22aae148.ngrok.io Open in urlscan Pro
52.15.194.28 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=
Submission: On May 27 via automatic, source phishtank (May 27th 2018, 12:52:29 am UTC)

Summary HTTP 7 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 52.15.194.28, located in Columbus, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is 22aae148.ngrok.io.

This is the only time 22aae148.ngrok.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online) Microsoft (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
3	52.15.194.28 52.15.194.28		16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	2.20.23.219 2.20.23.219		20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	52.15.72.79 52.15.72.79		16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
7	3

3 52.15.194.28 (Columbus, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: 00.edge.prod.oh.ngrok.com

22aae148.ngrok.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.20.23.219 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-20-23-219.deploy.static.akamaitechnologies.com

secure.aadcdn.microsoftonline-p.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.15.72.79 (Columbus, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: 03.edge.prod.oh.ngrok.com

22aae148.ngrok.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	ngrok.io 22aae148.ngrok.io	119 KB
2	microsoftonline-p.com secure.aadcdn.microsoftonline-p.com	85 KB
7	2

	Domain	Requested by
5	22aae148.ngrok.io	22aae148.ngrok.io
2	secure.aadcdn.microsoftonline-p.com	22aae148.ngrok.io
7	2

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=
Frame ID: D423DAE385761BB1C5A36D4BB9D91573
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i
headers server /php\/?([\d.]+)?/i

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Win32|Win64/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

webpack (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

env /^webpackJsonp$/i

Page Statistics

7
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

204 kB
Transfer

411 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request office.php Show response
22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/ 24 KB
25 KB 392ms
273ms Document
text/html 52.15.194.28
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: http://22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=
Protocol: HTTP/1.1
Server: 52.15.194.28 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: 00.edge.prod.oh.ngrok.com
Software: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.3 / PHP/7.2.3
Resource Hash: b97b259db6c3cc345482ce4a3734cffd8518c882611f55d0818a119a07c90486

Request headers

Host: 22aae148.ngrok.io
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: D423DAE385761BB1C5A36D4BB9D91573

Response headers

Date: Sun, 27 May 2018 00:52:15 GMT
Server: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.3
X-Powered-By: PHP/7.2.3
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK converged.login.min.css
22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/files/ 84 KB
85 KB 354ms
250ms Stylesheet
text/css 52.15.194.28
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: http://22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/files/converged.login.min.css
Requested by: Host: 22aae148.ngrok.io
URL: http://22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=
Protocol: HTTP/1.1
Server: 52.15.194.28 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: 00.edge.prod.oh.ngrok.com
Software: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.3 /
Resource Hash: 4f962ec8ae085492d496fcbbd74185ab1c8e377438dbcb5ec4f8517b7bd9293f

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 22aae148.ngrok.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=
Connection: keep-alive
Cache-Control: no-cache
Referer: http://22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Sun, 27 May 2018 00:52:16 GMT
Last-Modified: Sun, 27 May 2018 00:50:33 GMT
Server: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.3
Accept-Ranges: bytes
ETag: "15199-56d25637a8186"
Content-Length: 86425
Content-Type: text/css

GET
H/1.1 200
OK convergedlogin_pcore.min.js Show response
secure.aadcdn.microsoftonline-p.com/ests/2.1.6348.16/content/cdnbundles/ 284 KB
82 KB 41ms
7ms Script
application/x-javascript 2.20.23.219
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6348.16/content/cdnbundles/convergedlogin_pcore.min.js

Requested by

Host: 22aae148.ngrok.io
URL: http://22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=

Protocol

HTTP/1.1

Server

2.20.23.219 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-20-23-219.deploy.static.akamaitechnologies.com

Software

/

Resource Hash

bb49aa69e795d9a4e6175a9373bef378615ead2fb7aebe00954c2111db5f5f2d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer: http://22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=
Origin: http://22aae148.ngrok.io

Response headers

Date: Sun, 27 May 2018 00:52:18 GMT
Content-Encoding: gzip
Last-Modified: Wed, 26 Jul 2017 22:42:16 GMT
Content-MD5: 70JDX0xpFgO/0lUo3MXuxw==
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=27937
Strict-Transport-Security: max-age=31536000
Content-Length: 83081

GET
H/1.1 200
OK convergedloginpaginatedstrings-en-gb.min.js Show response
secure.aadcdn.microsoftonline-p.com/ests/2.1.6348.16/content/cdnbundles/ 10 KB
4 KB 39ms
6ms Script
application/x-javascript 2.20.23.219
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6348.16/content/cdnbundles/convergedloginpaginatedstrings-en-gb.min.js

Requested by

Host: 22aae148.ngrok.io
URL: http://22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=

Protocol

HTTP/1.1

Server

2.20.23.219 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-20-23-219.deploy.static.akamaitechnologies.com

Software

/

Resource Hash

76a549b7b5bb871680b150cc933d79b0b12a5b6f58d19348ece542f5d7a4af4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer: http://22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=
Origin: http://22aae148.ngrok.io

Response headers

Date: Sun, 27 May 2018 00:52:18 GMT
Content-Encoding: gzip
Last-Modified: Wed, 26 Jul 2017 22:41:35 GMT
Content-MD5: 2aonJl133r+/GhKf7Kl2dw==
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=27937
Strict-Transport-Security: max-age=31536000
Content-Length: 3442

GET
H/1.1 200
OK bannerlogo
22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/files/ 4 KB
5 KB 306ms
250ms Image
image/png 52.15.72.79
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/files/bannerlogo?ts=635974776182591704
Requested by: Host: 22aae148.ngrok.io
URL: http://22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=
Protocol: HTTP/1.1
Server: 52.15.72.79 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: 03.edge.prod.oh.ngrok.com
Software: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.3 /
Resource Hash: fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 22aae148.ngrok.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=
Connection: keep-alive
Cache-Control: no-cache
Referer: http://22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Sun, 27 May 2018 00:52:16 GMT
Last-Modified: Sun, 27 May 2018 00:50:33 GMT
Server: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.3
Accept-Ranges: bytes
ETag: "11e9-56d25637a7db5"
Content-Length: 4585

GET
H/1.1 200
OK microsoft_logo.svg
22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/files/ 4 KB
4 KB 242ms
242ms Image
image/svg+xml 52.15.72.79
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/files/microsoft_logo.svg?x=ee5c8d9fb6248c938fd0dc19370e90bd
Requested by: Host: 22aae148.ngrok.io
URL: http://22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=
Protocol: HTTP/1.1
Server: 52.15.72.79 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: 03.edge.prod.oh.ngrok.com
Software: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.3 /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 22aae148.ngrok.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=
Connection: keep-alive
Cache-Control: no-cache
Referer: http://22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Sun, 27 May 2018 00:52:16 GMT
Last-Modified: Sun, 27 May 2018 00:50:33 GMT
Server: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.3
Accept-Ranges: bytes
ETag: "e43-56d25637a8556"
Content-Length: 3651
Content-Type: image/svg+xml

GET
H/1.1 200
OK picker_account_aad.svg
22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/files/ 756 B
1013 B 246ms
246ms Image
image/svg+xml 52.15.194.28
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/files/picker_account_aad.svg?x=9de70d1c5191d1852a0d5aac28b44a6c
Requested by: Host: 22aae148.ngrok.io
URL: http://22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=
Protocol: HTTP/1.1
Server: 52.15.194.28 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: 00.edge.prod.oh.ngrok.com
Software: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.3 /
Resource Hash: 5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 22aae148.ngrok.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=
Connection: keep-alive
Cache-Control: no-cache
Referer: http://22aae148.ngrok.io/web/path/office/f32b30c2a289bfca2c9857ffc5871ac8/office.php?email=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Sun, 27 May 2018 00:52:16 GMT
Last-Modified: Sun, 27 May 2018 00:50:33 GMT
Server: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.3
Accept-Ranges: bytes
ETag: "2f4-56d25637a8927"
Content-Length: 756
Content-Type: image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online) Microsoft (Consumer)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| $Debug object| $Do undefined| g_iSRSFailed undefined| g_sSRSSuccess function| webpackJsonp object| StringRepository boolean| __

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

22aae148.ngrok.io
secure.aadcdn.microsoftonline-p.com
2.20.23.219
52.15.194.28
52.15.72.79
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
4f962ec8ae085492d496fcbbd74185ab1c8e377438dbcb5ec4f8517b7bd9293f
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
76a549b7b5bb871680b150cc933d79b0b12a5b6f58d19348ece542f5d7a4af4c
b97b259db6c3cc345482ce4a3734cffd8518c882611f55d0818a119a07c90486
bb49aa69e795d9a4e6175a9373bef378615ead2fb7aebe00954c2111db5f5f2d
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603