theawareindian.net/authntcate/offfice/e37b8b1a9b2d80688cdcc51f1968ec7f HTTP 301
http://theawareindian.net/authntcate/offfice/e37b8b1a9b2d80688cdcc51f1968ec7f/ HTTP 302
http://theawareindian.net/authntcate/offfice/e37b8b1a9b2d80688cdcc51f1968ec7f/B/?7468656177617265696e6469616e2e6e6574?session_is_registered Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
theawareindian.net/authntcate/offfice/e37b8b1a9b2d80688cdcc51f1968ec7f/B/ Redirect Chain
|
204 KB 39 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
microsoft_logo.svg
secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
0-small.jpg
secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/backgrounds/ |
3 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
0.jpg
secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/backgrounds/ |
277 KB 277 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
prefetch(1).html
theawareindian.net/authntcate/offfice/e37b8b1a9b2d80688cdcc51f1968ec7f/B/Sign%20in%20to%20your%20account_files/ Frame 85C4 |
23 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ellipsis_white.svg
secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/ |
915 B 641 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ellipsis_grey.svg
theawareindian.net/authntcate/offfice/e37b8b1a9b2d80688cdcc51f1968ec7f/B/Sign%20in%20to%20your%20account_files/ |
9 KB 9 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.3.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
style.css
theawareindian.net/wp-content/themes/aware%20indian/ Frame 85C4 |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
kpicasa_gallery.css
theawareindian.net/wp-content/plugins/kpicasa-gallery/ Frame 85C4 |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
pagenavi-css.css
theawareindian.net/wp-content/plugins/wp-pagenavi/ Frame 85C4 |
374 B 552 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
/
theawareindian.net/ Frame 85C4 |
2 KB 782 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.js
theawareindian.net/wp-includes/js/jquery/ Frame 85C4 |
95 KB 42 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-migrate.min.js
theawareindian.net/wp-includes/js/jquery/ Frame 85C4 |
10 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
superfish.js
theawareindian.net/wp-content/plugins/multi-level-navigation-plugin/scripts/ Frame 85C4 |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cforms.css
theawareindian.net/wp-content/plugins/cforms/styling/ Frame 85C4 |
9 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
cforms.js
theawareindian.net/wp-content/plugins/cforms/js/ Frame 85C4 |
17 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
calendar.css
theawareindian.net/wp-content/plugins/cforms/styling/ Frame 85C4 |
2 KB 1011 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation function| $ function| jQuery function| goNext function| closeBox function| checkSubmit function| isEmail function| iserror1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| theawareindian.net/ | Name: PHPSESSID Value: 22c62db277a38a615a8f1614b7eb4420 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
secure.aadcdn.microsoftonline-p.com
theawareindian.net
173.254.79.114
2001:4de0:ac18::1:a:2a
2a02:26f0:b600:198::35c1
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
100f8441da4bf56463c2a4a81e3aacedc98e40a34e8c3490c03bd32738d350f3
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
2e478b8aa88003b19943ffcca21e059d696321e48e21d16a981130725ddb8baf
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
65384c864f38a4798ed3c55fc630d25163c2974d31c493630ead5ae5149a502c
7e111456522e9b07304a6d358b0030e9cbfdcb0266a19131baefac8b4b6e4cee
7f75a920ab5bd75795aaa230763a9c0545e46bf05b7f115bb835c8bb7c741e36
a080ebb13108f385aaae8a59c784ce3b8ce0fdb8b3d1e2f8b5780bf2a6456689
a5a3fd7a5784854ec59a51c96f02da07c5aa12e3d90ff0a6b6fc1d1f2f2b5ced
c2711e9edc60964dcb5aada1bfa59c2d68d3d9dc1baf4a5ee058b4c1bd32c3eb
cf34e1b87bbfd9d9b185dec994924a496e279d8dc9387ad8d35bc0110134c4d3
d051b6b891d3e9ab1855b09c86bf1051c3d49f4a7aae1a127f772a51d1226c41
d26d406f5e2fa07da239e465935a5fef26ff2ac178de8f39991aa59d3ccb3628
f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea
fb519b6c0b75bbc401c01dde3a3ba1c05bb81d2656e79c119da2507e36703daa