office-action-needed.tk Open in urlscan Pro
85.93.145.120 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://zipansion.com/2jMmc
Effective URL:
http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html
Submission: On August 08 via manual (August 8th 2018, 6:03:42 pm UTC) from US

Summary HTTP 9 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 6 domains to perform 9 HTTP transactions. The main IP is 85.93.145.120, located in Moscow, Russian Federation and belongs to SPACENET-AS Internet Service Provider, RU. The main domain is office-action-needed.tk.

This is the only time office-action-needed.tk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online) Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2400:cb00:204... 2400:cb00:2048:1::681b:9b63	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 1	2400:cb00:204... 2400:cb00:2048:1::681b:9a63	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 1	2400:cb00:204... 2400:cb00:2048:1::681b:a06c	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2 4	85.93.145.120 85.93.145.120	34300 (SPACENET-...) (SPACENET-AS Internet Service Provider)
6	2a02:26f0:6c0... 2a02:26f0:6c00:283::35c1	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2620:1ec:a92:... 2620:1ec:a92::156	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
9	3

1 2400:cb00:2048:1::681b:9b63 (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

zipansion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2400:cb00:2048:1::681b:9a63 (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

zipansion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2400:cb00:2048:1::681b:a06c (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

clearload.bid	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 85.93.145.120 (Moscow, Russian Federation) 2 redirects

ASN34300 (SPACENET-AS Internet Service Provider, RU)
PTR: whm-dns.com

office-action-needed.gq	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
office-action-needed.tk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:26f0:6c00:283::35c1 (European Union)

ASN20940 (AKAMAI-ASN1, US)

secure.aadcdn.microsoftonline-p.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:a92::156 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

www.office.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	microsoftonline-p.com secure.aadcdn.microsoftonline-p.com	223 KB
3	office-action-needed.tk 1 redirects office-action-needed.tk	137 KB
2	zipansion.com 2 redirects zipansion.com	927 B
1	office.com www.office.com
1	office-action-needed.gq 1 redirects office-action-needed.gq	254 B
1	clearload.bid 1 redirects clearload.bid	1 KB
9	6

	Domain	Requested by
6	secure.aadcdn.microsoftonline-p.com	office-action-needed.tk
3	office-action-needed.tk	1 redirects office-action-needed.tk
2	zipansion.com	2 redirects
1	www.office.com	office-action-needed.tk
1	office-action-needed.gq	1 redirects
1	clearload.bid	1 redirects
9	6

This site contains links to these domains. Also see Links.

Domain
account.live.com
passwordreset.microsoftonline.com
login.live.com
www.microsoft.com
privacy.microsoft.com

Subject Issuer	Validity	Valid
secure.aadcdn.microsoftonline-p.com Microsoft IT TLS CA 1	`2017-08-15` - `2019-08-15`	2 years	crt.sh
portal.office.com Microsoft IT TLS CA 5	`2017-09-20` - `2019-09-20`	2 years	crt.sh

This page contains 2 frames:

Primary Page: http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html
Frame ID: 9C56F730ED951949D9D04E63188737AF
Requests: 8 HTTP requests in this frame

Frame: https://www.office.com/prefetch/prefetch
Frame ID: 45D2A8F8723570864E3DDAAD16BAA26A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://zipansion.com/2jMmc HTTP 302
http://zipansion.com/2jMmc HTTP 301
http://clearload.bid/-36721FXKC/2jMmc?rndad=2a014f8202a90002-1533751411 HTTP 302
http://office-action-needed.gq//ssl.php?id=2234956 HTTP 302
http://office-action-needed.tk/ HTTP 302
http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js/i
env /^jQuery$/i

Page Statistics

9
Requests

78 %
HTTPS

83 %
IPv6

6
Domains

6
Subdomains

3
IPs

3
Countries

360 kB
Transfer

375 kB
Size

5
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://account.live.com/password/reset?wreply=https:%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQIIAXWRO2vbUACFLTs2SVrakKWFLBlaUgqyrx6WI0MK8SMvR1Jiy5GvFqPHtXUVSVeRb-THrwilJZCxYzq1pVAKnbplytxfUDqVQiFjnR_Q5UzfgcP5Xua4Ild9Jgpi2arYMitbksCKMgdYS-QlVigLksADzi0DIVldXnn7KRRuHvxVL9fK779ffnhzzTzxKI1H1VJpPB4XyWCAHVR0SFj6wjC3DPOTYa6yeRSx3c51diQJkljhOIkHogQqcoXbLEK97UP9xFdnkKoz1dM6AJj6SXBoNIGiO1RrtAPNUATFUERV7wLNMH3TMENFh9TUjzk45zXd8w_1INQaXWoacKYaJjbnfbOhjH9kH2vb59Tj74MkeIb-ZJcGJAn7MRnRq9w3RotRtO_WSRQhhxbvMRRR7FgUk-goITFKKEajrTawg7M9iMTe-f7Erpf7fYeaKHRbwEK70SDV1EnQg16Quqcm249rR3Q6ncg7g67VNWseSo-GOIUcrMeOexbLLbwrTOPawUlnX0mh69KZgwG0mlHYsc6mLQLS4ZTAiW379iQ4xgFBo9T2WW9T4sO6ErRmfM9xZH74MVeYnx2S6Cb3aD41wu56nJABDtDtAvNr4SHIVRcXl1cyTzPrmbsF5l1-7vDz3Su1tvF857WfbKzlX2Ru8qVaz8A8qqDmWOWJ6zX80uGOU69502gz2j7da-x12yWDNA96Kdniq9xFgbkoFH4XMl-X_qf_Hw2
Title: Personal account

Search URL Search Domain Scan URL

URL: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQIIAXWRO2vbUACFLTs2SVrakKWFLBlaUgqyrx6WI0MK8SMvR1Jiy5GvFqPHtXUVSVeRb-THrwilJZCxYzq1pVAKnbplytxfUDqVQiFjnR_Q5UzfgcP5Xua4Ild9Jgpi2arYMitbksCKMgdYS-QlVigLksADzi0DIVldXnn7KRRuHvxVL9fK779ffnhzzTzxKI1H1VJpPB4XyWCAHVR0SFj6wjC3DPOTYa6yeRSx3c51diQJkljhOIkHogQqcoXbLEK97UP9xFdnkKoz1dM6AJj6SXBoNIGiO1RrtAPNUATFUERV7wLNMH3TMENFh9TUjzk45zXd8w_1INQaXWoacKYaJjbnfbOhjH9kH2vb59Tj74MkeIb-ZJcGJAn7MRnRq9w3RotRtO_WSRQhhxbvMRRR7FgUk-goITFKKEajrTawg7M9iMTe-f7Erpf7fYeaKHRbwEK70SDV1EnQg16Quqcm249rR3Q6ncg7g67VNWseSo-GOIUcrMeOexbLLbwrTOPawUlnX0mh69KZgwG0mlHYsc6mLQLS4ZTAiW379iQ4xgFBo9T2WW9T4sO6ErRmfM9xZH74MVeYnx2S6Cb3aD41wu56nJABDtDtAvNr4SHIVRcXl1cyTzPrmbsF5l1-7vDz3Su1tvF857WfbKzlX2Ru8qVaz8A8qqDmWOWJ6zX80uGOU69502gz2j7da-x12yWDNA96Kdniq9xFgbkoFH4XMl-X_qf_Hw2&mkt=en-US&hosted=0&device_platform=Windows+10
Title: Work or school account

Search URL Search Domain Scan URL

URL: https://login.live.com/oauth20_authorize.srf?response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&scope=openid+profile+email+offline_access&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2&state=rQIIAXWRO2vbUACFLTs2SVra0KWFLBlaUgqyrx6WI0MK8SMvR1Jiy5GvFqPHtXUVSVeRb-THrwilJZCxYzq1pVAKnbplytxfUDqVQiFjne5dznK-A4dzXuS4Ild9Kgpi2arYMitbksCKMgdYS-QlVigLksADzi0DIXm0vPLmYyhc3_ujXqyW3327eP_6klnqBzhFRYeEV8xjj9J4VC2VxuNxkQwG2PlnlD4zzA3D_GCYy2weRWy3c5UdSYIkVjhO4oEogYpc4TaKUG_7UD_21Rmk6kz1tA4Apn4cHBhNoOgO1RrtQDMUQTEUUdW7QDNM3zTMUNEhNfUjDs55Tff8Az0ItUaXmgacqYaJzXnebCjj79mH2tYZ9fg7IQmeod_ZpQFJwn5MRvQy95XRYhTtuXUSRcihxTsMRRQ7FsUkOkxIjBKK0WizDezgdBcisXe2N7Hr5X7foSYK3Raw0E40SDV1EvSgF6Tuicn249ohnU4n8vaga3XNmofSwyFOIQfrseOexnIL7wjTuLZ_3NlTUui6dOZgAK1mFHas02mLgHQ4JXBi2749CY5wQNAotX3W25D4sK4ErRnfcxyZH37IFeZjhyS6zj2YV42wuxYnZIADdLPA_Fy4D3LVxcXllcyTzFrmdoF5m5__-en2pVpbf7b9yk_WV_PPM9f5Uq1nYB5VUHOs8sT1Gn7pYNup17xptBFtnew2drvtkkGa-72UbPJV7rzAnBcKvwqZL0v_u_8v0&estsfed=1&uaid=336db3950bca4ef5971b35abc397b194&mkt=en-US&pcexp=false&popupui=
Title: Sign in with a Microsoft account

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-US/servicesagreement/
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/en-US/privacystatement
Title: Privacy & cookies

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://zipansion.com/2jMmc HTTP 302
http://zipansion.com/2jMmc HTTP 301
http://clearload.bid/-36721FXKC/2jMmc?rndad=2a014f8202a90002-1533751411 HTTP 302
http://office-action-needed.gq//ssl.php?id=2234956 HTTP 302
http://office-action-needed.tk/ HTTP 302
http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request index.html Show response
office-action-needed.tk/aa94d85667d761a30e2318097e2141/
Redirect Chain

https://zipansion.com/2jMmc
http://zipansion.com/2jMmc
http://clearload.bid/-36721FXKC/2jMmc?rndad=2a014f8202a90002-1533751411
http://office-action-needed.gq//ssl.php?id=2234956
http://office-action-needed.tk/
http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html

28 KB
29 KB

48ms
46ms

Document
text/html

85.93.145.120
SPACENET-AS Inter...

General

Check archive.org

Show headers Download Go to

Full URL: http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html
Protocol: HTTP/1.1
Server: 85.93.145.120 Moscow, Russian Federation, ASN34300 (SPACENET-AS Internet Service Provider, RU),
Reverse DNS: whm-dns.com
Software: Apache /
Resource Hash: f6591c87ee3dfcfa88fd302011f9b4943c7a378e2d30ae2658e2bc0dac28c1e5

Request headers

Host: office-action-needed.tk
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 9C56F730ED951949D9D04E63188737AF

Response headers

Date: Wed, 08 Aug 2018 18:03:31 GMT
Server: Apache
Last-Modified: Wed, 08 Aug 2018 18:03:31 GMT
Accept-Ranges: bytes
Content-Length: 29041
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html

Redirect headers

Date: Wed, 08 Aug 2018 18:03:31 GMT
Server: Apache
location: aa94d85667d761a30e2318097e2141/index.html
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK login.min.css
secure.aadcdn.microsoftonline-p.com/ests/2.1.6916.13/content/cdnbundles/ 23 KB
5 KB 8ms
6ms Stylesheet
text/css 2a02:26f0:6c00:283::35c1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6916.13/content/cdnbundles/login.min.css

Requested by

Host: office-action-needed.tk
URL: http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

794a3e7ac5b0b61344702fd93fef4eb4cd794df080d909a90a05d62efdd21957

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 08 Aug 2018 18:03:31 GMT
Content-Encoding: gzip
Last-Modified: Tue, 21 Nov 2017 04:40:19 GMT
Content-MD5: gEbF+HJAoFe7UHLivU1AVQ==
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=510698
Strict-Transport-Security: max-age=31536000
Content-Length: 5187

GET
H/1.1 200
OK jquery.js Show response
office-action-needed.tk/aa94d85667d761a30e2318097e2141/ 108 KB
108 KB 48ms
46ms Script
application/javascript 85.93.145.120
SPACENET-AS Inter...

General

Check archive.org

Show headers Download Go to

Full URL: http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/jquery.js
Requested by: Host: office-action-needed.tk
URL: http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html
Protocol: HTTP/1.1
Server: 85.93.145.120 Moscow, Russian Federation, ASN34300 (SPACENET-AS Internet Service Provider, RU),
Reverse DNS: whm-dns.com
Software: Apache /
Resource Hash: d9c500706bcdb6d8e2ba4de1a6ea3d30d87417b79aa26e51fa2b9b9f4ff37e5f

Request headers

Pragma: no-cache
Origin: http://office-action-needed.tk
Accept-Encoding: gzip, deflate
Host: office-action-needed.tk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html
Origin: http://office-action-needed.tk

Response headers

Date: Wed, 08 Aug 2018 18:03:32 GMT
Last-Modified: Wed, 08 Aug 2018 18:03:31 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 110160

GET
H/1.1 200
OK login_hover.min.css
secure.aadcdn.microsoftonline-p.com/ests/2.1.6916.13/content/cdnbundles/ 89 B
454 B 13ms
5ms Stylesheet
text/css 2a02:26f0:6c00:283::35c1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6916.13/content/cdnbundles/login_hover.min.css

Requested by

Host: office-action-needed.tk
URL: http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

91c2b74542e11d0278e02715a980b39582eae2e3b519ddd2d4f9ca939e58109c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 08 Aug 2018 18:03:31 GMT
Content-Encoding: gzip
Last-Modified: Tue, 21 Nov 2017 04:40:21 GMT
Content-MD5: k+LdzPr5J17LuCAOBMVTBQ==
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=510698
Strict-Transport-Security: max-age=31536000
Content-Length: 82

GET
H/1.1 200
OK heroillustration
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-uymyxxfhpwrbckvwvlxle8radh6vkzaj7cwkqpqixg/appbranding/y2tibtckspdiuxwdfhw-aqaika5xxfufyw7tdmgfq68/0/ 199 KB
199 KB 7ms
6ms Image
image/jpeg 2a02:26f0:6c00:283::35c1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.aadcdn.microsoftonline-p.com/dbd5a2dd-uymyxxfhpwrbckvwvlxle8radh6vkzaj7cwkqpqixg/appbranding/y2tibtckspdiuxwdfhw-aqaika5xxfufyw7tdmgfq68/0/heroillustration?ts=635673344126516270

Requested by

Host: office-action-needed.tk
URL: http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 08 Aug 2018 18:03:32 GMT
Last-Modified: Sat, 16 May 2015 00:53:32 GMT
Content-MD5: ZSg7Ej6yNeYXaumMAqxbHA==
Strict-Transport-Security: max-age=31536000
Content-Type: image\jpeg
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=74595
Connection: keep-alive
Content-Length: 203294

GET
H/1.1 200
OK bannerlogo
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-uymyxxfhpwrbckvwvlxle8radh6vkzaj7cwkqpqixg/appbranding/y2tibtckspdiuxwdfhw-aqaika5xxfufyw7tdmgfq68/0/ 16 KB
17 KB 6ms
6ms Image
image/png 2a02:26f0:6c00:283::35c1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.aadcdn.microsoftonline-p.com/dbd5a2dd-uymyxxfhpwrbckvwvlxle8radh6vkzaj7cwkqpqixg/appbranding/y2tibtckspdiuxwdfhw-aqaika5xxfufyw7tdmgfq68/0/bannerlogo?ts=635673344101780393

Requested by

Host: office-action-needed.tk
URL: http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

58c8851cbf14153c9559ec9159d74091d633fc08d3e792299f208866c07da331

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 08 Aug 2018 18:03:32 GMT
Last-Modified: Sat, 16 May 2015 00:53:32 GMT
Content-MD5: cE824r/yj1EF3hpfSs4z7Q==
Strict-Transport-Security: max-age=31536000
Content-Type: image\jpeg
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=74595
Connection: keep-alive
Content-Length: 16742

GET
H/1.1 200
OK close.png
secure.aadcdn.microsoftonline-p.com/ests/2.1.6916.13/content/images/ 190 B
517 B 6ms
5ms Image
image/png 2a02:26f0:6c00:283::35c1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6916.13/content/images/close.png

Requested by

Host: office-action-needed.tk
URL: http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

9e444d6e8e9247aa4f8fb0025995c7867fc1d63c182774f4524a3cf8588c10c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 08 Aug 2018 18:03:32 GMT
Last-Modified: Tue, 21 Nov 2017 04:42:31 GMT
Content-MD5: YnjsCsEWoilRLuXESGWLFg==
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=510698
Connection: keep-alive
Content-Length: 190

GET
H/1.1 200
OK microsoft_logo.png
secure.aadcdn.microsoftonline-p.com/ests/2.1.6916.13/content/images/ 1 KB
1 KB 7ms
7ms Image
image/png 2a02:26f0:6c00:283::35c1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6916.13/content/images/microsoft_logo.png

Requested by

Host: office-action-needed.tk
URL: http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 08 Aug 2018 18:03:32 GMT
Last-Modified: Tue, 21 Nov 2017 04:42:42 GMT
Content-MD5: 7ZyesNzhfXUr7eprWs2m2Q==
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=510698
Connection: keep-alive
Content-Length: 1057

GET
H2 200 prefetch
www.office.com/prefetch/ Frame 45D2 0
0 77ms
42ms Document
text/html 2620:1ec:a92::156
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.office.com/prefetch/prefetch

Requested by

Host: office-action-needed.tk
URL: http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:1ec:a92::156 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.office.com
:scheme: https
:path: /prefetch/prefetch
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html
accept-encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 9C56F730ED951949D9D04E63188737AF
Referer: http://office-action-needed.tk/aa94d85667d761a30e2318097e2141/index.html

Response headers

status: 200
cache-control: private, no-store, must-revalidate, max-age=0
content-length: 815
content-type: text/html; charset=utf-8
content-encoding: gzip
expires: Wed, 08 Aug 2018 18:02:32 GMT
vary: Accept-Encoding
set-cookie: OH.DCAffinity=OH-weu; path=/ OH.SID=9e36e868-ae5f-4541-92b2-4d688f9f317f; path=/; secure; HttpOnly OH.DCAffinity=OH-weu; path=/; secure; HttpOnly MUID=172BAE553815660E39EBA210390B676B; path=/; secure; expires=Mon, 02-Sep-2019 18:03:32 GMT; domain=office.com
strict-transport-security: max-age=31536000
x-ua-compatible: IE=edge,chrome=1
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
x-msedge-ref: Ref A: DC471E6805684DCEAAB7DCE5F01CEFA8 Ref B: VIEEDGE0716 Ref C: 2018-08-08T18:03:32Z
date: Wed, 08 Aug 2018 18:03:31 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online) Microsoft (Consumer)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
outlook.office365.com/	1970-01-19 02:48:07	Name: ClientId Value: 7944CEBB32CC4B4A9B255D97DC878AE0
outlook.office365.com/	1970-01-18 22:27:29	Name: OIDC Value: 1
.office.com/	1970-01-19 03:24:07	Name: MUID Value: 172BAE553815660E39EBA210390B676B
www.office.com/	1969-12-31 23:59:59	Name: OH.SID Value: 9e36e868-ae5f-4541-92b2-4d688f9f317f
www.office.com/	1969-12-31 23:59:59	Name: OH.DCAffinity Value: OH-weu

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

clearload.bid
office-action-needed.gq
office-action-needed.tk
secure.aadcdn.microsoftonline-p.com
www.office.com
zipansion.com
2400:cb00:2048:1::681b:9a63
2400:cb00:2048:1::681b:9b63
2400:cb00:2048:1::681b:a06c
2620:1ec:a92::156
2a02:26f0:6c00:283::35c1
85.93.145.120
58c8851cbf14153c9559ec9159d74091d633fc08d3e792299f208866c07da331
794a3e7ac5b0b61344702fd93fef4eb4cd794df080d909a90a05d62efdd21957
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
91c2b74542e11d0278e02715a980b39582eae2e3b519ddd2d4f9ca939e58109c
9e444d6e8e9247aa4f8fb0025995c7867fc1d63c182774f4524a3cf8588c10c5
d9c500706bcdb6d8e2ba4de1a6ea3d30d87417b79aa26e51fa2b9b9f4ff37e5f
f6591c87ee3dfcfa88fd302011f9b4943c7a378e2d30ae2658e2bc0dac28c1e5
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

office-action-needed.tk Open in urlscan Pro 85.93.145.120 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

78 %HTTPS

83 %IPv6

6 Domains

6 Subdomains

3 IPs

3 Countries

360 kBTransfer

375 kBSize

5 Cookies

5 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

5 Cookies

Indicators

office-action-needed.tk Open in urlscan Pro
85.93.145.120 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

78 %
HTTPS

83 %
IPv6

6
Domains

6
Subdomains

3
IPs

3
Countries

360 kB
Transfer

375 kB
Size

5
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!