broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev Open in urlscan Pro
2606:4700:3034::6815:eca Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://t5o8ymxdug.3271.muratgokce.com.tr/.T5o8yMXduG.aHR0cHM6Ly9ibG9nLW94LmNvbS93cC8vVDVvOHlNWGR1Ry80ODEwMzU2OTIva2FpLmhhdmVrb3N0LyNrYWku...
Effective URL:
https://broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev/
Submission: On November 23 via automatic, source openphish (November 23rd 2021, 5:32:38 am UTC) — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 4 countries across 7 domains to perform 10 HTTP transactions. The main IP is 2606:4700:3034::6815:eca, located in United States and belongs to CLOUDFLARENET, US. The main domain is broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on November 21st 2021. Valid for: a year.

This is the only time broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	94.199.200.74 94.199.200.74	42807 (AEROTEK-AS) (AEROTEK-AS)
1 2	198.54.116.113 198.54.116.113	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1	2606:4700:303... 2606:4700:3034::6815:eca	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2620:1ec:46::60 2620:1ec:46::60	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:3b	20446 (HIGHWINDS3) (HIGHWINDS3)
1	3.232.242.170 3.232.242.170	14618 (AMAZON-AES) (AMAZON-AES)
1	109.169.71.112 109.169.71.112	20860 (IOMART-AS) (IOMART-AS)
10	7

1 94.199.200.74 (Istanbul, Turkey)

ASN42807 (AEROTEK-AS, TR)
PTR: srvc70.turhost.com

t5o8ymxdug.3271.muratgokce.com.tr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 198.54.116.113 (United States) 1 redirects

ASN22612 (NAMECHEAP-NET, US)
PTR: server231-4.web-hosting.com

blog-ox.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3034::6815:eca (United States)

ASN13335 (CLOUDFLARENET, US)

broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:46::60 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:3b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.232.242.170 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-232-242-170.compute-1.amazonaws.com

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 109.169.71.112 (Catterick, United Kingdom)

ASN20860 (IOMART-AS, GB)

smtpjs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	msauth.net aadcdn.msauth.net	4 KB
2	blog-ox.com 1 redirects blog-ox.com	1 KB
1	smtpjs.com smtpjs.com	1 KB
1	ipify.org api.ipify.org	218 B
1	jquery.com code.jquery.com	30 KB
1	workers.dev broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev	20 KB
1	muratgokce.com.tr t5o8ymxdug.3271.muratgokce.com.tr	523 B
10	7

	Domain	Requested by
4	aadcdn.msauth.net	broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev
2	blog-ox.com	1 redirects t5o8ymxdug.3271.muratgokce.com.tr
1	smtpjs.com	broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev
1	api.ipify.org	broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev
1	code.jquery.com	broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev
1	broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev	blog-ox.com
1	t5o8ymxdug.3271.muratgokce.com.tr
10	7

This site contains no links.

Subject Issuer	Validity	Valid
blog-ox.com Sectigo RSA Domain Validation Secure Server CA	`2021-01-20` - `2022-01-23`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-11-21` - `2022-11-20`	a year	crt.sh
aadcdn.msauth.net DigiCert SHA2 Secure Server CA	`2021-07-08` - `2022-07-08`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
*.ipify.org Sectigo RSA Domain Validation Secure Server CA	`2021-01-19` - `2022-02-19`	a year	crt.sh
smtpjs.com R3	`2021-11-20` - `2022-02-18`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev/
Frame ID: 0FA5CEB2B9BA64F133238E03DC3894BE
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your Microsoft account

Page URL History Show full URLs

http://t5o8ymxdug.3271.muratgokce.com.tr/.T5o8yMXduG.aHR0cHM6Ly9ibG9nLW94LmNvbS93cC8vVDVvOHlNWGR1Ry80ODEwMzU2OTIva2Fp... Page URL
https://blog-ox.com/wp//T5o8yMXduG/481035692/kai.havekost/ HTTP 301
https://blog-ox.com/wp/T5o8yMXduG/481035692/kai.havekost/ Page URL
https://broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev/ Page URL

Page Statistics

10
Requests

90 %
HTTPS

43 %
IPv6

7
Domains

7
Subdomains

7
IPs

4
Countries

56 kB
Transfer

197 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://t5o8ymxdug.3271.muratgokce.com.tr/.T5o8yMXduG.aHR0cHM6Ly9ibG9nLW94LmNvbS93cC8vVDVvOHlNWGR1Ry80ODEwMzU2OTIva2FpLmhhdmVrb3N0LyNrYWkuaGF2ZWtvc3RAb3R0b2dyb3VwLmNvbQ== Page URL
https://blog-ox.com/wp//T5o8yMXduG/481035692/kai.havekost/ HTTP 301
https://blog-ox.com/wp/T5o8yMXduG/481035692/kai.havekost/ Page URL
https://broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://blog-ox.com/wp//T5o8yMXduG/481035692/kai.havekost/ HTTP 301
https://blog-ox.com/wp/T5o8yMXduG/481035692/kai.havekost/

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	.T5o8yMXduG.aHR0cHM6Ly9ibG9nLW94LmNvbS93cC8vVDVvOHlNWGR1Ry80ODEwMzU2OTIva2FpLmhhdmVrb3N0LyNrYWkuaGF2ZWtvc3RAb3R0b2dyb3VwLmNvbQ== t5o8ymxdug.3271.muratgokce.com.tr/	661 B 523 B	138ms 89ms	Document text/html	94.199.200.74 AEROTEK-AS
General Check archive.org Show headers Download Go to Full URL http://t5o8ymxdug.3271.muratgokce.com.tr/.T5o8yMXduG.aHR0cHM6Ly9ibG9nLW94LmNvbS93cC8vVDVvOHlNWGR1Ry80ODEwMzU2OTIva2FpLmhhdmVrb3N0LyNrYWkuaGF2ZWtvc3RAb3R0b2dyb3VwLmNvbQ== Protocol HTTP/1.1 Server 94.199.200.74 Istanbul, Turkey, ASN42807 (AEROTEK-AS, TR), Reverse DNS srvc70.turhost.com Software / PHP/7.0.33 Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Connection Keep-Alive Keep-Alive timeout=5, max=100 x-powered-by PHP/7.0.33 content-type text/html; charset=UTF-8 content-length 277 content-encoding gzip vary Accept-Encoding date Tue, 23 Nov 2021 05:32:32 GMT
GET H2	404	/ blog-ox.com/wp/T5o8yMXduG/481035692/kai.havekost/ Redirect Chain https://blog-ox.com/wp//T5o8yMXduG/481035692/kai.havekost/ https://blog-ox.com/wp/T5o8yMXduG/481035692/kai.havekost/	740 B 688 B	158ms 156ms	Document text/html	198.54.116.113 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://blog-ox.com/wp/T5o8yMXduG/481035692/kai.havekost/ Requested by Host: t5o8ymxdug.3271.muratgokce.com.tr URL: http://t5o8ymxdug.3271.muratgokce.com.tr/.T5o8yMXduG.aHR0cHM6Ly9ibG9nLW94LmNvbS93cC8vVDVvOHlNWGR1Ry80ODEwMzU2OTIva2FpLmhhdmVrb3N0LyNrYWkuaGF2ZWtvc3RAb3R0b2dyb3VwLmNvbQ== Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.116.113 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server231-4.web-hosting.com Software LiteSpeed / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer http://t5o8ymxdug.3271.muratgokce.com.tr/.T5o8yMXduG.aHR0cHM6Ly9ibG9nLW94LmNvbS93cC8vVDVvOHlNWGR1Ry80ODEwMzU2OTIva2FpLmhhdmVrb3N0LyNrYWkuaGF2ZWtvc3RAb3R0b2dyb3VwLmNvbQ== Response headers content-type text/html; charset=UTF-8 expires Wed, 11 Jan 1984 05:00:00 GMT cache-control no-cache, must-revalidate, max-age=0 link <https://blog-ox.com/wp/wp-json/>; rel="https://api.w.org/" x-litespeed-cache hit content-encoding br vary Accept-Encoding date Tue, 23 Nov 2021 05:32:33 GMT server LiteSpeed x-turbo-charged-by LiteSpeed Redirect headers content-type text/html; charset=UTF-8 expires Wed, 11 Jan 1984 05:00:00 GMT cache-control no-cache, must-revalidate, max-age=0 x-litespeed-tag c21_HTTP.404,c21_HTTP.301 x-redirect-by WordPress location https://blog-ox.com/wp/T5o8yMXduG/481035692/kai.havekost/ x-litespeed-cache-control no-cache content-length 0 date Tue, 23 Nov 2021 05:32:33 GMT server LiteSpeed x-turbo-charged-by LiteSpeed
GET H2	200	Primary Request / Show response broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev/	107 KB 20 KB	48ms 15ms	Document text/html	2606:4700:3034::6815:eca CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev/ Requested by Host: blog-ox.com URL: https://blog-ox.com/wp/T5o8yMXduG/481035692/kai.havekost/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::6815:eca , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `645a7eb701a5a2c18e30fba4c82e12e2596df6b9f2c4ce75319343c4e0fad5b5` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://blog-ox.com/ Response headers date Tue, 23 Nov 2021 05:32:33 GMT content-type text/html expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Zql3mWaG9uukispMDQEtVA4TwjTyYuBsnAOWl%2F%2Bs%2F%2BO805D0XRcqRhaccaPB00GV42XfW%2B1SMLj1IgQeK%2BNIcsj6XbTL7NCKdqP85d0kiF4OIb16iTdHhU27SHTaCqk%2Fj56eMXav3OVhNJq9IzkCVOz8umfebTwCFhVRbdU1oCY%2BuCbGGs9Fv7tjuz6POQBsMRU36DaSuSw3u5PPglGKb81yTCG2frPp7W7EEA05Sp32DButLdrYX3m5"}],"group":"cf-nel","max_age":604800} nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} vary Accept-Encoding server cloudflare cf-ray 6b28048798366909-FRA content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	microsoft_logo_ed9c9eb0dce17d752bedea6b5acda6d9.png aadcdn.msauth.net/ests/2.1/content/images/	1 KB 2 KB	32ms 9ms	Image image/png	2620:1ec:46::60 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/ests/2.1/content/images/microsoft_logo_ed9c9eb0dce17d752bedea6b5acda6d9.png Requested by Host: broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev URL: https://broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:46::60 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c` Request headers Accept-Language de-DE,de;q=0.9 Referer https://broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 23 Nov 2021 05:32:33 GMT x-azure-ref-originshield 0hF2cYQAAAACW5IH3HMKJSp+JT1XUDFPvQU1TMDRFREdFMTgxMQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-md5 7ZyesNzhfXUr7eprWs2m2Q== x-cache TCP_HIT content-length 1057 x-ms-lease-status unlocked last-modified Fri, 02 Nov 2018 20:25:31 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D641015620C409 x-azure-ref 08XycYQAAAACPBw5lMWP6TYECRM9N2Hf+RlJBRURHRTEwMTQAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2 content-type image/png access-control-allow-origin * x-ms-request-id 9381fed1-501e-0066-193b-df8f5d000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=604800 x-ms-version 2009-09-19
GET H2	200	arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png aadcdn.msauth.net/ests/2.1/content/images/	240 B 540 B	33ms 10ms	Image image/png	2620:1ec:46::60 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/ests/2.1/content/images/arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png Requested by Host: broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev URL: https://broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:46::60 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `ab50358475adae73a435466c72d1a48ab124e8ae06614663716a46dce5ac8b83` Request headers Accept-Language de-DE,de;q=0.9 Referer https://broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 23 Nov 2021 05:32:33 GMT x-azure-ref-originshield 0iU6cYQAAAACzCKsWW+XyT6MpKR3SH3JkQU1TMDRFREdFMTkwOQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-md5 fMCW2mqi26P4H8wcgmIVfA== x-cache TCP_HIT content-length 240 x-ms-lease-status unlocked last-modified Fri, 02 Nov 2018 20:25:10 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D64101494D74DC x-azure-ref 08XycYQAAAAB8dtOezgkLSapw1lSD07lZRlJBRURHRTEwMTQAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2 content-type image/png access-control-allow-origin * x-ms-request-id abbcf94c-d01e-0092-62a2-df8600000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=604800 x-ms-version 2009-09-19
GET H2	200	ellipsis_white_0ad43084800fd8b50a2576b5173746fe.png aadcdn.msauth.net/ests/2.1/content/images/	207 B 507 B	28ms 10ms	Image image/png	2620:1ec:46::60 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/ests/2.1/content/images/ellipsis_white_0ad43084800fd8b50a2576b5173746fe.png Requested by Host: broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev URL: https://broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:46::60 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `2c03ee38a4eba6a047c3a5bacb3eb461efe14be8acd46ae772350a4dea2f0175` Request headers Accept-Language de-DE,de;q=0.9 Referer https://broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 23 Nov 2021 05:32:33 GMT x-azure-ref-originshield 0iU6cYQAAAACYQVn5BaQiSL5YSReozbwLQU1TMDRFREdFMTkxNAAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-md5 CtQwhIAP2LUKJXa1FzdG/g== x-cache TCP_HIT content-length 207 x-ms-lease-status unlocked last-modified Fri, 02 Nov 2018 20:25:24 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D6410151EBB082 x-azure-ref 08XycYQAAAADKseT7QrU3SaCKZ6qrEQB2RlJBRURHRTEwMTQAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2 content-type image/png access-control-allow-origin * x-ms-request-id 45ac0845-201e-0045-52bf-df6368000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=604800 x-ms-version 2009-09-19
GET H2	200	jquery-3.1.1.min.js Show response code.jquery.com/	85 KB 30 KB	81ms 27ms	Script application/javascript	2001:4de0:ac18::1:a:3b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.1.1.min.js Requested by Host: broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev URL: https://broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash `85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf` Request headers Accept-Language de-DE,de;q=0.9 Referer https://broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 23 Nov 2021 05:32:33 GMT content-encoding gzip last-modified Thu, 22 Sep 2016 22:32:34 GMT server nginx etag W/"57e45c02-152b5" vary Accept-Encoding x-hw 1637645553.dop019.ml1.t,1637645553.cds202.ml1.hn,1637645553.cds204.ml1.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30070
GET H/1.1	200 OK	/ Show response api.ipify.org/	34 B 218 B	305ms 93ms	Script application/javascript	3.232.242.170 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.ipify.org/?format=jsonp&callback=getPublic Requested by Host: broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev URL: https://broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.232.242.170 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-232-242-170.compute-1.amazonaws.com Software Cowboy / Resource Hash `785b420f2025c47b3dec54733994945749c28396afa4561c235da6b8d5e69c32` Request headers Accept-Language de-DE,de;q=0.9 Referer https://broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Tue, 23 Nov 2021 05:32:34 GMT Via 1.1 vegur Server Cowboy Connection keep-alive Content-Length 34 Vary Origin Content-Type application/javascript
GET H2	200	smtp.js Show response smtpjs.com/v3/	871 B 1 KB	68ms 19ms	Script application/javascript	109.169.71.112 IOMART-AS
General Check archive.org Show headers Download Go to Full URL https://smtpjs.com/v3/smtp.js Requested by Host: broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev URL: https://broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 109.169.71.112 Catterick, United Kingdom, ASN20860 (IOMART-AS, GB), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776` Request headers Accept-Language de-DE,de;q=0.9 Referer https://broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Tue, 23 Nov 2021 05:32:33 GMT last-modified Tue, 10 Nov 2020 17:17:51 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET etag "162f436b85b7d61:0" content-type application/javascript access-control-allow-origin * accept-ranges bytes content-length 871
GET H2	200	2_bc3d32a696895f78c19df6c717586a5d.svg aadcdn.msauth.net/ests/2.1/content/images/backgrounds/	2 KB 1 KB	28ms 11ms	Image image/svg+xml	2620:1ec:46::60 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/ests/2.1/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg Requested by Host: broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev URL: https://broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:46::60 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68` Request headers Accept-Language de-DE,de;q=0.9 Referer https://broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 23 Nov 2021 05:32:33 GMT content-encoding gzip x-azure-ref-originshield 0U2WcYQAAAAC54yKPpVUPQI/Rf++W1S6UQU1TMDRFREdFMTgxNwAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-md5 DhdidjYrlCeaRJJRG/y9mA== x-cache TCP_HIT content-length 673 x-ms-lease-status unlocked last-modified Thu, 13 Feb 2020 02:05:12 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D7B0292911C366 x-azure-ref 08XycYQAAAADxh+Bbs3xESbcap4bVhqjxRlJBRURHRTEwMTQAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2 content-type image/svg+xml access-control-allow-origin * x-ms-request-id c55a6cf8-101e-0072-3eb0-df9377000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://blog-ox.com/wp/T5o8yMXduG/481035692/kai.havekost/#kai.havekost@ottogroup.com#undefined Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
api.ipify.org
blog-ox.com
broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev
code.jquery.com
smtpjs.com
t5o8ymxdug.3271.muratgokce.com.tr
109.169.71.112
198.54.116.113
2001:4de0:ac18::1:a:3b
2606:4700:3034::6815:eca
2620:1ec:46::60
3.232.242.170
94.199.200.74
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776
2c03ee38a4eba6a047c3a5bacb3eb461efe14be8acd46ae772350a4dea2f0175
645a7eb701a5a2c18e30fba4c82e12e2596df6b9f2c4ce75319343c4e0fad5b5
785b420f2025c47b3dec54733994945749c28396afa4561c235da6b8d5e69c32
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
ab50358475adae73a435466c72d1a48ab124e8ae06614663716a46dce5ac8b83
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev Open in urlscan Pro 2606:4700:3034::6815:eca Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

10 Requests

90 %HTTPS

43 %IPv6

7 Domains

7 Subdomains

7 IPs

4 Countries

56 kBTransfer

197 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

broad-unit-f03e.office365-microsoft-security-homeservice-protection-information.workers.dev Open in urlscan Pro
2606:4700:3034::6815:eca Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

90 %
HTTPS

43 %
IPv6

7
Domains

7
Subdomains

7
IPs

4
Countries

56 kB
Transfer

197 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!