microsoftonline.conductingcode.xyz Open in urlscan Pro
91.134.26.60 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://9557833j.employeesalaryincrease.com/?username=john.strpa%40wae.com
Effective URL:
https://microsoftonline.conductingcode.xyz/login.srf?__smso=vYUQtmYoQJm_ejBxzIzK1g%3D%3D&username=john.strpa%40wae.com&sso_reload=true
Submission Tags: falconsandbox
Submission: On October 12 via api (October 12th 2021, 7:14:00 am UTC) from US — Scanned from DE

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 13 HTTP transactions. The main IP is 91.134.26.60, located in France and belongs to OVH, FR. The main domain is microsoftonline.conductingcode.xyz.
TLS certificate: Issued by R3 on October 8th 2021. Valid for: 3 months.

This is the only time microsoftonline.conductingcode.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	80.78.23.65 80.78.23.65	39287 (ABSTRACT) (ABSTRACT)
6	91.134.26.60 91.134.26.60	16276 (OVH) (OVH)
13	3

2 80.78.23.65 (Sweden) 1 redirects

ASN39287 (ABSTRACT, FI)
PTR: 504e1741.host.njalla.net

9557833j.employeesalaryincrease.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 91.134.26.60 (France)

ASN16276 (OVH, FR)
PTR: v2.home2homesales.com

www.conductingcode.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
microsoftonline.conductingcode.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
login-live.conductingcode.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
22c5y80j2iiehli.conductingcode.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	conductingcode.xyz www.conductingcode.xyz microsoftonline.conductingcode.xyz login-live.conductingcode.xyz 22c5y80j2iiehli.conductingcode.xyz u32330gvn1fqiwg.conductingcode.xyz Failed	384 KB
2	employeesalaryincrease.com 1 redirects 9557833j.employeesalaryincrease.com	29 KB
13	2

	Domain	Requested by
2	microsoftonline.conductingcode.xyz	www.conductingcode.xyz microsoftonline.conductingcode.xyz
2	www.conductingcode.xyz	9557833j.employeesalaryincrease.com www.conductingcode.xyz
2	9557833j.employeesalaryincrease.com	1 redirects
1	22c5y80j2iiehli.conductingcode.xyz	microsoftonline.conductingcode.xyz
1	login-live.conductingcode.xyz	microsoftonline.conductingcode.xyz
0	u32330gvn1fqiwg.conductingcode.xyz Failed	22c5y80j2iiehli.conductingcode.xyz
13	6

This site contains no links.

Subject Issuer	Validity	Valid
employeesalaryincrease.com R3	`2021-10-11` - `2022-01-09`	3 months	crt.sh
conductingcode.xyz R3	`2021-10-08` - `2022-01-06`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://microsoftonline.conductingcode.xyz/login.srf?__smso=vYUQtmYoQJm_ejBxzIzK1g%3D%3D&username=john.strpa%40wae.com&sso_reload=true
Frame ID: 8D1E550B13FCAFF065BA75BFFF0FBC92
Requests: 12 HTTP requests in this frame

Frame: https://u32330gvn1fqiwg.conductingcode.xyz/Prefetch/Prefetch.aspx
Frame ID: 8CD77D15654A71D138DEE43805C256E1
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://9557833j.employeesalaryincrease.com/?username=john.strpa%40wae.com Page URL
https://9557833j.employeesalaryincrease.com/?username=john.strpa%40wae.com HTTP 302
https://www.conductingcode.xyz/b/3321344/?username=john.strpa%40wae.com Page URL
https://microsoftonline.conductingcode.xyz/login.srf?__smso=vYUQtmYoQJm_ejBxzIzK1g%3D%3D&username=john.strpa%40wae.com Page URL
https://microsoftonline.conductingcode.xyz/login.srf?__smso=vYUQtmYoQJm_ejBxzIzK1g%3D%3D&username=john.strpa%40wae.com&... Page URL

Page Statistics

13
Requests

54 %
HTTPS

0 %
IPv6

2
Domains

6
Subdomains

3
IPs

2
Countries

413 kB
Transfer

1559 kB
Size

10
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://9557833j.employeesalaryincrease.com/?username=john.strpa%40wae.com Page URL
https://9557833j.employeesalaryincrease.com/?username=john.strpa%40wae.com HTTP 302
https://www.conductingcode.xyz/b/3321344/?username=john.strpa%40wae.com Page URL
https://microsoftonline.conductingcode.xyz/login.srf?__smso=vYUQtmYoQJm_ejBxzIzK1g%3D%3D&username=john.strpa%40wae.com Page URL
https://microsoftonline.conductingcode.xyz/login.srf?__smso=vYUQtmYoQJm_ejBxzIzK1g%3D%3D&username=john.strpa%40wae.com&sso_reload=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://9557833j.employeesalaryincrease.com/?username=john.strpa%40wae.com HTTP 302
https://www.conductingcode.xyz/b/3321344/?username=john.strpa%40wae.com

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
9557833j.employeesalaryincrease.com/ 72 KB
29 KB 286ms
226ms Document
text/html 80.78.23.65
ABSTRACT

General

Check archive.org

Show headers Download Go to

Full URL

https://9557833j.employeesalaryincrease.com/?username=john.strpa%40wae.com

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

80.78.23.65 , Sweden, ASN39287 (ABSTRACT, FI),

Reverse DNS

504e1741.host.njalla.net

Software

nginx/1.17.10 /

Resource Hash

3da390e0ddfccb1b54f6f361f6e2407e7d5d9d551e7a9193ef2d42a67b8feaa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: 9557833j.employeesalaryincrease.com
:scheme: https
:path: /?username=john.strpa%40wae.com
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

server: nginx/1.17.10
date: Tue, 12 Oct 2021 07:13:55 GMT
content-type: text/html; charset=utf-8
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip

GET
H2

200

/ Show response
www.conductingcode.xyz/b/3321344/
Redirect Chain

https://9557833j.employeesalaryincrease.com/?username=john.strpa%40wae.com
https://www.conductingcode.xyz/b/3321344/?username=john.strpa%40wae.com

111 KB
24 KB

241ms
188ms

Document
text/html

91.134.26.60
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://www.conductingcode.xyz/b/3321344/?username=john.strpa%40wae.com

Requested by

Host: 9557833j.employeesalaryincrease.com
URL: https://9557833j.employeesalaryincrease.com/?username=john.strpa%40wae.com

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

91.134.26.60 , France, ASN16276 (OVH, FR),

Reverse DNS

v2.home2homesales.com

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

0035703176cc2644f625454e1998ecb50d6a33b90c7092322b4b2ed5351505ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: www.conductingcode.xyz
:scheme: https
:path: /b/3321344/?username=john.strpa%40wae.com
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://9557833j.employeesalaryincrease.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://9557833j.employeesalaryincrease.com/?username=john.strpa%40wae.com

Response headers

server: nginx/1.18.0 (Ubuntu)
date: Tue, 12 Oct 2021 07:13:56 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip

Redirect headers

server: nginx/1.17.10
date: Tue, 12 Oct 2021 07:13:55 GMT
content-type: text/html; charset=utf-8
location: https://www.conductingcode.xyz/b/3321344/?username=john.strpa%40wae.com
strict-transport-security: max-age=31536000; includeSubDomains

POST
H2 200 /
www.conductingcode.xyz/b/3321344/ 275 B
406 B 171ms
170ms XHR
application/json 91.134.26.60
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://www.conductingcode.xyz/b/3321344/?username=john.strpa%40wae.com

Requested by

Host: www.conductingcode.xyz
URL: https://www.conductingcode.xyz/b/3321344/?username=john.strpa%40wae.com

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

91.134.26.60 , France, ASN16276 (OVH, FR),

Reverse DNS

v2.home2homesales.com

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-fetch-mode: cors
origin: https://www.conductingcode.xyz
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: empty
content-length: 323
:path: /b/3321344/?username=john.strpa%40wae.com
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
content-type: application/x-www-form-urlencoded; charset=UTF-8
accept: */*
cache-control: no-cache
:authority: www.conductingcode.xyz
referer: https://www.conductingcode.xyz/b/3321344/?username=john.strpa%40wae.com
:scheme: https
sec-fetch-site: same-origin
:method: POST
Referer: https://www.conductingcode.xyz/b/3321344/?username=john.strpa%40wae.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Tue, 12 Oct 2021 07:13:56 GMT
content-encoding: gzip
vary: Accept-Encoding
server: nginx/1.18.0 (Ubuntu)
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json

GET
H2 200 login.srf Show response
microsoftonline.conductingcode.xyz/ 435 KB
119 KB 810ms
800ms Document
text/html 91.134.26.60
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://microsoftonline.conductingcode.xyz/login.srf?__smso=vYUQtmYoQJm_ejBxzIzK1g%3D%3D&username=john.strpa%40wae.com

Requested by

Host: www.conductingcode.xyz
URL: https://www.conductingcode.xyz/b/3321344/?username=john.strpa%40wae.com

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

91.134.26.60 , France, ASN16276 (OVH, FR),

Reverse DNS

v2.home2homesales.com

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

e65f62bea093c1213be1340f0982dd310cafbad746cbdd71fcfb590be5eef587

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: microsoftonline.conductingcode.xyz
:scheme: https
:path: /login.srf?__smso=vYUQtmYoQJm_ejBxzIzK1g%3D%3D&username=john.strpa%40wae.com
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://www.conductingcode.xyz/
accept-encoding: gzip, deflate, br
cookie: __smso=vYUQtmYoQJm/ejBxzIzK1g==
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.conductingcode.xyz/

Response headers

server: nginx/1.18.0 (Ubuntu)
date: Tue, 12 Oct 2021 07:13:57 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding Accept-Encoding
cache-control: no-store, no-cache
pragma: no-cache
p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
x-ms-request-id: 01972692-70aa-43da-8e1a-b34b922c0800
x-ms-ests-server: 2.1.12108.11 - WEULR2 ProdSlices
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]}
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
referrer-policy: strict-origin-when-cross-origin
access-control-allow-origin: *
access-control-allow-headers: *
set-cookie: fpc=Ajsl-2T2fL9ApTBg1hTDwpc; expires=Tue, 22 Aug 2073 14:27:53 GMT; HttpOnly; Path=/; Secure stsservicecookie=estsfd; Path=/; Secure x-ms-gateway-slice=estsfd; Path=/; Secure
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip

GET
H2 200 Primary Request login.srf Show response
microsoftonline.conductingcode.xyz/ 482 KB
115 KB 1379ms
1379ms Document
text/html 91.134.26.60
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://microsoftonline.conductingcode.xyz/login.srf?__smso=vYUQtmYoQJm_ejBxzIzK1g%3D%3D&username=john.strpa%40wae.com&sso_reload=true

Requested by

Host: microsoftonline.conductingcode.xyz
URL: https://microsoftonline.conductingcode.xyz/login.srf?__smso=vYUQtmYoQJm_ejBxzIzK1g%3D%3D&username=john.strpa%40wae.com

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

91.134.26.60 , France, ASN16276 (OVH, FR),

Reverse DNS

v2.home2homesales.com

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

d9418965da12be11515702ecfa1afdbfe412b2ec7b08efe052284b4f0d4f25aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: microsoftonline.conductingcode.xyz
:scheme: https
:path: /login.srf?__smso=vYUQtmYoQJm_ejBxzIzK1g%3D%3D&username=john.strpa%40wae.com&sso_reload=true
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://microsoftonline.conductingcode.xyz/login.srf?__smso=vYUQtmYoQJm_ejBxzIzK1g%3D%3D&username=john.strpa%40wae.com
accept-encoding: gzip, deflate, br
cookie: __smso=vYUQtmYoQJm/ejBxzIzK1g==; fpc=Ajsl-2T2fL9ApTBg1hTDwpc; stsservicecookie=estsfd; x-ms-gateway-slice=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://microsoftonline.conductingcode.xyz/login.srf?__smso=vYUQtmYoQJm_ejBxzIzK1g%3D%3D&username=john.strpa%40wae.com

Response headers

server: nginx/1.18.0 (Ubuntu)
date: Tue, 12 Oct 2021 07:13:58 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding Accept-Encoding
cache-control: no-store, no-cache
pragma: no-cache
p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
x-ms-request-id: b7f0a58b-6e08-477a-8dfd-caaece4fdd02
x-ms-ests-server: 2.1.12071.28 - WEULR1 ProdSlices
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]}
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
referrer-policy: strict-origin-when-cross-origin
access-control-allow-origin: *
access-control-allow-headers: *
set-cookie: esctx=AQABAAAAAAD--DLA3VO7QrddgJg7Wevr9gBpBm7zK--LKxWfUV_BB8yfSlWrqfWyP6kXHa7IZ7tp2s5zY3DMva71tuxTxsvmwNrbPl3Xr7gJpCouy2rs3MeohIipKs9GSL_O2gxwzH3tgoNd1PAZ2u3LyGkTeR84Jn4Cmub6-8BA4Pc-J1-9TSczUNqNfzYOKDpoxr8REtwgAA; HttpOnly; Path=/; Secure ExternalIdpStateHash=7qY_5B38-yX-xrJw8RO6YTs2fOsxNfW_dW7RR2Ed3fc; HttpOnly; Path=/; Secure buid=0.AUsAqzBRR7ViQUKp00fjfJvCFakreHKQRANPjYJWI3DqNWYBAAA.AQABAAEAAAD--DLA3VO7QrddgJg7WevrXuCgfTlfqjpEkOewQ7s1eGnFTeplJHpm9rezf8M9pkayHjusi2rsJPI4PCA1PqFfGGtxeiWQ4lMEAEFdsQaXqI4hTEpTK2m0UYpBfsNK9XAgAA; expires=Tue, 22 Aug 2073 14:27:55 GMT; HttpOnly; Path=/; Secure fpc=Ajsl-2T2fL9ApTBg1hTDwpe4vjNwAQAAALQs99gOAAAA; expires=Tue, 22 Aug 2073 14:27:55 GMT; HttpOnly; Path=/; Secure stsservicecookie=estsfd; Path=/; Secure x-ms-gateway-slice=estsfd; Path=/; Secure
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip

GET
H2 200 Me.htm
login-live.conductingcode.xyz/ 0
0 806ms
795ms Other
text/html 91.134.26.60
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://login-live.conductingcode.xyz/Me.htm?v=3
Requested by: Host: microsoftonline.conductingcode.xyz
URL: https://microsoftonline.conductingcode.xyz/login.srf?__smso=vYUQtmYoQJm_ejBxzIzK1g%3D%3D&username=john.strpa%40wae.com&sso_reload=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 91.134.26.60 , France, ASN16276 (OVH, FR),
Reverse DNS: v2.home2homesales.com
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://microsoftonline.conductingcode.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-headers: *

GET
H2 200 ConvergedLogin_PCore_K6sxFOiq5RA7iKp07WnW3g2.js Show response
22c5y80j2iiehli.conductingcode.xyz/shared/1.0/content/js/ 458 KB
126 KB 1031ms
1020ms Script
application/x-javascript 91.134.26.60
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://22c5y80j2iiehli.conductingcode.xyz/shared/1.0/content/js/ConvergedLogin_PCore_K6sxFOiq5RA7iKp07WnW3g2.js

Requested by

Host: microsoftonline.conductingcode.xyz
URL: https://microsoftonline.conductingcode.xyz/login.srf?__smso=vYUQtmYoQJm_ejBxzIzK1g%3D%3D&username=john.strpa%40wae.com&sso_reload=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

91.134.26.60 , France, ASN16276 (OVH, FR),

Reverse DNS

v2.home2homesales.com

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

f759d349d5aa5511eb9da444634ebc5997ad1b73cda202bf0aafea21a997c794

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://microsoftonline.conductingcode.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 12 Oct 2021 07:13:59 GMT
content-encoding: gzip
x-azure-ref-originshield: 0kZdgYQAAAADOGiUW1ioOSLxv5IAKIoL5TE9OMjFFREdFMDIxMQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
x-cache: TCP_HIT
x-azure-ref: 0tjVlYQAAAACVxaSLiChdTIKQir0ac9x2RlJBRURHRTEwMjAAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
strict-transport-security: max-age=31536000; includeSubDomains
x-ms-lease-status: unlocked
last-modified: Tue, 28 Sep 2021 07:11:29 GMT
server: nginx/1.18.0 (Ubuntu)
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: c65cf3c9-201e-0045-7a6d-bc6368000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19

GET Prefetch.aspx
u32330gvn1fqiwg.conductingcode.xyz/Prefetch/ Frame 8CD7 0
0

GET converged.v2.login.min_lgjnfq3xbrj5zvj5ionvww2.css
22c5y80j2iiehli.conductingcode.xyz/ests/2.1/content/cdnbundles/ 0
0

GET ux.converged.login.strings-de.min_gehy6aj7foxflw5sgkgr-a2.js
22c5y80j2iiehli.conductingcode.xyz/ests/2.1/content/cdnbundles/ 0
0

GET 2_bc3d32a696895f78c19df6c717586a5d.svg
22c5y80j2iiehli.conductingcode.xyz/shared/1.0/content/images/backgrounds/ 0
0

GET microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
22c5y80j2iiehli.conductingcode.xyz/shared/1.0/content/images/ 0
0

GET signin-options_4e48046ce74f4b89d45037c90576bfac.svg
22c5y80j2iiehli.conductingcode.xyz/shared/1.0/content/images/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: u32330gvn1fqiwg.conductingcode.xyz
URL: https://u32330gvn1fqiwg.conductingcode.xyz/Prefetch/Prefetch.aspx

Domain: 22c5y80j2iiehli.conductingcode.xyz
URL: https://22c5y80j2iiehli.conductingcode.xyz/ests/2.1/content/cdnbundles/converged.v2.login.min_lgjnfq3xbrj5zvj5ionvww2.css

Domain: 22c5y80j2iiehli.conductingcode.xyz
URL: https://22c5y80j2iiehli.conductingcode.xyz/ests/2.1/content/cdnbundles/ux.converged.login.strings-de.min_gehy6aj7foxflw5sgkgr-a2.js

Domain: 22c5y80j2iiehli.conductingcode.xyz
URL: https://22c5y80j2iiehli.conductingcode.xyz/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg

Domain: 22c5y80j2iiehli.conductingcode.xyz
URL: https://22c5y80j2iiehli.conductingcode.xyz/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg

Domain: 22c5y80j2iiehli.conductingcode.xyz
URL: https://22c5y80j2iiehli.conductingcode.xyz/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.employeesalaryincrease.com/	1970-01-20 06:39:18	Name: __Jqa2 Value: a2OiSrz-Sh6Dt-FlJ88QbQ==
.conductingcode.xyz/	1970-01-19 22:15:18	Name: __smso Value: vYUQtmYoQJm/ejBxzIzK1g==
microsoftonline.conductingcode.xyz/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd
microsoftonline.conductingcode.xyz/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
.microsoftonline.conductingcode.xyz/	1969-12-31 23:59:59	Name: AADSSO Value: NA\|NoExtension
microsoftonline.conductingcode.xyz/	1970-01-19 21:53:42	Name: SSOCOOKIEPULLED Value: 1
microsoftonline.conductingcode.xyz/	1969-12-31 23:59:59	Name: esctx Value: AQABAAAAAAD--DLA3VO7QrddgJg7Wevr9gBpBm7zK--LKxWfUV_BB8yfSlWrqfWyP6kXHa7IZ7tp2s5zY3DMva71tuxTxsvmwNrbPl3Xr7gJpCouy2rs3MeohIipKs9GSL_O2gxwzH3tgoNd1PAZ2u3LyGkTeR84Jn4Cmub6-8BA4Pc-J1-9TSczUNqNfzYOKDpoxr8REtwgAA
microsoftonline.conductingcode.xyz/	1969-12-31 23:59:59	Name: ExternalIdpStateHash Value: 7qY_5B38-yX-xrJw8RO6YTs2fOsxNfW_dW7RR2Ed3fc
microsoftonline.conductingcode.xyz/	1970-02-07 20:30:37	Name: buid Value: 0.AUsAqzBRR7ViQUKp00fjfJvCFakreHKQRANPjYJWI3DqNWYBAAA.AQABAAEAAAD--DLA3VO7QrddgJg7WevrXuCgfTlfqjpEkOewQ7s1eGnFTeplJHpm9rezf8M9pkayHjusi2rsJPI4PCA1PqFfGGtxeiWQ4lMEAEFdsQaXqI4hTEpTK2m0UYpBfsNK9XAgAA
microsoftonline.conductingcode.xyz/	1970-02-07 20:30:37	Name: fpc Value: Ajsl-2T2fL9ApTBg1hTDwpe4vjNwAQAAALQs99gOAAAA

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

22c5y80j2iiehli.conductingcode.xyz
9557833j.employeesalaryincrease.com
login-live.conductingcode.xyz
microsoftonline.conductingcode.xyz
u32330gvn1fqiwg.conductingcode.xyz
www.conductingcode.xyz
22c5y80j2iiehli.conductingcode.xyz
u32330gvn1fqiwg.conductingcode.xyz
80.78.23.65
91.134.26.60
0035703176cc2644f625454e1998ecb50d6a33b90c7092322b4b2ed5351505ba
3da390e0ddfccb1b54f6f361f6e2407e7d5d9d551e7a9193ef2d42a67b8feaa4
d9418965da12be11515702ecfa1afdbfe412b2ec7b08efe052284b4f0d4f25aa
e65f62bea093c1213be1340f0982dd310cafbad746cbdd71fcfb590be5eef587
f759d349d5aa5511eb9da444634ebc5997ad1b73cda202bf0aafea21a997c794

microsoftonline.conductingcode.xyz Open in urlscan Pro 91.134.26.60 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

13 Requests

54 %HTTPS

0 %IPv6

2 Domains

6 Subdomains

3 IPs

2 Countries

413 kBTransfer

1559 kBSize

10 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

10 Cookies

Security Headers

Indicators

microsoftonline.conductingcode.xyz Open in urlscan Pro
91.134.26.60 Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

54 %
HTTPS

0 %
IPv6

2
Domains

6
Subdomains

3
IPs

2
Countries

413 kB
Transfer

1559 kB
Size

10
Cookies

13 HTTP transactions
0 data transactions