proxy.validate365.nl

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 4 HTTP transactions. The main IP is 185.30.204.180, located in Netherlands and belongs to A2B, NL. The main domain is proxy.validate365.nl.
TLS certificate: Issued by R3 on February 20th 2024. Valid for: 3 months.

This is the only time proxy.validate365.nl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	185.30.204.180 185.30.204.180	51088 (A2B) (A2B)
2	152.199.23.37 152.199.23.37	15133 (EDGECAST) (EDGECAST)
1	146.75.120.193 146.75.120.193	54113 (FASTLY) (FASTLY)
4	3

1 185.30.204.180 (Netherlands)

ASN51088 (A2B, NL)
PTR: static.hostlinq.nl

proxy.validate365.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 152.199.23.37 (United States)

ASN15133 (EDGECAST, US)

aadcdn.msftauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.120.193 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

i.stack.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	msftauth.net aadcdn.msftauth.net — Cisco Umbrella Rank: 950	19 KB
1	imgur.com i.stack.imgur.com — Cisco Umbrella Rank: 10577	274 KB
1	validate365.nl proxy.validate365.nl	24 KB
4	3

	Domain	Requested by
2	aadcdn.msftauth.net	proxy.validate365.nl
1	i.stack.imgur.com	proxy.validate365.nl
1	proxy.validate365.nl
4	3

This site contains links to these domains. Also see Links.

Domain
login.live.com

Subject Issuer	Validity	Valid
proxy.validate365.nl R3	`2024-02-20` - `2024-05-20`	3 months	crt.sh
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA	`2023-12-01` - `2024-12-01`	a year	crt.sh
i.stack.imgur.com R3	`2024-03-08` - `2024-06-06`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://proxy.validate365.nl/valid/cor?rid=9DlJeU3
Frame ID: D7970D9F10BA529EB0102C3678D9B7EF
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Microsoft Login

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

317 kB
Transfer

468 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://login.live.com/oauth20_authorize.srf?response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&scope=openid+profile+email+offline_access&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2&state=rQIIAYWSO2_TUACF66QNtKp4iQExoA4MCHST63tjO45gSGLXMUnskDh1bCFFTmzXr9iJ7cRtfgFjWbsgISbYQAjEytapCwKxsCIGBEyMFP4AZzjL2b7zbZ2ji7gIi_B2niyS1ZtlXKYMZswC1qAxKLMkBEYZ0QBTmMYIkiYFcXxl69L1D4-f3e29Ep68d_yfr0-1Y2JzFLhLqziJps-JG06azpJqqZRlWTGybXfybygFRmi64f5bgjgliK8EcZzbsEIw6D_PJTRmEK4wiGFZhqXhWYqyqkFJ8ZG28lNdGCC5D6HmDbK24kN9qqUdb0B1PNOVlVqme6bXETpIF3qO5PGppIiocwihJOx5bVWEHW-Sal4v0Ka6oyt8JnOB8zl3Ua4tUgf9rSh2V9av3KYdxdPRLErS4_yL3IFtDdtxr1LXDv0ZAkwK-KDZsqjMk0APNfao8j7yGtIE1x-QXFqTBbFNC-54pCKKFdyD8XA5D5d6wx7AEALWY7NGy1omk7mVNC1mxjsNA0qOBCaW4vRTo7XCwHkA-nXfaWrdBtuvk27XDsFsteRrYDHBSW-sqbvLZmqTRr_VdmSfwQlnsDavjpvgvtsaCVo641dm1xEGizllh4fduhzw05EYgmFbUcYD9QwJU5GiXaO2MKOGBfd6ewfzKakZMaWAjjrkYMYqaaVSMROKXylorgoGH3grn2v5TbQSsy5LB3EsK4LV4EEYjLLAAgsueZkvnD08jcKT_IVoZoWuuTOLI9sNrNN14tv69vnCpfy1tZ21W1fhxu914unGmUSfvn_56NcX4puHDrf9E6-dbJQyp6SawzsLQRa1lCzVrQ4Oa939PjtMduP2mIGuru_q0E0c8R5dJY8KxFGhcFK4LHIjiVf6Sk3iaj0OjeCPAvHo3Nq7zf-o-HnrKoIIAlgGGO6QbLVMVzGr_wE1&estsfed=1&uaid=a491d51a523c47b39fc3686bf1b5d059&signup=1&lw=1&fl=easi2&fci=4345a7b9-9a63-4910-a426-35363201d503&mkt=en-US
Title: Create one!

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request cor Show response proxy.validate365.nl/valid/	174 KB 24 KB	209ms 111ms	Document text/html	185.30.204.180 A2B
General Check archive.org Show headers Download Go to Full URL https://proxy.validate365.nl/valid/cor?rid=9DlJeU3 Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.30.204.180 , Netherlands, ASN51088 (A2B, NL), Reverse DNS static.hostlinq.nl Software openresty / Resource Hash `50b79c860fa89f9cec9f342027d91d507f10167d2612f53764315bd105bef80a` Request headers Accept-Language nl-NL,nl;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers content-encoding gzip content-type text/html; charset=utf-8 date Mon, 15 Apr 2024 11:52:47 GMT server openresty vary Accept-Encoding x-served-by proxy.validate365.nl x-server gophish
GET H2	200	microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg aadcdn.msftauth.net/ests/2.1/content/images/	4 KB 2 KB	375ms 16ms	Image image/svg+xml	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg Requested by Host: proxy.validate365.nl URL: https://proxy.validate365.nl/valid/cor?rid=9DlJeU3 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ama/4891) / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://proxy.validate365.nl/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Mon, 15 Apr 2024 11:52:48 GMT content-encoding gzip content-md5 nzaLxFgP7ZB3dfMcaybWzw== age 112807 x-cache HIT content-length 1435 x-ms-lease-status unlocked last-modified Fri, 02 Nov 2018 20:25:22 GMT server ECAcc (ama/4891) etag 0x8D64101507E84BD vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 85409022-501e-002e-3c24-8e6908000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding cache-control public, max-age=604800 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	vzbuQ.jpg i.stack.imgur.com/	273 KB 274 KB	104ms 20ms	Image image/jpeg	146.75.120.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.stack.imgur.com/vzbuQ.jpg Requested by Host: proxy.validate365.nl URL: https://proxy.validate365.nl/valid/cor?rid=9DlJeU3 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash `6bde963a562ffd594492bdff280c01e9e6518856aa3a9f14b96fcad867ce2f0f` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://proxy.validate365.nl/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-cache-hits 53, 0 date Mon, 15 Apr 2024 11:52:47 GMT via 1.1 varnish, 1.1 varnish expires Thu, 31 Dec 2037 23:55:55 GMT last-modified Sun, 17 Jun 2018 23:41:30 GMT server cat factory 1.0 age 870709 x-timer S1713181968.887598,VS0,VE1 etag "bcc8c3add31d42b2c4b6d13c0db8d3a5" x-cache HIT, HIT content-type image/jpeg cache-control max-age=315360000 accept-ranges bytes content-length 279841 x-served-by cache-iad-kjyo7100078-IAD, cache-fra-etou8220099-FRA
GET H2	200	favicon_a_eupayfgghqiai7k9sol6lg2.ico aadcdn.msftauth.net/ests/2.1/content/images/	17 KB 17 KB	14ms 14ms	Other image/x-icon	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ama/48E4) / Resource Hash `90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://proxy.validate365.nl/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Mon, 15 Apr 2024 11:52:48 GMT content-md5 EuPayFgGHQiAI7K9SOL6lg== age 93042 x-cache HIT content-length 17174 x-ms-lease-status unlocked last-modified Fri, 02 Nov 2018 20:25:16 GMT server ECAcc (ama/48E4) etag 0x8D641014D44D8FD content-type image/x-icon access-control-allow-origin * x-ms-request-id e17e6dba-001e-001f-0952-8e631b000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding cache-control public, max-age=604800 x-ms-version 2009-09-19 accept-ranges bytes

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msftauth.net
i.stack.imgur.com
proxy.validate365.nl
146.75.120.193
152.199.23.37
185.30.204.180
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
50b79c860fa89f9cec9f342027d91d507f10167d2612f53764315bd105bef80a
6bde963a562ffd594492bdff280c01e9e6518856aa3a9f14b96fcad867ce2f0f
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

proxy.validate365.nl Open in urlscan Pro 185.30.204.180 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

4 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

317 kBTransfer

468 kBSize

0 Cookies

1 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

proxy.validate365.nl Open in urlscan Pro
185.30.204.180 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

317 kB
Transfer

468 kB
Size

0
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!