login-live-com.o365.maxlifeinsurance.skyfencenet.com
Open in
urlscan Pro
3.109.12.210
Malicious Activity!
Public Scan
Submission: On July 24 via api from LU — Scanned from US
Summary
TLS certificate: Issued by Sectigo RSA Organization Validation S... on July 21st 2023. Valid for: a year.
This is the only time login-live-com.o365.maxlifeinsurance.skyfencenet.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 3.109.12.210 3.109.12.210 | 16509 (AMAZON-02) (AMAZON-02) | |
6 | 13.127.35.125 13.127.35.125 | 16509 (AMAZON-02) (AMAZON-02) | |
11 | 3 |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-109-12-210.ap-south-1.compute.amazonaws.com
login-live-com.o365.maxlifeinsurance.skyfencenet.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-13-127-35-125.ap-south-1.compute.amazonaws.com
logincdn-msftauth-net.o365.maxlifeinsurance.skyfencenet.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
skyfencenet.com
login-live-com.o365.maxlifeinsurance.skyfencenet.com logincdn-msftauth-net.o365.maxlifeinsurance.skyfencenet.com browser-events-data-microsoft-com.o365.maxlifeinsurance.skyfencenet.com Failed |
359 KB |
11 | 1 |
Domain | Requested by | |
---|---|---|
6 | logincdn-msftauth-net.o365.maxlifeinsurance.skyfencenet.com |
login-live-com.o365.maxlifeinsurance.skyfencenet.com
logincdn-msftauth-net.o365.maxlifeinsurance.skyfencenet.com |
3 | login-live-com.o365.maxlifeinsurance.skyfencenet.com |
login-live-com.o365.maxlifeinsurance.skyfencenet.com
|
0 | browser-events-data-microsoft-com.o365.maxlifeinsurance.skyfencenet.com Failed |
login-live-com.o365.maxlifeinsurance.skyfencenet.com
|
11 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
skyfencenet.com Sectigo RSA Organization Validation Secure Server CA |
2023-07-21 - 2024-07-20 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://login-live-com.o365.maxlifeinsurance.skyfencenet.com/login.srf
Frame ID: 7FEE42E78745718018B18D5BB084F691
Requests: 10 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
login.srf
login-live-com.o365.maxlifeinsurance.skyfencenet.com/ |
28 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
__sf_event_listener_hook.js
login-live-com.o365.maxlifeinsurance.skyfencenet.com/__sf_resource/_/ |
2 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
__sf_ajax_hook.js
login-live-com.o365.maxlifeinsurance.skyfencenet.com/__sf_resource/_/ |
6 KB 6 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_en_vrhbvbr7cDaqFNeV1k7RTg2.js
logincdn-msftauth-net.o365.maxlifeinsurance.skyfencenet.com/shared/5/js/ |
906 KB 276 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
oneds-analytics-js_54b1724af1b05e2ba3db_en.js
logincdn-msftauth-net.o365.maxlifeinsurance.skyfencenet.com/shared/5/chunks/ |
89 KB 38 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
microsoft_logo_ee5c8d9fb6248c938fd0.svg
logincdn-msftauth-net.o365.maxlifeinsurance.skyfencenet.com/shared/5/images/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2_bc3d32a696895f78c19d.svg
logincdn-msftauth-net.o365.maxlifeinsurance.skyfencenet.com/shared/5/images/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
signin_options_4e48046ce74f4b89d450.svg
logincdn-msftauth-net.o365.maxlifeinsurance.skyfencenet.com/shared/5/images/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
logincdn-msftauth-net.o365.maxlifeinsurance.skyfencenet.com/16.000.30275.14/images/ |
17 KB 18 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS |
/
browser-events-data-microsoft-com.o365.maxlifeinsurance.skyfencenet.com/OneCollector/1.0/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
/
browser-events-data-microsoft-com.o365.maxlifeinsurance.skyfencenet.com/OneCollector/1.0/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- browser-events-data-microsoft-com.o365.maxlifeinsurance.skyfencenet.com
- URL
- https://browser-events-data-microsoft-com.o365.maxlifeinsurance.skyfencenet.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0
- Domain
- browser-events-data-microsoft-com.o365.maxlifeinsurance.skyfencenet.com
- URL
- https://browser-events-data-microsoft-com.o365.maxlifeinsurance.skyfencenet.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)23 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| __sf__initEventListenersHook object| PROOF object| ServerData function| $Loader object| g_dtFirstByte function| SRSRetry function| __sfLog function| __sf__redirect function| __sf__handleResponse function| __sf__trackXhr function| __sf__installAjaxHook function| __sf__installFetchHook function| show_verifcation_iframe function| sf_iframe_verification_success object| EventDict object| webpackChunk_msidentity_sisu_msa function| clearImmediate function| setImmediate object| regeneratorRuntime object| __dynProto$Gbl function| __sf__addEventListenerBase function| removeAllEventListeners function| __sf__removeEventListenerBase9 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.o365.maxlifeinsurance.skyfencenet.com/ | Name: __SF__login.live.com/uaid Value: a4ba52f37bcc4ac3b0d7ca7fa47f2cc4 |
|
.o365.maxlifeinsurance.skyfencenet.com/ | Name: __SF__login.live.com/MSPRequ Value: id=N<=1721858600&co=1 |
|
.o365.maxlifeinsurance.skyfencenet.com/ | Name: __SF__login.live.com/MSCC Value: 3.108.114.66-IN |
|
.o365.maxlifeinsurance.skyfencenet.com/ | Name: __SF__login.live.com/MSPOK Value: $uuid-235a5e2b-6e8d-45dc-ba2a-6733c7acbf27 |
|
.o365.maxlifeinsurance.skyfencenet.com/ | Name: __SF__login.live.com/OParams Value: 11O.DgLYXprw8Jhcj567xO!pjOSAV0zekkfvvYDzsgfYrfn1I!OoxQk9NAkqbmr23RSS74BdvUXBOtuq64eVU5La6ASAmXMVOEux*pqn8b0YUWxEq5o31UJAfrASWSAEYDJOo23qMdXvwBfb0LCM689HnuA$ |
|
.o365.maxlifeinsurance.skyfencenet.com/ | Name: __SF__sessionId Value: a2f5cef8bca8a0101a41bbe2a5c3f |
|
login-live-com.o365.maxlifeinsurance.skyfencenet.com/ | Name: MicrosoftApplicationsTelemetryDeviceId Value: 00073d35-139a-4151-b15c-5b7e00c8be45 |
|
login-live-com.o365.maxlifeinsurance.skyfencenet.com/ | Name: ai_session Value: SorzlhCNodvryPs/DWB8Pn|1721858606224|1721858606224 |
|
.maxlifeinsurance.skyfencenet.com/ | Name: __SF__sfbid Value: xbWmqVLoSld7d491a6 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
browser-events-data-microsoft-com.o365.maxlifeinsurance.skyfencenet.com
login-live-com.o365.maxlifeinsurance.skyfencenet.com
logincdn-msftauth-net.o365.maxlifeinsurance.skyfencenet.com
browser-events-data-microsoft-com.o365.maxlifeinsurance.skyfencenet.com
13.127.35.125
3.109.12.210
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e01def2cdddd00625b8fbc278e511abfe64d78f15cba430ba09bbbeebac28e1
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
198126ad3f4d583b32e828ed9c86a9ef0a3b7e2c8292b1422cd931a722da5418
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
95b405165788c2770cc071d5d04d152c59961a2434bada95df795233dba89460
a860b9561b1615b3dca00ef253ebc8f398b346e13042dc6bef68ccac5da536ad
ff5e17188ad9a9963d5c37398f544bc8ba75eeb0f4f89056962d5a6a9a57e5ed