microsoft.za.com Open in urlscan Pro
157.173.209.36  Malicious Activity! Public Scan

Submitted URL: https://microsoft.za.com/
Effective URL: https://microsoft.za.com/login.html
Submission Tags: @ecarlesi threat phishing Search All
Submission: On December 02 via api from IT — Scanned from GB

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 14 HTTP transactions. The main IP is 157.173.209.36, located in United Kingdom and belongs to AS-HOSTINGER Hostinger International Limited, CY. The main domain is microsoft.za.com.
TLS certificate: Issued by WR1 on December 2nd 2024. Valid for: 3 months.
This is the only time microsoft.za.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 10 157.173.209.36 47583 (AS-HOSTIN...)
14 2
Apex Domain
Subdomains
Transfer
10 za.com
microsoft.za.com
131 KB
0 gfx.ms Failed
auth.gfx.ms Failed
0 live.com Failed
msagfx.live.com Failed
14 3
Domain Requested by
10 microsoft.za.com 1 redirects microsoft.za.com
0 auth.gfx.ms Failed microsoft.za.com
0 msagfx.live.com Failed microsoft.za.com
14 3

This site contains links to these domains. Also see Links.

Domain
account.live.com
login.live.com
Subject Issuer Validity Valid
microsoft.za.com
WR1
2024-12-02 -
2025-03-02
3 months crt.sh

This page contains 1 frames:

Primary Page: https://microsoft.za.com/login.html
Frame ID: F011AA61A266C080BEEE55839F949721
Requests: 14 HTTP requests in this frame

Screenshot

Page Title

Sign in to your Microsoft account

Page URL History Show full URLs

  1. https://microsoft.za.com/ HTTP 302
    https://microsoft.za.com/login.html Page URL

Page Statistics

14
Requests

64 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

130 kB
Transfer

967 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://microsoft.za.com/ HTTP 302
    https://microsoft.za.com/login.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login.html
microsoft.za.com/
Redirect Chain
  • https://microsoft.za.com/
  • https://microsoft.za.com/login.html
33 KB
10 KB
Document
General
Full URL
https://microsoft.za.com/login.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
157.173.209.36 , United Kingdom, ASN47583 (AS-HOSTINGER Hostinger International Limited, CY),
Reverse DNS
Software
LiteSpeed /
Resource Hash
2da5776a64879295f337a1e5e4c61aeb262952d0b8f68a83aff70bf3fce780d6
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
content-encoding
br
content-length
9957
content-security-policy
upgrade-insecure-requests
content-type
text/html
date
Mon, 02 Dec 2024 04:54:22 GMT
etag
"85f7-674d30a8-a736c0ac3bf5fb56;br"
last-modified
Mon, 02 Dec 2024 03:59:36 GMT
panel
hpanel
platform
hostinger
server
LiteSpeed
vary
Accept-Encoding

Redirect headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control
no-cache, no-store, must-revalidate, max-age=0
content-length
0
content-security-policy
upgrade-insecure-requests
content-type
text/html; charset=UTF-8
date
Mon, 02 Dec 2024 04:54:21 GMT
location
login.html
panel
hpanel
platform
hostinger
server
LiteSpeed
x-powered-by
PHP/8.2.19
Converged_v21033.css
microsoft.za.com/index_files/
92 KB
15 KB
Stylesheet
General
Full URL
https://microsoft.za.com/index_files/Converged_v21033.css
Requested by
Host: microsoft.za.com
URL: https://microsoft.za.com/login.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
157.173.209.36 , United Kingdom, ASN47583 (AS-HOSTINGER Hostinger International Limited, CY),
Reverse DNS
Software
LiteSpeed /
Resource Hash
4e9e7c1c2df9e91cf271a7afe529360d199cdff23a721473062ee1ebabd6821f
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://microsoft.za.com/login.html

Response headers

panel
hpanel
content-security-policy
upgrade-insecure-requests
cache-control
public, max-age=604800
content-encoding
br
etag
"16e63-674d30a8-1a585c08fdef52cd;br"
expires
Mon, 09 Dec 2024 04:54:22 GMT
accept-ranges
bytes
content-length
14984
date
Mon, 02 Dec 2024 04:54:22 GMT
content-type
text/css
last-modified
Mon, 02 Dec 2024 03:59:36 GMT
vary
Accept-Encoding
server
LiteSpeed
platform
hostinger
ConvergedLoginPaginatedStrings.EN.js
microsoft.za.com/index_files/
0
0
Script
General
Full URL
https://microsoft.za.com/index_files/ConvergedLoginPaginatedStrings.EN.js
Requested by
Host: microsoft.za.com
URL: https://microsoft.za.com/login.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
157.173.209.36 , United Kingdom, ASN47583 (AS-HOSTINGER Hostinger International Limited, CY),
Reverse DNS
Software
LiteSpeed /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://microsoft.za.com/login.html

Response headers

panel
hpanel
content-encoding
br
etag
"999-63beabb4-f2ac67ad7e640253;br"
accept-ranges
bytes
content-length
912
date
Mon, 02 Dec 2024 04:54:22 GMT
content-type
text/html
last-modified
Wed, 11 Jan 2023 12:29:40 GMT
vary
Accept-Encoding
server
LiteSpeed
platform
hostinger
ConvergedLogin_PCore.js
microsoft.za.com/index_files/
418 KB
104 KB
Script
General
Full URL
https://microsoft.za.com/index_files/ConvergedLogin_PCore.js
Requested by
Host: microsoft.za.com
URL: https://microsoft.za.com/login.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
157.173.209.36 , United Kingdom, ASN47583 (AS-HOSTINGER Hostinger International Limited, CY),
Reverse DNS
Software
LiteSpeed /
Resource Hash
db255a3725ebe9511b9f4bc95d906b8ea2d1bc8d37ed799efa8cadb5ca6b6206
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://microsoft.za.com/login.html

Response headers

panel
hpanel
content-security-policy
upgrade-insecure-requests
cache-control
public, max-age=604800
content-encoding
br
etag
"688ac-674d30a8-a79312261896a569;br"
expires
Mon, 09 Dec 2024 04:54:22 GMT
accept-ranges
bytes
content-length
106253
date
Mon, 02 Dec 2024 04:54:22 GMT
content-type
application/x-javascript
last-modified
Mon, 02 Dec 2024 03:59:36 GMT
vary
Accept-Encoding
server
LiteSpeed
platform
hostinger
microsoft_logo.svg
microsoft.za.com/index_files/
4 KB
1 KB
Image
General
Full URL
https://microsoft.za.com/index_files/microsoft_logo.svg
Requested by
Host: microsoft.za.com
URL: https://microsoft.za.com/login.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
157.173.209.36 , United Kingdom, ASN47583 (AS-HOSTINGER Hostinger International Limited, CY),
Reverse DNS
Software
LiteSpeed /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://microsoft.za.com/login.html

Response headers

panel
hpanel
content-security-policy
upgrade-insecure-requests
cache-control
public, max-age=604800
content-encoding
br
etag
"e43-674d30a8-5565ec25b3435b64;br"
expires
Mon, 09 Dec 2024 04:54:22 GMT
accept-ranges
bytes
content-length
1361
date
Mon, 02 Dec 2024 04:54:22 GMT
content-type
image/svg+xml
last-modified
Mon, 02 Dec 2024 03:59:36 GMT
vary
Accept-Encoding
server
LiteSpeed
platform
hostinger
ellipsis_white.svg
microsoft.za.com/index_files/
915 B
284 B
Image
General
Full URL
https://microsoft.za.com/index_files/ellipsis_white.svg
Requested by
Host: microsoft.za.com
URL: https://microsoft.za.com/login.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
157.173.209.36 , United Kingdom, ASN47583 (AS-HOSTINGER Hostinger International Limited, CY),
Reverse DNS
Software
LiteSpeed /
Resource Hash
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://microsoft.za.com/login.html

Response headers

panel
hpanel
content-security-policy
upgrade-insecure-requests
cache-control
public, max-age=604800
content-encoding
br
etag
"393-674d30a8-75627fadd5e2acfc;br"
expires
Mon, 09 Dec 2024 04:54:22 GMT
accept-ranges
bytes
content-length
221
date
Mon, 02 Dec 2024 04:54:22 GMT
content-type
image/svg+xml
last-modified
Mon, 02 Dec 2024 03:59:36 GMT
vary
Accept-Encoding
server
LiteSpeed
platform
hostinger
ellipsis_grey.svg
microsoft.za.com/index_files/
915 B
287 B
Image
General
Full URL
https://microsoft.za.com/index_files/ellipsis_grey.svg
Requested by
Host: microsoft.za.com
URL: https://microsoft.za.com/login.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
157.173.209.36 , United Kingdom, ASN47583 (AS-HOSTINGER Hostinger International Limited, CY),
Reverse DNS
Software
LiteSpeed /
Resource Hash
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://microsoft.za.com/login.html

Response headers

panel
hpanel
content-security-policy
upgrade-insecure-requests
cache-control
public, max-age=604800
content-encoding
br
etag
"393-674d30a8-70e277916e3b81f2;br"
expires
Mon, 09 Dec 2024 04:54:22 GMT
accept-ranges
bytes
content-length
224
date
Mon, 02 Dec 2024 04:54:22 GMT
content-type
image/svg+xml
last-modified
Mon, 02 Dec 2024 03:59:36 GMT
vary
Accept-Encoding
server
LiteSpeed
platform
hostinger
ConvergedLoginPaginatedStrings.EN.js
msagfx.live.com/16.000.27773.2/
0
0

ConvergedLogin_PCore.js
msagfx.live.com/16.000.27773.2/
0
0

ConvergedLoginPaginatedStrings.EN.js
microsoft.za.com/index_files/
0
0
Script
General
Full URL
https://microsoft.za.com/index_files/ConvergedLoginPaginatedStrings.EN.js
Requested by
Host: microsoft.za.com
URL: https://microsoft.za.com/login.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
157.173.209.36 , United Kingdom, ASN47583 (AS-HOSTINGER Hostinger International Limited, CY),
Reverse DNS
Software
LiteSpeed /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://microsoft.za.com/login.html

Response headers

panel
hpanel
content-encoding
br
etag
"999-63beabb4-f2ac67ad7e640253;br"
accept-ranges
bytes
content-length
912
date
Mon, 02 Dec 2024 04:54:23 GMT
content-type
text/html
last-modified
Wed, 11 Jan 2023 12:29:40 GMT
vary
Accept-Encoding
server
LiteSpeed
platform
hostinger
ConvergedLogin_PCore.js
microsoft.za.com/index_files/
418 KB
0
Script
General
Full URL
https://microsoft.za.com/index_files/ConvergedLogin_PCore.js
Requested by
Host: microsoft.za.com
URL: https://microsoft.za.com/login.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
157.173.209.36 , United Kingdom, ASN47583 (AS-HOSTINGER Hostinger International Limited, CY),
Reverse DNS
Software
LiteSpeed /
Resource Hash
db255a3725ebe9511b9f4bc95d906b8ea2d1bc8d37ed799efa8cadb5ca6b6206
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://microsoft.za.com/login.html

Response headers

panel
hpanel
content-security-policy
upgrade-insecure-requests
cache-control
public, max-age=604800
content-encoding
br
etag
"688ac-674d30a8-a79312261896a569;br"
expires
Mon, 09 Dec 2024 04:54:22 GMT
accept-ranges
bytes
content-length
106253
date
Mon, 02 Dec 2024 04:54:22 GMT
content-type
application/x-javascript
last-modified
Mon, 02 Dec 2024 03:59:36 GMT
vary
Accept-Encoding
server
LiteSpeed
platform
hostinger
0-small.jpg
auth.gfx.ms/16.000.27773.2/images/Backgrounds/
0
0

0.jpg
auth.gfx.ms/16.000.27773.2/images/Backgrounds/
0
0

favicon.ico
auth.gfx.ms/16.000.27773.2/images/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
msagfx.live.com
URL
https://msagfx.live.com/16.000.27773.2/ConvergedLoginPaginatedStrings.EN.js
Domain
msagfx.live.com
URL
https://msagfx.live.com/16.000.27773.2/ConvergedLogin_PCore.js
Domain
auth.gfx.ms
URL
https://auth.gfx.ms/16.000.27773.2/images/Backgrounds/0-small.jpg?x=138bcee624fa04ef9b75e86211a9fe0d
Domain
auth.gfx.ms
URL
https://auth.gfx.ms/16.000.27773.2/images/Backgrounds/0.jpg?x=a5dbd4393ff6a725c7e62b61df7e72f0
Domain
auth.gfx.ms
URL
https://auth.gfx.ms/16.000.27773.2/images/favicon.ico

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| PROOF object| g_dtFirstByte number| g_iSRSFailed function| SRSRetry function| webpackJsonp

0 Cookies

5 Console Messages

Source Level URL
Text
network error URL: https://microsoft.za.com/index_files/ConvergedLoginPaginatedStrings.EN.js
Message:
Failed to load resource: the server responded with a status of 404 ()
javascript warning URL: https://microsoft.za.com/login.html(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://msagfx.live.com/16.000.27773.2/ConvergedLoginPaginatedStrings.EN.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://microsoft.za.com/login.html(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://msagfx.live.com/16.000.27773.2/ConvergedLoginPaginatedStrings.EN.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://microsoft.za.com/login.html(Line 17)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://msagfx.live.com/16.000.27773.2/ConvergedLogin_PCore.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://microsoft.za.com/index_files/ConvergedLoginPaginatedStrings.EN.js
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests