lingdu-onedrive.lingdupro.workers.dev Open in urlscan Pro
2606:4700:3037::6815:2b29  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://lingdu-onedrive.lingdupro.workers.dev/?sso_reload=true Page URL
2. https://lingdu-onedrive.lingdupro.workers.dev/?sso_reload=true Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response lingdu-onedrive.lingdupro.workers.dev/	20 KB 10 KB	2664ms 2525ms	Document text/html	2606:4700:3037::6815:2b29 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://lingdu-onedrive.lingdupro.workers.dev/?sso_reload=true Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:2b29 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a2d3ec5ede84091b91537aa7233e94f4ae4a02869c850e73d69edd7c77882871 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin * alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache cf-cache-status DYNAMIC cf-ray 84d8b24809e30b41-OSL content-encoding br content-type text/html; charset=utf-8 date Tue, 30 Jan 2024 09:30:30 GMT expires -1 nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} p3p CP="DSP CUR OTPi IND OTRi ONL FIN" pragma no-cache referrer-policy strict-origin-when-cross-origin report-to {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+frc"}]} server cloudflare strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding x-content-type-options nosniff x-ms-ests-server 2.1.17122.3 - JPE ProdSlices x-ms-request-id ccd11e17-56d3-4a31-870d-1fbe3cab6c00 x-xss-protection 0
GET H2	200	BssoInterrupt_Core_aoxn9LgNNeyAz3OYDcN7uA2.js Show response aadcdn.msauth.net/shared/1.0/content/js/	136 KB 49 KB	192ms 94ms	Script application/x-javascript	2620:1ec:bdf::71 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/shared/1.0/content/js/BssoInterrupt_Core_aoxn9LgNNeyAz3OYDcN7uA2.js Requested by Host: lingdu-onedrive.lingdupro.workers.dev URL: https://lingdu-onedrive.lingdupro.workers.dev/?sso_reload=true Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:bdf::71 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 15e697417242d779ddec5439f81b56bdc61974ffda9a40919be81428f341296e Request headers Referer https://lingdu-onedrive.lingdupro.workers.dev/ Origin https://lingdu-onedrive.lingdupro.workers.dev accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 30 Jan 2024 09:30:31 GMT content-encoding gzip x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 content-length 49102 x-ms-lease-status unlocked last-modified Fri, 22 Dec 2023 23:52:28 GMT etag 0x8DC03490E5BD232 x-azure-ref 20240130T093031Z-5syvrm5ggx2svcsfpdu2bsspu80000000eng00000000nyfm content-type application/x-javascript access-control-allow-origin * x-ms-request-id 7297ed00-501e-000e-2491-4b956e000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	Primary Request / Show response lingdu-onedrive.lingdupro.workers.dev/	41 KB 16 KB	3116ms 3115ms	Document text/html	2606:4700:3037::6815:2b29 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://lingdu-onedrive.lingdupro.workers.dev/?sso_reload=true Requested by Host: aadcdn.msauth.net URL: https://aadcdn.msauth.net/shared/1.0/content/js/BssoInterrupt_Core_aoxn9LgNNeyAz3OYDcN7uA2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:2b29 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 312722fbde7e0d493600a12899edbf9d97d8f939a1be60b12238f90bb5304a06 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://lingdu-onedrive.lingdupro.workers.dev/?sso_reload=true Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin * alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache cf-cache-status DYNAMIC cf-ray 84d8b25969f40b41-OSL content-encoding br content-type text/html; charset=utf-8 date Tue, 30 Jan 2024 09:30:34 GMT expires -1 link <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin, <https://aadcdn.msftauth.net>; rel=dns-prefetch, <https://aadcdn.msauth.net>; rel=dns-prefetch nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} p3p CP="DSP CUR OTPi IND OTRi ONL FIN" pragma no-cache referrer-policy strict-origin-when-cross-origin report-to {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+frc"}]} server cloudflare strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding x-content-type-options nosniff x-dns-prefetch-control on x-frame-options DENY x-ms-ests-server 2.1.17122.3 - KRC ProdSlices x-ms-request-id 9e9c8157-42cb-4128-bfb7-70d7088b6800 x-xss-protection 0
GET H2	200	converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	110 KB 20 KB	197ms 48ms	Stylesheet text/css	2606:2800:233:78b9:f44e:2c1f:31aa:d9ef EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css Requested by Host: lingdu-onedrive.lingdupro.workers.dev URL: https://lingdu-onedrive.lingdupro.workers.dev/?sso_reload=true Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ska/F6B1) / Resource Hash 4b01a0a34ce8ed4bc8a8713be0442d49da6a756236b7b4424622ca3dee820f41 Request headers Referer https://lingdu-onedrive.lingdupro.workers.dev/ Origin https://lingdu-onedrive.lingdupro.workers.dev accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 30 Jan 2024 09:30:34 GMT content-encoding gzip content-md5 kqhA3D0Xczna4D/t8ioitQ== age 2769237 x-cache HIT content-length 20314 x-ms-lease-status unlocked last-modified Wed, 27 Dec 2023 18:19:21 GMT server ECAcc (ska/F6B1) etag 0x8DC070858CA028D vary Accept-Encoding content-type text/css access-control-allow-origin * x-ms-request-id 38a03291-f01e-00d8-352f-3a3651000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	ConvergedLogin_PCore_G8Z5rroNOgOG4sM8nNFBUw2.js Show response aadcdn.msftauth.net/shared/1.0/content/js/	421 KB 116 KB	197ms 49ms	Script application/x-javascript	2606:2800:233:78b9:f44e:2c1f:31aa:d9ef EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_G8Z5rroNOgOG4sM8nNFBUw2.js Requested by Host: lingdu-onedrive.lingdupro.workers.dev URL: https://lingdu-onedrive.lingdupro.workers.dev/?sso_reload=true Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ska/F686) / Resource Hash f46a9d9c96d9343a0774ff88e584a2f41c67144cca542a0c006a7d7ded45b8da Request headers Referer https://lingdu-onedrive.lingdupro.workers.dev/ Origin https://lingdu-onedrive.lingdupro.workers.dev accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 30 Jan 2024 09:30:34 GMT content-encoding gzip content-md5 mxbQIOvnkJd51fNVvziCNA== age 2769237 x-cache HIT content-length 118619 x-ms-lease-status unlocked last-modified Fri, 22 Dec 2023 23:52:14 GMT server ECAcc (ska/F686) etag 0x8DC034905E60116 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 482d6e07-301e-0050-622f-3a3915000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	ux.converged.login.strings-fi.min_6-rko0pamlbyih16id1tpa2.js Show response aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	56 KB 16 KB	291ms 142ms	Script application/x-javascript	2606:2800:233:78b9:f44e:2c1f:31aa:d9ef EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-fi.min_6-rko0pamlbyih16id1tpa2.js Requested by Host: lingdu-onedrive.lingdupro.workers.dev URL: https://lingdu-onedrive.lingdupro.workers.dev/?sso_reload=true Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ska/F6B2) / Resource Hash ae3c31c05e43d4daac09698fb01f363bd4f57b1bc58eb5d59818446cbe41121b Request headers Referer https://lingdu-onedrive.lingdupro.workers.dev/ Origin https://lingdu-onedrive.lingdupro.workers.dev accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 30 Jan 2024 09:30:34 GMT content-encoding gzip content-md5 dWHX2zo2kkWkcKjuaKS1iA== age 4108406 x-cache HIT content-length 16387 x-ms-lease-status unlocked last-modified Thu, 07 Dec 2023 23:24:57 GMT server ECAcc (ska/F6B2) etag 0x8DBF77BB9ED2617 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 184e7370-801e-0053-0201-2e4413000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H/1.1	200 OK	Me.htm login.live.com/	0 0	449ms 187ms	Other text/html	20.190.159.75 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://login.live.com/Me.htm?v=3 Requested by Host: lingdu-onedrive.lingdupro.workers.dev URL: https://lingdu-onedrive.lingdupro.workers.dev/?sso_reload=true Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 20.190.159.75 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash Request headers accept-language fi-FI,fi;q=0.9 Referer https://lingdu-onedrive.lingdupro.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers
GET H2	200	oneDs_f2e0f4a029670f10d892.js Show response aadcdn.msftauth.net/shared/1.0/content/js/	186 KB 60 KB	189ms 48ms	Script application/x-javascript	2606:2800:233:78b9:f44e:2c1f:31aa:d9ef EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js Requested by Host: aadcdn.msftauth.net URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_G8Z5rroNOgOG4sM8nNFBUw2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ska/F6F4) / Resource Hash 8405362eb8f09df13ae244de155b51b1577274673d9728b6c81cd0278a63c8b0 Request headers accept-language fi-FI,fi;q=0.9 Referer https://lingdu-onedrive.lingdupro.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 30 Jan 2024 09:30:34 GMT content-encoding gzip content-md5 wegr9xrdYirQ87+FcvY0/A== age 21133440 x-cache HIT content-length 61052 x-ms-lease-status unlocked last-modified Thu, 25 May 2023 17:22:37 GMT server ECAcc (ska/F6F4) etag 0x8DB5D44A2CEB430 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 23240edd-c01e-002b-0229-93749b000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	convergedlogin_pcustomizationloader_3c4dade0e77065ef0ebe.js Show response aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/	153 KB 34 KB	53ms 52ms	Script application/x-javascript	2606:2800:233:78b9:f44e:2c1f:31aa:d9ef EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_3c4dade0e77065ef0ebe.js Requested by Host: aadcdn.msftauth.net URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_G8Z5rroNOgOG4sM8nNFBUw2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ska/F76D) / Resource Hash f4d950c649876fb897ae9732dc13e17fd19303c2bbe7fb628141c096c9f02949 Request headers accept-language fi-FI,fi;q=0.9 Referer https://lingdu-onedrive.lingdupro.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 30 Jan 2024 09:30:34 GMT content-encoding gzip content-md5 QYb0e9HyvT1Uj5ho0quyFg== age 3275484 x-cache HIT content-length 34606 x-ms-lease-status unlocked last-modified Fri, 22 Dec 2023 07:51:19 GMT server ECAcc (ska/F76D) etag 0x8DC02C2C8CB70CE vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 60852201-101e-00fa-0494-35f166000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/	2 KB 861 B	49ms 48ms	Image image/svg+xml	2606:2800:233:78b9:f44e:2c1f:31aa:d9ef EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ska/F78F) / Resource Hash 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68 Request headers accept-language fi-FI,fi;q=0.9 Referer https://lingdu-onedrive.lingdupro.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 30 Jan 2024 09:30:35 GMT content-encoding gzip content-md5 DhdidjYrlCeaRJJRG/y9mA== age 21133440 x-cache HIT content-length 673 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:43 GMT server ECAcc (ska/F78F) etag 0x8DB5C3F466DE917 vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 0512e658-301e-0050-3b29-939d0f000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg aadcdn.msftauth.net/shared/1.0/content/images/	4 KB 2 KB	49ms 49ms	Image image/svg+xml	2606:2800:233:78b9:f44e:2c1f:31aa:d9ef EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ska/F7A1) / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers accept-language fi-FI,fi;q=0.9 Referer https://lingdu-onedrive.lingdupro.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 30 Jan 2024 09:30:35 GMT content-encoding gzip content-md5 nzaLxFgP7ZB3dfMcaybWzw== age 21133440 x-cache HIT content-length 1435 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:48 GMT server ECAcc (ska/F7A1) etag 0x8DB5C3F495F4B8C vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 3ac418b8-601e-0058-0129-93ba20000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	convergedlogin_pstringcustomizationhelper_e1c340cfb6c159379a9a.js Show response aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/	111 KB 35 KB	49ms 49ms	Script application/x-javascript	2606:2800:233:78b9:f44e:2c1f:31aa:d9ef EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_e1c340cfb6c159379a9a.js Requested by Host: aadcdn.msftauth.net URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_G8Z5rroNOgOG4sM8nNFBUw2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ska/F76C) / Resource Hash c87dafb24d33a259dc38fd50c3ac11d90f4dc1d770e32bedecabdb33ca25be61 Request headers accept-language fi-FI,fi;q=0.9 Referer https://lingdu-onedrive.lingdupro.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 30 Jan 2024 09:30:35 GMT content-encoding gzip content-md5 Caw4nqvXpRPsKa0sGbFYvA== age 3275484 x-cache HIT content-length 35907 x-ms-lease-status unlocked last-modified Fri, 22 Dec 2023 07:51:19 GMT server ECAcc (ska/F76C) etag 0x8DC02C2C8DAEFC2 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id fa277cd9-e01e-0045-1294-350e3d000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg aadcdn.msftauth.net/shared/1.0/content/images/	2 KB 773 B	56ms 56ms	Image image/svg+xml	2606:2800:233:78b9:f44e:2c1f:31aa:d9ef EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ska/F744) / Resource Hash 8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93 Request headers accept-language fi-FI,fi;q=0.9 Referer https://lingdu-onedrive.lingdupro.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 30 Jan 2024 09:30:35 GMT content-encoding gzip content-md5 R2FAVxfpONfnQAuxVxXbHg== age 21118673 x-cache HIT content-length 621 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:52 GMT server ECAcc (ska/F744) etag 0x8DB5C3F4BB4F03C vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 26571626-801e-0008-2f4c-93f9aa000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B object| ServerData object| webpackJsonp object| ko object| PROOF object| StringRepository object| Telemetry object| telemetry_webpackJsonp boolean| __ConvergedLogin_PCore boolean| __ boolean| __convergedlogin_pcustomizationloader_3c4dade0e77065ef0ebe boolean| __convergedlogin_pstringcustomizationhelper_e1c340cfb6c159379a9a

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			lingdu-onedrive.lingdupro.workers.dev/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
			lingdu-onedrive.lingdupro.workers.dev/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd
			.lingdu-onedrive.lingdupro.workers.dev/	1969-12-31 23:59:59	Name: AADSSO Value: NA|NoExtension
			lingdu-onedrive.lingdupro.workers.dev/	1970-01-20 18:03:27	Name: SSOCOOKIEPULLED Value: 1
			lingdu-onedrive.lingdupro.workers.dev/	1970-01-20 18:46:39	Name: buid Value: 0.AUoAevE_MF7uWkSLULuBeNrdgQMAAAAAAPEPzgAAAAAAAACJAAA.AQABAAEAAAAmoFfGtYxvRrNriQdPKIZ-MOnVd-xz__0D3PpSFfXXrelNnRXufFTjELysRqn2tjMA7e4t5wRKeuH27-e6thsK6i2bm-4hTfv0TNfz3h2qd0swB6sSpL2Pj9JyUAQIL8ggAA
			lingdu-onedrive.lingdupro.workers.dev/	1970-01-20 18:46:39	Name: fpc Value: AmvVfdmrcjZBm1vxpTKhgPuIIA_cAQAAALm4St0OAAAA
			lingdu-onedrive.lingdupro.workers.dev/	1970-01-21 02:49:03	Name: MicrosoftApplicationsTelemetryDeviceId Value: 74f94c15-e758-40fc-911f-66ea28d2f5b5
			.lingdu-onedrive.lingdupro.workers.dev/	1970-01-21 03:25:03	Name: brcap Value: 0
			.login.live.com/	1969-12-31 23:59:59	Name: uaid Value: 3f776f892fe141bd9c42436a04419e78
			.login.live.com/	1969-12-31 23:59:59	Name: MSPRequ Value: id=N&lt=1706607034&co=1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
aadcdn.msftauth.net
lingdu-onedrive.lingdupro.workers.dev
login.live.com
20.190.159.75
2606:2800:233:78b9:f44e:2c1f:31aa:d9ef
2606:4700:3037::6815:2b29
2620:1ec:bdf::71
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
15e697417242d779ddec5439f81b56bdc61974ffda9a40919be81428f341296e
312722fbde7e0d493600a12899edbf9d97d8f939a1be60b12238f90bb5304a06
4b01a0a34ce8ed4bc8a8713be0442d49da6a756236b7b4424622ca3dee820f41
8405362eb8f09df13ae244de155b51b1577274673d9728b6c81cd0278a63c8b0
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
a2d3ec5ede84091b91537aa7233e94f4ae4a02869c850e73d69edd7c77882871
ae3c31c05e43d4daac09698fb01f363bd4f57b1bc58eb5d59818446cbe41121b
c87dafb24d33a259dc38fd50c3ac11d90f4dc1d770e32bedecabdb33ca25be61
f46a9d9c96d9343a0774ff88e584a2f41c67144cca542a0c006a7d7ded45b8da
f4d950c649876fb897ae9732dc13e17fd19303c2bbe7fb628141c096c9f02949