m.icrosoft.info Open in urlscan Pro
64.191.166.205 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://m.icrosoft.info/675c84155005a/380bcc1971500d05917bad4b351718e98724341a/
Submission: On December 13 via api (December 13th 2024, 9:11:00 pm UTC) from US — Scanned from IL

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 13 HTTP transactions. The main IP is 64.191.166.205, located in Lexington, United States and belongs to QX-NET-ASN-1, US. The main domain is m.icrosoft.info.
TLS certificate: Issued by E6 on December 1st 2024. Valid for: 3 months.

This is the only time m.icrosoft.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
7	64.191.166.205 64.191.166.205	13776 (QX-NET-ASN-1) (QX-NET-ASN-1)
1	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	172.67.142.245 172.67.142.245	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	207.211.211.27 207.211.211.27	60068 (CDN77 Dat...) (CDN77 Datacamp Limited)
2	54.80.160.189 54.80.160.189	14618 (AMAZON-AES) (AMAZON-AES)
13	5

7 64.191.166.205 (Lexington, United States)

ASN13776 (QX-NET-ASN-1, US)

m.icrosoft.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.67.142.245 (United States)

ASN13335 (CLOUDFLARENET, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 207.211.211.27 (Frankfurt am Main, Germany)

ASN60068 (CDN77 Datacamp Limited, GB)
PTR: 607028803.fra.cdn77.com

maxcdn.icons8.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.80.160.189 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-80-160-189.compute-1.amazonaws.com

cdn.assetboxes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	icrosoft.info m.icrosoft.info	206 KB
2	assetboxes.com cdn.assetboxes.com — Cisco Umbrella Rank: 248968	1 MB
2	fontawesome.com use.fontawesome.com — Cisco Umbrella Rank: 1331	27 KB
1	icons8.com maxcdn.icons8.com — Cisco Umbrella Rank: 105127	7 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 225	18 KB
13	5

	Domain	Requested by
7	m.icrosoft.info	m.icrosoft.info
2	cdn.assetboxes.com	m.icrosoft.info
2	use.fontawesome.com	m.icrosoft.info use.fontawesome.com
1	maxcdn.icons8.com	m.icrosoft.info
1	cdnjs.cloudflare.com	m.icrosoft.info
13	5

This site contains no links.

Subject Issuer	Validity	Valid
m.icrosoft.info E6	`2024-12-01` - `2025-03-01`	3 months	crt.sh
cdnjs.cloudflare.com WE1	`2024-11-26` - `2025-02-24`	3 months	crt.sh
use.fontawesome.com WE1	`2024-11-07` - `2025-02-06`	3 months	crt.sh
1220595937.rsc.cdn77.org E6	`2024-12-12` - `2025-03-12`	3 months	crt.sh
cdn.assetboxes.com R10	`2024-12-03` - `2025-03-03`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://m.icrosoft.info/675c84155005a/380bcc1971500d05917bad4b351718e98724341a/
Frame ID: 3C57283D5085C55D20A556EDBBBDE8CA
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your Microsoft account

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

1528 kB
Transfer

2400 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
m.icrosoft.info/675c84155005a/380bcc1971500d05917bad4b351718e98724341a/ 20 KB
4 KB 2663ms
2075ms Document
text/html 64.191.166.205
QX-NET-ASN-1

General

Check archive.org

Show headers Download Go to

Full URL: https://m.icrosoft.info/675c84155005a/380bcc1971500d05917bad4b351718e98724341a/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 64.191.166.205 Lexington, United States, ASN13776 (QX-NET-ASN-1, US),
Reverse DNS
Software: Apache /
Resource Hash: bb6f63cd588b2c02f441d557a4369d29d3607dabb593676842de918fcde9d4b0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-length: 4144
content-type: text/html; charset=UTF-8
date: Fri, 13 Dec 2024 21:10:52 GMT
server: Apache
vary: Accept-Encoding

GET
H/1.1 200
OK fontawesome.min.css
m.icrosoft.info/assets/fonts/font-awesome/css/ 87 KB
18 KB 397ms
395ms Stylesheet
text/css 64.191.166.205
QX-NET-ASN-1

General

Check archive.org

Show headers Download Go to

Full URL: https://m.icrosoft.info/assets/fonts/font-awesome/css/fontawesome.min.css
Requested by: Host: m.icrosoft.info
URL: https://m.icrosoft.info/675c84155005a/380bcc1971500d05917bad4b351718e98724341a/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 64.191.166.205 Lexington, United States, ASN13776 (QX-NET-ASN-1, US),
Reverse DNS
Software: Apache /
Resource Hash: c73281a7dfb7bf222e4032d23df1751286cbc70382edbe18c22f84c5b398701b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://m.icrosoft.info/675c84155005a/380bcc1971500d05917bad4b351718e98724341a/

Response headers

content-encoding: gzip
etag: "15b7b-6098258f69f0c-gzip"
accept-ranges: bytes
content-length: 18147
date: Fri, 13 Dec 2024 21:10:54 GMT
last-modified: Mon, 06 Nov 2023 21:15:03 GMT
vary: Accept-Encoding
server: Apache
content-type: text/css

GET
H/1.1 200
OK jquery-3.1.1.min.js Show response
m.icrosoft.info/assets/js/ 85 KB
30 KB 985ms
403ms Script
application/javascript 64.191.166.205
QX-NET-ASN-1

General

Check archive.org

Show headers Download Go to

Full URL: https://m.icrosoft.info/assets/js/jquery-3.1.1.min.js
Requested by: Host: m.icrosoft.info
URL: https://m.icrosoft.info/675c84155005a/380bcc1971500d05917bad4b351718e98724341a/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 64.191.166.205 Lexington, United States, ASN13776 (QX-NET-ASN-1, US),
Reverse DNS
Software: Apache /
Resource Hash: 7162e4718b70ab98408c656e6b3404d20df3c0d6facf3c8471c5b1a2a88d5529

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://m.icrosoft.info/675c84155005a/380bcc1971500d05917bad4b351718e98724341a/

Response headers

content-encoding: gzip
etag: "152c5-6098258fba04b-gzip"
accept-ranges: bytes
content-length: 30095
date: Fri, 13 Dec 2024 21:10:54 GMT
last-modified: Mon, 06 Nov 2023 21:15:03 GMT
vary: Accept-Encoding
server: Apache
content-type: application/javascript

GET
H/1.1 200
OK jquery_ui.js Show response
m.icrosoft.info/assets/js/ 509 KB
122 KB 955ms
372ms Script
application/javascript 64.191.166.205
QX-NET-ASN-1

General

Check archive.org

Show headers Download Go to

Full URL

https://m.icrosoft.info/assets/js/jquery_ui.js?v=1.5

Requested by

Host: m.icrosoft.info
URL: https://m.icrosoft.info/675c84155005a/380bcc1971500d05917bad4b351718e98724341a/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

64.191.166.205 Lexington, United States, ASN13776 (QX-NET-ASN-1, US),

Reverse DNS

Software

Apache /

Resource Hash

1bf4686be65431946ebbc1cb07b0be92c7dadd35b31d3189cd5ec9f4c742da15

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://m.icrosoft.info/675c84155005a/380bcc1971500d05917bad4b351718e98724341a/

Response headers

transfer-encoding: chunked
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "7f20a-5e8a7c4816bac-gzip"
accept-ranges: bytes
date: Fri, 13 Dec 2024 21:10:54 GMT
last-modified: Wed, 14 Sep 2022 19:02:17 GMT
vary: Accept-Encoding
server: Apache
content-type: application/javascript

GET
H/1.1 200
OK bootstrap.min.css
m.icrosoft.info/assets/bootstrap/bootstrap-3.3.7/css/ 118 KB
20 KB 649ms
248ms Stylesheet
text/css 64.191.166.205
QX-NET-ASN-1

General

Check archive.org

Show headers Download Go to

Full URL: https://m.icrosoft.info/assets/bootstrap/bootstrap-3.3.7/css/bootstrap.min.css
Requested by: Host: m.icrosoft.info
URL: https://m.icrosoft.info/675c84155005a/380bcc1971500d05917bad4b351718e98724341a/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 64.191.166.205 Lexington, United States, ASN13776 (QX-NET-ASN-1, US),
Reverse DNS
Software: Apache /
Resource Hash: f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://m.icrosoft.info/675c84155005a/380bcc1971500d05917bad4b351718e98724341a/

Response headers

content-encoding: gzip
etag: "1d970-6263134cf58cb-gzip"
accept-ranges: bytes
content-length: 19744
date: Fri, 13 Dec 2024 21:10:54 GMT
last-modified: Tue, 05 Nov 2024 21:37:21 GMT
vary: Accept-Encoding
server: Apache
content-type: text/css

GET
H/1.1 200
OK bootstrap-theme.min.css
m.icrosoft.info/assets/bootstrap/bootstrap-3.3.7/css/ 23 KB
3 KB 809ms
228ms Stylesheet
text/css 64.191.166.205
QX-NET-ASN-1

General

Check archive.org

Show headers Download Go to

Full URL: https://m.icrosoft.info/assets/bootstrap/bootstrap-3.3.7/css/bootstrap-theme.min.css
Requested by: Host: m.icrosoft.info
URL: https://m.icrosoft.info/675c84155005a/380bcc1971500d05917bad4b351718e98724341a/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 64.191.166.205 Lexington, United States, ASN13776 (QX-NET-ASN-1, US),
Reverse DNS
Software: Apache /
Resource Hash: 653e073e97423adda5bc3917a241ee8497dd38a48f14bcde0098a4e54fd0fa5e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://m.icrosoft.info/675c84155005a/380bcc1971500d05917bad4b351718e98724341a/

Response headers

content-encoding: gzip
etag: "5b71-6263134cf58cb-gzip"
accept-ranges: bytes
content-length: 2776
date: Fri, 13 Dec 2024 21:10:54 GMT
last-modified: Tue, 05 Nov 2024 21:37:21 GMT
vary: Accept-Encoding
server: Apache
content-type: text/css

GET
H/1.1 200
OK bootstrap.min.js Show response
m.icrosoft.info/assets/bootstrap/bootstrap-3.3.7/js/ 36 KB
10 KB 838ms
232ms Script
application/javascript 64.191.166.205
QX-NET-ASN-1

General

Check archive.org

Show headers Download Go to

Full URL

https://m.icrosoft.info/assets/bootstrap/bootstrap-3.3.7/js/bootstrap.min.js

Requested by

Host: m.icrosoft.info
URL: https://m.icrosoft.info/675c84155005a/380bcc1971500d05917bad4b351718e98724341a/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

64.191.166.205 Lexington, United States, ASN13776 (QX-NET-ASN-1, US),

Reverse DNS

Software

Apache /

Resource Hash

53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://m.icrosoft.info/675c84155005a/380bcc1971500d05917bad4b351718e98724341a/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
etag: "90b5-5e8a7c499fdba-gzip"
accept-ranges: bytes
content-length: 9833
date: Fri, 13 Dec 2024 21:10:54 GMT
last-modified: Wed, 14 Sep 2022 19:02:19 GMT
vary: Accept-Encoding
server: Apache
content-type: application/javascript

GET
H3 200 bootstrap.min.css
cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.5.0/css/ 157 KB
18 KB 142ms
74ms Stylesheet
text/css 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.5.0/css/bootstrap.min.css

Requested by

Host: m.icrosoft.info
URL: https://m.icrosoft.info/675c84155005a/380bcc1971500d05917bad4b351718e98724341a/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://m.icrosoft.info/

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5ebae359-27293"
age: 624937
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F50c1gsr9GykOUJSlNjoR9LNC35yI4oxJV%2FMENQ4urOGNELiOwEB2Up5W29WPgk1%2F1SE%2F7VFaJGDU22XwSPNW5cJYoI5Vza2vRuv2eN9DqqUqSPWk4p8Pg1YnTvz8a6TcmjgClb6"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Wed, 03 Dec 2025 21:10:54 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 13 Dec 2024 21:10:54 GMT
content-type: text/css; charset=utf-8
last-modified: Tue, 12 May 2020 17:56:41 GMT
vary: Accept-Encoding
priority: u=0,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8f18f18dae4ec21f-TLV
accept-ranges: bytes
access-control-allow-origin: *
content-length: 17522
server: cloudflare

GET
H2 200 all.css
use.fontawesome.com/releases/v5.12.0/css/ 56 KB
14 KB 356ms
127ms Stylesheet
text/css 172.67.142.245
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.12.0/css/all.css
Requested by: Host: m.icrosoft.info
URL: https://m.icrosoft.info/675c84155005a/380bcc1971500d05917bad4b351718e98724341a/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.142.245 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c9b46437d7418e1712daaad6d73fa17c2c6afb5681770c90339c25428415b7fd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://m.icrosoft.info/

Response headers

cache-control: max-age=31556926
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: HIT
etag: W/"500d1a92f875b1d96d37a3a3f8f0438c"
age: 672878
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QeKWbVvg7SQvkxv8AqM9Xb0vn9d2k7Z0AyDw0OxnntrfqWEtCdfczGLfTuY3m5yEknIKs83FPwqf04dSL2UZpw2n3gbQMrII37c80BHFqWhRLHo9j0R6gI7aVVp6NAsBsKAEsSHO"}],"group":"cf-nel","max_age":604800}
cf-ray: 8f18f18ecb109583-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=54733&min_rtt=54585&rtt_var=15472&sent=7&recv=9&lost=0&retrans=0&sent_bytes=4032&recv_bytes=2271&delivery_rate=70740&cwnd=252&unsent_bytes=0&cid=ef5e9c60a024ef99&ts=129&x=0"
date: Fri, 13 Dec 2024 21:10:54 GMT
content-type: text/css
last-modified: Fri, 22 Sep 2023 01:45:03 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 line-awesome.min.css
maxcdn.icons8.com/fonts/line-awesome/1.1/css/ 27 KB
7 KB 368ms
121ms Stylesheet
text/css 207.211.211.27
CDN77 Datacamp Li...

General

Check archive.org

Show headers Download Go to

Full URL: https://maxcdn.icons8.com/fonts/line-awesome/1.1/css/line-awesome.min.css
Requested by: Host: m.icrosoft.info
URL: https://m.icrosoft.info/675c84155005a/380bcc1971500d05917bad4b351718e98724341a/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 207.211.211.27 Frankfurt am Main, Germany, ASN60068 (CDN77 Datacamp Limited, GB),
Reverse DNS: 607028803.fra.cdn77.com
Software: CDN77-Turbo /
Resource Hash: 1e8638f605575bd335d49efa95e165adf7ef06dda8e367661ac2517a0a3a96b4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://m.icrosoft.info/

Response headers

access-control-max-age: 3000
access-control-expose-headers: Content-Range, Content-Length, ETag
content-encoding: gzip
etag: W/"4334c8c70998d81bde3e6765828811a6"
x-77-cache: HIT
access-control-allow-methods: GET
x-amz-meta-mtime: 1654507817.389231056
date: Fri, 13 Dec 2024 21:10:54 GMT
content-type: text/css; charset=utf-8
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
x-77-nzt-ray: 43862e24e3e6622cdea25c678ac0f020
last-modified: Mon, 06 Jun 2022 09:58:54 GMT
x-amz-id-2: xU5kr54ZaYK+NKwXtQBOyxYIXAxhL0iJE2ujSx3OwFhrdZGkZjbQgzHc5q2knfptl5G1nUywNt0=
x-77-nzt: EgwBz9PTGQH3gDoLAAwB1GY4EQH3v14FAA
x-amz-request-id: SNB9VNKB00H1VN11
access-control-allow-origin: *
x-77-pop: frankfurtDE
x-77-age: 735872
server: CDN77-Turbo

GET
H2 200 admslogopng164078335361cc5df9c45db848938146.png
cdn.assetboxes.com/c/8961/images/ 4 KB
4 KB 575ms
192ms Image
image/png 54.80.160.189
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.assetboxes.com/c/8961/images/admslogopng164078335361cc5df9c45db848938146.png

Requested by

Host: m.icrosoft.info
URL: https://m.icrosoft.info/675c84155005a/380bcc1971500d05917bad4b351718e98724341a/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.80.160.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-80-160-189.compute-1.amazonaws.com

Software

Apache /

Resource Hash

ce7b8581fa1acfca82e0fa4d24b2b786e467fc863420e6eef50a05238947adb2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://m.icrosoft.info/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "1135-5d448a4f571e0"
accept-ranges: bytes
content-length: 4405
date: Fri, 13 Dec 2024 21:10:54 GMT
last-modified: Wed, 29 Dec 2021 13:09:13 GMT
content-type: image/png
server: Apache

GET
H2 200 microsoftbackgroundlppng161607202160534d55e1fda616167359.png
cdn.assetboxes.com/c/8961/images/ 1 MB
1 MB 319ms
319ms Image
image/png 54.80.160.189
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.assetboxes.com/c/8961/images/microsoftbackgroundlppng161607202160534d55e1fda616167359.png

Requested by

Host: m.icrosoft.info
URL: https://m.icrosoft.info/675c84155005a/380bcc1971500d05917bad4b351718e98724341a/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.80.160.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-80-160-189.compute-1.amazonaws.com

Software

Apache /

Resource Hash

24c68a968e99d841f446d6953d3eb15109b286de77fbbaf60a0577375d0d9a16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://m.icrosoft.info/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "13c247-5bdcf16cd3f18"
accept-ranges: bytes
content-length: 1294919
date: Fri, 13 Dec 2024 21:10:55 GMT
last-modified: Thu, 18 Mar 2021 12:53:41 GMT
content-type: image/png
server: Apache

GET
H2 200 fa-regular-400.woff2
use.fontawesome.com/releases/v5.12.0/webfonts/ 13 KB
14 KB 350ms
123ms Font
font/woff2 172.67.142.245
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.12.0/webfonts/fa-regular-400.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.12.0/css/all.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.142.245 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 86e496b536b26ba60cdb68df9dd9143b19a63b65e30e373b0321833aab1295d6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://m.icrosoft.info
Referer: https://use.fontawesome.com/releases/v5.12.0/css/all.css

Response headers

cf-cache-status: HIT
etag: "9efb86976bd53e159166c12365f61e25"
age: 60125
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5ftgHQIwvjShjMjZ5a7CUW%2FF190eMQjebyivEAfH8oQ0aiqxBED5jYno%2BHEzMeVo%2BvdgJsXmk8wmNzG6UIdSetOEE4nwD964%2FqnIHJxkRC8e85lqGRMWL8imw6XbkXdvusFsKCrM"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=54426&min_rtt=54358&rtt_var=20433&sent=7&recv=8&lost=0&retrans=0&sent_bytes=4031&recv_bytes=2253&delivery_rate=71084&cwnd=252&unsent_bytes=0&cid=87b6218e14a64003&ts=127&x=0"
date: Fri, 13 Dec 2024 21:10:55 GMT
content-type: font/woff2
last-modified: Fri, 22 Sep 2023 01:45:05 GMT
vary: Origin, Accept-Encoding
cache-control: max-age=31556926
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8f18f1972d8fef48-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 13576
server: cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://m.icrosoft.info/675c84155005a/380bcc1971500d05917bad4b351718e98724341a/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.assetboxes.com
cdnjs.cloudflare.com
m.icrosoft.info
maxcdn.icons8.com
use.fontawesome.com
104.17.25.14
172.67.142.245
207.211.211.27
54.80.160.189
64.191.166.205
1bf4686be65431946ebbc1cb07b0be92c7dadd35b31d3189cd5ec9f4c742da15
1e8638f605575bd335d49efa95e165adf7ef06dda8e367661ac2517a0a3a96b4
24c68a968e99d841f446d6953d3eb15109b286de77fbbaf60a0577375d0d9a16
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
653e073e97423adda5bc3917a241ee8497dd38a48f14bcde0098a4e54fd0fa5e
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c
7162e4718b70ab98408c656e6b3404d20df3c0d6facf3c8471c5b1a2a88d5529
86e496b536b26ba60cdb68df9dd9143b19a63b65e30e373b0321833aab1295d6
bb6f63cd588b2c02f441d557a4369d29d3607dabb593676842de918fcde9d4b0
c73281a7dfb7bf222e4032d23df1751286cbc70382edbe18c22f84c5b398701b
c9b46437d7418e1712daaad6d73fa17c2c6afb5681770c90339c25428415b7fd
ce7b8581fa1acfca82e0fa4d24b2b786e467fc863420e6eef50a05238947adb2
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

m.icrosoft.info Open in urlscan Pro 64.191.166.205 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

0 %IPv6

5 Domains

5 Subdomains

5 IPs

3 Countries

1528 kBTransfer

2400 kBSize

0 Cookies

0 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

m.icrosoft.info Open in urlscan Pro
64.191.166.205 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

1528 kB
Transfer

2400 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!