![](/screenshots/4a78057e-a7ae-470d-836c-0bf15639c972.png)
login-live.com-secure.net
Open in
urlscan Pro
78.47.159.0
Malicious Activity!
Public Scan
Submission: On July 13 via manual from DE
Summary
TLS certificate: Issued by R3 on May 4th 2021. Valid for: 3 months.
This is the only time login-live.com-secure.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
16 | 78.47.159.0 78.47.159.0 | 24940 (HETZNER-AS) (HETZNER-AS) | |
3 | 116.203.230.3 116.203.230.3 | 24940 (HETZNER-AS) (HETZNER-AS) | |
19 | 2 |
ASN24940 (HETZNER-AS, DE)
PTR: static.3.230.203.116.clients.your-server.de
api.sosafe.de |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
com-secure.net
login-live.com-secure.net |
1 MB |
3 |
sosafe.de
api.sosafe.de |
14 KB |
19 | 2 |
Domain | Requested by | |
---|---|---|
16 | login-live.com-secure.net |
login-live.com-secure.net
|
3 | api.sosafe.de |
login-live.com-secure.net
|
19 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
com-secure.net R3 |
2021-05-04 - 2021-08-02 |
3 months | crt.sh |
api.sosafe.de R3 |
2021-07-07 - 2021-10-05 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://login-live.com-secure.net/de/?code=4221b072335df1ca05ed685b3632c506
Frame ID: F9A4FD28ACB1B5D6C1756F12D40EA6BC
Requests: 19 HTTP requests in this frame
Screenshot
![](/screenshots/4a78057e-a7ae-470d-836c-0bf15639c972.png)
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
- script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
login-live.com-secure.net/de/ |
5 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.css
login-live.com-secure.net/assets/bootstrap/css/ |
138 KB 138 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fontawesome-all.min.css
login-live.com-secure.net/assets/fonts/ |
40 KB 40 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
material-icons.min.css
login-live.com-secure.net/assets/fonts/ |
667 B 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
typicons.min.css
login-live.com-secure.net/assets/fonts/ |
15 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.min.css
login-live.com-secure.net/assets/css/ |
4 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
info.svg
login-live.com-secure.net/assets/img/ |
338 B 709 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
question.svg
login-live.com-secure.net/assets/img/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
_version.js
login-live.com-secure.net/assets/js/ |
80 B 458 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
5.19.2-sentry.min.js
login-live.com-secure.net/assets/js/ |
57 KB 57 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
login-live.com-secure.net/assets/js/ |
85 KB 85 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.js
login-live.com-secure.net/assets/bootstrap/js/ |
69 KB 69 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lang.js
login-live.com-secure.net/assets/js/ |
19 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.js
login-live.com-secure.net/assets/js/ |
1 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bundle.min.js
login-live.com-secure.net/assets/js/ |
11 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ip
api.sosafe.de/v1/user/ |
77 B 650 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
info
api.sosafe.de/v1/report/ |
675 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
report
api.sosafe.de/v1/ |
11 KB 12 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1.png
login-live.com-secure.net/assets/img/ |
642 KB 642 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)39 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| soSafeSentryBuild object| Sentry object| __SENTRY__ function| $ function| jQuery object| bootstrap object| soSafeDictionary function| hasFinishedLoading function| onCodeInfoLoaded function| stylePageRtl object| CONSTANTS_DEV object| CONSTANTS_PROD object| CONSTANTS_STAGE object| CONSTANTS function| isDevelopmentEnvironment function| isStagingEnvironment function| isProductionEnvironment function| initPage function| getPage function| getUserIp function| getInfoForCode function| sendReportCall function| translate function| initLang function| setEventListeners function| findGetParameter string| soSafeLanguage string| infopage0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains |
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.sosafe.de
login-live.com-secure.net
116.203.230.3
78.47.159.0
00646f48f5303963be9bc2f08c1a91de77d21cd4b564832b4c35230f468aa746
0acca0c94ebaa625ffffc6650a8942c9feeb3e42739df5bdf36435613917d8a2
16338693257207afecfd0db0881700330f25d2efec43463e330a98dd206c9256
39646863a414e0a84920b3a8639c0f3e8c94535e8dc051b42b485a068dc2902f
3b1570b5ff9ff35087c117c63a418199a11c6eeaf6954846b297b7bf95496129
46b4721c80749cc5e1ec6cf4c5fec78a2c51fdfc4ee9c94f2223cdaf4fbd8ced
5aa8caa7067efbf51232832298b337582c00619f968de5ca4325b1885cf2b68b
7aaaa9db626b93b7f3f84506642bad0e32f1d914ce151d4f23ac88317b58705f
81c4f50096d17e8cdfe9c95d5996af25efba6d081462ddd068a1014fd7cd28d4
8660ed12799916f277ccbb1fa1ba74dc2483dffa91089998ddfed5a9feb32200
928f97f310d8f768c5e3d521e3b1ce2cff156f9cc60c5d09fad772f4a2c43f52
a76c08e9cdc3bb87bfb57627ad8f6b46f0e5ef826cc7f046dfbaf25d7b7958ea
ab21975975bc50565bb8c3c547e29ffaea99a1f70ddddd1328a016ab83cc1dc7
e2fc95a542d2220697a5b576425c8f1d543d1c3c60d7013237929b8f5313bc60
e6d320e78607a6fef00f912cc201d2745e38271aedae23cfa9a0b7823542cc2d
e78098c9d55fcd196acc23bb905e94881fbe157504e9c179f23ae85399e28682
e9f51290c7050c5bd66a45c9fb34ee8ccdf2b95e9f16551a37d496ca4d508ecd
ecc9012fe5c421149acf0e70eccfefe4979ef2fd2887db1a9452bff6fdbe99ba
fd702d8d6882cc47c74308ec46b1476035492c3d887741b279bb830c49b9b2bf