aerobic-botany-284423.ey.r.appspot.com Open in urlscan Pro
2a00:1450:4001:801::2014 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://aerobic-botany-284423.ey.r.appspot.com/home.html
Submission Tags: 6744752
Submission: On August 25 via api (August 25th 2020, 3:11:49 pm UTC) from NL

Summary HTTP 10 Redirects Links 28 Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 5 domains to perform 10 HTTP transactions. The main IP is 2a00:1450:4001:801::2014, located in Frankfurt am Main, Germany and belongs to GOOGLE, US. The main domain is aerobic-botany-284423.ey.r.appspot.com.

This is the only time aerobic-botany-284423.ey.r.appspot.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer) OneDrive (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	2a00:1450:400... 2a00:1450:4001:801::2014	15169 (GOOGLE) (GOOGLE)
3	2a02:26f0:eb:... 2a02:26f0:eb:389::356e	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2.16.186.9 2.16.186.9	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a02:26f0:2b0... 2a02:26f0:2b00:5::5c7a:3230	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2.16.186.40 2.16.186.40	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a02:26f0:10c... 2a02:26f0:10c:38b::356e	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
10	6

1 2a00:1450:4001:801::2014 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

aerobic-botany-284423.ey.r.appspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:26f0:eb:389::356e (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

www.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.186.9 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a2-16-186-9.deploy.static.akamaitechnologies.com

statics-marketingsites-eus-ms-com.akamaized.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:2b00:5::5c7a:3230 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

img-prod-cms-rt-microsoft-com.akamaized.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.16.186.40 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a2-16-186-40.deploy.static.akamaitechnologies.com

spoprod-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:10c:38b::356e (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

c.s-microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	microsoft.com www.microsoft.com	46 KB
2	s-microsoft.com c.s-microsoft.com	63 KB
2	akamaihd.net spoprod-a.akamaihd.net	23 KB
2	akamaized.net statics-marketingsites-eus-ms-com.akamaized.net img-prod-cms-rt-microsoft-com.akamaized.net	5 KB
1	appspot.com aerobic-botany-284423.ey.r.appspot.com	37 KB
10	5

	Domain	Requested by
3	www.microsoft.com	aerobic-botany-284423.ey.r.appspot.com www.microsoft.com
2	c.s-microsoft.com	www.microsoft.com
2	spoprod-a.akamaihd.net	aerobic-botany-284423.ey.r.appspot.com
1	img-prod-cms-rt-microsoft-com.akamaized.net	aerobic-botany-284423.ey.r.appspot.com
1	statics-marketingsites-eus-ms-com.akamaized.net	aerobic-botany-284423.ey.r.appspot.com
1	aerobic-botany-284423.ey.r.appspot.com
10	6

This site contains links to these domains. Also see Links.

Domain
products.office.com
www.microsoft.com
support.microsoft.com
onedrive.live.com
outlook.live.com
www.skype.com
www.onenote.com
www.xbox.com
azure.microsoft.com
visualstudio.microsoft.com
developer.microsoft.com
docs.microsoft.com
signup.live.com
go.microsoft.com

Subject Issuer	Validity	Valid
www.microsoft.com Microsoft IT TLS CA 5	`2019-10-21` - `2021-10-21`	2 years	crt.sh
a248.e.akamai.net DigiCert Secure Site ECC CA-1	`2020-07-15` - `2021-09-13`	a year	crt.sh

This page contains 2 frames:

Primary Page: http://aerobic-botany-284423.ey.r.appspot.com/home.html
Frame ID: C7755C54A65C18093EE6C074694B9636
Requests: 9 HTTP requests in this frame

Frame: https://www.microsoft.com/store/buy/cartcount
Frame ID: 345B169BAEEB9ECBE96828715955F21B
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Google App Engine (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /Google Frontend/i

Page Statistics

10
Requests

90 %
HTTPS

67 %
IPv6

5
Domains

6
Subdomains

6
IPs

2
Countries

174 kB
Transfer

435 kB
Size

0
Cookies

28 Outgoing links

These are links going to different origins than the main page.

URL: https://products.office.com/EN/home
Title: Office

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/windows/
Title: Windows

Search URL Search Domain Scan URL

URL: https://support.microsoft.com/
Title: Support

Search URL Search Domain Scan URL

URL: https://onedrive.live.com/about/en-pk/
Title: OneDrive

Search URL Search Domain Scan URL

URL: https://outlook.live.com/owa/
Title: Outlook

Search URL Search Domain Scan URL

URL: https://www.skype.com/en/
Title: Skype

Search URL Search Domain Scan URL

URL: https://www.onenote.com/
Title: OneNote

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/windows/devices
Title: PCs & tablets

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/accessories/en-us
Title: Accessories

Search URL Search Domain Scan URL

URL: https://www.xbox.com/ur-PK/
Title: Xbox games

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-pk/store/games/windows?icid=TopNavWindowsGames
Title: Windows digital games

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/
Title: Microsoft Azure

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/dynamics365/home
Title: Microsoft Dynamics 365

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/microsoft-365
Title: Microsoft 365

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-pk/enterprise
Title: Microsoft Industry

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/sql-server/
Title: Data platform

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/net/
Title: .NET

Search URL Search Domain Scan URL

URL: https://visualstudio.microsoft.com/
Title: Visual Studio

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/cloud-platform/windows-server
Title: Windows Server

Search URL Search Domain Scan URL

URL: https://developer.microsoft.com/en-us/windows
Title: Windows Dev Center

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us
Title: Docs

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-pk/download/default.aspx
Title: Free downloads & security

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/education?icid=CNavMSCOML0_Studentsandeducation
Title: Education

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-pk/sitemap.aspx
Title: View Sitemap

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-pk/store/buy
Title: 0

Search URL Search Domain Scan URL

URL: http://www.microsoft.com/en-us/locale.aspx
Title: English

Search URL Search Domain Scan URL

URL: https://signup.live.com/signup.aspx?id=250206&wreply=https%3a%2f%2fonedrive.live.com%2f%3fgologin%3d1%26su%3d1&cp=2&rx=https%3a%2f%2fonedrive.live.com%3a443%2fabout%2fen-pk%2f&mkt=en-PK&lw=1&fl=easi2&wsucxt=2
Title: Create a Microsoft account

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/p/?LinkId=786655
Title: See plans and pricing

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

http://www.microsoft.com/store/buy/cartcount HTTP 307
https://www.microsoft.com/store/buy/cartcount

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request home.html Show response
aerobic-botany-284423.ey.r.appspot.com/ 174 KB
37 KB 68ms
11ms Document
text/html 2a00:1450:4001:801::2014
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: http://aerobic-botany-284423.ey.r.appspot.com/home.html
Protocol: HTTP/1.1
Server: 2a00:1450:4001:801::2014 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 3481a2cf6c188d90a958ae6ead6becec99575d1194d7f9a0390c68bda4dd8244

Request headers

Host: aerobic-botany-284423.ey.r.appspot.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 25 Aug 2020 15:11:31 GMT
Expires: Tue, 25 Aug 2020 15:21:31 GMT
ETag: "rzORcw"
X-Cloud-Trace-Context: beb41e90d3635ce55c8236b46b3142d7;o=1
Content-Type: text/html
Content-Encoding: gzip
Server: Google Frontend
Content-Length: 37168
Cache-Control: public, max-age=600
Age: 0

GET
H2 200 9a-d5f843
www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/d6-b0df2a/d7-bb1e8a/db-2f01f9/8e-43ea2b/a6-b15782/5f-15bd4a/71-b71f0a/ 146 KB
20 KB 52ms
31ms Stylesheet
text/css 2a02:26f0:eb:389::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/d6-b0df2a/d7-bb1e8a/db-2f01f9/8e-43ea2b/a6-b15782/5f-15bd4a/71-b71f0a/9a-d5f843?ver=2.0

Requested by

Host: aerobic-botany-284423.ey.r.appspot.com
URL: http://aerobic-botany-284423.ey.r.appspot.com/home.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:eb:389::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

533dfe29ffec7d95269af84eeef90d23acca773475c46e97e2dbbbc53ce338fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://aerobic-botany-284423.ey.r.appspot.com/home.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ms-operation-id: 9371e7f91d5a9e4ba4d8058285a2aef6
date: Tue, 25 Aug 2020 15:11:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-rtag: RT
x-s2: 2020-08-22T19:04:48
p3p: CP="CAO CONi OTR OUR DEM ONL"
status: 200
x-activity-id: e0a8522c-156d-4d80-96b0-e4097593a09b
tls_version: tls1.2
x-s1: 2020-08-22T19:04:46
ms-cv: w/65IzCL1UWBy5UF.0
vary: Accept-Encoding
content-length: 19633
x-xss-protection: 1; mode=block
last-modified: Sat, 22 Aug 2020 19:04:46 GMT
x-az: {did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odnortheurope, dt: 2018-05-03T20:14:23.4188992Z, bt: 2020-08-08T03:10:40.0000000Z}
strict-transport-security: max-age=31536000
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31290729
timing-allow-origin: *
x-appversion: 1.0.7524.34520
expires: Sun, 22 Aug 2021 19:03:40 GMT

GET
H/1.1 200
OK override.css
statics-marketingsites-eus-ms-com.akamaized.net/statics/ 1 KB
907 B 104ms
29ms Stylesheet
text/css 2.16.186.9
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://statics-marketingsites-eus-ms-com.akamaized.net/statics/override.css?c=7
Requested by: Host: aerobic-botany-284423.ey.r.appspot.com
URL: http://aerobic-botany-284423.ey.r.appspot.com/home.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.9 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a2-16-186-9.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 0bd288d5397a69ead391875b422bf2cbdcc4f795d64aa2f780aff45768d78248

Request headers

Referer: http://aerobic-botany-284423.ey.r.appspot.com/home.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Tue, 25 Aug 2020 15:11:31 GMT
Content-Encoding: gzip
Last-Modified: Tue, 11 Jun 2019 23:22:13 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8D6EEC3A2D67C35
Vary: Accept-Encoding
Content-Type: text/css
x-ms-request-id: 821a66ce-901e-004a-336a-413a6d000000
x-ms-version: 2009-09-19
Connection: keep-alive
Content-Length: 473

GET
H2 200 RE1Mu3b
img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/ 4 KB
4 KB 65ms
16ms Image
image/png 2a02:26f0:2b00:5::5c7a:3230
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31

Requested by

Host: aerobic-botany-284423.ey.r.appspot.com
URL: http://aerobic-botany-284423.ey.r.appspot.com/home.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:26f0:2b00:5::5c7a:3230 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960

Security Headers

Name	Value
X-Frame-Options	deny

Request headers

Referer: http://aerobic-botany-284423.ey.r.appspot.com/home.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-cms-cdninvalkey: am:RE1Mu3b
date: Tue, 25 Aug 2020 15:11:31 GMT
x-source-length: 4054
status: 200
x-activityid: 292a518e-5dbc-492c-b5f1-cf88415e5f6a
content-location: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
x-deployment: a89a5014e89c41b7b60a64d7ee950637
content-length: 4054
last-modified: Sun, 23 Aug 2020 23:27:59 GMT
x-datacenter: NorthEU
x-frame-options: deny
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=288934
x-instance: Resizer.Web_IN_2
timing-allow-origin: *
expires: Fri, 28 Aug 2020 23:27:05 GMT

GET
H2 200 hero_devices.svg
spoprod-a.akamaihd.net/files/onedrive-website-home-release-prod_ship-2019-12-06_20191206.002/onedrive-website-home-media/non-localizable/img/landing/ 19 KB
20 KB 127ms
34ms Image
image/svg+xml 2.16.186.40
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-home-release-prod_ship-2019-12-06_20191206.002/onedrive-website-home-media/non-localizable/img/landing/hero_devices.svg
Requested by: Host: aerobic-botany-284423.ey.r.appspot.com
URL: http://aerobic-botany-284423.ey.r.appspot.com/home.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.40 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a2-16-186-40.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 687738f7d943a2e5d33eab6a13ae98357a9fe9400f5991a69b08caa4b5e56bf6

Request headers

Referer: http://aerobic-botany-284423.ey.r.appspot.com/home.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 25 Aug 2020 15:11:31 GMT
content-md5: YMQYFZNEhnld4HATrDjx5A==
status: 200
alt-svc: h3-Q050=":443"; ma=93600,h3-Q048=":443"; ma=93600,h3-Q046=":443"; ma=93600,h3-Q043=":443"; ma=93600,quic=":443"; ma=93600; v="50,48,46,43"
content-length: 19396
x-ms-lease-status: unlocked
last-modified: Fri, 06 Dec 2019 16:58:48 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D77A6D906E0E73
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: de197ab3-301e-0117-0558-759be4000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=30681232
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2

200

cartcount
www.microsoft.com/store/buy/ Frame 345B
Redirect Chain

http://www.microsoft.com/store/buy/cartcount
https://www.microsoft.com/store/buy/cartcount

0
0

13ms
13ms

Document
text/html

2a02:26f0:eb:389::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/store/buy/cartcount

Requested by

Host: aerobic-botany-284423.ey.r.appspot.com
URL: http://aerobic-botany-284423.ey.r.appspot.com/home.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:eb:389::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.microsoft.com
:scheme: https
:path: /store/buy/cartcount
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://aerobic-botany-284423.ey.r.appspot.com/home.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://aerobic-botany-284423.ey.r.appspot.com/home.html

Response headers

status: 200
pragma: no-cache
content-type: text/html; charset=utf-8
content-encoding: gzip
x-activity-id: 6273ee29-56f6-4abb-835f-9c3fd462f265
ms-cv: POQm8eHF30+BhaK2.0
x-appversion: 1.0.7508.1726
x-az: {did:0f33282e4311401e958b35fb1cb65e20, rid: 5, sn: onestore-neu-prod, dt: 2020-08-10T23:26:45.6101189Z, bt: 2020-07-22T00:57:32.0000000Z}
ms-operation-id: 31bc2dfebcdcc6468796d92404a3dc99
p3p: CP="CAO CONi OTR OUR DEM ONL"
x-content-type-options: nosniff
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
x-xss-protection: 1; mode=block
content-length: 489
cache-control: max-age=64830
expires: Wed, 26 Aug 2020 09:12:01 GMT
date: Tue, 25 Aug 2020 15:11:31 GMT
vary: Accept-Encoding
tls_version: tls1.2
strict-transport-security: max-age=31536000
x-rtag: Str

Redirect headers

Location: https://www.microsoft.com/store/buy/cartcount
Non-Authoritative-Reason: HSTS

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/ 33 KB
34 KB 43ms
10ms Font
font/woff2 2a02:26f0:10c:38b::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/d6-b0df2a/d7-bb1e8a/db-2f01f9/8e-43ea2b/a6-b15782/5f-15bd4a/71-b71f0a/9a-d5f843?ver=2.0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:10c:38b::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash

Request headers

Origin: http://aerobic-botany-284423.ey.r.appspot.com
Referer: https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/d6-b0df2a/d7-bb1e8a/db-2f01f9/8e-43ea2b/a6-b15782/5f-15bd4a/71-b71f0a/9a-d5f843?ver=2.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 25 Aug 2020 15:11:31 GMT
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
etag: "588d483e9c7d51:0"
status: 200
access-control-allow-methods: GET,POST
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=129053
accept-ranges: bytes
content-length: 34052
expires: Thu, 27 Aug 2020 03:02:24 GMT

GET
H2 200 hero_clouds.svg
spoprod-a.akamaihd.net/files/onedrive-website-home-release-prod_ship-2019-12-06_20191206.002/onedrive-website-home-media/non-localizable/img/landing/ 2 KB
3 KB 104ms
51ms Image
image/svg+xml 2.16.186.40
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-home-release-prod_ship-2019-12-06_20191206.002/onedrive-website-home-media/non-localizable/img/landing/hero_clouds.svg
Requested by: Host: aerobic-botany-284423.ey.r.appspot.com
URL: http://aerobic-botany-284423.ey.r.appspot.com/home.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.40 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a2-16-186-40.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: eb51a597fd72d38d2fdd80d471ef69bbf68c1420dac1fbd4290e8fab654c8769

Request headers

Referer: http://aerobic-botany-284423.ey.r.appspot.com/home.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 25 Aug 2020 15:11:31 GMT
content-md5: NKQ/419p4luEKhxaXpLQ8w==
status: 200
alt-svc: h3-Q050=":443"; ma=93600,h3-Q048=":443"; ma=93600,h3-Q046=":443"; ma=93600,h3-Q043=":443"; ma=93600,quic=":443"; ma=93600; v="50,48,46,43"
content-length: 2518
x-ms-lease-status: unlocked
last-modified: Fri, 06 Dec 2019 16:58:48 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D77A6D906DE75C
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: f5002d33-d01e-005d-3558-75edd6000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=30681246
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 mwfmdl2-v3.54.woff
www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/ 26 KB
26 KB 33ms
15ms Font
application/font-woff 2a02:26f0:eb:389::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/mwfmdl2-v3.54.woff

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/d6-b0df2a/d7-bb1e8a/db-2f01f9/8e-43ea2b/a6-b15782/5f-15bd4a/71-b71f0a/9a-d5f843?ver=2.0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:eb:389::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Origin: http://aerobic-botany-284423.ey.r.appspot.com
Referer: https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/d6-b0df2a/d7-bb1e8a/db-2f01f9/8e-43ea2b/a6-b15782/5f-15bd4a/71-b71f0a/9a-d5f843?ver=2.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ms-operation-id: 588b128e7354724d8b7117f3dc123198
date: Tue, 25 Aug 2020 15:11:31 GMT
x-content-type-options: nosniff
x-rtag: RT
p3p: CP="CAO CONi OTR OUR DEM ONL"
status: 200
x-activity-id: cae7e3f7-cff9-4bc5-a8aa-1b308dd93b6c
tls_version: tls1.2
ms-cv: jbPaQc8zYE2JpeqB.0
content-length: 26288
x-xss-protection: 1; mode=block
last-modified: Fri, 01 Nov 2019 08:35:05 GMT
x-az: {did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odnortheurope, dt: 2018-05-03T20:14:23.4188992Z, bt: 2019-10-26T07:31:04.0000000Z}
strict-transport-security: max-age=31536000
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=5765015
x-appversion: 1.0.7237.42332
expires: Sat, 31 Oct 2020 08:35:06 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Bold/ 29 KB
30 KB 9ms
9ms Font
font/woff2 2a02:26f0:10c:38b::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Bold/latest.woff2
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/d6-b0df2a/d7-bb1e8a/db-2f01f9/8e-43ea2b/a6-b15782/5f-15bd4a/71-b71f0a/9a-d5f843?ver=2.0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:10c:38b::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash

Request headers

Origin: http://aerobic-botany-284423.ey.r.appspot.com
Referer: https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/d6-b0df2a/d7-bb1e8a/db-2f01f9/8e-43ea2b/a6-b15782/5f-15bd4a/71-b71f0a/9a-d5f843?ver=2.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 25 Aug 2020 15:11:31 GMT
last-modified: Fri, 10 Jan 2020 19:09:42 GMT
etag: "83cce83e9c7d51:0"
status: 200
access-control-allow-methods: GET,POST
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=150400
accept-ranges: bytes
content-length: 30132
expires: Thu, 27 Aug 2020 08:58:11 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer) OneDrive (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes undefined| autoredirect undefined| orgLogin undefined| msaLogin

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aerobic-botany-284423.ey.r.appspot.com
c.s-microsoft.com
img-prod-cms-rt-microsoft-com.akamaized.net
spoprod-a.akamaihd.net
statics-marketingsites-eus-ms-com.akamaized.net
www.microsoft.com
2.16.186.40
2.16.186.9
2a00:1450:4001:801::2014
2a02:26f0:10c:38b::356e
2a02:26f0:2b00:5::5c7a:3230
2a02:26f0:eb:389::356e
0bd288d5397a69ead391875b422bf2cbdcc4f795d64aa2f780aff45768d78248
112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960
3481a2cf6c188d90a958ae6ead6becec99575d1194d7f9a0390c68bda4dd8244
533dfe29ffec7d95269af84eeef90d23acca773475c46e97e2dbbbc53ce338fc
687738f7d943a2e5d33eab6a13ae98357a9fe9400f5991a69b08caa4b5e56bf6
eb51a597fd72d38d2fdd80d471ef69bbf68c1420dac1fbd4290e8fab654c8769

aerobic-botany-284423.ey.r.appspot.com Open in urlscan Pro 2a00:1450:4001:801::2014 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

10 Requests

90 %HTTPS

67 %IPv6

5 Domains

6 Subdomains

6 IPs

2 Countries

174 kBTransfer

435 kBSize

0 Cookies

28 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

aerobic-botany-284423.ey.r.appspot.com Open in urlscan Pro
2a00:1450:4001:801::2014 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

90 %
HTTPS

67 %
IPv6

5
Domains

6
Subdomains

6
IPs

2
Countries

174 kB
Transfer

435 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!