urlscan.io logo urlscan.io
SecurityTrails logo

login-live-com.office365.apps.maxsolutions.com.au Open in urlscan Pro
3.104.248.170  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=e%22-us&lc=1033&uaid=ab431b84529441b59952486dd38ee6ea
Effective URL: https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=EN-US&uaid=ab431b84529441b59952486dd38ee6ea&lc=1033
Submission: On December 22 via automatic, source openphish — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 3.104.248.170, located in Sydney, Australia and belongs to AMAZON-02, US. The main domain is login-live-com.office365.apps.maxsolutions.com.au.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on March 15th 2022. Valid for: a year.
This is the only time login-live-com.office365.apps.maxsolutions.com.au was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 13.211.19.151 16509 (AMAZON-02)
4 3.104.248.170 16509 (AMAZON-02)
4 1
Apex Domain
Subdomains		 Transfer
5 maxsolutions.com.au
login-live-com.office365.apps.maxsolutions.com.au
17 KB
4 1
Domain Requested by
5 login-live-com.office365.apps.maxsolutions.com.au 1 redirects login-live-com.office365.apps.maxsolutions.com.au
4 1

This site contains no links.

Subject Issuer Validity Valid
*.maxsolutions.com.au
DigiCert TLS RSA SHA256 2020 CA1		 2022-03-15 -
2023-04-15		 a year crt.sh

This page contains 1 frames:

Primary Page: https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=EN-US&uaid=ab431b84529441b59952486dd38ee6ea&lc=1033
Frame ID: CA7A2C3A572DE53AB7B6A4358E986BA3
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Microsoft account

Page URL History Show full URLs

  1. http://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=e%22-us&lc=1033&uaid=ab431b84529441b59952486dd38ee6ea HTTP 302
    https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=EN-US&uaid=ab431b84529441b59952486dd38ee6ea&lc=1033 Page URL

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

15 kB
Transfer

16 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=e%22-us&lc=1033&uaid=ab431b84529441b59952486dd38ee6ea HTTP 302
    https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=EN-US&uaid=ab431b84529441b59952486dd38ee6ea&lc=1033 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request jsdisabled.srf
login-live-com.office365.apps.maxsolutions.com.au/
Redirect Chain
  • http://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=e%22-us&lc=1033&uaid=ab431b84529441b59952486dd38ee6ea
  • https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=EN-US&uaid=ab431b84529441b59952486dd38ee6ea&lc=1033
5 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=EN-US&uaid=ab431b84529441b59952486dd38ee6ea&lc=1033
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.104.248.170 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-104-248-170.ap-southeast-2.compute.amazonaws.com
Software
/
Resource Hash
7c6340c44f3c819f142b90c202add1275249954603d8503d2fab46eb94321406
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

Cache-Control
no-store, no-cache
Content-Encoding
gzip
Content-Type
text/html; charset=utf-8
Date
Thu, 22 Dec 2022 01:06:14 GMT
Expires
Thu, 22 Dec 2022 01:05:14 GMT
Link
<https://logincdn.msftauth.net>; rel=preconnect; crossorigin <https://acctcdn.msauth.net>; rel=preconnect; crossorigin <https://acctcdn.msftauth.net>; rel=preconnect; crossorigin <https://acctcdn.msauth.net/>; rel=dns-prefetch <https://acctcdn-msftauth-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch <https://acctcdnmsftuswe2-azureedge-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch <https://acctcdnvzeuno-azureedge-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch <https://logincdn.msauth.net/>; rel=dns-prefetch <https://logincdn-msftauth-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch <https://lgincdnvzeuno-azureedge-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch <https://lgincdnmsftuswe2-azureedge-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch
P3P
CP="DSP CUR OTPi IND OTRi ONL FIN"
PPServer
PPV: 30 H: BY1PPF5D7C5AF71 V: 0
Pragma
no-cache
Referrer-Policy
strict-origin-when-cross-origin
Strict-Transport-Security
max-age=31536000
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-DNS-Prefetch-Control
on
X-Frame-Options
DENY
X-XSS-Protection
1; mode=block
x-ms-request-id
075f51fa-d544-48b3-9488-cccc36971d88
x-ms-route-info
R3_BAY

Redirect headers

Cache-Control
no-store, no-cache
Content-Type
text/html; charset=utf-8
Date
Thu, 22 Dec 2022 01:06:14 GMT
Expires
Thu, 22 Dec 2022 01:05:14 GMT
Link
<https://logincdn.msauth.net>; rel=preconnect; crossorigin <https://acctcdn.msauth.net>; rel=preconnect; crossorigin <https://acctcdn.msftauth.net>; rel=preconnect; crossorigin <https://acctcdn.msauth.net/>; rel=dns-prefetch <https://acctcdn-msftauth-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch <https://acctcdnmsftuswe2-azureedge-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch <https://acctcdnvzeuno-azureedge-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch <https://logincdn.msauth.net/>; rel=dns-prefetch <https://logincdn-msftauth-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch <https://lgincdnvzeuno-azureedge-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch <https://lgincdnmsftuswe2-azureedge-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch
Location
https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=EN-US&uaid=ab431b84529441b59952486dd38ee6ea&lc=1033
P3P
CP="DSP CUR OTPi IND OTRi ONL FIN"
PPServer
PPV: 30 H: BY1PPF68D120E9B V: 0
Pragma
no-cache
Referrer-Policy
strict-origin-when-cross-origin
Strict-Transport-Security
max-age=31536000
Transfer-Encoding
chunked
X-Content-Type-Options
nosniff
X-DNS-Prefetch-Control
on
X-XSS-Protection
1; mode=block
x-ms-request-id
769797e7-c67a-4b8a-96e0-6944314714e3
x-ms-route-info
R3_BAY
__sf_event_listener_hook.js
login-live-com.office365.apps.maxsolutions.com.au/__sf_resource/_/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://login-live-com.office365.apps.maxsolutions.com.au/__sf_resource/_/__sf_event_listener_hook.js
Requested by
Host: login-live-com.office365.apps.maxsolutions.com.au
URL: https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=EN-US&uaid=ab431b84529441b59952486dd38ee6ea&lc=1033
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.104.248.170 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-104-248-170.ap-southeast-2.compute.amazonaws.com
Software
/
Resource Hash
a860b9561b1615b3dca00ef253ebc8f398b346e13042dc6bef68ccac5da536ad
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=EN-US&uaid=ab431b84529441b59952486dd38ee6ea&lc=1033
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Cache-Control
max-age=21600
X-Content-Type-Options
nosniff
Content-Length
1849
Content-Type
text/javascript
__sf_ajax_hook.js
login-live-com.office365.apps.maxsolutions.com.au/__sf_resource/_/ 		6 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://login-live-com.office365.apps.maxsolutions.com.au/__sf_resource/_/__sf_ajax_hook.js
Requested by
Host: login-live-com.office365.apps.maxsolutions.com.au
URL: https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=EN-US&uaid=ab431b84529441b59952486dd38ee6ea&lc=1033
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.104.248.170 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-104-248-170.ap-southeast-2.compute.amazonaws.com
Software
/
Resource Hash
198126ad3f4d583b32e828ed9c86a9ef0a3b7e2c8292b1422cd931a722da5418
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=EN-US&uaid=ab431b84529441b59952486dd38ee6ea&lc=1033
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Cache-Control
max-age=21600
X-Content-Type-Options
nosniff
Content-Length
6334
Content-Type
text/javascript
ms-logo-v2.jpg
login-live-com.office365.apps.maxsolutions.com.au/images/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login-live-com.office365.apps.maxsolutions.com.au/images/ms-logo-v2.jpg
Requested by
Host: login-live-com.office365.apps.maxsolutions.com.au
URL: https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=EN-US&uaid=ab431b84529441b59952486dd38ee6ea&lc=1033
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.104.248.170 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-104-248-170.ap-southeast-2.compute.amazonaws.com
Software
/
Resource Hash
bc2b16b51738b77d94ed7591ad1033fa804297ca9faaa35222aa65773f749164
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=EN-US&uaid=ab431b84529441b59952486dd38ee6ea&lc=1033
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000
Date
Thu, 22 Dec 2022 01:06:14 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sun, 27 Nov 2022 09:47:48 GMT
PPServer
PPV: 30 H: BY1PPF521859390 V: 0
ETag
"07aab4e452d91:0"
Content-Type
image/jpeg
x-ms-request-id
f69330b5-7a04-4a9d-a649-0f53b767893c
Cache-Control
max-age=31536000
Accept-Ranges
bytes
Content-Length
2797
X-XSS-Protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| __sf__initEventListenersHook function| __sfLog function| __sf__redirect function| __sf__handleResponse function| __sf__trackXhr function| __sf__installAjaxHook function| __sf__installFetchHook function| show_verifcation_iframe function| sf_iframe_verification_success object| EventDict function| __sf__addEventListenerBase function| removeAllEventListeners function| __sf__removeEventListenerBase

2 Cookies

Domain/Path Name / Value
.office365.apps.maxsolutions.com.au/ Name: __SF__sessionId
Value: 67d1fe3a9d62a01020c507ae0b6b6
.apps.maxsolutions.com.au/ Name: __SF__sfbid
Value: U7lqmPzkqda8a776cd

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block