urlscan.io logo urlscan.io
SecurityTrails logo

www.yourfaxweb.com Open in urlscan Pro
52.32.121.188  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Submission: On September 21 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 15 HTTP transactions. The main IP is 52.32.121.188, located in Boardman, United States and belongs to AMAZON-02, US. The main domain is www.yourfaxweb.com.
This is the only time www.yourfaxweb.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
2 52.32.121.188 16509 (AMAZON-02)
9 2620:1ec:46::45 8075 (MICROSOFT...)
1 16.182.40.33 16509 (AMAZON-02)
2 100.22.4.245 16509 (AMAZON-02)
1 40.126.32.134 8075 (MICROSOFT...)
15 5
2    52.32.121.188 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-32-121-188.us-west-2.compute.amazonaws.com
www.yourfaxweb.com
9    2620:1ec:46::45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
aadcdn.msauth.net
1    16.182.40.33 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com
staticmediafiles.s3.amazonaws.com
2    100.22.4.245 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-100-22-4-245.us-west-2.compute.amazonaws.com
members.ironscales.com
1    40.126.32.134 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
login.live.com
Apex Domain
Subdomains		 Transfer
9 msauth.net
aadcdn.msauth.net — Cisco Umbrella Rank: 2466
78 KB
2 ironscales.com
members.ironscales.com — Cisco Umbrella Rank: 186785
1 KB
2 yourfaxweb.com
www.yourfaxweb.com
13 KB
1 live.com
login.live.com — Cisco Umbrella Rank: 62
1 amazonaws.com
staticmediafiles.s3.amazonaws.com — Cisco Umbrella Rank: 610100
95 KB
15 5
Domain Requested by
9 aadcdn.msauth.net www.yourfaxweb.com
2 members.ironscales.com www.yourfaxweb.com
2 www.yourfaxweb.com staticmediafiles.s3.amazonaws.com
1 login.live.com www.yourfaxweb.com
1 staticmediafiles.s3.amazonaws.com www.yourfaxweb.com
15 5

This site contains links to these domains. Also see Links.

Domain
members.ironscales.com
Subject Issuer Validity Valid
aadcdn.msauth.net
DigiCert SHA2 Secure Server CA		 2023-07-29 -
2024-07-29		 a year crt.sh
*.s3.amazonaws.com
Amazon RSA 2048 M01		 2023-03-21 -
2023-12-19		 9 months crt.sh
ironscales.com
Amazon RSA 2048 M01		 2023-04-17 -
2024-05-15		 a year crt.sh
login.live.com
DigiCert SHA2 Secure Server CA		 2023-07-02 -
2024-07-02		 a year crt.sh

This page contains 1 frames:

Primary Page: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Frame ID: E7CBDA9DB976EF20AC2BFB267C3BCCC1
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

None

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

87 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

186 kB
Transfer

236 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 3675235-RdbD3TZKFuCUsw
www.yourfaxweb.com/ 		12 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
HTTP/1.1
Server
52.32.121.188 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-32-121-188.us-west-2.compute.amazonaws.com
Software
gunicorn/19.7.1 /
Resource Hash
12f4377f12827f3cfc562f8c9ff39b20c3250d3bd961cd55f560e11048b9288f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
keep-alive
Content-Length
12670
Content-Type
text/html; charset=utf-8
Date
Thu, 21 Sep 2023 13:01:47 GMT
Server
gunicorn/19.7.1
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Cookie
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-UA-Compatible
IE=edge,chrome=1
X-XSS-Protection
1; mode=block
converged.v2.login.min_99ypt2ae9l1eaa2j9r7rkw2.css
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ 		99 KB
19 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_99ypt2ae9l1eaa2j9r7rkw2.css
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
968d3f29171b0c97399611fbcd07bc81db0253fd91ec36dc456d08bb94b9bac7

Request headers

Referer
http://www.yourfaxweb.com/
Origin
http://www.yourfaxweb.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 21 Sep 2023 13:01:48 GMT
content-encoding
gzip
x-cache
TCP_HIT
content-length
18756
x-ms-lease-status
unlocked
last-modified
Tue, 28 Apr 2020 21:29:25 GMT
etag
0x8D7EBBB39E2A763
x-azure-ref
20230921T130148Z-yyqxg8uz7x5r7err0nb12en9u400000004ng00000000nw1y
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
ec24f07f-501e-005a-5f16-ec5a55000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
53_8b36337037cff88c3df203bb73d58e41.png
aadcdn.msauth.net/ests/2.1/content/images/applogos/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e4e1e65871749d18aea150643c07e0aab2057da057c6c57ec1c3c43580e1c898

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Thu, 21 Sep 2023 13:01:48 GMT
last-modified
Wed, 12 Feb 2020 22:11:35 GMT
etag
0x8D7B008867A4ADE
x-azure-ref
20230921T130148Z-u8ztxzuub11q35a5vyyr4b00gn0000000dag00000000pab3
x-cache
TCP_HIT
content-type
image/png
access-control-allow-origin
*
x-ms-request-id
ecb81378-201e-003d-2c30-ecc979000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
content-length
5139
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msauth.net/ests/2.1/content/images/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 21 Sep 2023 13:01:48 GMT
content-encoding
gzip
x-cache
TCP_HIT
content-length
1435
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:31 GMT
etag
0x8D64101560D5E58
x-azure-ref
20230921T130148Z-u8ztxzuub11q35a5vyyr4b00gn0000000dag00000000pab4
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
0ccf6e98-d01e-003a-734c-eb1877000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes
documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg
aadcdn.msauth.net/ests/2.1/content/images/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
a76c08e9cdc3bb87bfb57627ad8f6b46f0e5ef826cc7f046dfbaf25d7b7958ea

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 21 Sep 2023 13:01:48 GMT
content-encoding
gzip
x-cache
TCP_HIT
content-length
606
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:19 GMT
etag
0x8D641014F2C0C35
x-azure-ref
20230921T130148Z-u8ztxzuub11q35a5vyyr4b00gn0000000dag00000000pab5
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
54fc5b23-c01e-0023-6d6b-ecdb46000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes
ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg
aadcdn.msauth.net/ests/2.1/content/images/ 		915 B
781 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 21 Sep 2023 13:01:48 GMT
content-encoding
gzip
x-cache
TCP_HIT
content-length
263
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:24 GMT
etag
0x8D64101521A1ED5
x-azure-ref
20230921T130148Z-u8ztxzuub11q35a5vyyr4b00gn0000000dag00000000pab6
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
f31562b6-e01e-0059-5d4a-ec2753000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes
jquery-1.11.0.min.js
staticmediafiles.s3.amazonaws.com/static/webapp/js/ 		94 KB
95 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://staticmediafiles.s3.amazonaws.com/static/webapp/js/jquery-1.11.0.min.js
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
16.182.40.33 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Date
Thu, 21 Sep 2023 13:01:49 GMT
x-amz-version-id
null
Last-Modified
Mon, 04 Jul 2016 08:58:20 GMT
Server
AmazonS3
x-amz-request-id
REH85YHDV5AE2A7V
ETag
"8fc25e27d42774aeae6edbc0a18b72aa"
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
96381
x-amz-id-2
n8YH6pcgXWN7nGYzxNTibMsNUaY9ZKPs5iQRUN/H3ckR4MxL0xrLq3ldvqF+ZxdkhWlOpOOva5w=
create_click_event.js
members.ironscales.com/static/training/js/ 		376 B
554 B 		Script
General
Check archive.org
Download Go to
Full URL
https://members.ironscales.com/static/training/js/create_click_event.js
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
100.22.4.245 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-100-22-4-245.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
8aa0dc07e67658e85b668f449655068ffeadaa406a21115acae58dc176c4487b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Thu, 21 Sep 2023 13:01:48 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 14 Sep 2023 09:47:14 GMT
server
nginx
content-encoding
gzip
etag
W/"6502d6a2-178"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge,chrome=1
confirm_data_entry_on_typing.js
members.ironscales.com/static/training/js/ 		848 B
772 B 		Script
General
Check archive.org
Download Go to
Full URL
https://members.ironscales.com/static/training/js/confirm_data_entry_on_typing.js
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
100.22.4.245 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-100-22-4-245.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
657348bf276aef9bf7efc01f6dcf6779395c2de5e5e582981c0b450f5a529d14
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Thu, 21 Sep 2023 13:01:48 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 14 Sep 2023 09:47:14 GMT
server
nginx
content-encoding
gzip
etag
W/"6502d6a2-350"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge,chrome=1
Me.htm
login.live.com/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://login.live.com/Me.htm?v=3
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.126.32.134 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers
converged.v2.login.min_99ypt2ae9l1eaa2j9r7rkw2.css
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ 		0
19 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_99ypt2ae9l1eaa2j9r7rkw2.css
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 21 Sep 2023 13:01:48 GMT
content-encoding
gzip
x-cache
TCP_MISS
content-length
18756
x-ms-lease-status
unlocked
last-modified
Tue, 28 Apr 2020 21:29:25 GMT
etag
0x8D7EBBB39E2A763
x-azure-ref
20230921T130148Z-u8ztxzuub11q35a5vyyr4b00gn0000000dag00000000pab7
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
59de62b5-101e-004e-308b-ec467f000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
ux.converged.login.strings-en-gb.min_4i45pxpdp6x6jbo6acwtew2.js
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ 		0
12 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en-gb.min_4i45pxpdp6x6jbo6acwtew2.js
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 21 Sep 2023 13:01:48 GMT
content-encoding
gzip
x-cache
TCP_MISS
content-length
11315
x-ms-lease-status
unlocked
last-modified
Mon, 01 Jun 2020 20:58:49 GMT
etag
0x8D8066E95286BBE
x-azure-ref
20230921T130148Z-u8ztxzuub11q35a5vyyr4b00gn0000000dag00000000pabc
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
f59abc82-f01e-0004-098b-ec9b7b000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg
aadcdn.msauth.net/ests/2.1/content/images/appbackgrounds/ 		987 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
8b34a475187302935336bf43a2bf2a4e0adb9a1e87953ea51f6fcf0ef52a4a1d

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Thu, 21 Sep 2023 13:01:48 GMT
last-modified
Mon, 30 Mar 2020 02:45:50 GMT
etag
0x8D7D454750E6395
x-azure-ref
20230921T130148Z-u8ztxzuub11q35a5vyyr4b00gn0000000dag00000000pabg
x-cache
TCP_HIT
content-type
image/jpeg
access-control-allow-origin
*
x-ms-request-id
98bcaf8b-f01e-0090-0730-ecd004000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
content-length
987
49_7916a894ebde7d29c2cc29b267f1299f.jpg
aadcdn.msauth.net/ests/2.1/content/images/appbackgrounds/ 		17 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Thu, 21 Sep 2023 13:01:48 GMT
last-modified
Mon, 30 Mar 2020 02:45:50 GMT
etag
0x8D7D4547537019A
x-azure-ref
20230921T130148Z-u8ztxzuub11q35a5vyyr4b00gn0000000dag00000000pabh
x-cache
TCP_HIT
content-type
image/jpeg
access-control-allow-origin
*
x-ms-request-id
1a7dc20f-901e-0096-3d6b-ec2a08000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
content-length
17453
3675235-RdbD3TZKFuCUsw
www.yourfaxweb.com/tracking/create_click_event/ 		21 B
386 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://www.yourfaxweb.com/tracking/create_click_event/3675235-RdbD3TZKFuCUsw
Requested by
Host: staticmediafiles.s3.amazonaws.com
URL: https://staticmediafiles.s3.amazonaws.com/static/webapp/js/jquery-1.11.0.min.js
Protocol
HTTP/1.1
Server
52.32.121.188 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-32-121-188.us-west-2.compute.amazonaws.com
Software
gunicorn/19.7.1 /
Resource Hash
8e348a2876686697c17bc2784470cbebe761146f0bbfc180a67a52793117882d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

Date
Thu, 21 Sep 2023 13:01:48 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Server
gunicorn/19.7.1
Vary
Cookie
X-Frame-Options
SAMEORIGIN
Content-Type
application/json
Connection
keep-alive
Content-Length
21
X-XSS-Protection
1; mode=block
X-UA-Compatible
IE=edge,chrome=1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| createClickEvent object| excludedKeyCodes function| confirmDataEntryOnTyping

2 Cookies

Domain/Path Name / Value
.login.live.com/ Name: uaid
Value: de7d3da19af743aa8e5d57af6fd1fb9b
.login.live.com/ Name: MSPRequ
Value: id=N&lt=1695301308&co=1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block