urlscan.io logo urlscan.io
SecurityTrails logo

login-live-com.office365.apps.maxsolutions.com.au Open in urlscan Pro
3.104.248.170  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf
Effective URL: https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=DE-DE&uaid=ff0bf500d1f444dd9d80361dc917622f&lc=1031
Submission: On July 20 via api from LU — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 3.104.248.170, located in Sydney, Australia and belongs to AMAZON-02, US. The main domain is login-live-com.office365.apps.maxsolutions.com.au.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on March 15th 2022. Valid for: a year.
This is the only time login-live-com.office365.apps.maxsolutions.com.au was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 5 3.104.248.170 16509 (AMAZON-02)
4 1
Apex Domain
Subdomains		 Transfer
5 maxsolutions.com.au
login-live-com.office365.apps.maxsolutions.com.au
17 KB
4 1
Domain Requested by
5 login-live-com.office365.apps.maxsolutions.com.au 1 redirects login-live-com.office365.apps.maxsolutions.com.au
4 1

This site contains no links.

Subject Issuer Validity Valid
*.maxsolutions.com.au
DigiCert TLS RSA SHA256 2020 CA1		 2022-03-15 -
2023-04-15		 a year crt.sh

This page contains 1 frames:

Primary Page: https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=DE-DE&uaid=ff0bf500d1f444dd9d80361dc917622f&lc=1031
Frame ID: 881395723AE7D393B1D1C566D0A6ACC5
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Microsoft-Konto

Page URL History Show full URLs

  1. http://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf HTTP 302
    https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=DE-DE&uaid=ff0bf500d1f444dd9d80361dc917622f&lc=1031 Page URL

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

15 kB
Transfer

16 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf HTTP 302
    https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=DE-DE&uaid=ff0bf500d1f444dd9d80361dc917622f&lc=1031 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request jsdisabled.srf
login-live-com.office365.apps.maxsolutions.com.au/
Redirect Chain
  • http://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf
  • https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=DE-DE&uaid=ff0bf500d1f444dd9d80361dc917622f&lc=1031
5 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=DE-DE&uaid=ff0bf500d1f444dd9d80361dc917622f&lc=1031
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.104.248.170 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-104-248-170.ap-southeast-2.compute.amazonaws.com
Software
/
Resource Hash
06d8f0406155e16a51d5a0b041f58e076dfd6efce513fb9b9f977f467e917c51
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 10176.72.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.167 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store, no-cache
Content-Encoding
gzip
Content-Type
text/html; charset=utf-8
Date
Wed, 20 Jul 2022 12:09:02 GMT
Expires
Wed, 20 Jul 2022 12:08:02 GMT
Link
<https://logincdn.msauth.net>; rel=preconnect; crossorigin <https://acctcdn.msauth.net>; rel=preconnect; crossorigin <https://acctcdn.msftauth.net>; rel=preconnect; crossorigin <https://acctcdn.msauth.net/>; rel=dns-prefetch <https://acctcdn-msftauth-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch <https://acctcdnmsftuswe2-azureedge-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch <https://acctcdnvzeuno-azureedge-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch <https://logincdn.msauth.net/>; rel=dns-prefetch <https://lgincdnvzeuno-azureedge-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch <https://lgincdnmsftuswe2-azureedge-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch
P3P
CP="DSP CUR OTPi IND OTRi ONL FIN"
PPServer
PPV: 30 H: BY1PPF139F96A99 V: 0
Pragma
no-cache
Referrer-Policy
strict-origin-when-cross-origin
Strict-Transport-Security
max-age=31536000
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-DNS-Prefetch-Control
on
X-Frame-Options
DENY
X-XSS-Protection
1; mode=block
x-ms-request-id
8680e207-4595-4b19-a303-d68752fcf7ee
x-ms-route-info
R3_BAY

Redirect headers

Cache-Control
no-store, no-cache
Content-Type
text/html; charset=utf-8
Date
Wed, 20 Jul 2022 12:09:00 GMT
Expires
Wed, 20 Jul 2022 12:08:00 GMT
Link
<https://logincdn.msauth.net>; rel=preconnect; crossorigin <https://acctcdn.msauth.net>; rel=preconnect; crossorigin <https://acctcdn.msftauth.net>; rel=preconnect; crossorigin <https://acctcdn.msauth.net/>; rel=dns-prefetch <https://acctcdn-msftauth-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch <https://acctcdnmsftuswe2-azureedge-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch <https://acctcdnvzeuno-azureedge-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch <https://logincdn.msauth.net/>; rel=dns-prefetch <https://lgincdnvzeuno-azureedge-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch <https://lgincdnmsftuswe2-azureedge-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch
Location
https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=DE-DE&uaid=ff0bf500d1f444dd9d80361dc917622f&lc=1031
P3P
CP="DSP CUR OTPi IND OTRi ONL FIN"
PPServer
PPV: 30 H: BY1PEPF00004112 V: 0
Pragma
no-cache
Referrer-Policy
strict-origin-when-cross-origin
Strict-Transport-Security
max-age=31536000
Transfer-Encoding
chunked
X-Content-Type-Options
nosniff
X-DNS-Prefetch-Control
on
X-XSS-Protection
1; mode=block
x-ms-request-id
16e98657-bba9-4335-be2a-2c7005340a7c
x-ms-route-info
R3_BAY
__sf_event_listener_hook.js
login-live-com.office365.apps.maxsolutions.com.au/__sf_resource/_/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://login-live-com.office365.apps.maxsolutions.com.au/__sf_resource/_/__sf_event_listener_hook.js
Requested by
Host: login-live-com.office365.apps.maxsolutions.com.au
URL: https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=DE-DE&uaid=ff0bf500d1f444dd9d80361dc917622f&lc=1031
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.104.248.170 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-104-248-170.ap-southeast-2.compute.amazonaws.com
Software
/
Resource Hash
a860b9561b1615b3dca00ef253ebc8f398b346e13042dc6bef68ccac5da536ad
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=DE-DE&uaid=ff0bf500d1f444dd9d80361dc917622f&lc=1031
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 10176.72.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.167 Safari/537.36

Response headers

Cache-Control
max-age=21600
X-Content-Type-Options
nosniff
Content-Length
1849
Content-Type
text/javascript
__sf_ajax_hook.js
login-live-com.office365.apps.maxsolutions.com.au/__sf_resource/_/ 		6 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://login-live-com.office365.apps.maxsolutions.com.au/__sf_resource/_/__sf_ajax_hook.js
Requested by
Host: login-live-com.office365.apps.maxsolutions.com.au
URL: https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=DE-DE&uaid=ff0bf500d1f444dd9d80361dc917622f&lc=1031
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.104.248.170 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-104-248-170.ap-southeast-2.compute.amazonaws.com
Software
/
Resource Hash
198126ad3f4d583b32e828ed9c86a9ef0a3b7e2c8292b1422cd931a722da5418
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=DE-DE&uaid=ff0bf500d1f444dd9d80361dc917622f&lc=1031
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 10176.72.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.167 Safari/537.36

Response headers

Cache-Control
max-age=21600
X-Content-Type-Options
nosniff
Content-Length
6334
Content-Type
text/javascript
ms-logo-v2.jpg
login-live-com.office365.apps.maxsolutions.com.au/images/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login-live-com.office365.apps.maxsolutions.com.au/images/ms-logo-v2.jpg
Requested by
Host: login-live-com.office365.apps.maxsolutions.com.au
URL: https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=DE-DE&uaid=ff0bf500d1f444dd9d80361dc917622f&lc=1031
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.104.248.170 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-104-248-170.ap-southeast-2.compute.amazonaws.com
Software
/
Resource Hash
bc2b16b51738b77d94ed7591ad1033fa804297ca9faaa35222aa65773f749164
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=DE-DE&uaid=ff0bf500d1f444dd9d80361dc917622f&lc=1031
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 10176.72.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.167 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000
X-Content-Type-Options
nosniff
Last-Modified
Fri, 17 Jun 2022 13:20:36 GMT
PPServer
PPV: 30 H: BY1PEPF0000412A V: 0
ETag
"06aa874d82d81:0"
Content-Type
image/jpeg
x-ms-request-id
f6f7cf9f-8d79-4a95-a3de-df55c0b1b2d2
Cache-Control
max-age=31536000
Date
Wed, 20 Jul 2022 12:09:02 GMT
Accept-Ranges
bytes
Content-Length
2797
X-XSS-Protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| __sf__initEventListenersHook function| __sfLog function| __sf__redirect function| __sf__handleResponse function| __sf__trackXhr function| __sf__installAjaxHook function| __sf__installFetchHook function| show_verifcation_iframe function| sf_iframe_verification_success object| EventDict function| __sf__addEventListenerBase function| removeAllEventListeners function| __sf__removeEventListenerBase

2 Cookies

Domain/Path Name / Value
.office365.apps.maxsolutions.com.au/ Name: __SF__sessionId
Value: b9d59ba5c84aa0101a75028aefe12
.apps.maxsolutions.com.au/ Name: __SF__sfbid
Value: HZhMpels5Jc6fecb0a

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block