![](/screenshots/353adf7f-31d3-4347-8437-ef717658c826.png)
d3f0y65hjjnb5a.cloudfront.net
Open in
urlscan Pro
108.138.34.103
Malicious Activity!
Public Scan
Submission: On June 20 via api from US — Scanned from DE
Summary
TLS certificate: Issued by Amazon RSA 2048 M01 on October 10th 2023. Valid for: a year.
This is the only time d3f0y65hjjnb5a.cloudfront.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 108.138.34.103 108.138.34.103 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:303... 2606:4700:3037::ac43:8ef5 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a02:6ea0:c70... 2a02:6ea0:c700::22 | 60068 (CDN77 _) (CDN77 _) | |
1 | 2620:1ec:29:1... 2620:1ec:29:1::45 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
7 | 6 |
ASN16509 (AMAZON-02, US)
PTR: server-108-138-34-103.muc50.r.cloudfront.net
d3f0y65hjjnb5a.cloudfront.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 268 |
65 KB |
1 |
msauth.net
aadcdn.msauth.net — Cisco Umbrella Rank: 1015 |
1 KB |
1 |
icons8.com
maxcdn.icons8.com — Cisco Umbrella Rank: 120245 |
7 KB |
1 |
fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 1381 |
13 KB |
1 |
cloudfront.net
d3f0y65hjjnb5a.cloudfront.net |
8 KB |
7 | 5 |
Domain | Requested by | |
---|---|---|
3 | cdnjs.cloudflare.com |
d3f0y65hjjnb5a.cloudfront.net
|
1 | aadcdn.msauth.net |
d3f0y65hjjnb5a.cloudfront.net
|
1 | maxcdn.icons8.com |
d3f0y65hjjnb5a.cloudfront.net
|
1 | use.fontawesome.com |
d3f0y65hjjnb5a.cloudfront.net
|
1 | d3f0y65hjjnb5a.cloudfront.net | |
7 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
account.microsoft.com |
privacy.microsoft.com |
www.microsoft.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.cloudfront.net Amazon RSA 2048 M01 |
2023-10-10 - 2024-09-19 |
a year | crt.sh |
cdnjs.cloudflare.com E1 |
2024-06-02 - 2024-08-31 |
3 months | crt.sh |
use.fontawesome.com Cloudflare Inc ECC CA-3 |
2023-10-12 - 2024-10-10 |
a year | crt.sh |
1220595937.rsc.cdn77.org R3 |
2024-05-15 - 2024-08-13 |
3 months | crt.sh |
aadcdn.msauth.net DigiCert SHA2 Secure Server CA |
2024-04-30 - 2025-04-30 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://d3f0y65hjjnb5a.cloudfront.net/?rid=bK8Nh0n
Frame ID: BDFCB132B71B1F18C7D02A30127D2B23
Requests: 8 HTTP requests in this frame
Screenshot
![](/screenshots/353adf7f-31d3-4347-8437-ef717658c826.png)
Page Title
Sign in to your Microsoft accountDetected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: Create one!
Search URL Search Domain Scan URL
Title: Privacy & cookies
Search URL Search Domain Scan URL
Title: Terms of use
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
d3f0y65hjjnb5a.cloudfront.net/ |
13 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.css
cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.5.0/css/ |
157 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.css
use.fontawesome.com/releases/v5.12.0/css/ |
56 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
line-awesome.min.css
maxcdn.icons8.com/fonts/line-awesome/1.1/css/ |
27 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/ |
87 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.bundle.min.js
cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.5.0/js/ |
79 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2_bc3d32a696895f78c19df6c717586a5d.svg
aadcdn.msauth.net/shared/1.0/content/images/backgrounds/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage function| $ function| jQuery object| bootstrap0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msauth.net
cdnjs.cloudflare.com
d3f0y65hjjnb5a.cloudfront.net
maxcdn.icons8.com
use.fontawesome.com
104.17.24.14
108.138.34.103
2606:4700:3037::ac43:8ef5
2620:1ec:29:1::45
2a02:6ea0:c700::22
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
1e8638f605575bd335d49efa95e165adf7ef06dda8e367661ac2517a0a3a96b4
5edf297381b409d711bc8d27676951a59e151e783412850332519c05243d1e24
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c
c70940d2d7189accb410e734f4e5e5bd4191d3e418db6939e76a9e7a01e471e1
c9b46437d7418e1712daaad6d73fa17c2c6afb5681770c90339c25428415b7fd
de1f23b347cbb29018dd4ab9f47dc606ae9ec24b54fedfce56c077fe3361aed7
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d