storage.googleapis.com Open in urlscan Pro
2a00:1450:4001:820::2010  Malicious Activity! Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	hannah_smith@manulife& relaja.me/css/Hannah_smith/142946/	0 301 B	415ms 159ms	Document text/html	162.241.125.23 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://relaja.me/css/Hannah_smith/142946/hannah_smith@manulife& Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.241.125.23 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-125-23.unifiedlayer.com Software Apache / Resource Hash Request headers Host relaja.me Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 30 Aug 2020 08:47:51 GMT Server Apache refresh 0;url=https://storage.googleapis.com/aformylal-942031909/index.html#hannah_smith@manulife Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H2	200	Primary Request index.html Show response storage.googleapis.com/aformylal-942031909/	261 KB 261 KB	32ms 8ms	Document text/html	2a00:1450:4001:820::2010 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://storage.googleapis.com/aformylal-942031909/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software UploadServer / Resource Hash d089bb5d3e0df3a62e2bf49002c0cd2712d244a70884b550af136e48a025bac9 Request headers :method GET :authority storage.googleapis.com :scheme https :path /aformylal-942031909/index.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://relaja.me/css/Hannah_smith/142946/hannah_smith@manulife& accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://relaja.me/css/Hannah_smith/142946/hannah_smith@manulife& Response headers status 200 x-guploader-uploadid ABg5-UxH2tL9IscmJj5i__akclgtH-zYrUrk-dxzaKTL6vOpFbbtN-5xMJM6vDwrsBAiHP73JdtdFgzeSoiZYTJNR9ExpqZCRw expires Sun, 30 Aug 2020 09:40:01 GMT date Sun, 30 Aug 2020 08:40:01 GMT last-modified Tue, 25 Aug 2020 14:17:11 GMT etag "b4eda90ead05cd059cb402aedd24e7b7" x-goog-generation 1598365031792973 x-goog-metageneration 1 x-goog-stored-content-encoding identity x-goog-stored-content-length 266896 content-type text/html x-goog-hash crc32c=WsPiyA== md5=tO2pDq0FzQWctAKu3STntw== x-goog-storage-class STANDARD accept-ranges bytes content-length 266896 server UploadServer cache-control public, max-age=3600 age 471 alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	Me.htm login.live.com/	0 0	479ms 160ms	Other text/html	40.90.22.189 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://login.live.com/Me.htm?v=2 Requested by Host: relaja.me URL: https://relaja.me/css/Hannah_smith/142946/hannah_smith@manulife& Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 40.90.22.189 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash Request headers Referer https://storage.googleapis.com/aformylal-942031909/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H2	200	converged.v2.login.min_5vz1lgudtctdponkgjfmwg2.css aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	0 19 KB	62ms 14ms	Other text/css	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_5vz1lgudtctdponkgjfmwg2.css Requested by Host: relaja.me URL: https://relaja.me/css/Hannah_smith/142946/hannah_smith@manulife& Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ama/8AC7) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://storage.googleapis.com/aformylal-942031909/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sun, 30 Aug 2020 08:47:52 GMT content-encoding gzip content-md5 NoeBLUB3Ajr5wpF+VBd1BQ== age 2808612 x-cache HIT status 200 content-length 18769 x-ms-lease-status unlocked last-modified Wed, 25 Mar 2020 00:13:53 GMT server ECAcc (ama/8AC7) etag 0x8D7D05166C5A9CB vary Accept-Encoding content-type text/css access-control-allow-origin * x-ms-request-id 0616e179-501e-0022-761e-65adb9000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	ux.converged.login.strings-en-gb.min_fp_zmebxnjkdgdexgzweda2.js aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	0 11 KB	71ms 24ms	Other application/x-javascript	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en-gb.min_fp_zmebxnjkdgdexgzweda2.js Requested by Host: relaja.me URL: https://relaja.me/css/Hannah_smith/142946/hannah_smith@manulife& Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ama/8B29) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://storage.googleapis.com/aformylal-942031909/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sun, 30 Aug 2020 08:47:52 GMT content-encoding gzip content-md5 m7mGbnc/a5OxLw0WUIECTA== age 11664577 x-cache HIT status 200 content-length 11211 x-ms-lease-status unlocked last-modified Thu, 16 Apr 2020 05:07:08 GMT server ECAcc (ama/8B29) etag 0x8D7E1C403AEE075 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 11b42c0b-301e-0099-7393-1440ca000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	900 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 61d7ccc5d2c41bf86be6cefb0063405067849ba64e9f219f60596ef09a54a942 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	915 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	polyfills-bundle-0296778c6f2deb0d9882.js blobs.officehome.msocdn.com/bundles/ Frame CD68	0 20 KB	56ms 14ms	Other application/x-javascript	95.100.198.108 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://blobs.officehome.msocdn.com/bundles/polyfills-bundle-0296778c6f2deb0d9882.js Requested by Host: srcdoc URL: about:srcdoc Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.100.198.108 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a95-100-198-108.deploy.static.akamaitechnologies.com Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sun, 30 Aug 2020 08:47:53 GMT content-encoding gzip content-md5 akb7k+/PQ7yIGFC9fRkDEQ== status 200 x-cache-start 1595066326 content-length 20461 x-ms-lease-status unlocked last-modified Tue, 21 Apr 2020 20:02:28 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D7E62EEB4975DB vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 8ea86026-e01e-012f-2dea-5cb083000000 access-control-expose-headers content-length x-ms-version 2009-09-19 timing-allow-origin *
GET H2	200	sharedscripts-5a4ab47f8a.js blobs.officehome.msocdn.com/bundles/ Frame CD68	0 15 KB	65ms 23ms	Other application/x-javascript	95.100.198.108 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://blobs.officehome.msocdn.com/bundles/sharedscripts-5a4ab47f8a.js Requested by Host: srcdoc URL: about:srcdoc Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.100.198.108 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a95-100-198-108.deploy.static.akamaitechnologies.com Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sun, 30 Aug 2020 08:47:53 GMT content-encoding gzip x-cdn 116 content-md5 Wkq0f4r6Ex8x/T/XUPcmwg== status 200 x-cache-start 1581462625, 1581462741, 1597321269 content-length 14881 x-ms-lease-status unlocked last-modified Tue, 11 Feb 2020 04:28:13 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D7AEAACEC6DBC4 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id df6f250f-e01e-010d-3330-e1deb5000000 access-control-expose-headers content-length x-ms-version 2009-09-19 timing-allow-origin * x-ms-meta-cloudbuildid dcf09019-d8da-ad92-f19b-f8fc0cde3a52
GET H2	200	staticscripts-edc6bed83f.js blobs.officehome.msocdn.com/bundles/ Frame CD68	0 5 KB	70ms 28ms	Other application/x-javascript	95.100.198.108 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://blobs.officehome.msocdn.com/bundles/staticscripts-edc6bed83f.js Requested by Host: srcdoc URL: about:srcdoc Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.100.198.108 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a95-100-198-108.deploy.static.akamaitechnologies.com Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sun, 30 Aug 2020 08:47:53 GMT content-encoding gzip content-md5 7ca+2D8M94hGnehMVia3mg== status 200 x-cache-start 1588214506, 1592209502, 1595066326 content-length 4543 x-ms-lease-status unlocked last-modified Tue, 28 Apr 2020 19:25:14 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D7EBA9E04DDA18 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 4222fef2-b01e-0011-5498-1e40f7000000 access-control-expose-headers content-length x-ms-version 2009-09-19 timing-allow-origin *
GET H2	200	app-bundle-fc95401edea794a5239e.js blobs.officehome.msocdn.com/bundles/ Frame CD68	0 195 KB	71ms 30ms	Other application/x-javascript	95.100.198.108 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://blobs.officehome.msocdn.com/bundles/app-bundle-fc95401edea794a5239e.js Requested by Host: srcdoc URL: about:srcdoc Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.100.198.108 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a95-100-198-108.deploy.static.akamaitechnologies.com Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sun, 30 Aug 2020 08:47:53 GMT content-encoding gzip content-md5 V469WIWtxL85DoNkfFyLgw== status 200 x-cache-start 1588214505, 1592209502, 1595066326 content-length 198346 x-ms-lease-status unlocked last-modified Thu, 30 Apr 2020 00:55:27 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D7ECA12C74471D vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id e69c07f8-801e-011d-7f98-1ee853000000 access-control-expose-headers content-length x-ms-version 2009-09-19 timing-allow-origin *
GET H2	200	app-bundle-f435d1a12b22b6dafd75.css blobs.officehome.msocdn.com/bundles/ Frame CD68	0 12 KB	84ms 43ms	Other text/css	95.100.198.108 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://blobs.officehome.msocdn.com/bundles/app-bundle-f435d1a12b22b6dafd75.css Requested by Host: srcdoc URL: about:srcdoc Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.100.198.108 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a95-100-198-108.deploy.static.akamaitechnologies.com Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sun, 30 Aug 2020 08:47:53 GMT content-encoding gzip content-md5 3u9OjULWZymSGZR1aZE3Gg== status 200 x-cache-start 1595066326, 1596786651, 1598433858 content-length 11479 x-ms-lease-status unlocked last-modified Wed, 29 Apr 2020 01:48:53 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D7EBDF78FC218F vary Accept-Encoding content-type text/css access-control-allow-origin * x-ms-request-id ee3621cd-701e-006a-19ea-5c2b47000000 access-control-expose-headers content-length x-ms-version 2009-09-19 timing-allow-origin *
GET H2	200	header-default-tablet-a2ddbeaa7f.svg blobs.officehome.msocdn.com/images/content/images/fluent-background-sources/ Frame CD68	0 2 KB	86ms 45ms	Other image/svg+xml	95.100.198.108 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://blobs.officehome.msocdn.com/images/content/images/fluent-background-sources/header-default-tablet-a2ddbeaa7f.svg Requested by Host: srcdoc URL: about:srcdoc Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.100.198.108 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a95-100-198-108.deploy.static.akamaitechnologies.com Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sun, 30 Aug 2020 08:47:53 GMT content-encoding gzip x-cdn 229 content-md5 ot2+qn/QQT0KgsW06CNWYg== status 200 x-cache-start 1574834535, 1574834764, 1596106424 content-length 1432 x-ms-lease-status unlocked last-modified Tue, 24 Sep 2019 20:19:53 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D7412C8F602F2D vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id c5ca83a3-201e-0110-28e8-a4075f000000 access-control-expose-headers content-length x-ms-version 2009-09-19 timing-allow-origin * x-ms-meta-cloudbuildid c26d3444-9354-d941-cc81-c4d5dcbbad4e
GET H2	200	boot.worldwide.0.mouse.js r4.res.office365.com/owa/prem/16.3708.0.2741982/scripts/ Frame E198	648 KB 176 KB	357ms 328ms	Stylesheet application/x-javascript	2a02:26f0:10c:395::753 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://r4.res.office365.com/owa/prem/16.3708.0.2741982/scripts/boot.worldwide.0.mouse.js Requested by Host: srcdoc URL: about:srcdoc Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:10c:395::753 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software AkamaiNetStorage / Resource Hash 30bc3ba126e91f95d7480a073785a1d477006db381f181da67d29644674ba142 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 30 Aug 2020 08:47:53 GMT content-encoding gzip last-modified Sat, 11 Apr 2020 08:44:49 GMT server AkamaiNetStorage status 200 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control public,max-age=630720000, s-maxage=630720000 strict-transport-security max-age=31536000; includeSubDomains accept-ranges bytes timing-allow-origin * content-length 179729
GET H2	200	boot.worldwide.1.mouse.js r4.res.office365.com/owa/prem/16.3708.0.2741982/scripts/ Frame E198	644 KB 160 KB	351ms 322ms	Stylesheet application/x-javascript	2a02:26f0:10c:395::753 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://r4.res.office365.com/owa/prem/16.3708.0.2741982/scripts/boot.worldwide.1.mouse.js Requested by Host: srcdoc URL: about:srcdoc Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:10c:395::753 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software AkamaiNetStorage / Resource Hash 88da7254eb00325266f2297f09cc17b46c644709463068e2e177f22102734775 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 30 Aug 2020 08:47:53 GMT content-encoding gzip last-modified Sat, 11 Apr 2020 08:44:52 GMT server AkamaiNetStorage status 200 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control public,max-age=630720000, s-maxage=630720000 strict-transport-security max-age=31536000; includeSubDomains accept-ranges bytes timing-allow-origin * content-length 163102
GET H2	200	boot.worldwide.2.mouse.js r4.res.office365.com/owa/prem/16.3708.0.2741982/scripts/ Frame E198	647 KB 167 KB	155ms 126ms	Stylesheet application/x-javascript	2a02:26f0:10c:395::753 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://r4.res.office365.com/owa/prem/16.3708.0.2741982/scripts/boot.worldwide.2.mouse.js Requested by Host: srcdoc URL: about:srcdoc Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:10c:395::753 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software AkamaiNetStorage / Resource Hash fa26e0423c31f84de5a9ad9383d04fad8c1145f662984b654098322db628f0c6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 30 Aug 2020 08:47:53 GMT content-encoding gzip last-modified Sat, 11 Apr 2020 08:44:49 GMT server AkamaiNetStorage status 200 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control public,max-age=630720000, s-maxage=630720000 strict-transport-security max-age=31536000; includeSubDomains accept-ranges bytes timing-allow-origin * content-length 170001
GET H2	200	boot.worldwide.3.mouse.js r4.res.office365.com/owa/prem/16.3708.0.2741982/scripts/ Frame E198	645 KB 143 KB	340ms 312ms	Stylesheet application/x-javascript	2a02:26f0:10c:395::753 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://r4.res.office365.com/owa/prem/16.3708.0.2741982/scripts/boot.worldwide.3.mouse.js Requested by Host: srcdoc URL: about:srcdoc Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:10c:395::753 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software AkamaiNetStorage / Resource Hash bf2c963593144782db28d7de6ffba0acc2ef59e2102b973c50d53c87fd82cca9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 30 Aug 2020 08:47:53 GMT content-encoding gzip last-modified Sat, 11 Apr 2020 08:44:52 GMT server AkamaiNetStorage status 200 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control public,max-age=630720000, s-maxage=630720000 strict-transport-security max-age=31536000; includeSubDomains accept-ranges bytes timing-allow-origin * content-length 145696
GET H2	200	sprite1.mouse.png r4.res.office365.com/owa/prem/16.3708.0.2741982/resources/images/0/ Frame E198	16 KB 17 KB	345ms 317ms	Stylesheet image/png	2a02:26f0:10c:395::753 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://r4.res.office365.com/owa/prem/16.3708.0.2741982/resources/images/0/sprite1.mouse.png Requested by Host: srcdoc URL: about:srcdoc Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:10c:395::753 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software AkamaiNetStorage / Resource Hash 99190cfe65f919edb8071d84eee7096ec27561bc9b9fa396e55e0eb5e2cd0194 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 30 Aug 2020 08:47:53 GMT last-modified Sat, 11 Apr 2020 08:14:01 GMT server AkamaiNetStorage status 200 strict-transport-security max-age=31536000; includeSubDomains content-type image/png access-control-allow-origin * cache-control public,max-age=630720000, s-maxage=630720000 accept-ranges bytes timing-allow-origin * content-length 16664
GET H2	200	converged.v2.login.min_5vz1lgudtctdponkgjfmwg2.css aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	0 18 KB	14ms 13ms	Other text/css	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_5vz1lgudtctdponkgjfmwg2.css Requested by Host: relaja.me URL: https://relaja.me/css/Hannah_smith/142946/hannah_smith@manulife& Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ama/8AC7) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://storage.googleapis.com/aformylal-942031909/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sun, 30 Aug 2020 08:47:53 GMT content-encoding gzip content-md5 NoeBLUB3Ajr5wpF+VBd1BQ== age 2808613 x-cache HIT status 200 content-length 18769 x-ms-lease-status unlocked last-modified Wed, 25 Mar 2020 00:13:53 GMT server ECAcc (ama/8AC7) etag 0x8D7D05166C5A9CB vary Accept-Encoding content-type text/css access-control-allow-origin * x-ms-request-id 0616e179-501e-0022-761e-65adb9000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	ux.converged.login.strings-en-gb.min_fp_zmebxnjkdgdexgzweda2.js aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	0 11 KB	16ms 16ms	Other application/x-javascript	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en-gb.min_fp_zmebxnjkdgdexgzweda2.js Requested by Host: relaja.me URL: https://relaja.me/css/Hannah_smith/142946/hannah_smith@manulife& Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ama/8B29) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://storage.googleapis.com/aformylal-942031909/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sun, 30 Aug 2020 08:47:53 GMT content-encoding gzip content-md5 m7mGbnc/a5OxLw0WUIECTA== age 11664578 x-cache HIT status 200 content-length 11211 x-ms-lease-status unlocked last-modified Thu, 16 Apr 2020 05:07:08 GMT server ECAcc (ama/8B29) etag 0x8D7E1C403AEE075 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 11b42c0b-301e-0099-7393-1440ca000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	converged.v2.login.min_5vz1lgudtctdponkgjfmwg2.css Show response aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	99 KB 19 KB	55ms 14ms	Fetch text/css	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_5vz1lgudtctdponkgjfmwg2.css Requested by Host: relaja.me URL: https://relaja.me/css/Hannah_smith/142946/hannah_smith@manulife& Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ama/8AC7) / Resource Hash 90eaced895f510255f1652c21f02f1d21f89063124c1bb9bc1b0d4661cf2340a Request headers Referer https://storage.googleapis.com/aformylal-942031909/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sun, 30 Aug 2020 08:47:58 GMT content-encoding gzip content-md5 NoeBLUB3Ajr5wpF+VBd1BQ== age 2808618 x-cache HIT status 200 content-length 18769 x-ms-lease-status unlocked last-modified Wed, 25 Mar 2020 00:13:53 GMT server ECAcc (ama/8AC7) etag 0x8D7D05166C5A9CB vary Accept-Encoding content-type text/css access-control-allow-origin * x-ms-request-id 0616e179-501e-0022-761e-65adb9000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	ux.converged.login.strings-en-gb.min_fp_zmebxnjkdgdexgzweda2.js Show response aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	37 KB 11 KB	65ms 24ms	Fetch application/x-javascript	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en-gb.min_fp_zmebxnjkdgdexgzweda2.js Requested by Host: relaja.me URL: https://relaja.me/css/Hannah_smith/142946/hannah_smith@manulife& Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ama/8B29) / Resource Hash 4d34dcf8ad32dca85257284f9cc47ca0b358dea3c54df5cb0d710a971e26c8ad Request headers Referer https://storage.googleapis.com/aformylal-942031909/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sun, 30 Aug 2020 08:47:58 GMT content-encoding gzip content-md5 m7mGbnc/a5OxLw0WUIECTA== age 11664583 x-cache HIT status 200 content-length 11211 x-ms-lease-status unlocked last-modified Thu, 16 Apr 2020 05:07:08 GMT server ECAcc (ama/8B29) etag 0x8D7E1C403AEE075 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 11b42c0b-301e-0099-7393-1440ca000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes object| _0x55d6 function| _0x1541 object| Zlib object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B object| ServerData object| StringRepository object| PROOF boolean| __ function| savepage_ShadowLoader

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msftauth.net
blobs.officehome.msocdn.com
login.live.com
r4.res.office365.com
relaja.me
storage.googleapis.com
152.199.23.37
162.241.125.23
2a00:1450:4001:820::2010
2a02:26f0:10c:395::753
40.90.22.189
95.100.198.108
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6
30bc3ba126e91f95d7480a073785a1d477006db381f181da67d29644674ba142
4d34dcf8ad32dca85257284f9cc47ca0b358dea3c54df5cb0d710a971e26c8ad
61d7ccc5d2c41bf86be6cefb0063405067849ba64e9f219f60596ef09a54a942
88da7254eb00325266f2297f09cc17b46c644709463068e2e177f22102734775
90eaced895f510255f1652c21f02f1d21f89063124c1bb9bc1b0d4661cf2340a
99190cfe65f919edb8071d84eee7096ec27561bc9b9fa396e55e0eb5e2cd0194
bf2c963593144782db28d7de6ffba0acc2ef59e2102b973c50d53c87fd82cca9
d089bb5d3e0df3a62e2bf49002c0cd2712d244a70884b550af136e48a025bac9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fa26e0423c31f84de5a9ad9383d04fad8c1145f662984b654098322db628f0c6