office365.suppports.com Open in urlscan Pro
35.222.212.161  Malicious Activity! Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response office365.suppports.com/	21 KB 5 KB	1150ms 903ms	Document text/html	35.222.212.161 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://office365.suppports.com/?rid=01F3MF7P8K0CFHBHQ7DWW868BH Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.222.212.161 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 161.212.222.35.bc.googleusercontent.com Software nginx/1.17.8 / Resource Hash 7cac0f4bb567655cc7af50006ac157f1c2b7f1eaf100e208f548de2ce7092dd3 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers :method GET :authority office365.suppports.com :scheme https :path /?rid=01F3MF7P8K0CFHBHQ7DWW868BH pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers server nginx/1.17.8 date Sat, 24 Jul 2021 13:37:17 GMT content-type text/html; charset=utf-8 content-encoding gzip vary Accept-Encoding strict-transport-security max-age=15724800; includeSubDomains
GET H2	200	microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg aadcdn.msftauth.net/ests/2.1/content/images/	4 KB 2 KB	144ms 110ms	Image image/svg+xml	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg Requested by Host: office365.suppports.com URL: https://office365.suppports.com/?rid=01F3MF7P8K0CFHBHQ7DWW868BH Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Referer https://office365.suppports.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sat, 24 Jul 2021 13:37:17 GMT content-encoding gzip content-md5 nzaLxFgP7ZB3dfMcaybWzw== x-cache HIT content-length 1435 x-ms-lease-status unlocked last-modified Fri, 02 Nov 2018 20:25:22 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D64101507E84BD vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 78c8fe03-f01e-0012-7291-806cc0000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding cache-control public, max-age=604800 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg aadcdn.msftauth.net/ests/2.1/content/images/	915 B 656 B	41ms 8ms	Image image/svg+xml	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg Requested by Host: office365.suppports.com URL: https://office365.suppports.com/?rid=01F3MF7P8K0CFHBHQ7DWW868BH Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8F5C) / Resource Hash 6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea Request headers Referer https://office365.suppports.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sat, 24 Jul 2021 13:37:17 GMT content-encoding gzip content-md5 HMwsHhNXdtrfirQDkzcqMA== age 379232 x-cache HIT content-length 263 x-ms-lease-status unlocked last-modified Fri, 02 Nov 2018 20:25:15 GMT server ECAcc (frc/8F5C) etag 0x8D641014CC1CD9F vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 9561aca1-801e-006a-661e-7d7634000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding cache-control public, max-age=604800 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	0_a5dbd4393ff6a725c7e62b61df7e72f0.jpg aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/	277 KB 277 KB	45ms 14ms	Image image/jpeg	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/0_a5dbd4393ff6a725c7e62b61df7e72f0.jpg Requested by Host: office365.suppports.com URL: https://office365.suppports.com/?rid=01F3MF7P8K0CFHBHQ7DWW868BH Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8F10) / Resource Hash 211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb Request headers Referer https://office365.suppports.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sat, 24 Jul 2021 13:37:17 GMT content-md5 pdvUOT/2pyXH5ith335y8A== age 364408 x-cache HIT content-length 283351 x-ms-lease-status unlocked last-modified Fri, 02 Nov 2018 20:26:15 GMT server ECAcc (frc/8F10) etag 0x8D64101702F5B97 content-type image/jpeg access-control-allow-origin * x-ms-request-id ffcd6b33-a01e-0096-2840-7d7f29000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding cache-control public, max-age=604800 x-ms-version 2009-09-19 accept-ranges bytes

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msftauth.net
office365.suppports.com
152.199.23.37
35.222.212.161
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
7cac0f4bb567655cc7af50006ac157f1c2b7f1eaf100e208f548de2ce7092dd3