![](/screenshots/3fcd266c-f637-4782-9382-b1624acef7d1.png)
exception.amperisc.de
Open in
urlscan Pro
77.243.85.213
Public Scan
Effective URL: https://exception.amperisc.de/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvv...
Submission Tags: @ecarlesi threat #phishing #microsoft Search All
Submission: On June 01 via api from FR — Scanned from DE
Summary
TLS certificate: Issued by R3 on June 1st 2023. Valid for: 3 months.
This is the only time exception.amperisc.de was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 104.248.48.130 104.248.48.130 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
1 8 | 77.243.85.213 77.243.85.213 | 47583 (AS-HOSTINGER) (AS-HOSTINGER) | |
1 | 40.126.32.74 40.126.32.74 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
11 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
amperisc.de
1 redirects
exception.amperisc.de |
913 KB |
2 |
anpq.de
2 redirects
anpq.de |
324 B |
1 |
live.com
login.live.com — Cisco Umbrella Rank: 91 |
|
11 | 3 |
Domain | Requested by | |
---|---|---|
8 | exception.amperisc.de |
1 redirects
exception.amperisc.de
|
2 | anpq.de | 2 redirects |
1 | login.live.com |
exception.amperisc.de
|
11 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
exception.amperisc.de R3 |
2023-06-01 - 2023-08-30 |
3 months | crt.sh |
login.live.com DigiCert SHA2 Secure Server CA |
2023-04-02 - 2024-04-02 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://exception.amperisc.de/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true
Frame ID: 81F9A61C301BA7E7846F79FEE17F4672
Requests: 11 HTTP requests in this frame
Screenshot
![](/screenshots/3fcd266c-f637-4782-9382-b1624acef7d1.png)
Page Title
Sign in to your accountPage URL History Show full URLs
-
http://anpq.de/
HTTP 301
https://anpq.de/ HTTP 302
https://exception.amperisc.de/?rthe HTTP 302
https://exception.amperisc.de/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f9376527... Page URL
- https://exception.amperisc.de/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f9376527... Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://anpq.de/
HTTP 301
https://anpq.de/ HTTP 302
https://exception.amperisc.de/?rthe HTTP 302
https://exception.amperisc.de/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0 Page URL
- https://exception.amperisc.de/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0&sso_reload=true Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://anpq.de/ HTTP 301
- https://anpq.de/ HTTP 302
- https://exception.amperisc.de/?rthe HTTP 302
- https://exception.amperisc.de/__//eqooqp/qcwvj2/x2.0/cwvjqtkbg?enkgpv_kf=4765445d-32e6-49d0-83g6-1f93765276ec&tgfktgev_wtk=jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hncpfkpix2&tgurqpug_varg=eqfg%20kf_vqmgp&ueqrg=qrgpkf%20rtqhkng%20jvvru%3C%2H%2Hyyy.qhhkeg.eqo%2Hx2%2HQhhkegJqog.Cnn&tgurqpug_oqfg=hqto_rquv&pqpeg=637929903776466681.A2A4AlPlQYKvPYTnOk00PYToNYGaPIGvPIOzO2TjPljoOoA1PVK3AoO5QVOvQYGaPk00AYLlNVi5BFCvAoAaOliyQYHlOYWz&wk_nqecngu=gp-WU&omv=gp-WU&uvcvg=I-XnsevaZLqScbPfu6RYpY7IJD_LTOPESPKueoPo49a8yaDo0kqCdRJbDG3lbRNIEam2zNMQCsdLvyVNVNFWspCLHwP5Uk8CHlDZMafbjd6z4GKk3_P0qHa9xXPJADlYDaFR66v5o5Tc01hUKi5E_UkoKs8q1prnbGla9Aj5bbLO6ATkGK82KM6RbZaa32JC_42rdz0FxBy525JrewXiOC1XYRBkEMHna3LGpORVj7Nfhqq6y-4zLmWjmayBnR-YwnorQ3rtTugIAMDKXXrnLy&z-enkgpv-UMW=KF_PGVUVCPFCTF2_0&z-enkgpv-xgt=6.12.1.0
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
cwvjqtkbg
exception.amperisc.de/__//eqooqp/qcwvj2/x2.0/ Redirect Chain
|
154 KB 56 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
cwvjqtkbg
exception.amperisc.de/__//eqooqp/qcwvj2/x2.0/ |
203 KB 53 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Me.htm
login.live.com/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ConvergedLogin_PCore_s9lCYGipHOEtFkYXVZWDhg2.js
exception.amperisc.de/aadcdn.msauth.net/~/shared/1.0/content/js/ |
673 KB 673 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
oneDs_641b1cf809bdc17b42ab.js
exception.amperisc.de/aadcdn.msauth.net/~/shared/1.0/content/js/ |
186 KB 61 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js
exception.amperisc.de/aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/ |
107 KB 33 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
converged.v2.login.min_jhbu09ckrizehfz_kojdnq2.css
exception.amperisc.de/aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/ |
0 20 KB |
Other
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ux.converged.login.strings-en.min_q2kk7hjiv1-6ob8yqlefww2.js
exception.amperisc.de/aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/ |
0 15 KB |
Other
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
convergedlogin_pfetchsessionsprogress_ae573f441ee1cf781ec7.js
exception.amperisc.de/aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
marching_ants_white_166de53471265253ab3a456defe6da23.gif
exception.amperisc.de/aadcdn.msauth.net/~/shared/1.0/content/images/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif
exception.amperisc.de/aadcdn.msauth.net/~/shared/1.0/content/images/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- exception.amperisc.de
- URL
- https://exception.amperisc.de/aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_ae573f441ee1cf781ec7.js
- Domain
- exception.amperisc.de
- URL
- https://exception.amperisc.de/aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif
- Domain
- exception.amperisc.de
- URL
- https://exception.amperisc.de/aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif
Verdicts & Comments Add Verdict or Comment
22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B object| ServerData object| webpackJsonp object| ko object| PROOF object| StringRepository object| Telemetry object| telemetry_webpackJsonp boolean| __ConvergedLogin_PCore boolean| __ boolean| __convergedlogin_pcustomizationloader_80e93b9a4cb13643afca12 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
exception.amperisc.de/ | Name: qPdM Value: 3WpuXucVOMRO |
|
exception.amperisc.de/ | Name: qPdM.sig Value: 1XozRpvjX6Pg7w-Gw6E5Ig7wMsA |
|
exception.amperisc.de/ | Name: x-ms-gateway-slice Value: estsfd |
|
exception.amperisc.de/ | Name: stsservicecookie Value: estsfd |
|
.exception.amperisc.de/ | Name: AADSSO Value: NA|NoExtension |
|
exception.amperisc.de/ | Name: SSOCOOKIEPULLED Value: 1 |
|
exception.amperisc.de/ | Name: buid Value: 0.AQYAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAD--DLA3VO7QrddgJg7WevrXKvn6XcTYcyJHGzgfC823W1e7fjri0VNl1YWfYxo9-4oNXZY4itqdgcX4FINK26UWKtt9su_zU8h_7zamr-hofxN5nzVPgiWZuvfyQJ-lrYgAA |
|
.exception.amperisc.de/ | Name: esctx Value: PAQABAAEAAAD--DLA3VO7QrddgJg7Wevrr8_LaRLOi3KgmhsWpIZ6Bcjs5bRkIjqKqgylF7MyyQyYfLJCWJ8tzhTALZngv4I0PT0kVDd9guWxotPnBLE71qBitHIg2djUHsuZ_9NJ4J1m9ILAS5HZUylnSDZQBt2KL2uvpUhMP6ssI1-DktArjPaHC2xELjXAfkkkDuhf97r_7RU7iAQsUBMu05AYngvPtS-n19_CQzF51fYP_BIi3d4pipybIz_sUdV5ss_ltw4gAA |
|
exception.amperisc.de/ | Name: fpc Value: As_2iApnU5REgqnFW19dX9u8Ae7AAQAAAKr2CtwOAAAA |
|
.login.live.com/ | Name: uaid Value: 18fa0d0df09b4586ac1fe24d76a8b69f |
|
.login.live.com/ | Name: MSPRequ Value: id=N<=1685651371&co=1 |
|
.exception.amperisc.de/ | Name: brcap Value: 0 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline'; |
Strict-Transport-Security | max-age=31536000; includeSubDomains |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
anpq.de
exception.amperisc.de
login.live.com
exception.amperisc.de
104.248.48.130
40.126.32.74
77.243.85.213
5f5fbee72883732799d75f6c08679ed8a6e769ae4f3afdcd3721103a481afa80
adae76a984138099bacade6a729279178da0d985b1c6133565080bdb7b93a62e
cc58721894324d6f6f53b7fe4cb0d08f923aa75e52506c0a58d29e4390b7cedd
d4ea1a07b23257f411af4f8c20aa528d23c4dadbd4c81d5db454f5d82351adc4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855