login-microsoftonline.capitaln.org

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 185.70.104.54, located in Russian Federation and belongs to HOSTKEY-RU-AS, NL. The main domain is login-microsoftonline.capitaln.org.
TLS certificate: Issued by R3 on June 8th 2022. Valid for: 3 months.

This is the only time login-microsoftonline.capitaln.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	192.169.80.50 192.169.80.50	46475 (LIMESTONE...) (LIMESTONENETWORKS)
3	185.70.104.54 185.70.104.54	50867 (HOSTKEY-R...) (HOSTKEY-RU-AS)
6	3

1 192.169.80.50 (United States)

ASN46475 (LIMESTONENETWORKS, US)
PTR: host.sdserver8.com

roger.waltzman.ultramedicinadiagnostica.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.70.104.54 (Russian Federation)

ASN50867 (HOSTKEY-RU-AS, NL)

login-microsoftonline.capitaln.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	capitaln.org login-microsoftonline.capitaln.org aadcdn-msftauth-4eef4d4e.capitaln.org Failed login.capitaln.org Failed	190 KB
1	ultramedicinadiagnostica.com.br roger.waltzman.ultramedicinadiagnostica.com.br	7 KB
6	2

	Domain	Requested by
3	login-microsoftonline.capitaln.org	roger.waltzman.ultramedicinadiagnostica.com.br login-microsoftonline.capitaln.org
1	roger.waltzman.ultramedicinadiagnostica.com.br
0	login.capitaln.org Failed	login-microsoftonline.capitaln.org
0	aadcdn-msftauth-4eef4d4e.capitaln.org Failed	login-microsoftonline.capitaln.org
6	4

This site contains no links.

Subject Issuer	Validity	Valid
capitaln.org R3	`2022-06-08` - `2022-09-06`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://login-microsoftonline.capitaln.org/?username=roger.waltzman@mtem.com&sso_reload=true
Frame ID: 1947BEFEC65407622BD76BDE64AB9E20
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://roger.waltzman.ultramedicinadiagnostica.com.br/?=roger.waltzman@mtem.com?p_p_id=webcontentfilters_WAR_webcontentsearchportl... Page URL
https://login-microsoftonline.capitaln.org/?username=roger.waltzman@mtem.com Page URL
https://login-microsoftonline.capitaln.org/?username=roger.waltzman@mtem.com Page URL
https://login-microsoftonline.capitaln.org/?username=roger.waltzman@mtem.com&sso_reload=true Page URL

Page Statistics

6
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

4
Subdomains

3
IPs

2
Countries

197 kB
Transfer

707 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://roger.waltzman.ultramedicinadiagnostica.com.br/?=roger.waltzman@mtem.com?p_p_id=webcontentfilters_WAR_webcontentsearchportlet&p_p_lifecycle=1&p_p_state=normal&p_p_mode=view&_webcontentfilters_WAR_webcontentsearchportlet_filterRow_1741367_CATEGORIES=on Page URL
https://login-microsoftonline.capitaln.org/?username=roger.waltzman@mtem.com Page URL
https://login-microsoftonline.capitaln.org/?username=roger.waltzman@mtem.com Page URL
https://login-microsoftonline.capitaln.org/?username=roger.waltzman@mtem.com&sso_reload=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response roger.waltzman.ultramedicinadiagnostica.com.br/	7 KB 7 KB	580ms 160ms	Document text/html	192.169.80.50 LIMESTONENETWORKS
General Check archive.org Show headers Download Go to Full URL http://roger.waltzman.ultramedicinadiagnostica.com.br/?=roger.waltzman@mtem.com?p_p_id=webcontentfilters_WAR_webcontentsearchportlet&p_p_lifecycle=1&p_p_state=normal&p_p_mode=view&_webcontentfilters_WAR_webcontentsearchportlet_filterRow_1741367_CATEGORIES=on Protocol HTTP/1.1 Server 192.169.80.50 , United States, ASN46475 (LIMESTONENETWORKS, US), Reverse DNS host.sdserver8.com Software Apache / PHP/5.6.40 Resource Hash `d1a2f68b56d55d87e63bcb54b2fe219612c519e2009b0a4f4cdfbb1c6205e147` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Thu, 23 Jun 2022 01:06:13 GMT Keep-Alive timeout=2, max=100 Server Apache Transfer-Encoding chunked X-Powered-By PHP/5.6.40
GET H2	200	/ Show response login-microsoftonline.capitaln.org/	72 KB 25 KB	674ms 204ms	Document text/html	185.70.104.54 HOSTKEY-RU-AS
General Check archive.org Show headers Download Go to Full URL https://login-microsoftonline.capitaln.org/?username=roger.waltzman@mtem.com Requested by Host: roger.waltzman.ultramedicinadiagnostica.com.br URL: http://roger.waltzman.ultramedicinadiagnostica.com.br/?=roger.waltzman@mtem.com?p_p_id=webcontentfilters_WAR_webcontentsearchportlet&p_p_lifecycle=1&p_p_state=normal&p_p_mode=view&_webcontentfilters_WAR_webcontentsearchportlet_filterRow_1741367_CATEGORIES=on Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.70.104.54 , Russian Federation, ASN50867 (HOSTKEY-RU-AS, NL), Reverse DNS Software nginx/1.21.6 / Resource Hash `d09f4760886b7b1cd245468efe62a6e4cd91ac0d74a9e2df6d56a7014bcf4181` Request headers Referer http://roger.waltzman.ultramedicinadiagnostica.com.br/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-headers * access-control-allow-origin * content-encoding gzip content-type text/html; charset=utf-8 date Tue, 21 Jun 2022 01:33:59 GMT server nginx/1.21.6 vary Accept-Encoding
GET H2	200	/ Show response login-microsoftonline.capitaln.org/	289 KB 84 KB	980ms 979ms	Document text/html	185.70.104.54 HOSTKEY-RU-AS
General Check archive.org Show headers Download Go to Full URL https://login-microsoftonline.capitaln.org/?username=roger.waltzman@mtem.com Requested by Host: login-microsoftonline.capitaln.org URL: https://login-microsoftonline.capitaln.org/?username=roger.waltzman@mtem.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.70.104.54 , Russian Federation, ASN50867 (HOSTKEY-RU-AS, NL), Reverse DNS Software nginx/1.21.6 / Resource Hash `058bfc537ade37494e63667e2c5f05cc72b159547f1d6b5371914688f2cc3079` Request headers Referer https://login-microsoftonline.capitaln.org/?username=roger.waltzman@mtem.com Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-headers * access-control-allow-origin * cache-control no-store, no-cache content-encoding gzip content-type text/html; charset=utf-8 date Tue, 21 Jun 2022 01:34:01 GMT nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} p3p CP="DSP CUR OTPi IND OTRi ONL FIN" pragma no-cache referrer-policy strict-origin-when-cross-origin report-to {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity-nel-measure-office-4eef4d4e.capitaln.org/api/report?catId=GW+estsfd+dub2"}]} server nginx/1.21.6 vary Accept-Encoding Accept-Encoding x-ms-ests-server 2.1.13006.6 - WEULR2 ProdSlices x-ms-request-id 4b694ba5-14c2-430d-a20e-88c7e7130700
GET H2	200	Primary Request / Show response login-microsoftonline.capitaln.org/	337 KB 80 KB	1429ms 1428ms	Document text/html	185.70.104.54 HOSTKEY-RU-AS
General Check archive.org Show headers Download Go to Full URL https://login-microsoftonline.capitaln.org/?username=roger.waltzman@mtem.com&sso_reload=true Requested by Host: login-microsoftonline.capitaln.org URL: https://login-microsoftonline.capitaln.org/?username=roger.waltzman@mtem.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.70.104.54 , Russian Federation, ASN50867 (HOSTKEY-RU-AS, NL), Reverse DNS Software nginx/1.21.6 / Resource Hash `c533329d68d395bb3deadd7c734cbdd9fa39a8075525a78af68bb9388ae0993e` Request headers Referer https://login-microsoftonline.capitaln.org/?username=roger.waltzman@mtem.com Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-headers * access-control-allow-origin * cache-control no-store, no-cache content-encoding gzip content-type text/html; charset=utf-8 date Tue, 21 Jun 2022 01:34:02 GMT nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} p3p CP="DSP CUR OTPi IND OTRi ONL FIN" pragma no-cache referrer-policy strict-origin-when-cross-origin report-to {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity-nel-measure-office-4eef4d4e.capitaln.org/api/report?catId=GW+estsfd+dub2"}]} server nginx/1.21.6 vary Accept-Encoding Accept-Encoding x-ms-ests-server 2.1.12890.7 - WUS2 ProdSlices x-ms-request-id 00f6dfc4-2d8e-4825-8ead-f4fdb6c95900
GET		ConvergedLogin_PCore_UbUmcyGu3AmHaoehHvoQJA2.js aadcdn-msftauth-4eef4d4e.capitaln.org/shared/1.0/content/js/	0 0

GET		Me.htm login.capitaln.org/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: aadcdn-msftauth-4eef4d4e.capitaln.org
URL: https://aadcdn-msftauth-4eef4d4e.capitaln.org/shared/1.0/content/js/ConvergedLogin_PCore_UbUmcyGu3AmHaoehHvoQJA2.js

Domain: login.capitaln.org
URL: https://login.capitaln.org/Me.htm?v=3

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.capitaln.org/	1970-01-20 12:44:42	Name: __iun4 Value: NGVlZjRkNGUtOWUyMS00YTA3LTgxZmUtZTNlNjk4MjFkMWE0Ojc3YzliN2M3LWM1MTgtNDUzMS1iNTFjLWQ5NWU2ODY1YjAzYQ==
.login-microsoftonline.capitaln.org/	1969-12-31 23:59:59	Name: AADSSO Value: NA\|NoExtension
login-microsoftonline.capitaln.org/	1970-01-20 03:59:06	Name: SSOCOOKIEPULLED Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn-msftauth-4eef4d4e.capitaln.org
login-microsoftonline.capitaln.org
login.capitaln.org
roger.waltzman.ultramedicinadiagnostica.com.br
aadcdn-msftauth-4eef4d4e.capitaln.org
login.capitaln.org
185.70.104.54
192.169.80.50
058bfc537ade37494e63667e2c5f05cc72b159547f1d6b5371914688f2cc3079
c533329d68d395bb3deadd7c734cbdd9fa39a8075525a78af68bb9388ae0993e
d09f4760886b7b1cd245468efe62a6e4cd91ac0d74a9e2df6d56a7014bcf4181
d1a2f68b56d55d87e63bcb54b2fe219612c519e2009b0a4f4cdfbb1c6205e147

login-microsoftonline.capitaln.org Open in urlscan Pro 185.70.104.54 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

6 Requests

50 %HTTPS

0 %IPv6

2 Domains

4 Subdomains

3 IPs

2 Countries

197 kBTransfer

707 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

3 Cookies

Indicators

login-microsoftonline.capitaln.org Open in urlscan Pro
185.70.104.54 Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

4
Subdomains

3
IPs

2
Countries

197 kB
Transfer

707 kB
Size

3
Cookies

6 HTTP transactions
0 data transactions