urlscan.io logo urlscan.io
SecurityTrails logo

outlookloffice365user34k.z13.web.core.windows.net Open in urlscan Pro
52.239.214.161  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://j90sg-60.azurewebsites.net/iscaba?dyu=anthony.dalton@meggitt.com&&20.2.38.85&&cc0_34k3=meggitt.com&sr=anthony.dalton@meggit...
Effective URL: https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993
Submission: On January 14 via manual from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 2 countries across 6 domains to perform 11 HTTP transactions. The main IP is 52.239.214.161, located in Redmond, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US. The main domain is outlookloffice365user34k.z13.web.core.windows.net.
TLS certificate: Issued by Microsoft IT TLS CA 5 on April 19th 2018. Valid for: 2 years.
This is the only time outlookloffice365user34k.z13.web.core.windows.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 2 52.176.2.229 8075 (MICROSOFT...)
2 52.239.214.161 8075 (MICROSOFT...)
1 54.148.84.95 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
2 104.16.9.231 13335 (CLOUDFLAR...)
2 47.252.95.97 45102 (CNNIC-ALI...)
1 2a00:1450:400... 15169 (GOOGLE)
11 7
2    52.176.2.229 (Des Moines, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
j90sg-60.azurewebsites.net
2    52.239.214.161 (Redmond, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
outlookloffice365user34k.z13.web.core.windows.net
1    54.148.84.95 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-148-84-95.us-west-2.compute.amazonaws.com
www.sitepoint.com
2    2a00:1450:4001:820::2010 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
storage.googleapis.com
2    104.16.9.231 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdn.discordapp.com
2    47.252.95.97 (San Mateo, United States)

ASN45102 (CNNIC-ALIBABA-CN-NET-AP Alibaba (China) Technology Co., Ltd., CN)
loppa.oss-us-east-1.aliyuncs.com
1    2a00:1450:4001:808::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
ajax.googleapis.com
Domain Requested by
2 loppa.oss-us-east-1.aliyuncs.com outlookloffice365user34k.z13.web.core.windows.net
2 cdn.discordapp.com outlookloffice365user34k.z13.web.core.windows.net
2 storage.googleapis.com outlookloffice365user34k.z13.web.core.windows.net
2 outlookloffice365user34k.z13.web.core.windows.net outlookloffice365user34k.z13.web.core.windows.net
2 j90sg-60.azurewebsites.net 1 redirects
1 ajax.googleapis.com outlookloffice365user34k.z13.web.core.windows.net
1 www.sitepoint.com outlookloffice365user34k.z13.web.core.windows.net
11 7

This site contains no links.

Subject Issuer Validity Valid
*.azurewebsites.net
Microsoft IT TLS CA 4		 2017-12-17 -
2019-12-17		 2 years crt.sh
*.web.core.windows.net
Microsoft IT TLS CA 5		 2018-04-19 -
2020-04-19		 2 years crt.sh
sitepoint.com
SSL.com Premium EV CA		 2018-08-07 -
2019-09-23		 a year crt.sh
*.storage.googleapis.com
Google Internet Authority G3		 2018-12-19 -
2019-03-13		 3 months crt.sh
ssl711320.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2018-10-18 -
2019-04-26		 6 months crt.sh
*.oss.aliyuncs.com
GlobalSign Organization Validation CA - SHA256 - G2		 2018-11-30 -
2019-12-01		 a year crt.sh
*.googleapis.com
Google Internet Authority G3		 2018-12-19 -
2019-03-13		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993
Frame ID: 82A6C12061DEB7B75C351C4E73B433A3
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://j90sg-60.azurewebsites.net/iscaba?dyu=anthony.dalton@meggitt.com&&20.2.38.85&&cc0_34k3=meggitt.com&sr=a... HTTP 301
    https://j90sg-60.azurewebsites.net/iscaba/?dyu=anthony.dalton@meggitt.com&&20.2.38.85&&cc0_34k3=meggitt.com&sr=... Page URL
  2. https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /IIS(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • headers server /IIS(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • env /^jQuery$/i

Page Statistics

11
Requests

100 %
HTTPS

29 %
IPv6

6
Domains

7
Subdomains

7
IPs

2
Countries

804 kB
Transfer

866 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://j90sg-60.azurewebsites.net/iscaba?dyu=anthony.dalton@meggitt.com&&20.2.38.85&&cc0_34k3=meggitt.com&sr=anthony.dalton@meggitt.com&K9DEJDIR=meggitt.com&sc-3d=anthony.dalton@meggitt.com&&02127507716&&cc0_34k3=anthony%20dalton&sr=anthony.dalton@meggitt.com&92V7679=meggitt.com&sc-3d=anthony.dalton@meggitt.com HTTP 301
    https://j90sg-60.azurewebsites.net/iscaba/?dyu=anthony.dalton@meggitt.com&&20.2.38.85&&cc0_34k3=meggitt.com&sr=anthony.dalton@meggitt.com&K9DEJDIR=meggitt.com&sc-3d=anthony.dalton@meggitt.com&&02127507716&&cc0_34k3=anthony%20dalton&sr=anthony.dalton@meggitt.com&92V7679=meggitt.com&sc-3d=anthony.dalton@meggitt.com Page URL
  2. https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://j90sg-60.azurewebsites.net/iscaba?dyu=anthony.dalton@meggitt.com&&20.2.38.85&&cc0_34k3=meggitt.com&sr=anthony.dalton@meggitt.com&K9DEJDIR=meggitt.com&sc-3d=anthony.dalton@meggitt.com&&02127507716&&cc0_34k3=anthony%20dalton&sr=anthony.dalton@meggitt.com&92V7679=meggitt.com&sc-3d=anthony.dalton@meggitt.com HTTP 301
  • https://j90sg-60.azurewebsites.net/iscaba/?dyu=anthony.dalton@meggitt.com&&20.2.38.85&&cc0_34k3=meggitt.com&sr=anthony.dalton@meggitt.com&K9DEJDIR=meggitt.com&sc-3d=anthony.dalton@meggitt.com&&02127507716&&cc0_34k3=anthony%20dalton&sr=anthony.dalton@meggitt.com&92V7679=meggitt.com&sc-3d=anthony.dalton@meggitt.com

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
j90sg-60.azurewebsites.net/iscaba/
Redirect Chain
  • https://j90sg-60.azurewebsites.net/iscaba?dyu=anthony.dalton@meggitt.com&&20.2.38.85&&cc0_34k3=meggitt.com&sr=anthony.dalton@meggitt.com&K9DEJDIR=meggitt.com&sc-3d=anthony.dalton@meggitt.com&&02127...
  • https://j90sg-60.azurewebsites.net/iscaba/?dyu=anthony.dalton@meggitt.com&&20.2.38.85&&cc0_34k3=meggitt.com&sr=anthony.dalton@meggitt.com&K9DEJDIR=meggitt.com&sc-3d=anthony.dalton@meggitt.com&&0212...
452 B
620 B 		Document
General
Check archive.org
Download Go to
Full URL
https://j90sg-60.azurewebsites.net/iscaba/?dyu=anthony.dalton@meggitt.com&&20.2.38.85&&cc0_34k3=meggitt.com&sr=anthony.dalton@meggitt.com&K9DEJDIR=meggitt.com&sc-3d=anthony.dalton@meggitt.com&&02127507716&&cc0_34k3=anthony%20dalton&sr=anthony.dalton@meggitt.com&92V7679=meggitt.com&sc-3d=anthony.dalton@meggitt.com
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.176.2.229 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / PHP/5.6.38 ASP.NET
Resource Hash
063424f023a422330c16d83bf3a08096237a9725f90ac9842b535fec73e9a333

Request headers

Host
j90sg-60.azurewebsites.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate, br
Cookie
ARRAffinity=a2063aba30f62df8e4f3accc78a2eb747c5441b060ca24d3975d72d2736e6432
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Length
379
Content-Type
text/html; charset=UTF-8
Content-Encoding
gzip
Vary
Accept-Encoding
Server
Microsoft-IIS/10.0
X-Powered-By
PHP/5.6.38 ASP.NET
Date
Mon, 14 Jan 2019 16:54:53 GMT

Redirect headers

Content-Length
493
Content-Type
text/html; charset=UTF-8
Location
https://j90sg-60.azurewebsites.net/iscaba/?dyu=anthony.dalton@meggitt.com&&20.2.38.85&&cc0_34k3=meggitt.com&sr=anthony.dalton@meggitt.com&K9DEJDIR=meggitt.com&sc-3d=anthony.dalton@meggitt.com&&02127507716&&cc0_34k3=anthony%20dalton&sr=anthony.dalton@meggitt.com&92V7679=meggitt.com&sc-3d=anthony.dalton@meggitt.com
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
Set-Cookie
ARRAffinity=a2063aba30f62df8e4f3accc78a2eb747c5441b060ca24d3975d72d2736e6432;Path=/;HttpOnly;Domain=j90sg-60.azurewebsites.net
Date
Mon, 14 Jan 2019 16:54:53 GMT
Primary Request 9544120004d9a4b193af053574037993
outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/ 		53 KB
53 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.214.161 Redmond, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
64a79fcdcaf49ceb01bf0ae0115130e3f4da804405b0f05599971963b4045176

Request headers

Host
outlookloffice365user34k.z13.web.core.windows.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://j90sg-60.azurewebsites.net/iscaba/?dyu=anthony.dalton@meggitt.com&&20.2.38.85&&cc0_34k3=meggitt.com&sr=anthony.dalton@meggitt.com&K9DEJDIR=meggitt.com&sc-3d=anthony.dalton@meggitt.com&&02127507716&&cc0_34k3=anthony%20dalton&sr=anthony.dalton@meggitt.com&92V7679=meggitt.com&sc-3d=anthony.dalton@meggitt.com
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://j90sg-60.azurewebsites.net/iscaba/?dyu=anthony.dalton@meggitt.com&&20.2.38.85&&cc0_34k3=meggitt.com&sr=anthony.dalton@meggitt.com&K9DEJDIR=meggitt.com&sc-3d=anthony.dalton@meggitt.com&&02127507716&&cc0_34k3=anthony%20dalton&sr=anthony.dalton@meggitt.com&92V7679=meggitt.com&sc-3d=anthony.dalton@meggitt.com

Response headers

Content-Length
53832
Content-Type
text/html
Vary
Origin
Server
Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
x-ms-error-code
WebContentNotFound
x-ms-request-id
4b75b97f-901e-0094-1929-ac0cef000000
x-ms-version
2018-03-28
Date
Mon, 14 Jan 2019 16:54:54 GMT
MaskedPassword.js
www.sitepoint.com/examples/password/MaskedPassword/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.sitepoint.com/examples/password/MaskedPassword/MaskedPassword.js
Requested by
Host: outlookloffice365user34k.z13.web.core.windows.net
URL: https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.148.84.95 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-148-84-95.us-west-2.compute.amazonaws.com
Software
Apache/2.2.22 (Debian) /
Resource Hash
7742fb83d98648f94727a40d5c3381b3245805e62b6f998002d933715ac84b6a

Request headers

Referer
https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 14 Jan 2019 16:24:02 GMT
Content-Encoding
gzip
X-Cache-Lookup
HIT from ip-172-31-17-101.us-west-2.compute.internal:3128
Last-Modified
Fri, 15 Oct 2010 00:03:45 GMT
Server
Apache/2.2.22 (Debian)
Age
1853
ETag
"680936-4208-4929c8f629a40"
Vary
Accept-Encoding
X-Cache
HIT from ip-172-31-17-101.us-west-2.compute.internal
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
5767
converged.login.min.css
storage.googleapis.com/office2018/public/css/ 		84 KB
85 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://storage.googleapis.com/office2018/public/css/converged.login.min.css
Requested by
Host: outlookloffice365user34k.z13.web.core.windows.net
URL: https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:820::2010 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
UploadServer /
Resource Hash
4f962ec8ae085492d496fcbbd74185ab1c8e377438dbcb5ec4f8517b7bd9293f

Request headers

Referer
https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 14 Jan 2019 16:02:03 GMT
age
3172
status
200
x-guploader-uploadid
AEnB2Uq-hby_eQqoFYe5hCIJswdq88YK5HZCCF0qJl9ji_oWUoJ8WFx927Vo0GRy4jcJ2Oe0d16cYfK2XLVyx-gmfrIm6dd4Cg
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
86425
last-modified
Mon, 12 Feb 2018 02:07:46 GMT
server
UploadServer
etag
"041294f2364ba96d1008aff40415ada5"
x-goog-hash
crc32c=Z3ahJA==, md5=BBKU8jZLqW0QCK/0BBWtpQ==
x-goog-generation
1518401266838995
cache-control
public, max-age=3600
x-goog-stored-content-length
86425
accept-ranges
bytes
content-type
text/css
expires
Mon, 14 Jan 2019 17:02:03 GMT
microsoft_logo.svg
storage.googleapis.com/office2018/public/images/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://storage.googleapis.com/office2018/public/images/microsoft_logo.svg
Requested by
Host: outlookloffice365user34k.z13.web.core.windows.net
URL: https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:820::2010 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
UploadServer /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Referer
https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 14 Jan 2019 16:02:03 GMT
age
3172
status
200
x-guploader-uploadid
AEnB2UqFter3nIJQCwcqlcZzG7nGQ5IrF_MpWCoQY-8_mvTSUEPmaJEe0pTDUZSYyQVH3kJA-HCD8u6j8RfssChjs0isZK59Ug
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
3651
last-modified
Mon, 12 Feb 2018 02:08:14 GMT
server
UploadServer
etag
"ee5c8d9fb6248c938fd0dc19370e90bd"
x-goog-hash
crc32c=c/EO4g==, md5=7lyNn7YkjJOP0NwZNw6QvQ==
x-goog-generation
1518401294094787
cache-control
public, max-age=3600
x-goog-stored-content-length
3651
accept-ranges
bytes
content-type
image/svg+xml
expires
Mon, 14 Jan 2019 17:02:03 GMT
30.gif
cdn.discordapp.com/attachments/466747916187336706/502092033779957760/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.discordapp.com/attachments/466747916187336706/502092033779957760/30.gif
Requested by
Host: outlookloffice365user34k.z13.web.core.windows.net
URL: https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.16.9.231 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
52600dd842dfe2b1de28fb0e8a9dd948be6b19ac2d9e4905dafaa4aa059802ac

Request headers

Referer
https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 14 Jan 2019 16:54:55 GMT
cf-cache-status
HIT
status
200
x-guploader-uploadid
AEnB2UrUjEHcQ1YmgdUml_F5E7nGdzK0kTGG6Tc_tZiKY_ARRIvm4bpH6IFWVzKstvaptzbz0cD4y6XoJM6BcWww3CdeXRG4ag
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
4684
cf-ray
4991a092df9bc861-AMS
x-robots-tag
noindex, nofollow, noarchive, nocache, noimageindex, noodp
last-modified
Wed, 17 Oct 2018 12:14:29 GMT
server
cloudflare
etag
"e454c93bcb857648c648ea1a8178734e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=7imm8Q==, md5=5FTJO8uFdkjGSOoagXhzTg==
x-goog-generation
1539778469324166
cache-control
public, max-age=31536000
x-goog-stored-content-length
4684
accept-ranges
bytes
content-type
image/gif
expires
Tue, 14 Jan 2020 16:54:55 GMT
microsoft.png
cdn.discordapp.com/attachments/466747916187336706/518045849037701130/ 		21 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.discordapp.com/attachments/466747916187336706/518045849037701130/microsoft.png
Requested by
Host: outlookloffice365user34k.z13.web.core.windows.net
URL: https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.16.9.231 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f3c40b7dcd551731a8082217fe2859cf3023b0832057b424724032a9b4b9555f

Request headers

Referer
https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 14 Jan 2019 16:54:55 GMT
cf-cache-status
HIT
status
200
x-guploader-uploadid
AEnB2Ur2SA5u2kpISKTVpsxDzmUP5zxAa5eoGx3Lv0J70b_Uh53e9434q5t8sdvndEnX5s2qWx_UuJlATDM70W3axV4Ol3Veyw
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
21353
cf-ray
4991a092df9cc861-AMS
x-robots-tag
noindex, nofollow, noarchive, nocache, noimageindex, noodp
last-modified
Fri, 30 Nov 2018 12:49:15 GMT
server
cloudflare
etag
"447a15a254d0848aa6159f85d780b4ad"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=bG0HFA==, md5=RHoVolTQhIqmFZ+F14C0rQ==
x-goog-generation
1543582155278090
cache-control
public, max-age=31536000
x-goog-stored-content-length
21353
accept-ranges
bytes
content-type
image/png
expires
Tue, 14 Jan 2020 16:54:55 GMT
54b6d9334161a54.png
loppa.oss-us-east-1.aliyuncs.com/ 		753 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://loppa.oss-us-east-1.aliyuncs.com/54b6d9334161a54.png
Requested by
Host: outlookloffice365user34k.z13.web.core.windows.net
URL: https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
47.252.95.97 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-CN-NET-AP Alibaba (China) Technology Co., Ltd., CN),
Reverse DNS
Software
AliyunOSS /
Resource Hash
9dd5e031a96cb31830ef2fb13009f70f2001f7204e8e96faf0999821e7dd67eb

Request headers

Referer
https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-oss-object-type
Normal
Date
Mon, 14 Jan 2019 16:54:55 GMT
x-oss-request-id
5C3CBEDF94A45298608EEC9B
Last-Modified
Wed, 12 Sep 2018 03:08:41 GMT
Server
AliyunOSS
Content-MD5
3IGZz15lhbXXoDdJbfFpKw==
ETag
"DC8199CF5E6585B5D7A037496DF1692B"
Content-Type
image/png
x-oss-storage-class
Standard
Connection
keep-alive
Accept-Ranges
bytes
x-oss-hash-crc64ecma
14909334537735148911
Content-Length
753
x-oss-server-time
1
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
Requested by
Host: outlookloffice365user34k.z13.web.core.windows.net
URL: https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:808::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 03 Jan 2019 07:15:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
985178
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
30399
x-xss-protection
1; mode=block
last-modified
Thu, 25 Jan 2018 15:33:24 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 03 Jan 2020 07:15:17 GMT
small.jpg
outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/images/ 		32 KB
32 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/images/small.jpg?x=12f4b8b543125cc986c79cd85320812f
Requested by
Host: outlookloffice365user34k.z13.web.core.windows.net
URL: https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.214.161 Redmond, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
473847afccb50ac58923a453c020c2b867b67417bccb991d05b315ab6a14fcab

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
outlookloffice365user34k.z13.web.core.windows.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993
Connection
keep-alive
Cache-Control
no-cache
Referer
https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 14 Jan 2019 16:54:55 GMT
Server
Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
x-ms-error-code
WebContentNotFound
Vary
Origin
Content-Type
text/html
x-ms-request-id
4b75bbdf-901e-0094-2529-ac0cef000000
x-ms-version
2018-03-28
Content-Length
53832
760fe41056b0b16.jpg
loppa.oss-us-east-1.aliyuncs.com/ 		566 KB
566 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://loppa.oss-us-east-1.aliyuncs.com/760fe41056b0b16.jpg
Requested by
Host: outlookloffice365user34k.z13.web.core.windows.net
URL: https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
47.252.95.97 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-CN-NET-AP Alibaba (China) Technology Co., Ltd., CN),
Reverse DNS
Software
AliyunOSS /
Resource Hash
7764c38d71f5ee52d39f237f08b4e82b4715c73bfa0afbaee30a60b0dfd058ca

Request headers

Referer
https://outlookloffice365user34k.z13.web.core.windows.net/9544120004d9a4b193af053574037993/9544120004d9a4b193af053574037993
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-oss-object-type
Normal
Date
Mon, 14 Jan 2019 16:54:56 GMT
x-oss-request-id
5C3CBEE094A45298608EECCC
Last-Modified
Wed, 12 Sep 2018 03:04:14 GMT
Server
AliyunOSS
Content-MD5
r4KMjwxdtZ4HLKo9+v4fzQ==
ETag
"AF828C8F0C5DB59E072CAA3DFAFE1FCD"
Content-Type
image/jpeg
x-oss-storage-class
Standard
Connection
keep-alive
Accept-Ranges
bytes
x-oss-hash-crc64ecma
555916454670177095
Content-Length
579468
x-oss-server-time
1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) Microsoft (Consumer)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| MaskedPassword function| $ function| jQuery function| validateEmail function| send_form function| validate_email_input_and_password function| input_on_change function| randomString

0 Cookies