login.office365online.sgmexinternational.com Open in urlscan Pro
82.163.176.104 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://ib.adnxs.com/getuid?http://Fairwaymc.aubergeresrots.com/762617272796640666169727761796d632e636f6d
Effective URL:
https://login.office365online.sgmexinternational.com/login.php?ss=2&ea=762617272796640666169727761796d632e636f6d
Submission: On February 24 via manual (February 24th 2022, 9:31:45 pm UTC) from US — Scanned from NL

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 9 HTTP transactions. The main IP is 82.163.176.104, located in United Kingdom and belongs to WILDCARD-AS Wildcard UK Limited, GB. The main domain is login.office365online.sgmexinternational.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on February 24th 2022. Valid for: 3 months.

This is the only time login.office365online.sgmexinternational.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
3 3	185.33.221.53 185.33.221.53	29990 (ASN-APPNEX) (ASN-APPNEX)
1	162.0.217.44 162.0.217.44	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1 9	82.163.176.104 82.163.176.104	34119 (WILDCARD-...) (WILDCARD-AS Wildcard UK Limited)
9	3

3 185.33.221.53 (Amsterdam, Netherlands) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 718.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.0.217.44 (Amsterdam, Netherlands)

ASN22612 (NAMECHEAP-NET, US)
PTR: business146-5.web-hosting.com

fairwaymc.aubergeresrots.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 82.163.176.104 (United Kingdom) 1 redirects

ASN34119 (WILDCARD-AS Wildcard UK Limited, GB)
PTR: sv91.ifastnet.com

login.office365online.sgmexinternational.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	sgmexinternational.com 1 redirects login.office365online.sgmexinternational.com	58 KB
3	adnxs.com 3 redirects ib.adnxs.com — Cisco Umbrella Rank: 210	3 KB
1	aubergeresrots.com fairwaymc.aubergeresrots.com	6 KB
9	3

	Domain	Requested by
9	login.office365online.sgmexinternational.com	1 redirects login.office365online.sgmexinternational.com
3	ib.adnxs.com	3 redirects
1	fairwaymc.aubergeresrots.com
9	3

This site contains no links.

Subject Issuer	Validity	Valid
login.office365online.sgmexinternational.com cPanel, Inc. Certification Authority	`2022-02-24` - `2022-05-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://login.office365online.sgmexinternational.com/login.php?ss=2&ea=762617272796640666169727761796d632e636f6d
Frame ID: 487E8F00FFE1C6E1C954F51E33AECF49
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Enter your password

Page URL History Show full URLs

http://ib.adnxs.com/getuid?http://Fairwaymc.aubergeresrots.com/762617272796640666169727761796d63... HTTP 307
https://ib.adnxs.com/sbounce?%2Fgetuid%3Fhttp%3A%2F%2FFairwaymc.aubergeresrots.com%2F762617272796... HTTP 307
https://ib.adnxs.com/bounce?%2Fsbounce%3F%252Fgetuid%253Fhttp%253A%252F%252FFairwaymc.aubergeresr... HTTP 302
http://fairwaymc.aubergeresrots.com/762617272796640666169727761796d632e636f6d Page URL
https://login.office365online.sgmexinternational.com/index?ss=2&ea=762617272796640666169727761796d632e636f6d HTTP 302
https://login.office365online.sgmexinternational.com/login.php?ss=2&ea=762617272796640666169727761796d632e636f6d Page URL

Page Statistics

9
Requests

89 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

64 kB
Transfer

161 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ib.adnxs.com/getuid?http://Fairwaymc.aubergeresrots.com/762617272796640666169727761796d632e636f6d HTTP 307
https://ib.adnxs.com/sbounce?%2Fgetuid%3Fhttp%3A%2F%2FFairwaymc.aubergeresrots.com%2F762617272796640666169727761796d632e636f6d HTTP 307
https://ib.adnxs.com/bounce?%2Fsbounce%3F%252Fgetuid%253Fhttp%253A%252F%252FFairwaymc.aubergeresrots.com%252F762617272796640666169727761796d632e636f6d HTTP 302
http://fairwaymc.aubergeresrots.com/762617272796640666169727761796d632e636f6d Page URL
https://login.office365online.sgmexinternational.com/index?ss=2&ea=762617272796640666169727761796d632e636f6d HTTP 302
https://login.office365online.sgmexinternational.com/login.php?ss=2&ea=762617272796640666169727761796d632e636f6d Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://ib.adnxs.com/getuid?http://Fairwaymc.aubergeresrots.com/762617272796640666169727761796d632e636f6d HTTP 307
https://ib.adnxs.com/sbounce?%2Fgetuid%3Fhttp%3A%2F%2FFairwaymc.aubergeresrots.com%2F762617272796640666169727761796d632e636f6d HTTP 307
https://ib.adnxs.com/bounce?%2Fsbounce%3F%252Fgetuid%253Fhttp%253A%252F%252FFairwaymc.aubergeresrots.com%252F762617272796640666169727761796d632e636f6d HTTP 302
http://fairwaymc.aubergeresrots.com/762617272796640666169727761796d632e636f6d

9 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

762617272796640666169727761796d632e636f6d Show response
fairwaymc.aubergeresrots.com/
Redirect Chain

http://ib.adnxs.com/getuid?http://Fairwaymc.aubergeresrots.com/762617272796640666169727761796d632e636f6d
https://ib.adnxs.com/sbounce?%2Fgetuid%3Fhttp%3A%2F%2FFairwaymc.aubergeresrots.com%2F762617272796640666169727761796d632e636f6d
https://ib.adnxs.com/bounce?%2Fsbounce%3F%252Fgetuid%253Fhttp%253A%252F%252FFairwaymc.aubergeresrots.com%252F762617272796640666169727761796d632e636f6d
http://fairwaymc.aubergeresrots.com/762617272796640666169727761796d632e636f6d

7 KB
6 KB

74ms
37ms

Document
text/html

162.0.217.44
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

http://fairwaymc.aubergeresrots.com/762617272796640666169727761796d632e636f6d

Protocol

HTTP/1.1

Server

162.0.217.44 Amsterdam, Netherlands, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business146-5.web-hosting.com

Software

LiteSpeed / PHP/7.2.34

Resource Hash

7df7188678d0b36d0e7d6c0a9c037eb29821463c4aeae5aa163ffe566b485ca0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: nl-NL,nl;q=0.9

Response headers

keep-alive: timeout=5, max=100
x-powered-by: PHP/7.2.34
content-type: text/html; charset=UTF-8
content-length: 5603
content-encoding: gzip
vary: Accept-Encoding
date: Thu, 24 Feb 2022 21:31:41 GMT
server: LiteSpeed
x-turbo-charged-by: LiteSpeed
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
referrer-policy: no-referrer-when-downgrade

Redirect headers

Server: nginx/1.17.9
Date: Thu, 24 Feb 2022 21:31:41 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Location: http://Fairwaymc.aubergeresrots.com/762617272796640666169727761796d632e636f6d
AN-X-Request-Uuid: 276d8686-afe9-4443-b40f-cfd287719060
X-Proxy-Origin: 95.211.199.145; 95.211.199.145; 718.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a00f7ed35be5bfea9cbbdcbeca07f536d9db6fb6391ca55ad38790eecb01ffeb

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: http://fairwaymc.aubergeresrots.com/762617272796640666169727761796d632e636f6d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

Primary Request login.php Show response
login.office365online.sgmexinternational.com/
Redirect Chain

https://login.office365online.sgmexinternational.com/index?ss=2&ea=762617272796640666169727761796d632e636f6d
https://login.office365online.sgmexinternational.com/login.php?ss=2&ea=762617272796640666169727761796d632e636f6d

14 KB
11 KB

694ms
693ms

Document
text/html

82.163.176.104
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.office365online.sgmexinternational.com/login.php?ss=2&ea=762617272796640666169727761796d632e636f6d
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 82.163.176.104 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS: sv91.ifastnet.com
Software: nginx /
Resource Hash: ca14ddf2162a3ad1508d2e6626547920d3daa5ef3dfcb29cf11801625c9611cf

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: nl-NL,nl;q=0.9
Referer: http://fairwaymc.aubergeresrots.com/762617272796640666169727761796d632e636f6d

Response headers

server: nginx
date: Thu, 24 Feb 2022 21:31:42 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-encoding: br

Redirect headers

server: nginx
date: Thu, 24 Feb 2022 21:31:41 GMT
content-type: text/html; charset=UTF-8
content-length: 0
location: login.php?ss=2&ea=762617272796640666169727761796d632e636f6d
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache

GET
H2 200 en.js Show response
login.office365online.sgmexinternational.com/files/ 8 KB
3 KB 57ms
57ms Script
application/javascript 82.163.176.104
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.office365online.sgmexinternational.com/files/en.js
Requested by: Host: login.office365online.sgmexinternational.com
URL: https://login.office365online.sgmexinternational.com/login.php?ss=2&ea=762617272796640666169727761796d632e636f6d
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 82.163.176.104 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS: sv91.ifastnet.com
Software: nginx /
Resource Hash: 6369118b817a8a0549092cce8b77d77ac7ec88cc76a66d3ed9e32e9c4f6fb23f

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: https://login.office365online.sgmexinternational.com/login.php?ss=2&ea=762617272796640666169727761796d632e636f6d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 24 Feb 2022 21:31:42 GMT
content-encoding: br
last-modified: Fri, 16 Oct 2020 15:15:48 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000, public, proxy-revalidate, public, proxy-revalidate
expires: Sat, 26 Mar 2022 21:31:42 GMT

GET
H2 200 Converged1033.css
login.office365online.sgmexinternational.com/files/ 99 KB
18 KB 61ms
60ms Stylesheet
text/css 82.163.176.104
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.office365online.sgmexinternational.com/files/Converged1033.css
Requested by: Host: login.office365online.sgmexinternational.com
URL: https://login.office365online.sgmexinternational.com/login.php?ss=2&ea=762617272796640666169727761796d632e636f6d
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 82.163.176.104 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS: sv91.ifastnet.com
Software: nginx /
Resource Hash: c7813d74ea586bd46be064ae15384fcb9f3a2279cc108adf711d8fa8ea523435

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: https://login.office365online.sgmexinternational.com/login.php?ss=2&ea=762617272796640666169727761796d632e636f6d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 24 Feb 2022 21:31:42 GMT
content-encoding: br
last-modified: Fri, 16 Oct 2020 15:15:48 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000, public, proxy-revalidate
expires: Sat, 26 Mar 2022 21:31:42 GMT

GET
H2 200 ou.png
login.office365online.sgmexinternational.com/files2/ 5 KB
5 KB 48ms
47ms Image
image/png 82.163.176.104
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.office365online.sgmexinternational.com/files2/ou.png
Requested by: Host: login.office365online.sgmexinternational.com
URL: https://login.office365online.sgmexinternational.com/login.php?ss=2&ea=762617272796640666169727761796d632e636f6d
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 82.163.176.104 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS: sv91.ifastnet.com
Software: nginx /
Resource Hash: e4e1e65871749d18aea150643c07e0aab2057da057c6c57ec1c3c43580e1c898

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: https://login.office365online.sgmexinternational.com/login.php?ss=2&ea=762617272796640666169727761796d632e636f6d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 24 Feb 2022 21:31:42 GMT
last-modified: Fri, 16 Oct 2020 15:15:48 GMT
server: nginx
content-type: image/png
cache-control: max-age=2592000, public, proxy-revalidate
accept-ranges: bytes
content-length: 5139
expires: Sat, 26 Mar 2022 21:31:42 GMT

GET
H2 200 microsoft_logo.svg
login.office365online.sgmexinternational.com/files/ 4 KB
2 KB 47ms
46ms Image
image/svg+xml 82.163.176.104
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.office365online.sgmexinternational.com/files/microsoft_logo.svg
Requested by: Host: login.office365online.sgmexinternational.com
URL: https://login.office365online.sgmexinternational.com/login.php?ss=2&ea=762617272796640666169727761796d632e636f6d
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 82.163.176.104 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS: sv91.ifastnet.com
Software: nginx /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: https://login.office365online.sgmexinternational.com/login.php?ss=2&ea=762617272796640666169727761796d632e636f6d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 24 Feb 2022 21:31:42 GMT
content-encoding: br
last-modified: Fri, 16 Oct 2020 15:15:48 GMT
server: nginx
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=0
expires: Thu, 24 Feb 2022 21:31:42 GMT

GET
H2 200 arrow_left.png
login.office365online.sgmexinternational.com/files/ 240 B
434 B 48ms
47ms Image
image/png 82.163.176.104
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.office365online.sgmexinternational.com/files/arrow_left.png
Requested by: Host: login.office365online.sgmexinternational.com
URL: https://login.office365online.sgmexinternational.com/login.php?ss=2&ea=762617272796640666169727761796d632e636f6d
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 82.163.176.104 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS: sv91.ifastnet.com
Software: nginx /
Resource Hash: ab50358475adae73a435466c72d1a48ab124e8ae06614663716a46dce5ac8b83

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: https://login.office365online.sgmexinternational.com/login.php?ss=2&ea=762617272796640666169727761796d632e636f6d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 24 Feb 2022 21:31:42 GMT
last-modified: Fri, 16 Oct 2020 15:15:48 GMT
server: nginx
content-type: image/png
cache-control: max-age=2592000, public, proxy-revalidate
accept-ranges: bytes
content-length: 240
expires: Sat, 26 Mar 2022 21:31:42 GMT

GET
H2 200 1-small.jpg
login.office365online.sgmexinternational.com/files2/ 987 B
1 KB 50ms
49ms Image
image/jpeg 82.163.176.104
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.office365online.sgmexinternational.com/files2/1-small.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 82.163.176.104 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS: sv91.ifastnet.com
Software: nginx /
Resource Hash: 8b34a475187302935336bf43a2bf2a4e0adb9a1e87953ea51f6fcf0ef52a4a1d

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: https://login.office365online.sgmexinternational.com/common/login
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 24 Feb 2022 21:31:42 GMT
last-modified: Fri, 16 Oct 2020 15:15:48 GMT
server: nginx
content-type: image/jpeg
cache-control: max-age=2592000, public, proxy-revalidate
accept-ranges: bytes
content-length: 987
expires: Sat, 26 Mar 2022 21:31:42 GMT

GET
H2 200 1.jpg
login.office365online.sgmexinternational.com/files2/ 17 KB
17 KB 49ms
49ms Image
image/jpeg 82.163.176.104
WILDCARD-AS Wildc...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.office365online.sgmexinternational.com/files2/1.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 82.163.176.104 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS: sv91.ifastnet.com
Software: nginx /
Resource Hash: d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: https://login.office365online.sgmexinternational.com/common/login
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 24 Feb 2022 21:31:42 GMT
last-modified: Fri, 16 Oct 2020 15:15:48 GMT
server: nginx
content-type: image/jpeg
cache-control: max-age=2592000, public, proxy-revalidate
accept-ranges: bytes
content-length: 17453
expires: Sat, 26 Mar 2022 21:31:42 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.adnxs.com/	1970-01-20 03:18:34	Name: uuid2 Value: 5105766355278340506
			login.office365online.sgmexinternational.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: b3b0398cbcfb804b137cff978b7093d1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fairwaymc.aubergeresrots.com
ib.adnxs.com
login.office365online.sgmexinternational.com
162.0.217.44
185.33.221.53
82.163.176.104
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
6369118b817a8a0549092cce8b77d77ac7ec88cc76a66d3ed9e32e9c4f6fb23f
7df7188678d0b36d0e7d6c0a9c037eb29821463c4aeae5aa163ffe566b485ca0
8b34a475187302935336bf43a2bf2a4e0adb9a1e87953ea51f6fcf0ef52a4a1d
a00f7ed35be5bfea9cbbdcbeca07f536d9db6fb6391ca55ad38790eecb01ffeb
ab50358475adae73a435466c72d1a48ab124e8ae06614663716a46dce5ac8b83
c7813d74ea586bd46be064ae15384fcb9f3a2279cc108adf711d8fa8ea523435
ca14ddf2162a3ad1508d2e6626547920d3daa5ef3dfcb29cf11801625c9611cf
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3
e4e1e65871749d18aea150643c07e0aab2057da057c6c57ec1c3c43580e1c898

login.office365online.sgmexinternational.com Open in urlscan Pro 82.163.176.104 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

9 Requests

89 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

64 kBTransfer

161 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

2 Cookies

Security Headers

Indicators

login.office365online.sgmexinternational.com Open in urlscan Pro
82.163.176.104 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

89 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

64 kB
Transfer

161 kB
Size

2
Cookies

9 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!