www.launcestoneye.bid

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 104.27.147.21, located in San Francisco, United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is www.launcestoneye.bid.
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on May 25th 2018. Valid for: 6 months.

This is the only time www.launcestoneye.bid was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
4	104.27.147.21 104.27.147.21	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	2.19.41.58 2.19.41.58	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	2

4 104.27.147.21 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.launcestoneye.bid	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.19.41.58 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-19-41-58.deploy.static.akamaitechnologies.com

auth.gfx.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	launcestoneye.bid www.launcestoneye.bid	24 KB
2	gfx.ms auth.gfx.ms	293 KB
6	2

	Domain	Requested by
4	www.launcestoneye.bid	www.launcestoneye.bid
2	auth.gfx.ms	www.launcestoneye.bid
6	2

This site contains links to these domains. Also see Links.

Domain
account.live.com
login.live.com

Subject Issuer	Validity	Valid
sni69806.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2018-05-25` - `2018-12-01`	6 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.launcestoneye.bid/God/360/auth.php
Frame ID: BF4A9F630FAE254CF30C59296CE15368
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

Page Statistics

6
Requests

67 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

317 kB
Transfer

400 kB
Size

2
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.0%26rpsnv%3d13%26ct%3d1487839659%26rver%3d6.4.6456.0%26wp%3dMBI_SSL_SHARED%26wreply%3dhttps:%252F%252Fmail.live.com%252Fdefault.aspx%253Frru%253Dinbox%26lc%3d1033%26id%3d64855%26mkt%3den-us%26cbcxt%3dmai%26contextid%3dD14CC336F0098F23%26bk%3d1503963204&id=64855&uiflavor=web&cobrandid=140721366560808&uaid=f713b74fcfa54a14996b70cc1b69f5a6&mkt=EN-US&lc=1033&bk=1503963204
Title: Forgot my password

Search URL Search Domain Scan URL

URL: https://login.live.com/logout.srf?wa=wsignin1.0&rpsnv=13&ct=1487839659&rver=6.4.6456.0&wp=MBI_SSL_SHARED&wreply=https:%2F%2Fmail.live.com%2Fdefault.aspx%3Frru%3Dinbox&lc=1033&id=64855&mkt=en-us&cbcxt=mai&contextid=D14CC336F0098F23&ru=https://mail.live.com/default.aspx%3frru%3dinbox&bk=1503963204&lm=I
Title: Sign in with a different Microsoft account

Search URL Search Domain Scan URL

URL: https://login.live.com/gls.srf?urlID=WinLiveTermsOfUse&mkt=EN-US&vv=1600
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://login.live.com/gls.srf?urlID=MSNPrivacyStatement&mkt=EN-US&vv=1600
Title: Privacy & Cookies

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request auth.php Show response www.launcestoneye.bid/God/360/	19 KB 6 KB	210ms 188ms	Document text/html	104.27.147.21 Cloudflare
General Check archive.org Download Go to Full URL https://www.launcestoneye.bid/God/360/auth.php Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.27.147.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `cf09195bef2fe60448a8d698cbbbba98040d66a7e6f387425faba590172a93b3` Request headers :method GET :authority www.launcestoneye.bid :scheme https :path /God/360/auth.php pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 accept-encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 X-DevTools-Emulate-Network-Conditions-Client-Id BF4A9F630FAE254CF30C59296CE15368 Response headers status 200 date Thu, 31 May 2018 08:43:22 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=de98450d65fb6bf751462097eee661c171527756202; expires=Fri, 31-May-19 08:43:22 GMT; path=/; domain=.launcestoneye.bid; HttpOnly; Secure PHPSESSID=6l73rq46lq5ju99fjai7lo8jf3; path=/ expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma no-cache expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 4238270b7b382654-FRA content-encoding gzip
GET H2	200	Converged1033.css www.launcestoneye.bid/God/360/files/	85 KB 16 KB	12ms 11ms	Stylesheet text/css	104.27.147.21 Cloudflare
General Check archive.org Download Go to Full URL https://www.launcestoneye.bid/God/360/files/Converged1033.css Requested by Host: www.launcestoneye.bid URL: https://www.launcestoneye.bid/God/360/auth.php Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.27.147.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `0df34b37d2d23a2a5056ac368248444c36789c9f71b7e15c13e056b722f335ff` Request headers :path /God/360/files/Converged1033.css pragma no-cache cookie __cfduid=de98450d65fb6bf751462097eee661c171527756202; PHPSESSID=6l73rq46lq5ju99fjai7lo8jf3 accept-encoding gzip, deflate user-agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 accept text/css,/;q=0.1 cache-control no-cache :authority www.launcestoneye.bid referer https://www.launcestoneye.bid/God/360/auth.php :scheme https :method GET Referer https://www.launcestoneye.bid/God/360/auth.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Response headers date Thu, 31 May 2018 08:43:22 GMT content-encoding gzip cf-cache-status HIT last-modified Tue, 29 Aug 2017 02:33:54 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=14400 cf-ray 4238270cabcb2654-FRA expires Thu, 31 May 2018 12:43:22 GMT
GET H2	200	microsoft_logo.svg www.launcestoneye.bid/God/360/files/	4 KB 1 KB	16ms 16ms	Image image/svg+xml	104.27.147.21 Cloudflare
General Check archive.org Download Go to Show image Full URL https://www.launcestoneye.bid/God/360/files/microsoft_logo.svg Requested by Host: www.launcestoneye.bid URL: https://www.launcestoneye.bid/God/360/auth.php Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.27.147.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers :path /God/360/files/microsoft_logo.svg pragma no-cache cookie __cfduid=de98450d65fb6bf751462097eee661c171527756202; PHPSESSID=6l73rq46lq5ju99fjai7lo8jf3 accept-encoding gzip, deflate user-agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 accept image/webp,image/apng,image/,/;q=0.8 cache-control* no-cache :authority www.launcestoneye.bid referer https://www.launcestoneye.bid/God/360/auth.php :scheme https :method GET Referer https://www.launcestoneye.bid/God/360/auth.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Response headers date Thu, 31 May 2018 08:43:22 GMT content-encoding gzip cf-cache-status HIT last-modified Tue, 29 Aug 2017 02:33:54 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/svg+xml status 200 cache-control public, max-age=14400 cf-ray 4238270cabcc2654-FRA expires Thu, 31 May 2018 12:43:22 GMT
GET H2	200	picker_account_msa.svg www.launcestoneye.bid/God/360/files/	379 B 358 B	9ms 8ms	Image image/svg+xml	104.27.147.21 Cloudflare
General Check archive.org Download Go to Show image Full URL https://www.launcestoneye.bid/God/360/files/picker_account_msa.svg Requested by Host: www.launcestoneye.bid URL: https://www.launcestoneye.bid/God/360/auth.php Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.27.147.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `34d8da073f47030ee94b99d84fbe68e3345bd8aaa37ea909ff2da00238447486` Request headers :path /God/360/files/picker_account_msa.svg pragma no-cache cookie __cfduid=de98450d65fb6bf751462097eee661c171527756202; PHPSESSID=6l73rq46lq5ju99fjai7lo8jf3 accept-encoding gzip, deflate user-agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 accept image/webp,image/apng,image/,/;q=0.8 cache-control* no-cache :authority www.launcestoneye.bid referer https://www.launcestoneye.bid/God/360/auth.php :scheme https :method GET Referer https://www.launcestoneye.bid/God/360/auth.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Response headers date Thu, 31 May 2018 08:43:23 GMT content-encoding gzip cf-cache-status HIT last-modified Tue, 29 Aug 2017 02:33:54 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/svg+xml status 200 cache-control public, max-age=14400 cf-ray 4238270cbbd12654-FRA expires Thu, 31 May 2018 12:43:23 GMT
GET H/1.1	200 OK	0.jpg auth.gfx.ms/16.000.27497.00/images/Backgrounds/	291 KB 291 KB	7ms 7ms	Image image/jpeg	2.19.41.58 AKAMAI-ASN1
General Check archive.org Download Go to Show image Full URL https://auth.gfx.ms/16.000.27497.00/images/Backgrounds/0.jpg?x=f5a9a9531b8f4bcc86eabb19472d15d5 Requested by Host: www.launcestoneye.bid URL: https://www.launcestoneye.bid/God/360/auth.php Protocol HTTP/1.1 Server 2.19.41.58 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a2-19-41-58.deploy.static.akamaitechnologies.com Software Microsoft-IIS/8.5 / Resource Hash `62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214` Request headers Referer https://www.launcestoneye.bid/God/360/auth.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Response headers Date Thu, 31 May 2018 08:43:23 GMT Last-Modified Thu, 03 Aug 2017 17:45:25 GMT PPServer PPV: 30 H: BL2IDSPRTS1C004 V: 0 ETag "80285c4980cd31:0" Content-Type image/jpeg Access-Control-Allow-Origin * Cache-Control max-age=557203 Connection keep-alive Accept-Ranges bytes Content-Length 298105 Server Microsoft-IIS/8.5
GET H/1.1	200 OK	0-small.jpg auth.gfx.ms/16.000.27497.00/images/Backgrounds/	1 KB 1 KB	6ms 6ms	Image image/jpeg	2.19.41.58 AKAMAI-ASN1
General Check archive.org Download Go to Show image Full URL https://auth.gfx.ms/16.000.27497.00/images/Backgrounds/0-small.jpg?x=12f4b8b543125cc986c79cd85320812f Requested by Host: www.launcestoneye.bid URL: https://www.launcestoneye.bid/God/360/auth.php Protocol HTTP/1.1 Server 2.19.41.58 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a2-19-41-58.deploy.static.akamaitechnologies.com Software Microsoft-IIS/8.5 / Resource Hash `c13db279143e1845ee4aaee5afedc5bd75e9f7d50024b63883b45332c4960b3b` Request headers Referer https://www.launcestoneye.bid/God/360/auth.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Response headers Date Thu, 31 May 2018 08:43:23 GMT Last-Modified Thu, 03 Aug 2017 17:45:24 GMT PPServer PPV: 30 H: BL2IDSPRTS1A003 V: 0 ETag "092c34880cd31:0" Content-Type image/jpeg Access-Control-Allow-Origin * Cache-Control max-age=269337 Connection keep-alive Accept-Ranges bytes Content-Length 1029 Server Microsoft-IIS/8.5

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.launcestoneye.bid/	1969-12-31 23:59:59	Name: PHPSESSID Value: 6l73rq46lq5ju99fjai7lo8jf3
			.launcestoneye.bid/	1970-01-19 01:08:12	Name: __cfduid Value: de98450d65fb6bf751462097eee661c171527756202

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

auth.gfx.ms
www.launcestoneye.bid
104.27.147.21
2.19.41.58
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0df34b37d2d23a2a5056ac368248444c36789c9f71b7e15c13e056b722f335ff
34d8da073f47030ee94b99d84fbe68e3345bd8aaa37ea909ff2da00238447486
62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214
c13db279143e1845ee4aaee5afedc5bd75e9f7d50024b63883b45332c4960b3b
cf09195bef2fe60448a8d698cbbbba98040d66a7e6f387425faba590172a93b3

www.launcestoneye.bid Open in urlscan Pro 104.27.147.21 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

6 Requests

67 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

317 kBTransfer

400 kBSize

2 Cookies

4 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

2 Cookies

Indicators

www.launcestoneye.bid Open in urlscan Pro
104.27.147.21 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

67 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

317 kB
Transfer

400 kB
Size

2
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!