lizenz-mircosft.com Open in urlscan Pro
185.101.159.163  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request r20l7wamr2ftu7ok Show response lizenz-mircosft.com/	30 KB 5 KB	346ms 301ms	Document text/html	185.101.159.163 HOSTTECH-AS
General Check archive.org Show headers Download Go to Full URL https://lizenz-mircosft.com/r20l7wamr2ftu7ok Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.101.159.163 , Switzerland, ASN207143 (HOSTTECH-AS, CH), Reverse DNS mail.cloudserver953.com Software Lucy / Resource Hash e4a6dc045849d4af3c2a0718575508478d1382fd17d5f6ddf0dfbe74fc4d5a9a Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Access-Control-Allow-Headers * Access-Control-Allow-Methods * Access-Control-Allow-Origin * Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Content-Encoding gzip Content-Length 4451 Content-Type text/html; charset=UTF-8 Date Mon, 26 Sep 2022 09:31:58 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Lucy Vary Accept-Encoding
GET H/1.1	200 OK	events.js Show response lizenz-mircosft.com/js/	558 B 917 B	17ms 17ms	Script text/javascript	185.101.159.163 HOSTTECH-AS
General Check archive.org Show headers Download Go to Full URL https://lizenz-mircosft.com/js/events.js Requested by Host: lizenz-mircosft.com URL: https://lizenz-mircosft.com/r20l7wamr2ftu7ok Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.101.159.163 , Switzerland, ASN207143 (HOSTTECH-AS, CH), Reverse DNS mail.cloudserver953.com Software Lucy / Resource Hash a8f7e59c2a6d75c51e1898b2d1ff9f6f666caad39a12d215e506202fce2ce150 Request headers accept-language de-DE,de;q=0.9 Referer https://lizenz-mircosft.com/r20l7wamr2ftu7ok User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Date Mon, 26 Sep 2022 09:31:58 GMT Server Lucy Access-Control-Allow-Methods * Content-Type text/javascript;charset=UTF-8 Access-Control-Allow-Origin * Cache-Control max-age=86400 Connection Keep-Alive Access-Control-Allow-Headers * Content-Length 558 Keep-Alive timeout=5, max=99 Expires Tue, 27 Sep 2022 09:31:58 GMT
GET H/1.1	200 OK	converged.css lizenz-mircosft.com/public/campaign/4/6/15/	107 KB 20 KB	37ms 19ms	Stylesheet text/css	185.101.159.163 HOSTTECH-AS
General Check archive.org Show headers Download Go to Full URL https://lizenz-mircosft.com/public/campaign/4/6/15/converged.css Requested by Host: lizenz-mircosft.com URL: https://lizenz-mircosft.com/r20l7wamr2ftu7ok Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.101.159.163 , Switzerland, ASN207143 (HOSTTECH-AS, CH), Reverse DNS mail.cloudserver953.com Software Lucy / Resource Hash 2d13d6356908f5099f72df819e22e5872031ae37a264b32be7d509571d14912f Request headers accept-language de-DE,de;q=0.9 Referer https://lizenz-mircosft.com/r20l7wamr2ftu7ok User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Date Mon, 26 Sep 2022 09:31:58 GMT Content-Encoding gzip Last-Modified Tue, 14 Jun 2022 14:39:24 GMT Server Lucy ETag "1ad0e-5e1695ef14dc7-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 19839
GET H/1.1	200 OK	microsoft-logo.png lizenz-mircosft.com/public/campaign/4/6/15/	5 KB 6 KB	46ms 16ms	Image image/png	185.101.159.163 HOSTTECH-AS
General Check archive.org Show headers Download Go to Show image Full URL https://lizenz-mircosft.com/public/campaign/4/6/15/microsoft-logo.png Requested by Host: lizenz-mircosft.com URL: https://lizenz-mircosft.com/r20l7wamr2ftu7ok Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.101.159.163 , Switzerland, ASN207143 (HOSTTECH-AS, CH), Reverse DNS mail.cloudserver953.com Software Lucy / Resource Hash b2e77b5f00050e45bb5ca08fd0fcaa20fed53a675e8ce5e126f99ade07a569cd Request headers accept-language de-DE,de;q=0.9 Referer https://lizenz-mircosft.com/r20l7wamr2ftu7ok User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Date Mon, 26 Sep 2022 09:31:58 GMT Last-Modified Tue, 14 Jun 2022 14:39:24 GMT Server Lucy ETag "1522-5e1695ef14dc7" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 5410
GET H/1.1	200 OK	timeme.min.js Show response lizenz-mircosft.com/js/	4 KB 4 KB	29ms 16ms	Script text/javascript	185.101.159.163 HOSTTECH-AS
General Check archive.org Show headers Download Go to Full URL https://lizenz-mircosft.com/js/timeme.min.js Requested by Host: lizenz-mircosft.com URL: https://lizenz-mircosft.com/r20l7wamr2ftu7ok Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.101.159.163 , Switzerland, ASN207143 (HOSTTECH-AS, CH), Reverse DNS mail.cloudserver953.com Software Lucy / Resource Hash 3ae66a8d261814acf0678914f1832973fe5be31912abf545f81fe4f97fd707dd Request headers accept-language de-DE,de;q=0.9 Referer https://lizenz-mircosft.com/r20l7wamr2ftu7ok User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Date Mon, 26 Sep 2022 09:31:58 GMT Server Lucy Access-Control-Allow-Methods * Content-Type text/javascript;charset=UTF-8 Access-Control-Allow-Origin * Cache-Control max-age=86400 Connection Keep-Alive Access-Control-Allow-Headers * Content-Length 4210 Keep-Alive timeout=5, max=100 Expires Tue, 27 Sep 2022 09:31:58 GMT
GET H/1.1	200 OK	time-tracker.js Show response lizenz-mircosft.com/js/	2 KB 2 KB	45ms 17ms	Script text/javascript	185.101.159.163 HOSTTECH-AS
General Check archive.org Show headers Download Go to Full URL https://lizenz-mircosft.com/js/time-tracker.js Requested by Host: lizenz-mircosft.com URL: https://lizenz-mircosft.com/r20l7wamr2ftu7ok Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.101.159.163 , Switzerland, ASN207143 (HOSTTECH-AS, CH), Reverse DNS mail.cloudserver953.com Software Lucy / Resource Hash ce5b41bb9e310321a957d16cbd21b476c2f68454eb3eb6c5f79a3f3e823908c0 Request headers accept-language de-DE,de;q=0.9 Referer https://lizenz-mircosft.com/r20l7wamr2ftu7ok User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Date Mon, 26 Sep 2022 09:31:58 GMT Server Lucy Access-Control-Allow-Methods * Content-Type text/javascript;charset=UTF-8 Access-Control-Allow-Origin * Cache-Control max-age=86400 Connection Keep-Alive Access-Control-Allow-Headers * Content-Length 1597 Keep-Alive timeout=5, max=99 Expires Tue, 27 Sep 2022 09:31:58 GMT
GET H/1.1	200 OK	converged.css lizenz-mircosft.com/public/campaign/4/6/15/	0 20 KB	50ms 19ms	Other text/css	185.101.159.163 HOSTTECH-AS
General Check archive.org Show headers Download Go to Full URL https://lizenz-mircosft.com/public/campaign/4/6/15/converged.css Requested by Host: lizenz-mircosft.com URL: https://lizenz-mircosft.com/r20l7wamr2ftu7ok Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.101.159.163 , Switzerland, ASN207143 (HOSTTECH-AS, CH), Reverse DNS mail.cloudserver953.com Software Lucy / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://lizenz-mircosft.com/r20l7wamr2ftu7ok User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Date Mon, 26 Sep 2022 09:31:58 GMT Content-Encoding gzip Last-Modified Tue, 14 Jun 2022 14:39:24 GMT Server Lucy ETag "1ad0e-5e1695ef14dc7-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 19839
GET H/1.1	404 Not Found	ux.js lizenz-mircosft.com/	0 0	48ms 16ms	Other text/html	185.101.159.163 HOSTTECH-AS
General Check archive.org Show headers Download Go to Full URL https://lizenz-mircosft.com/ux.js Requested by Host: lizenz-mircosft.com URL: https://lizenz-mircosft.com/r20l7wamr2ftu7ok Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.101.159.163 , Switzerland, ASN207143 (HOSTTECH-AS, CH), Reverse DNS mail.cloudserver953.com Software Lucy / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://lizenz-mircosft.com/r20l7wamr2ftu7ok User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Date Mon, 26 Sep 2022 09:31:58 GMT Server Lucy Access-Control-Allow-Methods * Content-Type text/html;charset=UTF-8 Access-Control-Allow-Origin * Connection close Access-Control-Allow-Headers * Content-Length 1079
GET H/1.1	200 OK	bgsmall.jpg lizenz-mircosft.com/public/campaign/4/6/15/	987 B 1 KB	16ms 16ms	Image image/jpeg	185.101.159.163 HOSTTECH-AS
General Check archive.org Show headers Download Go to Show image Full URL https://lizenz-mircosft.com/public/campaign/4/6/15/bgsmall.jpg Requested by Host: lizenz-mircosft.com URL: https://lizenz-mircosft.com/r20l7wamr2ftu7ok Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.101.159.163 , Switzerland, ASN207143 (HOSTTECH-AS, CH), Reverse DNS mail.cloudserver953.com Software Lucy / Resource Hash 8b34a475187302935336bf43a2bf2a4e0adb9a1e87953ea51f6fcf0ef52a4a1d Request headers accept-language de-DE,de;q=0.9 Referer https://lizenz-mircosft.com/r20l7wamr2ftu7ok User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Date Mon, 26 Sep 2022 09:31:58 GMT Last-Modified Tue, 14 Jun 2022 14:39:24 GMT Server Lucy ETag "3db-5e1695ef14dc7" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 987
GET H/1.1	200 OK	bg.jpg lizenz-mircosft.com/public/campaign/4/6/15/	17 KB 17 KB	17ms 16ms	Image image/jpeg	185.101.159.163 HOSTTECH-AS
General Check archive.org Show headers Download Go to Show image Full URL https://lizenz-mircosft.com/public/campaign/4/6/15/bg.jpg Requested by Host: lizenz-mircosft.com URL: https://lizenz-mircosft.com/r20l7wamr2ftu7ok Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.101.159.163 , Switzerland, ASN207143 (HOSTTECH-AS, CH), Reverse DNS mail.cloudserver953.com Software Lucy / Resource Hash d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3 Request headers accept-language de-DE,de;q=0.9 Referer https://lizenz-mircosft.com/r20l7wamr2ftu7ok User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Date Mon, 26 Sep 2022 09:31:58 GMT Last-Modified Tue, 14 Jun 2022 14:39:24 GMT Server Lucy ETag "442d-5e1695ef14dc7" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 17453
POST H/1.1	200 OK	track-time lizenz-mircosft.com/scenario/	0 589 B	175ms 175ms	Ping text/html	185.101.159.163 HOSTTECH-AS
General Check archive.org Show headers Download Go to Full URL https://lizenz-mircosft.com/scenario/track-time Requested by Host: lizenz-mircosft.com URL: https://lizenz-mircosft.com/r20l7wamr2ftu7ok Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.101.159.163 , Switzerland, ASN207143 (HOSTTECH-AS, CH), Reverse DNS mail.cloudserver953.com Software Lucy / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://lizenz-mircosft.com/r20l7wamr2ftu7ok accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Pragma no-cache Date Mon, 26 Sep 2022 09:31:59 GMT Server Lucy Access-Control-Max-Age 86400 Access-Control-Allow-Methods * Content-Type text/html; charset=UTF-8 Access-Control-Allow-Origin * Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Access-Control-Allow-Credentials true Connection Keep-Alive Access-Control-Allow-Headers * Content-Length 0 Keep-Alive timeout=5, max=99 Expires Thu, 19 Nov 1981 08:52:00 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| lucyDispatchEvent function| showPasswordPage object| TimeMe boolean| injected function| trackTime function| sendUserActivityTimeData function| runChromeTimeTracker function| isChrome

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			lizenz-mircosft.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: cb8ptq826f5991p5h2crobccd2
			lizenz-mircosft.com/	1970-01-20 06:59:36	Name: link Value: r20l7wamr2ftu7ok

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://lizenz-mircosft.com/ux.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

lizenz-mircosft.com
185.101.159.163
2d13d6356908f5099f72df819e22e5872031ae37a264b32be7d509571d14912f
3ae66a8d261814acf0678914f1832973fe5be31912abf545f81fe4f97fd707dd
8b34a475187302935336bf43a2bf2a4e0adb9a1e87953ea51f6fcf0ef52a4a1d
a8f7e59c2a6d75c51e1898b2d1ff9f6f666caad39a12d215e506202fce2ce150
b2e77b5f00050e45bb5ca08fd0fcaa20fed53a675e8ce5e126f99ade07a569cd
ce5b41bb9e310321a957d16cbd21b476c2f68454eb3eb6c5f79a3f3e823908c0
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4a6dc045849d4af3c2a0718575508478d1382fd17d5f6ddf0dfbe74fc4d5a9a