itsupportcenter.z13.web.core.windows.net
Open in
urlscan Pro
20.150.32.1
Malicious Activity!
Public Scan
Submission: On September 07 via automatic, source phishtank
Summary
TLS certificate: Issued by Microsoft IT TLS CA 5 on August 29th 2020. Valid for: a year.
This is the only time itsupportcenter.z13.web.core.windows.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online) Generic Email (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 20.150.32.1 20.150.32.1 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2a00:1450:400... 2a00:1450:4001:808::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:3b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:1b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
4 4 | 207.241.228.146 207.241.228.146 | 7941 (INTERNET-...) (INTERNET-ARCHIVE) | |
4 4 | 207.241.224.2 207.241.224.2 | 7941 (INTERNET-...) (INTERNET-ARCHIVE) | |
4 | 207.241.233.58 207.241.233.58 | 7941 (INTERNET-...) (INTERNET-ARCHIVE) | |
2 | 207.241.233.48 207.241.233.48 | 7941 (INTERNET-...) (INTERNET-ARCHIVE) | |
10 | 6 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
itsupportcenter.z13.web.core.windows.net |
ASN7941 (INTERNET-ARCHIVE, US)
PTR: ia802908.us.archive.org
ia802908.us.archive.org |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
archive.org
8 redirects
ia801406.us.archive.org archive.org ia802908.us.archive.org ia902908.us.archive.org |
9 KB |
1 |
jquery.com
code.jquery.com |
24 KB |
1 |
bootstrapcdn.com
stackpath.bootstrapcdn.com |
7 KB |
1 |
googleapis.com
ajax.googleapis.com |
29 KB |
1 |
windows.net
itsupportcenter.z13.web.core.windows.net |
9 KB |
10 | 5 |
Domain | Requested by | |
---|---|---|
4 | ia802908.us.archive.org |
itsupportcenter.z13.web.core.windows.net
ia802908.us.archive.org |
4 | archive.org | 4 redirects |
4 | ia801406.us.archive.org | 4 redirects |
2 | ia902908.us.archive.org |
itsupportcenter.z13.web.core.windows.net
|
1 | code.jquery.com |
itsupportcenter.z13.web.core.windows.net
|
1 | stackpath.bootstrapcdn.com |
itsupportcenter.z13.web.core.windows.net
|
1 | ajax.googleapis.com |
itsupportcenter.z13.web.core.windows.net
|
1 | itsupportcenter.z13.web.core.windows.net | |
10 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.web.core.windows.net Microsoft IT TLS CA 5 |
2020-08-29 - 2021-08-29 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-08-19 - 2020-11-11 |
3 months | crt.sh |
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA |
2019-09-14 - 2020-10-13 |
a year | crt.sh |
jquery.org COMODO RSA Domain Validation Secure Server CA |
2018-10-17 - 2020-10-16 |
2 years | crt.sh |
*.us.archive.org Go Daddy Secure Certificate Authority - G2 |
2019-12-23 - 2022-02-21 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://itsupportcenter.z13.web.core.windows.net/?ghop7ol01cqsu5nrt3hv5ev9p?c=abuse@optusnet.com.au&ghop7ol01cqsu5nrt3hv5ev9p
Frame ID: C9AE2706BDBD637F94C6E1957AED7A6D
Requests: 10 HTTP requests in this frame
Screenshot
Detected technologies
Microsoft HTTPAPI (Web Servers) ExpandDetected patterns
- headers server /Microsoft-HTTPAPI(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 3- https://ia801406.us.archive.org/2/items/bottom_202004/loginAdvanced.css HTTP 301
- https://archive.org/download/bottom_202004/loginAdvanced.css HTTP 302
- https://ia802908.us.archive.org/3/items/bottom_202004/loginAdvanced.css
- https://ia801406.us.archive.org/2/items/bottom_202004/logo.png HTTP 301
- https://archive.org/download/bottom_202004/logo.png HTTP 302
- https://ia902908.us.archive.org/3/items/bottom_202004/logo.png
- https://ia801406.us.archive.org/2/items/bottom_202004/top.png HTTP 301
- https://archive.org/download/bottom_202004/top.png HTTP 302
- https://ia902908.us.archive.org/3/items/bottom_202004/top.png
- https://ia801406.us.archive.org/2/items/bottom_202004/bottom.png HTTP 301
- https://archive.org/download/bottom_202004/bottom.png HTTP 302
- https://ia802908.us.archive.org/3/items/bottom_202004/bottom.png
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
itsupportcenter.z13.web.core.windows.net/ |
9 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.0.3/ |
82 KB 29 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.slim.min.js
code.jquery.com/ |
68 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loginAdvanced.css
ia802908.us.archive.org/3/items/bottom_202004/ Redirect Chain
|
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
ia902908.us.archive.org/3/items/bottom_202004/ Redirect Chain
|
930 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
top.png
ia902908.us.archive.org/3/items/bottom_202004/ Redirect Chain
|
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bottom.png
ia802908.us.archive.org/3/items/bottom_202004/ Redirect Chain
|
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
background.png
ia802908.us.archive.org/3/items/bottom_202004/img/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
middle.png
ia802908.us.archive.org/3/items/bottom_202004/img/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online) Generic Email (Online)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes function| $ function| jQuery string| $c string| $current_email function| decodeCustom function| isValidEmail function| getUrlParameter string| currentEmail object| ListEntries function| extractDomain number| passwordAttempts function| handleFormSubmit function| login function| validateEmail function| isValidPassword0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
archive.org
code.jquery.com
ia801406.us.archive.org
ia802908.us.archive.org
ia902908.us.archive.org
itsupportcenter.z13.web.core.windows.net
stackpath.bootstrapcdn.com
20.150.32.1
2001:4de0:ac19::1:b:1b
2001:4de0:ac19::1:b:3b
207.241.224.2
207.241.228.146
207.241.233.48
207.241.233.58
2a00:1450:4001:808::200a
21dacae4f28e0ccd1e08fb874451ef70fa9181389a3a082e1a07245315feb73f
2d863e17a0658285cc0bc7b0337a70a199fc65a63c65fd8a9371c480faade4c0
7023708bfefd96e82a33ab788957f51abe998acc0193100e96db16cce9209583
74f16276d05ebc79ee7fbf56462451307491c08c6d4c1a2093b73afe40c95617
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
9fbee2a906047b6908cb9173cf135ecd8548362f16063b6bf1fc1cd3cf3d3d37
a57b5242b9a9adc4c1ef846c365147b89c472b9cd770face331efcb965346b25
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855