mslogin.net
45.77.233.154 Malicious Activity! Public Scan Open in urlscan Pro

Go To Rescan
Add Verdict Report

URL:
https://mslogin.net/?rid=luKq9dI 6yr old
Submission: On January 03 via manual (January 3rd 2025, 12:25:38 am UTC) from US — Scanned from AU

Summary HTTP 11 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 45.77.233.154, located in Sydney, Australia and belongs to AS-VULTR, US. The main domain is mslogin.net. 6yr old
TLS certificate: Issued by R10 on December 8th 2024. Valid for: 3mo.

This is the only time mslogin.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
2	45.77.233.154 45.77.233.154	20473 (AS-VULTR) (AS-VULTR)
9	152.199.39.108 152.199.39.108	15133 (EDGECAST) (EDGECAST)
11	2

2 45.77.233.154 (Sydney, Australia)

ASN20473 (AS-VULTR, US)
PTR: smtp-gophish.mslogin.net

mslogin.net 6yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

9 152.199.39.108 (United States)

ASN15133 (EDGECAST, US)

aadcdn.msftauth.net 7yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

	Apex Domain Subdomains	Transfer
9	msftauth.net aadcdn.msftauth.net — Cisco Umbrella Rank: 876 7yr old	228 KB
2	mslogin.net mslogin.net 6yr old	9 KB
11	2

	Domain	Requested by
9	aadcdn.msftauth.net	mslogin.net
2	mslogin.net
11	2

This site contains links to these domains. Also see Links.

Domain
login.live.com
www.microsoft.com
privacy.microsoft.com

Subject Issuer	Validity	Valid
fishing.mslogin.net R10	`2024-12-08` - `2025-03-08`	3mo	crt.sh
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA	`2024-05-25` - `2025-05-25`	1yr	crt.sh

This page contains 1 frames:

Primary Page: https://mslogin.net/?rid=luKq9dI
Frame ID: 42622B681541ED97979397C89C992AEC
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your account

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

238 kB
Transfer

908 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://login.live.com/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2fwww.office.com%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2fwww.microsoft365.com%2flandingv2&response_type=code+id_token&state=he49dcIv_Gl9LuVFCP-MSPwWCuosbn8Xt48lW2aFn4DIQQRPzpfNdZJlzuDX2zlGBSJEsec_mvhmwqalOVfje5KUvv-v9er1rvMz05dURypXImNQhzkz5W5JXl9VfV5y6qx_2EdVnFA-Sb8QbOT6OOUbKZh5tc7ugCUfWQGi2-_0QWR0TVZCBb66ZHnjkeFoa-3Bqivg_KbglKRr38fdslwGf5wYlB1ObyVT37wjtiiOAyuJt3mmFvWIqACMgJuoW8UlzrAOv6NZU-0fE0EOzbk32z0qKplV3vlkjwYGncbX2RrE9NpZ5ttAVMmlVj6I&response_mode=form_post&nonce=638342346251700592.YmJiMWM0ZGYtYjFkMi00YTE2LTkxNjEtYzk1MTQ0MjIwOThlMGFkOTZiY2MtZWU1OC00ZDM1LTk5MmUtZGZiNzIyYzgzNmRi&x-client-SKU=ID_NET6_0&x-client-Ver=6.30.1.0&uaid=f08529e4b133413eb43cfe7a038a7d62&msproxy=1&issuer=mso&tenant=common&ui_locales=en-US&signup=1&lw=1&fl=easi2&epct=PAQABAAEAAAAtyolDObpQQ5VtlI4uGjEPmfUzIDula10O0yhhpsqIJtABtmmZn_c8PJRqYPcvsNxzI12KIvr-hjWcgGMdIG1nSKfXc6Ac7AS9ONYSyW1wuYGgCAYIMWL_WyYnyhxgp0CrR0JM0YU6p69F-fcjRRhEUjx8on2-9Hx92odYrl-z5S8D_FUZLYSysZsh0OuWXJkKkK3Jgx_2P0w9Zf5mH-LfB72eDABx1iqdxmroiqbePSAA&jshs=0
Title: Create one!

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-US/servicesagreement/
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/en-US/privacystatement
Title: Privacy & cookies

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
mslogin.net/ 43 KB
9 KB 182ms
91ms Document
text/html 45.77.233.154
AS-VULTR

General

Check archive.org

Download Go to

Full URL: https://mslogin.net/?rid=luKq9dI
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.77.233.154 Sydney, Australia, ASN20473 (AS-VULTR, US),
Reverse DNS: smtp-gophish.mslogin.net
Software: /
Resource Hash: 870b4a72f1483fe577bd2fae51aad9c0d5af7bb933184f844ccc97a8cda221ab

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 03 Jan 2025 00:25:38 GMT
vary: Accept-Encoding
x-server: gophish

GET
H2 200 converged.v2.login.min_ltjvsvk5aekta_kgibi0gg2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ 109 KB
20 KB 140ms
42ms Stylesheet
text/css 152.199.39.108
EDGECAST

General

Check archive.org

Download Go to

Full URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_ltjvsvk5aekta_kgibi0gg2.css
Requested by: Host: mslogin.net
URL: https://mslogin.net/?rid=luKq9dI
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.39.108 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (nwa/E7A9) /
Resource Hash: 1a0ea89ae667420caeae29d594d53258e6ed157dab7e8dfe6f154f0054b0cf99

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://mslogin.net
Referer: https://mslogin.net/

Response headers

content-md5: znAMuOwBXwRYMjVZ8p4wCw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-lease-status: unlocked
etag: 0x8DBAF1F9F5D8653
age: 24291589
x-ms-version: 2009-09-19
x-cache: HIT
date: Fri, 03 Jan 2025 00:25:39 GMT
content-type: text/css
last-modified: Wed, 06 Sep 2023 21:24:15 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
x-ms-request-id: c79a173f-801e-00af-5a87-80155f000000
accept-ranges: bytes
access-control-allow-origin: *
content-length: 20208
x-ms-blob-type: BlockBlob
server: ECAcc (nwa/E7A9)

GET
H2 200 ConvergedLogin_PCore_qEXQbrILMMB9aM8-LvObPA2.js Show response
aadcdn.msftauth.net/shared/1.0/content/js/ 418 KB
115 KB 157ms
60ms Script
application/x-javascript 152.199.39.108
EDGECAST

General

Check archive.org

Download Go to

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_qEXQbrILMMB9aM8-LvObPA2.js
Requested by: Host: mslogin.net
URL: https://mslogin.net/?rid=luKq9dI
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.39.108 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (nwa/E7C4) /
Resource Hash: dffe9bb4e5c9ee3ec8d54f6a3d8ec6f00c3ffe59d7f95731c9a1a553cde76662

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://mslogin.net
Referer: https://mslogin.net/

Response headers

content-md5: 0hq6ZqI38Flc2M/Nb5TwMQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-lease-status: unlocked
etag: 0x8DBCA90CD989B3F
age: 23158004
x-ms-version: 2009-09-19
x-cache: HIT
date: Fri, 03 Jan 2025 00:25:39 GMT
content-type: application/x-javascript
last-modified: Wed, 11 Oct 2023 19:32:27 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
x-ms-request-id: 0d0d8c6b-901e-004a-64d7-8a8722000000
accept-ranges: bytes
access-control-allow-origin: *
content-length: 117659
x-ms-blob-type: BlockBlob
server: ECAcc (nwa/E7C4)

GET
H2 200 ux.converged.login.strings-en.min_nuufn5205b7sdhopbfnpda2.js Show response
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ 50 KB
15 KB 198ms
100ms Script
application/x-javascript 152.199.39.108
EDGECAST

General

Check archive.org

Download Go to

Full URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_nuufn5205b7sdhopbfnpda2.js
Requested by: Host: mslogin.net
URL: https://mslogin.net/?rid=luKq9dI
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.39.108 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (nwa/E7C9) /
Resource Hash: 20374d2ae310b6854dbb1654a2ba15460db9fc6ef13d73719325c96f51564690

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://mslogin.net
Referer: https://mslogin.net/

Response headers

content-md5: yVWQvURdNhC6SymC+IA6ag==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-lease-status: unlocked
etag: 0x8DBC88D912A1DE0
age: 23162597
x-ms-version: 2009-09-19
x-cache: HIT
date: Fri, 03 Jan 2025 00:25:39 GMT
content-type: application/x-javascript
last-modified: Mon, 09 Oct 2023 06:04:15 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
x-ms-request-id: 04b54f02-501e-00fe-1ecc-8a5d6e000000
accept-ranges: bytes
access-control-allow-origin: *
content-length: 14855
x-ms-blob-type: BlockBlob
server: ECAcc (nwa/E7C9)

GET
H2 200 convergedlogin_pcustomizationloader_6a0a93f432ff1bd21896.js Show response
aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/ 153 KB
34 KB 166ms
69ms Script
application/x-javascript 152.199.39.108
EDGECAST

General

Check archive.org

Download Go to

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_6a0a93f432ff1bd21896.js
Requested by: Host: mslogin.net
URL: https://mslogin.net/?rid=luKq9dI
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.39.108 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (nwa/E7C6) /
Resource Hash: 62958a7a610d9ab060a681661a74fd96ecaecfffe6f63506baa0fa2ff0c62307

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://mslogin.net/

Response headers

content-md5: OnkOoulmGcNNEMlZtm3IAg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-lease-status: unlocked
etag: 0x8DBC6097671DA27
age: 23158004
x-ms-version: 2009-09-19
x-cache: HIT
date: Fri, 03 Jan 2025 00:25:39 GMT
content-type: application/x-javascript
last-modified: Fri, 06 Oct 2023 01:13:34 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
x-ms-request-id: 5ba0493a-201e-0049-40d7-8afa24000000
accept-ranges: bytes
access-control-allow-origin: *
content-length: 34604
x-ms-blob-type: BlockBlob
server: ECAcc (nwa/E7C6)

GET
H2 200 convergedlogin_pfetchsessionsprogress_2ea9c943c12c3a188467.js Show response
aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/ 15 KB
6 KB 140ms
43ms Script
application/x-javascript 152.199.39.108
EDGECAST

General

Check archive.org

Download Go to

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_2ea9c943c12c3a188467.js
Requested by: Host: mslogin.net
URL: https://mslogin.net/?rid=luKq9dI
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.39.108 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (nwa/E7AA) /
Resource Hash: efc1f9c1912ce7d5038579732bccca1b3e7551ffa943a5a2d7d52011dcd3bcaa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://mslogin.net/

Response headers

content-md5: Igs2B5Y2mExmvZgOoa5E2A==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-lease-status: unlocked
etag: 0x8DBC60977118525
age: 13463587
x-ms-version: 2009-09-19
x-cache: HIT
date: Fri, 03 Jan 2025 00:25:39 GMT
content-type: application/x-javascript
last-modified: Fri, 06 Oct 2023 01:13:35 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
x-ms-request-id: cfb22f70-501e-000d-3d02-e39c1a000000
accept-ranges: bytes
access-control-allow-origin: *
content-length: 5516
x-ms-blob-type: BlockBlob
server: ECAcc (nwa/E7AA)

GET
H2 200 convergedlogin_pstringcustomizationhelper_9746a172068dc48a03ee.js Show response
aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/ 111 KB
35 KB 141ms
43ms Script
application/x-javascript 152.199.39.108
EDGECAST

General

Check archive.org

Download Go to

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_9746a172068dc48a03ee.js
Requested by: Host: mslogin.net
URL: https://mslogin.net/?rid=luKq9dI
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.39.108 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (nwa/E7BA) /
Resource Hash: bec216cfa6e40efdc61e8ca41b96242d59fa72b6b4e1ee301b8e5e43c4ff2b62

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://mslogin.net/

Response headers

content-md5: CErHHv5EYTNZwpjhqEPv3w==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-lease-status: unlocked
etag: 0x8DBCA90CB952401
age: 23158004
x-ms-version: 2009-09-19
x-cache: HIT
date: Fri, 03 Jan 2025 00:25:39 GMT
content-type: application/x-javascript
last-modified: Wed, 11 Oct 2023 19:32:24 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
x-ms-request-id: 59fe7652-301e-00bc-21d7-8ad87b000000
accept-ranges: bytes
access-control-allow-origin: *
content-length: 35920
x-ms-blob-type: BlockBlob
server: ECAcc (nwa/E7BA)

GET
H2 200 microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
aadcdn.msftauth.net/shared/1.0/content/images/ 4 KB
2 KB 71ms
71ms Image
image/svg+xml 152.199.39.108
EDGECAST

General

Check archive.org

Download Go to Show image

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Requested by: Host: mslogin.net
URL: https://mslogin.net/?rid=luKq9dI
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.39.108 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (nwa/E7B7) /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://mslogin.net/

Response headers

content-md5: nzaLxFgP7ZB3dfMcaybWzw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-lease-status: unlocked
etag: 0x8DB5C3F495F4B8C
age: 24478477
x-ms-version: 2009-09-19
x-cache: HIT
date: Fri, 03 Jan 2025 00:25:39 GMT
content-type: image/svg+xml
last-modified: Wed, 24 May 2023 10:11:48 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
x-ms-request-id: d1739f3c-b01e-00f0-4ed4-7eff73000000
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1435
x-ms-blob-type: BlockBlob
server: ECAcc (nwa/E7B7)

GET
H2 200 signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
aadcdn.msftauth.net/shared/1.0/content/images/ 2 KB
774 B 75ms
75ms Image
image/svg+xml 152.199.39.108
EDGECAST

General

Check archive.org

Download Go to Show image

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Requested by: Host: mslogin.net
URL: https://mslogin.net/?rid=luKq9dI
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.39.108 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (nwa/E7C3) /
Resource Hash: 8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://mslogin.net/

Response headers

content-md5: R2FAVxfpONfnQAuxVxXbHg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-lease-status: unlocked
etag: 0x8DB5C3F4BB4F03C
age: 24480157
x-ms-version: 2009-09-19
x-cache: HIT
date: Fri, 03 Jan 2025 00:25:39 GMT
content-type: image/svg+xml
last-modified: Wed, 24 May 2023 10:11:52 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
x-ms-request-id: 4499239d-001e-00f3-0cd0-7e8275000000
accept-ranges: bytes
access-control-allow-origin: *
content-length: 621
x-ms-blob-type: BlockBlob
server: ECAcc (nwa/E7C3)

GET
H2 200 2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/ 2 KB
826 B 32ms
32ms Image
image/svg+xml 152.199.39.108
EDGECAST

General

Check archive.org

Download Go to Show image

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Requested by: Host: mslogin.net
URL: https://mslogin.net/?rid=luKq9dI
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.39.108 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (nwa/E7BE) /
Resource Hash: 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://mslogin.net/

Response headers

content-md5: DhdidjYrlCeaRJJRG/y9mA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-lease-status: unlocked
etag: 0x8DB5C3F466DE917
age: 24480074
x-ms-version: 2009-09-19
x-cache: HIT
date: Fri, 03 Jan 2025 00:25:39 GMT
content-type: image/svg+xml
last-modified: Wed, 24 May 2023 10:11:43 GMT
vary: Accept-Encoding
cache-control: public, max-age=31536000
x-ms-request-id: a2a97448-901e-00b6-41d0-7ed66e000000
accept-ranges: bytes
access-control-allow-origin: *
content-length: 673
x-ms-blob-type: BlockBlob
server: ECAcc (nwa/E7BE)

GET
H2 404 favicon.ico
mslogin.net/ 19 B
111 B 38ms
38ms Other
text/plain 45.77.233.154
AS-VULTR

General

Check archive.org

Download Go to

Full URL

https://mslogin.net/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.77.233.154 Sydney, Australia, ASN20473 (AS-VULTR, US),

Reverse DNS

smtp-gophish.mslogin.net

Software

Resource Hash

b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://mslogin.net/?rid=luKq9dI

Response headers

content-length: 19
date: Fri, 03 Jan 2025 00:25:39 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
x-content-type-options: nosniff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

7 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://mslogin.net/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msftauth.net
mslogin.net
152.199.39.108
45.77.233.154
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
1a0ea89ae667420caeae29d594d53258e6ed157dab7e8dfe6f154f0054b0cf99
20374d2ae310b6854dbb1654a2ba15460db9fc6ef13d73719325c96f51564690
62958a7a610d9ab060a681661a74fd96ecaecfffe6f63506baa0fa2ff0c62307
870b4a72f1483fe577bd2fae51aad9c0d5af7bb933184f844ccc97a8cda221ab
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
bec216cfa6e40efdc61e8ca41b96242d59fa72b6b4e1ee301b8e5e43c4ff2b62
dffe9bb4e5c9ee3ec8d54f6a3d8ec6f00c3ffe59d7f95731c9a1a553cde76662
efc1f9c1912ce7d5038579732bccca1b3e7551ffa943a5a2d7d52011dcd3bcaa

mslogin.net 45.77.233.154 Malicious Activity! Public Scan Open in urlscan Pro

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

11 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

238 kBTransfer

908 kBSize

0 Cookies

3 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script Fetch XHR CSS Image Font Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Window variables

0 Cookies

1 Console Messages

Indicators

mslogin.net
45.77.233.154 Malicious Activity! Public Scan Open in urlscan Pro

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

238 kB
Transfer

908 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!