![](/screenshots/4e3b2c2a-e47c-4aae-865d-540d471bde56.png)
authmicrosoffonlne.piantemoran.com
Open in
urlscan Pro
2606:4700:3032::6815:4246
Malicious Activity!
Public Scan
Effective URL: https://authmicrosoffonlne.piantemoran.com/
Submission: On June 11 via api from US — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1P5 on May 27th 2024. Valid for: 3 months.
This is the only time authmicrosoffonlne.piantemoran.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 103.153.183.146 103.153.183.146 | 140947 (SNTHOSTIN...) (SNTHOSTINGS-AS-AP SnTHostings) | |
2 11 | 2606:4700:303... 2606:4700:3032::6815:4246 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700::68... 2606:4700::6811:2b8 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
15 | 4 |
ASN140947 (SNTHOSTINGS-AS-AP SnTHostings, IN)
PTR: 103.153.183.146.static.snthostings.com
shamoi.2afn8.top |
ASN13335 (CLOUDFLARENET, US)
authmicrosoffonlne.piantemoran.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
piantemoran.com
2 redirects
authmicrosoffonlne.piantemoran.com |
161 KB |
2 |
cloudflare.com
challenges.cloudflare.com — Cisco Umbrella Rank: 4305 |
14 KB |
2 |
2afn8.top
shamoi.2afn8.top |
933 B |
15 | 3 |
Domain | Requested by | |
---|---|---|
11 | authmicrosoffonlne.piantemoran.com |
2 redirects
authmicrosoffonlne.piantemoran.com
|
2 | challenges.cloudflare.com |
authmicrosoffonlne.piantemoran.com
challenges.cloudflare.com |
2 | shamoi.2afn8.top | |
15 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
cpcontacts.shamoi.2afn8.top R3 |
2024-05-18 - 2024-08-16 |
3 months | crt.sh |
piantemoran.com GTS CA 1P5 |
2024-05-27 - 2024-08-25 |
3 months | crt.sh |
challenges.cloudflare.com Cloudflare Inc ECC CA-3 |
2023-08-18 - 2024-08-17 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://authmicrosoffonlne.piantemoran.com/
Frame ID: 20947E5D9FFEEE4EE5C15A74DB5AB1A4
Requests: 14 HTTP requests in this frame
Frame:
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/egq7d/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Frame ID: D88FC0B83D86F13ABD966C8C2B1EC8DC
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/4e3b2c2a-e47c-4aae-865d-540d471bde56.png)
Page Title
Nur einen Moment…Page URL History Show full URLs
-
http://shamoi.2afn8.top/rekshab/
HTTP 307
https://shamoi.2afn8.top/rekshab/ Page URL
- https://authmicrosoffonlne.piantemoran.com/ Page URL
-
https://authmicrosoffonlne.piantemoran.com/cdn-cgi/phish-bypass?atok=xyVLEa9Eot4LD6yWiP4E8SRBkbcMofFnKJJYK2r7DeE-171812...
HTTP 301
https://authmicrosoffonlne.piantemoran.com/ HTTP 307
https://authmicrosoffonlne.piantemoran.com/cdn-cgi/phish-bypass?atok=xyVLEa9Eot4LD6yWiP4E8SRBkbcMofFnKJJYK2r7DeE-171812... HTTP 301
https://authmicrosoffonlne.piantemoran.com/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://shamoi.2afn8.top/rekshab/
HTTP 307
https://shamoi.2afn8.top/rekshab/ Page URL
- https://authmicrosoffonlne.piantemoran.com/ Page URL
-
https://authmicrosoffonlne.piantemoran.com/cdn-cgi/phish-bypass?atok=xyVLEa9Eot4LD6yWiP4E8SRBkbcMofFnKJJYK2r7DeE-1718126035-0.0.1.1-%2F
HTTP 301
https://authmicrosoffonlne.piantemoran.com/ HTTP 307
https://authmicrosoffonlne.piantemoran.com/cdn-cgi/phish-bypass?atok=xyVLEa9Eot4LD6yWiP4E8SRBkbcMofFnKJJYK2r7DeE-1718126035-0.0.1.1-%2F HTTP 301
https://authmicrosoffonlne.piantemoran.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://shamoi.2afn8.top/rekshab/ HTTP 307
- https://shamoi.2afn8.top/rekshab/
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
shamoi.2afn8.top/rekshab/ Redirect Chain
|
176 B 418 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
shamoi.2afn8.top/ |
315 B 515 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
authmicrosoffonlne.piantemoran.com/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
cf.errors.css
authmicrosoffonlne.piantemoran.com/cdn-cgi/styles/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
icon-exclamation.png
authmicrosoffonlne.piantemoran.com/cdn-cgi/images/ |
452 B 634 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
authmicrosoffonlne.piantemoran.com/ |
16 KB 8 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
/
authmicrosoffonlne.piantemoran.com/ Redirect Chain
|
16 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
v1
authmicrosoffonlne.piantemoran.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/ |
369 KB 103 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
api.js
challenges.cloudflare.com/turnstile/v0/g/6aac8896f227/ |
42 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
authmicrosoffonlne.piantemoran.com/ |
12 KB 12 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
8dedb49f-5e94-413b-8147-6d5d20e9fc18
https://authmicrosoffonlne.piantemoran.com/ |
13 B 0 |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
bd8d6425ad49fb2
authmicrosoffonlne.piantemoran.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1612331006:1718122244:NqT5kEC8XMchEaAnc0RII9IgtrgcltveVvTWwqMVTek/89233c1b9d7d9bd6/ |
16 KB 13 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
authmicrosoffonlne.piantemoran.com/ |
16 KB 8 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
normal
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/egq7d/0x4AAAAAAADnPIDROrmt1Wwj/light/ Frame D88F |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
7cf2f3f3-8dd7-44cc-bd34-1ce82af3c893
https://authmicrosoffonlne.piantemoran.com/ |
80 B 0 |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Cloudflare (Online)18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| _cf_chl_opt function| OZxW4 boolean| xUuJ3 function| Hbleq2 function| gnIE8 function| OGjdC1 function| KTENW1 function| gjwQJ1 function| kwsq6 object| krDY8 object| vWLFN5 object| IsRt4 number| vcXU0 object| angular object| turnstile boolean| vTyI7 string| NCyjN11 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.authmicrosoffonlne.piantemoran.com/ | Name: __cf_mw_byp Value: xyVLEa9Eot4LD6yWiP4E8SRBkbcMofFnKJJYK2r7DeE-1718126035-0.0.1.1-/ |
7 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
authmicrosoffonlne.piantemoran.com
challenges.cloudflare.com
shamoi.2afn8.top
103.153.183.146
2606:4700:3032::6815:4246
2606:4700::6811:2b8
05082d586a39bfa18455bf35abcdfd725450770a97c6264227d87025b0423b87
22401f58443400f39ce653a1736059092e1e5f85ffbbbaeda4b11c16b5bade6e
27ed816bd105985c1e93158a554964dbee8ba3e734b705676c8510bac40be109
2f1c49addd6d5f596eb3ae4dbfff718098ceb824700b5fd79d33de3aefc14925
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04
a282de4a21e3746409906549a75300eddb577ff477c6bfef628f09b03855997a
b4b990b830df66f399a57ef2a3fce67b8141b1d9b2eecca9579bb0ec9a15a019
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
dc32102f12f808c708e49863422818e48431e1e53ccf3353ecc31dafea4d55d3
e4311df48643a571201b7e9668a113540d9a3ac8f45d7fb87f8e48394861de58
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f224ebb66945020d86fea873ab0987066a8f249468e29db28aac9b1d4993d575
f3418640c1204265881221580b9d1554424f6ed49549d408da50c690ab29f400