![](/screenshots/53e9b9c8-0312-4e3e-a44f-a5b1f16dc2de.png)
tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net
Open in
urlscan Pro
40.69.106.97
Malicious Activity!
Public Scan
Effective URL: https://tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net/en/
Submission: On May 12 via api from US — Scanned from CA
Summary
TLS certificate: Issued by Microsoft Azure RSA TLS Issuing CA 08 on March 13th 2024. Valid for: a year.
This is the only time tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Canadian Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 4 | 40.69.106.97 40.69.106.97 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
7 | 20.60.43.235 20.60.43.235 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 172.253.115.95 172.253.115.95 | 15169 (GOOGLE) (GOOGLE) | |
1 | 23.1.200.101 23.1.200.101 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 151.101.193.229 151.101.193.229 | 54113 (FASTLY) (FASTLY) | |
1 | 142.251.111.97 142.251.111.97 | 15169 (GOOGLE) (GOOGLE) | |
1 | 72.21.81.200 72.21.81.200 | 15133 (EDGECAST) (EDGECAST) | |
2 | 52.179.73.52 52.179.73.52 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
20 | 9 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
clouduatrcconv.blob.core.windows.net |
ASN16625 (AKAMAI-AS, US)
PTR: a23-1-200-101.deploy.static.akamaitechnologies.com
www.canada.ca |
ASN15169 (GOOGLE, US)
PTR: bk-in-f97.1e100.net
www.googletagmanager.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
dc.services.visualstudio.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
windows.net
clouduatrcconv.blob.core.windows.net |
661 KB |
4 |
trafficmanager.net
1 redirects
tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net |
10 KB |
2 |
visualstudio.com
dc.services.visualstudio.com — Cisco Umbrella Rank: 751 |
200 B |
1 |
msecnd.net
az416426.vo.msecnd.net — Cisco Umbrella Rank: 2776 |
22 KB |
1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39 |
48 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 310 |
1 KB |
1 |
canada.ca
www.canada.ca — Cisco Umbrella Rank: 37480 |
38 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 380 |
33 KB |
20 | 8 |
Domain | Requested by | |
---|---|---|
7 | clouduatrcconv.blob.core.windows.net |
tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net
clouduatrcconv.blob.core.windows.net |
4 | tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net |
1 redirects
tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net
|
2 | dc.services.visualstudio.com |
az416426.vo.msecnd.net
|
1 | az416426.vo.msecnd.net |
tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net
|
1 | www.googletagmanager.com |
tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net
|
1 | cdn.jsdelivr.net |
tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net
|
1 | www.canada.ca |
tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net
|
1 | ajax.googleapis.com |
tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net
|
20 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.canada.ca |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.azurewebsites.net Microsoft Azure RSA TLS Issuing CA 08 |
2024-03-13 - 2025-03-08 |
a year | crt.sh |
*.blob.core.windows.net Microsoft Azure RSA TLS Issuing CA 03 |
2024-04-05 - 2025-03-31 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
*.canada.ca GeoTrust RSA CA 2018 |
2024-01-24 - 2025-01-23 |
a year | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3 |
2023-09-27 - 2024-10-28 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
*.vo.msecnd.net DigiCert SHA2 Secure Server CA |
2024-01-30 - 2025-01-30 |
a year | crt.sh |
in.applicationinsights.azure.com Microsoft Azure RSA TLS Issuing CA 04 |
2024-04-18 - 2025-04-13 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net/en/
Frame ID: 266468AD22D308E231FEF3484BD74E41
Requests: 19 HTTP requests in this frame
Screenshot
![](/screenshots/53e9b9c8-0312-4e3e-a44f-a5b1f16dc2de.png)
Page Title
Convergence Portal / Portail ConvergencePage URL History Show full URLs
-
https://tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net/
HTTP 302
https://tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net/en/ Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- googletagmanager\.com/gtag/js
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Terms and conditions
Search URL Search Domain Scan URL
Title: Avis
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net/
HTTP 302
https://tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net/en/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net/en/ Redirect Chain
|
8 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.css
clouduatrcconv.blob.core.windows.net/xrmportal-webfiles/ |
313 KB 313 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
glyphicons-font-awesome-migrate.min.css
tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net/css/ |
13 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
default.bundle.css
tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net/css/ |
0 0 |
Stylesheet
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
theme.min.css
clouduatrcconv.blob.core.windows.net/xrmportal-webfiles/css/ |
297 KB 298 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
RP.css
clouduatrcconv.blob.core.windows.net/xrmportal-webfiles/ |
24 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.9.1/ |
90 KB 33 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sp-bg-10.jpg
www.canada.ca/content/dam/canada/splash/ |
38 KB 38 KB |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sig-blk-en.svg
clouduatrcconv.blob.core.windows.net/xrmportal-webfiles/assets/ |
10 KB 11 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wmms-blk.svg
clouduatrcconv.blob.core.windows.net/xrmportal-webfiles/assets/ |
5 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.cookie.min.js
cdn.jsdelivr.net/npm/jquery.cookie@1.4.1/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
RP.Common.js
clouduatrcconv.blob.core.windows.net/xrmportal-webfiles/ |
4 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
125 KB 48 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
glyphicons-halflings-regular.woff2
clouduatrcconv.blob.core.windows.net/xrmportal-webfiles/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ai.0.js
az416426.vo.msecnd.net/scripts/a/ |
94 KB 22 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
glyphicons-halflings-regular.woff
clouduatrcconv.blob.core.windows.net/xrmportal-webfiles/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
glyphicons-halflings-regular.ttf
clouduatrcconv.blob.core.windows.net/xrmportal-webfiles/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
clouduatrcconv.blob.core.windows.net/xrmportal-webfiles/ |
5 KB 6 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
track
dc.services.visualstudio.com/v2/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
track
dc.services.visualstudio.com/v2/ |
96 B 200 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- clouduatrcconv.blob.core.windows.net
- URL
- https://clouduatrcconv.blob.core.windows.net/xrmportal-webfiles/fonts/glyphicons-halflings-regular.woff2
- Domain
- clouduatrcconv.blob.core.windows.net
- URL
- https://clouduatrcconv.blob.core.windows.net/xrmportal-webfiles/fonts/glyphicons-halflings-regular.woff
- Domain
- clouduatrcconv.blob.core.windows.net
- URL
- https://clouduatrcconv.blob.core.windows.net/xrmportal-webfiles/fonts/glyphicons-halflings-regular.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Canadian Government (Government)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| parseQueryString function| buildSelectIntoList function| getDecodedHtml function| decodeHtml function| gtag object| dataLayer object| appInsights object| google_tag_manager object| google_tag_data object| AI object| Microsoft function| __extends function| _endsWith6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net/ | Name: Dynamics365PortalAnalytics Value: Rma4Ygft-HgHxH0lLSVdl56kKm06_O-ogiC6WN8ORDQqLAdYjWWiqS2SFwecgPeqxLrw6dlzjRTN_wpoUYAUFCnx1jpyd9iS-cnL866xlj084YTZiM0ShZgvfQbIrd_9TkVvK75-gIpfKaKs4g5D8w2 |
|
.tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net/ | Name: ARRAffinity Value: 049ecdba39d54bafc58464e95b89cb2cef886df08ad303081c46fe34e398382e |
|
.tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net/ | Name: ARRAffinitySameSite Value: 049ecdba39d54bafc58464e95b89cb2cef886df08ad303081c46fe34e398382e |
|
tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net/ | Name: ASP.NET_SessionId Value: lxux0wepy0uyo13sfzyueug4 |
|
tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net/ | Name: ai_user Value: Ji4E4|2024-05-12T02:48:14.157Z |
|
tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net/ | Name: ai_session Value: CvqkS|1715482094561.6|1715482094561.6 |
7 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload |
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
az416426.vo.msecnd.net
cdn.jsdelivr.net
clouduatrcconv.blob.core.windows.net
dc.services.visualstudio.com
tm-6346943f-8d66-4d4d-a38b-034e34b5aa12.trafficmanager.net
www.canada.ca
www.googletagmanager.com
clouduatrcconv.blob.core.windows.net
142.251.111.97
151.101.193.229
172.253.115.95
20.60.43.235
23.1.200.101
40.69.106.97
52.179.73.52
72.21.81.200
00982f89c26d7393e8cbb3eb0daa7a7d900aa446f9eb8364b566d79421328ab8
1a83bcab05ffe3c5e5e8cd52e99a53be12d7af34eb14ab9be929184be9523a2b
22ad692f8d408db2cb6ed5a9e6bc01926c4ea04a74704c61407aefeb492c6366
282e01c7f0a7fb43cd280b3afcc7a75d1c1f6dbaff91c2a22d9a1820d7572bda
2d50ce909a846fb8fabbe06a36dae9a6ee526d92cd57f090f5fe9fe3b992e415
5034923843dc5d27b9e1556fd8205aac74a4776532c05107e6fccac51c447f71
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e
6ecb3da4b4b5adae0b627fafbf31366a07c33c047452ee750822e34b14dd1fb2
6fcbb08a78aa7780c639f0e3e1943e0a0f7af03043aa82f745d103c215b1feab
73ee363ee4285da90c0fd36eced60110c468f3b01c8a6a44aac6a9e7195231f3
a16b8f94c0dd6233e7fa1902016419db82226479133ef7e4b5a72823b88dd4f5
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
c57c66615531f7f1571e8d4f032c73b2dce424393d5dec0d927a98f90463315b
dc827f391db1b0a6917a1773e98731ab7901dd9897f0ad46c0f797f27f279487
ede8178f5d7e3f8bafa83702d2c54ae6f6e3bfb12f8acda98d5181a63365c81f