microsoftexchangev8yfx.16mb.com Open in urlscan Pro
185.224.138.34 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://noreferv8yfx.96.lt/CsbivQK2o9kTJxOJRg41&email=/redirector.php?id=yY95hFBsk8&ub=rrr016ar1r013ar02ar0.r014ar05ar0r05a...
Effective URL:
http://microsoftexchangev8yfx.16mb.com/oauth/indexa.php?P=_93894574342hdfjsixaoweue5_j1489738549283781331983743fncn_Product-UserID&ub=r...
Submission: On June 29 via manual (June 29th 2018, 5:24:53 pm UTC) from CA

Summary HTTP 2 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 2 HTTP transactions. The main IP is 185.224.138.34, located in and belongs to HOSTINGER-AS, LT. The main domain is microsoftexchangev8yfx.16mb.com.

This is the only time microsoftexchangev8yfx.16mb.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
1 1	185.224.138.33 185.224.138.33		47583 (HOSTINGER-AS) (HOSTINGER-AS)
1 2	185.224.138.34 185.224.138.34		47583 (HOSTINGER-AS) (HOSTINGER-AS)
1	205.185.208.52 205.185.208.52		20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group)
2	3

1 185.224.138.33 (None, ) 1 redirects

ASN47583 (HOSTINGER-AS, LT)

noreferv8yfx.96.lt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.224.138.34 (None, ) 1 redirects

ASN47583 (HOSTINGER-AS, LT)

microsoftexchangev8yfx.16mb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.185.208.52 (Phoenix, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip052.ssl.hwcdn.net

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	16mb.com 1 redirects microsoftexchangev8yfx.16mb.com	309 KB
1	jquery.com code.jquery.com	28 KB
1	96.lt 1 redirects noreferv8yfx.96.lt	361 B
2	3

	Domain	Requested by
2	microsoftexchangev8yfx.16mb.com	1 redirects
1	code.jquery.com	microsoftexchangev8yfx.16mb.com
1	noreferv8yfx.96.lt	1 redirects
2	3

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://microsoftexchangev8yfx.16mb.com/oauth/indexa.php?P=_93894574342hdfjsixaoweue5_j1489738549283781331983743fncn_Product-UserID&ub=rrr016ar1r013ar02ar0.r014ar05ar0r05arrrr010ar1r017ar1r02ar04ar1r04ar013ar3r4r011a.r01ar3r09a
Frame ID: A831A3B28A176D4B98C56084511F97C6
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://noreferv8yfx.96.lt/CsbivQK2o9kTJxOJRg41&email=/redirector.php?id=yY95hFBsk8&ub=rrr016ar1r013ar0... HTTP 302
http://microsoftexchangev8yfx.16mb.com/oauth/index.php?ub=rrr016ar1r013ar02ar0.r014ar05ar0r05arrrr010ar1r017ar1r02a... HTTP 302
http://microsoftexchangev8yfx.16mb.com/oauth/indexa.php?P=_93894574342hdfjsixaoweue5_j1489738549283781331983743fncn... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Lua (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

OpenResty (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^jQuery$/i

Page Statistics

2
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

337 kB
Transfer

865 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://noreferv8yfx.96.lt/CsbivQK2o9kTJxOJRg41&email=/redirector.php?id=yY95hFBsk8&ub=rrr016ar1r013ar02ar0.r014ar05ar0r05arrrr010ar1r017ar1r02ar04ar1r04ar013ar3r4r011a.r01ar3r09a HTTP 302
http://microsoftexchangev8yfx.16mb.com/oauth/index.php?ub=rrr016ar1r013ar02ar0.r014ar05ar0r05arrrr010ar1r017ar1r02ar04ar1r04ar013ar3r4r011a.r01ar3r09a HTTP 302
http://microsoftexchangev8yfx.16mb.com/oauth/indexa.php?P=_93894574342hdfjsixaoweue5_j1489738549283781331983743fncn_Product-UserID&ub=rrr016ar1r013ar02ar0.r014ar05ar0r05arrrr010ar1r017ar1r02ar04ar1r04ar013ar3r4r011a.r01ar3r09a Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
6 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request indexa.php Show response microsoftexchangev8yfx.16mb.com/oauth/ Redirect Chain http://noreferv8yfx.96.lt/CsbivQK2o9kTJxOJRg41&email=/redirector.php?id=yY95hFBsk8&ub=rrr016ar1r013ar02ar0.r014ar05ar0r05arrrr010ar1r017ar1r02ar04ar1r04ar013ar3r4r011a.r01ar3r09a http://microsoftexchangev8yfx.16mb.com/oauth/index.php?ub=rrr016ar1r013ar02ar0.r014ar05ar0r05arrrr010ar1r017ar1r02ar04ar1r04ar013ar3r4r011a.r01ar3r09a http://microsoftexchangev8yfx.16mb.com/oauth/indexa.php?P=_93894574342hdfjsixaoweue5_j1489738549283781331983743fncn_Product-UserID&ub=rrr016ar1r013ar02ar0.r014ar05ar0r05arrrr010ar1r017ar1r02ar04ar1...	511 KB 309 KB	32ms 32ms	Document text/html	185.224.138.34 HOSTINGER-AS
General Check archive.org Show headers Download Go to Full URL http://microsoftexchangev8yfx.16mb.com/oauth/indexa.php?P=_93894574342hdfjsixaoweue5_j1489738549283781331983743fncn_Product-UserID&ub=rrr016ar1r013ar02ar0.r014ar05ar0r05arrrr010ar1r017ar1r02ar04ar1r04ar013ar3r4r011a.r01ar3r09a Protocol HTTP/1.1 Server 185.224.138.34 -, , ASN47583 (HOSTINGER-AS, LT), Reverse DNS Software openresty / PHP/7.0.30 Resource Hash `6efb59398e8e28a35fccc8448688d748dd70de760b0112f5bc570ae386e719d5` Request headers Host microsoftexchangev8yfx.16mb.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 X-DevTools-Emulate-Network-Conditions-Client-Id A831A3B28A176D4B98C56084511F97C6 Response headers Server openresty Date Fri, 29 Jun 2018 17:24:42 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive X-Powered-By PHP/7.0.30 Content-Encoding gzip Redirect headers Server openresty Date Fri, 29 Jun 2018 17:24:42 GMT Content-Type text/html; charset=UTF-8 Content-Length 0 Connection keep-alive X-Powered-By PHP/7.0.30 Location indexa.php?P=_93894574342hdfjsixaoweue5_j1489738549283781331983743fncn_Product-UserID&ub=rrr016ar1r013ar02ar0.r014ar05ar0r05arrrr010ar1r017ar1r02ar04ar1r04ar013ar3r4r011a.r01ar3r09a
GET DATA	200 OK	truncated /	3 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/jpeg
GET H/1.1	200 OK	jquery-3.3.1.slim.min.js Show response code.jquery.com/	68 KB 28 KB	20ms 6ms	Script application/javascript	205.185.208.52 Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.3.1.slim.min.js Requested by Host: microsoftexchangev8yfx.16mb.com URL: http://microsoftexchangev8yfx.16mb.com/oauth/indexa.php?P=_93894574342hdfjsixaoweue5_j1489738549283781331983743fncn_Product-UserID&ub=rrr016ar1r013ar02ar0.r014ar05ar0r05arrrr010ar1r017ar1r02ar04ar1r04ar013ar3r4r011a.r01ar3r09a Protocol HTTP/1.1 Server 205.185.208.52 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US), Reverse DNS vip052.ssl.hwcdn.net Software nginx / Resource Hash `dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://microsoftexchangev8yfx.16mb.com/oauth/indexa.php?P=_93894574342hdfjsixaoweue5_j1489738549283781331983743fncn_Product-UserID&ub=rrr016ar1r013ar02ar0.r014ar05ar0r05arrrr010ar1r017ar1r02ar04ar1r04ar013ar3r4r011a.r01ar3r09a Origin http://microsoftexchangev8yfx.16mb.com Response headers Date Fri, 29 Jun 2018 17:24:42 GMT Content-Encoding gzip Last-Modified Sat, 20 Jan 2018 17:26:44 GMT Server nginx ETag W/"5a637bd4-1111d" Vary Accept-Encoding X-HW 1530293082.dop011.fr8.shc,1530293082.dop011.fr8.t,1530293082.cds019.fr8.c Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control max-age=315360000 Connection Keep-Alive Accept-Ranges bytes Content-Length 28008
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/svg+xml
GET DATA	200 OK	truncated /	513 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/svg+xml
GET DATA	200 OK	truncated /	915 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/svg+xml
GET DATA	200 OK	truncated /	915 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/svg+xml
GET DATA	200 OK	truncated /	277 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/jpeg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery string| currentEmail object| ListEntries number| passwordAttempts function| handleFormSubmit function| login function| validateEmail function| isValidPassword function| toggleUsernameError function| togglePasswordError

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
microsoftexchangev8yfx.16mb.com
noreferv8yfx.96.lt
185.224.138.33
185.224.138.34
205.185.208.52
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
6efb59398e8e28a35fccc8448688d748dd70de760b0112f5bc570ae386e719d5
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea