sdfjioxc.uk
Open in
urlscan Pro
217.61.123.203
Malicious Activity!
Public Scan
URL:
http://sdfjioxc.uk/newoffice/office/Sign_in/
Submission: On May 08 via api from CA
Submission: On May 08 via api from CA
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 5 HTTP transactions.
The main IP is 217.61.123.203, located in
Arezzo, Italy and
belongs to ARUBA-ASN, IT.
The main domain is sdfjioxc.uk.
This is the only time sdfjioxc.uk was scanned on urlscan.io!
This is the only time sdfjioxc.uk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Office 365 (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 5 | 217.61.123.203 217.61.123.203 | 31034 (ARUBA-ASN) (ARUBA-ASN) | |
| 5 | 1 |
5
217.61.123.203
(Arezzo, Italy)
ASN31034 (ARUBA-ASN, IT)
PTR: host203-123-61-217.static.arubacloud.com
ASN31034 (ARUBA-ASN, IT)
PTR: host203-123-61-217.static.arubacloud.com
| sdfjioxc.uk |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 5 |
sdfjioxc.uk
sdfjioxc.uk |
241 KB |
| 5 | 1 |
| Domain | Requested by | |
|---|---|---|
| 5 | sdfjioxc.uk |
sdfjioxc.uk
|
| 5 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| login.live.com |
| login.microsoftonline.com |
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://sdfjioxc.uk/newoffice/office/Sign_in/
Frame ID: 187AABCFE9287257D80117EA850883A8
Requests: 5 HTTP requests in this frame
3 Outgoing links
These are links going to different origins than the main page.
URL: https://login.live.com/login.srf?wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQIIAeNisNLJKCkpKLbS1y_ILypJzNHLzUwuyi_OTyvJz8vJzEvVS87P1csvSs9MAbGKhLgEGptYG5w-fHbfrnHFxWTzz5hVjMqEjdC_wMj4gpHxFpOgf1G6Z0p4sVtqSmpRYklmft4jJt7Q4tQi_7ycypD87NS8XcwqBinmZuZGZpa6qWnmZromJgbGuhbmhsm6ZsaGBolpSSmW5sapF1gEXrEwGbD-YGFcxAp01s6Enor5cRa-K3acWboi7tjlU6z6ac6lZSWB2aXeERYppRWlXnm-zmVhhuGlvoZm7v5plgF-TvkBPuH6uZUeybaWVoYT2IQmsDEd4GQEAA2&id=&uaid=80058281f04247f3b728d44434b3f95c&pcexp=false&popupui=
Title: Sign in with a Microsoft account
Title: Sign in with a Microsoft account
Search URL Search Domain Scan URL
URL: https://login.microsoftonline.com/termsofuse
Title: Terms of use
Title: Terms of use
Search URL Search Domain Scan URL
URL: https://login.microsoftonline.com/privacy
Title: Privacy & Cookies
Title: Privacy & Cookies
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
sdfjioxc.uk/newoffice/office/Sign_in/ |
15 KB 15 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login.css
sdfjioxc.uk/newoffice/office/Sign_in/filess/ |
21 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
heroillustration.jpg
sdfjioxc.uk/newoffice/office/Sign_in/filess/ |
199 KB 199 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bannerlogo.png
sdfjioxc.uk/newoffice/office/Sign_in/filess/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
microsoft_logo.png
sdfjioxc.uk/newoffice/office/Sign_in/filess/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Office 365 (Online)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| submitFunction0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
sdfjioxc.uk
217.61.123.203
317665a335f4cd7b5967cf94fec3041e074834b42eda55c9e095210656cec82b
50a268dd9f3ee0d19d94bdd9d26f1ee62a2d0923ba8e4264c8bd506bb5d491b8
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
988e349f2bf4e87154738c7b2c1fa86618713a8cfa0cef60a046f5add89bd9de
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603