supportwebmail-hotmail.carewellcenter.com Open in urlscan Pro
23.229.183.37 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email=
Submission: On November 03 via automatic, source openphish (November 3rd 2017, 11:31:56 pm UTC)

Summary HTTP 10 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 10 HTTP transactions. The main IP is 23.229.183.37, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US. The main domain is supportwebmail-hotmail.carewellcenter.com.

This is the only time supportwebmail-hotmail.carewellcenter.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	23.229.183.37 23.229.183.37	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
8	2a02:26f0:122... 2a02:26f0:122:399::34ef	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
10	3

1 23.229.183.37 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-23-229-183-37.ip.secureserver.net

supportwebmail-hotmail.carewellcenter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a02:26f0:122:399::34ef (European Union)

ASN20940 (AKAMAI-ASN1, US)

auth.gfx.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
msagfx.live.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	gfx.ms auth.gfx.ms	392 KB
1	live.com msagfx.live.com	78 KB
1	carewellcenter.com supportwebmail-hotmail.carewellcenter.com	6 KB
0	office365.com Failed outlook.office365.com Failed
10	4

	Domain	Requested by
7	auth.gfx.ms	supportwebmail-hotmail.carewellcenter.com
1	msagfx.live.com	supportwebmail-hotmail.carewellcenter.com
1	supportwebmail-hotmail.carewellcenter.com
0	outlook.office365.com Failed	supportwebmail-hotmail.carewellcenter.com
10	4

This site contains links to these domains. Also see Links.

Domain
account.live.com
login.live.com

Subject Issuer	Validity	Valid
msagfx.live.com Microsoft IT TLS CA 4	`2017-07-27` - `2019-07-17`	2 years	crt.sh

This page contains 2 frames:

Primary Page: http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email=
Frame ID: 11008.1
Requests: 9 HTTP requests in this frame

Frame: https://outlook.office365.com/owa/prefetch.aspx?id=292841&mkt=EN-GB
Frame ID: 11008.4
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

10
Requests

80 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

475 kB
Transfer

940 kB
Size

4
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.0%26rpsnv%3d13%26ct%3d1505945230%26rver%3d6.7.6640.0%26wp%3dMBI_SSL%26wreply%3dhttps%253a%252f%252foutlook.live.com%252fowa%252f%253fauthRedirect%253dtrue%2526realm%253dhotmail.com%2526RpsCsrfState%253dc127d36c-c8f7-8396-d6d8-cd70a2a665c7%26id%3d292841%26whr%3dhotmail.com%26CBCXT%3dout%26fl%3dwld%26cobrandid%3d90015%26contextid%3dFC0AEAB72C1B61E6%26bk%3d1505945230&id=292841&uiflavor=web&cobrandid=912202191352&uaid=4cffcbfe4f364cb2b7bb277297d36014&mkt=EN-GB&lc=2057&bk=1505945230
Title: Forgotten my password

Search URL Search Domain Scan URL

URL: https://login.live.com/logout.srf?wa=wsignin1.0&rpsnv=13&ct=1505945230&rver=6.7.6640.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fauthRedirect%3dtrue%26realm%3dhotmail.com%26RpsCsrfState%3dc127d36c-c8f7-8396-d6d8-cd70a2a665c7&id=292841&whr=hotmail.com&CBCXT=out&fl=wld&cobrandid=90015&contextid=FC0AEAB72C1B61E6&ru=https://outlook.live.com/owa/%3fauthRedirect%3dtrue%26realm%3dhotmail.com%26RpsCsrfState%3dc127d36c-c8f7-8396-d6d8-cd70a2a665c7&bk=1505945230&lm=I
Title: Sign in with a different Microsoft account

Search URL Search Domain Scan URL

URL: https://login.live.com/gls.srf?urlID=WinLiveTermsOfUse&mkt=EN-GB&vv=1600
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://login.live.com/gls.srf?urlID=MSNPrivacyStatement&mkt=EN-GB&vv=1600
Title: Privacy & Cookies

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set signed.in.php Show response supportwebmail-hotmail.carewellcenter.com/page/	20 KB 6 KB	312ms 161ms	Document text/html	23.229.183.37 GoDaddy.com
General Check archive.org Show headers Download Go to Full URL http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= Protocol HTTP/1.1 Server 23.229.183.37 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US), Reverse DNS ip-23-229-183-37.ip.secureserver.net Software Apache / PHP/5.4.45 Resource Hash `8e38d9a21f21d55f5e1b166003a706b22762366d02d26798cf664359ac61aac1` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host supportwebmail-hotmail.carewellcenter.com Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Cache-Control no-cache Connection keep-alive Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Response headers Pragma no-cache Date Fri, 03 Nov 2017 23:31:44 GMT Content-Encoding gzip Server Apache X-Powered-By PHP/5.4.45 Vary Accept-Encoding,User-Agent Content-Type text/html Set-Cookie PHPSESSID=56d1222387b01c6f23141e35e63fe248; path=/ Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Keep-Alive timeout=5 Content-Length 5952 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	Converged2057.css auth.gfx.ms/16.000.27523.1/	86 KB 16 KB	37ms 9ms	Stylesheet text/css	2a02:26f0:122:399::34ef AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://auth.gfx.ms/16.000.27523.1/Converged2057.css Requested by Host: supportwebmail-hotmail.carewellcenter.com URL: http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:122:399::34ef , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash `87b829bfb1157d61ec498223d05481421fbfa239f538ca5932d55db86894678c` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host auth.gfx.ms User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Accept text/css,/;q=0.1 Referer http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= Connection keep-alive Cache-Control no-cache Referer http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Response headers Date Fri, 03 Nov 2017 23:31:45 GMT Content-Encoding gzip Last-Modified Fri, 08 Sep 2017 04:27:18 GMT PPServer PPV: 30 H: BL2IDSPRTS1A003 V: 0 ETag "0d75ac15a28d31:0" Vary Accept-Encoding Content-Type text/css Access-Control-Allow-Origin * Cache-Control max-age=589228 Connection keep-alive Accept-Ranges bytes Content-Length 16704 Server Microsoft-IIS/8.5
GET H/1.1	200 OK	ConvergedLoginPaginatedStrings.EN-GB.js Show response auth.gfx.ms/16.000.27523.1/	13 KB 4 KB	33ms 6ms	Script application/javascript	2a02:26f0:122:399::34ef AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://auth.gfx.ms/16.000.27523.1/ConvergedLoginPaginatedStrings.EN-GB.js Requested by Host: supportwebmail-hotmail.carewellcenter.com URL: http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:122:399::34ef , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash `f03c8a575739c570aebb56b411cdd0dea625e0d0fe0281ad60be5f78e531b6fd` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host auth.gfx.ms User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Accept / Referer http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= Connection keep-alive Cache-Control no-cache Referer http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Response headers Date Fri, 03 Nov 2017 23:31:45 GMT Content-Encoding gzip Last-Modified Fri, 08 Sep 2017 04:27:18 GMT PPServer PPV: 30 H: BL2IDSPRTS1C001 V: 0 ETag "0d75ac15a28d31:0" Vary Accept-Encoding Content-Type application/javascript Access-Control-Allow-Origin * Cache-Control max-age=589228 Connection keep-alive Accept-Ranges bytes Content-Length 4307 Server Microsoft-IIS/8.5
GET H/1.1	200 OK	ConvergedLogin_PCore.js Show response auth.gfx.ms/16.000.27523.1/	262 KB 78 KB	40ms 14ms	Script application/javascript	2a02:26f0:122:399::34ef AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://auth.gfx.ms/16.000.27523.1/ConvergedLogin_PCore.js Requested by Host: supportwebmail-hotmail.carewellcenter.com URL: http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:122:399::34ef , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash `2eb191c276422210cc8b755922e08bbfdd52083f4d244c4c4f9cdf171c442a28` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host auth.gfx.ms User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Accept / Referer http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= Connection keep-alive Cache-Control no-cache Referer http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Response headers Date Fri, 03 Nov 2017 23:31:45 GMT Content-Encoding gzip Last-Modified Fri, 08 Sep 2017 04:27:18 GMT PPServer PPV: 30 H: BL2IDSPRTS1C001 V: 0 ETag "0d75ac15a28d31:0" Vary Accept-Encoding Content-Type application/javascript Access-Control-Allow-Origin * Cache-Control max-age=267251 Transfer-Encoding chunked Connection keep-alive Transfer-Encoding Accept-Ranges bytes Server Microsoft-IIS/8.5
GET H/1.1	200 OK	microsoft_logo.svg auth.gfx.ms/16.000.27523.1/images/	4 KB 1 KB	7ms 7ms	Image image/svg+xml	2a02:26f0:122:399::34ef AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://auth.gfx.ms/16.000.27523.1/images/microsoft_logo.svg?x=ee5c8d9fb6248c938fd0dc19370e90bd Requested by Host: supportwebmail-hotmail.carewellcenter.com URL: http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:122:399::34ef , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host auth.gfx.ms User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= Connection keep-alive Cache-Control no-cache Referer http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Response headers Date Fri, 03 Nov 2017 23:31:45 GMT Content-Encoding gzip Last-Modified Fri, 08 Sep 2017 04:27:18 GMT PPServer PPV: 30 H: BL2IDSPRTS1C001 V: 0 ETag "0d75ac15a28d31:0" Vary Accept-Encoding Content-Type image/svg+xml Access-Control-Allow-Origin * Cache-Control max-age=551532 Connection keep-alive Accept-Ranges bytes Content-Length 1435 Server Microsoft-IIS/8.5
GET H/1.1	200 OK	picker_account_msa.svg auth.gfx.ms/16.000.27523.1/images/	379 B 379 B	6ms 6ms	Image image/svg+xml	2a02:26f0:122:399::34ef AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://auth.gfx.ms/16.000.27523.1/images/picker_account_msa.svg?x=2d8f86059be176833897099ee6ddedeb Requested by Host: supportwebmail-hotmail.carewellcenter.com URL: http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:122:399::34ef , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash `34d8da073f47030ee94b99d84fbe68e3345bd8aaa37ea909ff2da00238447486` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host auth.gfx.ms User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= Connection keep-alive Cache-Control no-cache Referer http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Response headers Date Fri, 03 Nov 2017 23:31:45 GMT Last-Modified Fri, 08 Sep 2017 04:27:18 GMT PPServer PPV: 30 H: BL2IDSPRTS1A002 V: 0 ETag "0d75ac15a28d31:0" Content-Type image/svg+xml Access-Control-Allow-Origin * Cache-Control max-age=214135 Connection keep-alive Accept-Ranges bytes Content-Length 379 Server Microsoft-IIS/8.5
GET H/1.1	200 OK	ConvergedLogin_PCore.js Show response msagfx.live.com/16.000.27523.1/	262 KB 78 KB	37ms 11ms	Script application/javascript	2a02:26f0:122:399::34ef AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://msagfx.live.com/16.000.27523.1/ConvergedLogin_PCore.js Requested by Host: supportwebmail-hotmail.carewellcenter.com URL: http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:122:399::34ef , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash `2eb191c276422210cc8b755922e08bbfdd52083f4d244c4c4f9cdf171c442a28` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host msagfx.live.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Accept / Referer http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= Connection keep-alive Cache-Control no-cache Referer http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers Date Fri, 03 Nov 2017 23:31:45 GMT Content-Encoding gzip Last-Modified Fri, 08 Sep 2017 04:27:18 GMT PPServer PPV: 30 H: BL2IDSPRTS1C001 V: 0 ETag "0d75ac15a28d31:0" Vary Accept-Encoding Content-Type application/javascript Access-Control-Allow-Origin * Cache-Control max-age=267251 Transfer-Encoding chunked Connection keep-alive Transfer-Encoding Accept-Ranges bytes Server Microsoft-IIS/8.5
GET		prefetch.aspx outlook.office365.com/owa/ Frame 1100	0 0

GET H/1.1	200 OK	0-small.jpg auth.gfx.ms/16.000.27523.1/images/Backgrounds/	1 KB 1 KB	6ms 6ms	Image image/jpeg	2a02:26f0:122:399::34ef AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://auth.gfx.ms/16.000.27523.1/images/Backgrounds/0-small.jpg?x=12f4b8b543125cc986c79cd85320812f Requested by Host: supportwebmail-hotmail.carewellcenter.com URL: http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:122:399::34ef , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash `c13db279143e1845ee4aaee5afedc5bd75e9f7d50024b63883b45332c4960b3b` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host auth.gfx.ms User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= Connection keep-alive Cache-Control no-cache Referer http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Response headers Date Fri, 03 Nov 2017 23:31:45 GMT Last-Modified Fri, 08 Sep 2017 04:27:18 GMT PPServer PPV: 30 H: BL2IDSPRTS1C001 V: 0 ETag "0d75ac15a28d31:0" Content-Type image/jpeg Access-Control-Allow-Origin * Cache-Control max-age=209758 Connection keep-alive Accept-Ranges bytes Content-Length 1029 Server Microsoft-IIS/8.5
GET H/1.1	200 OK	0.jpg auth.gfx.ms/16.000.27523.1/images/Backgrounds/	291 KB 291 KB	8ms 7ms	Image image/jpeg	2a02:26f0:122:399::34ef AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://auth.gfx.ms/16.000.27523.1/images/Backgrounds/0.jpg?x=f5a9a9531b8f4bcc86eabb19472d15d5 Requested by Host: supportwebmail-hotmail.carewellcenter.com URL: http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:122:399::34ef , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash `62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host auth.gfx.ms User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= Connection keep-alive Cache-Control no-cache Referer http://supportwebmail-hotmail.carewellcenter.com/page/signed.in.php?email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 Response headers Date Fri, 03 Nov 2017 23:31:45 GMT Last-Modified Fri, 08 Sep 2017 04:27:18 GMT PPServer PPV: 30 H: BL2IDSPRTS1A001 V: 0 ETag "0d75ac15a28d31:0" Content-Type image/jpeg Access-Control-Allow-Origin * Cache-Control max-age=209753 Connection keep-alive Accept-Ranges bytes Content-Length 298105 Server Microsoft-IIS/8.5

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: outlook.office365.com
URL: https://outlook.office365.com/owa/prefetch.aspx?id=292841&mkt=EN-GB

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
outlook.office365.com/	1970-01-18 15:43:10	Name: OIDC Value: 1
outlook.office365.com/	1970-01-18 20:08:07	Name: ClientId Value: EEF14044A7334561B93374B988DD8407
outlook.office365.com/	1970-01-01 00:00:00	Name: OWAPF Value: v:16.2001.3.2434165&l:mouse
supportwebmail-hotmail.carewellcenter.com/	1970-01-01 00:00:00	Name: PHPSESSID Value: 56d1222387b01c6f23141e35e63fe248

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

auth.gfx.ms
msagfx.live.com
outlook.office365.com
supportwebmail-hotmail.carewellcenter.com
outlook.office365.com
23.229.183.37
2a02:26f0:122:399::34ef
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
2eb191c276422210cc8b755922e08bbfdd52083f4d244c4c4f9cdf171c442a28
34d8da073f47030ee94b99d84fbe68e3345bd8aaa37ea909ff2da00238447486
62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214
87b829bfb1157d61ec498223d05481421fbfa239f538ca5932d55db86894678c
8e38d9a21f21d55f5e1b166003a706b22762366d02d26798cf664359ac61aac1
c13db279143e1845ee4aaee5afedc5bd75e9f7d50024b63883b45332c4960b3b
f03c8a575739c570aebb56b411cdd0dea625e0d0fe0281ad60be5f78e531b6fd

supportwebmail-hotmail.carewellcenter.com Open in urlscan Pro 23.229.183.37 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

10 Requests

80 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

475 kBTransfer

940 kBSize

4 Cookies

4 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

4 Cookies

Indicators

supportwebmail-hotmail.carewellcenter.com Open in urlscan Pro
23.229.183.37 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

80 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

475 kB
Transfer

940 kB
Size

4
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!