URL: https://microsoft-authentication.it/
Submission Tags: @phishunt_io
Submission: On March 14 via api from DE — Scanned from IT

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main IP is 93.51.172.73, located in Padova, Italy and belongs to FASTWEB, IT. The main domain is microsoft-authentication.it.
TLS certificate: Issued by R3 on March 13th 2023. Valid for: 3 months.
This is the only time microsoft-authentication.it was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 93.51.172.73 12874 (FASTWEB)
1 76.72.166.146 17090 (DATABASEB...)
3 3
Apex Domain
Subdomains
Transfer
2 microsoft-authentication.it
microsoft-authentication.it
53 KB
1 incompetech.com
incompetech.com — Cisco Umbrella Rank: 823400
3 2
Domain Requested by
2 microsoft-authentication.it microsoft-authentication.it
1 incompetech.com microsoft-authentication.it
3 2

This site contains no links.

Subject Issuer Validity Valid
microsoft-authentication.it
R3
2023-03-13 -
2023-06-11
3 months crt.sh
incompetech.com
R3
2023-03-01 -
2023-05-30
3 months crt.sh

This page contains 1 frames:

Primary Page: https://microsoft-authentication.it/
Frame ID: E9DBBA2DBFFCC5EED84FD3C735E5EEFB
Requests: 4 HTTP requests in this frame

Screenshot

Page Title

CybergON warpdrive

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

53 kB
Transfer

2594 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
microsoft-authentication.it/
32 KB
32 KB
Document
General
Full URL
https://microsoft-authentication.it/
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
93.51.172.73 Padova, Italy, ASN12874 (FASTWEB, IT),
Reverse DNS
93-51-172-73.ip267.fastwebnet.it
Software
nginx/1.21.6 /
Resource Hash
570ffb88731766edea848175b5d734e3246eec001be32d818c22163b8a4541df

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language
it-IT,it;q=0.9

Response headers

accept-ranges
bytes
content-length
32979
content-type
text/html
date
Tue, 14 Mar 2023 00:49:15 GMT
etag
"628bf8e7-80d3"
last-modified
Mon, 23 May 2022 21:13:11 GMT
server
nginx/1.21.6
starfield.css
microsoft-authentication.it/
20 KB
20 KB
Stylesheet
General
Full URL
https://microsoft-authentication.it/starfield.css
Requested by
Host: microsoft-authentication.it
URL: https://microsoft-authentication.it/
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
93.51.172.73 Padova, Italy, ASN12874 (FASTWEB, IT),
Reverse DNS
93-51-172-73.ip267.fastwebnet.it
Software
nginx/1.21.6 /
Resource Hash
f8a32b4e46bcb52a8e8f515b41a047ec9931639ff18e2068b754e5173e4f73af

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://microsoft-authentication.it/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Tue, 14 Mar 2023 00:49:15 GMT
last-modified
Mon, 23 May 2022 21:13:11 GMT
server
nginx/1.21.6
accept-ranges
bytes
etag
"628bf8e7-50d5"
content-length
20693
content-type
text/css
Arcadia.mp3
incompetech.com/music/royalty-free/mp3-royaltyfree/
2 MB
0
Media
General
Full URL
https://incompetech.com/music/royalty-free/mp3-royaltyfree/Arcadia.mp3
Requested by
Host: microsoft-authentication.it
URL: https://microsoft-authentication.it/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
76.72.166.146 Fort Worth, United States, ASN17090 (DATABASEBYDESIGNLLC, US),
Reverse DNS
Software
Apache/2.2.22 (Ubuntu) /
Resource Hash

Request headers

Referer
https://microsoft-authentication.it/
Accept-Encoding
identity;q=1, *;q=0
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
Range
bytes=0-

Response headers

Pragma
no-cache
Date
Tue, 14 Mar 2023 00:48:39 GMT
Last-Modified
Sun, 15 Feb 2015 14:11:38 GMT
Server
Apache/2.2.22 (Ubuntu)
ETag
"3d14ff-50f210c4f8096"
Content-Type
application/octet-stream
Content-Range
bytes 0-4003070/4003071
Cache-Control
no-cache, no-store, must-revalidate
Content-Disposition
attachment
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=500
Content-Length
4003071
Expires
0
truncated
/
14 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
341acd4c371c33c11151a305076962f2c7ddce7afc4f77927f0737457f178bdd

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Content-Type
image/jpeg

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

0 Cookies

2 Console Messages

Source Level URL
Text
security warning URL: https://microsoft-authentication.it/(Line 116)
Message:
Mixed Content: The page at 'https://microsoft-authentication.it/' was loaded over HTTPS, but requested an insecure element 'http://incompetech.com/music/royalty-free/mp3-royaltyfree/Arcadia.mp3'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://microsoft-authentication.it/
Message:
Mixed Content: The page at 'https://microsoft-authentication.it/' was loaded over HTTPS, but requested an insecure audio file 'http://incompetech.com/music/royalty-free/mp3-royaltyfree/Arcadia.mp3'. This content should also be served over HTTPS.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

incompetech.com
microsoft-authentication.it
76.72.166.146
93.51.172.73
341acd4c371c33c11151a305076962f2c7ddce7afc4f77927f0737457f178bdd
570ffb88731766edea848175b5d734e3246eec001be32d818c22163b8a4541df
f8a32b4e46bcb52a8e8f515b41a047ec9931639ff18e2068b754e5173e4f73af