urlscan.io logo urlscan.io
SecurityTrails logo

outlookloffice365user34k.z13.web.core.windows.net Open in urlscan Pro
52.239.214.161  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://j90sg-80.azurewebsites.net/iscaba?dyu=lorri_andrews@lol.com&&63.64.99.58&&cc0_34k3=lol.com&sr=lorri_andrews@lol.com&SMCP7Y9...
Effective URL: https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187
Submission: On January 14 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 2 countries across 6 domains to perform 11 HTTP transactions. The main IP is 52.239.214.161, located in Redmond, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US. The main domain is outlookloffice365user34k.z13.web.core.windows.net.
TLS certificate: Issued by Microsoft IT TLS CA 5 on April 19th 2018. Valid for: 2 years.
This is the only time outlookloffice365user34k.z13.web.core.windows.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 2 52.176.2.229 8075 (MICROSOFT...)
2 52.239.214.161 8075 (MICROSOFT...)
1 54.148.84.95 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
2 104.16.12.231 13335 (CLOUDFLAR...)
2 47.252.95.97 45102 (CNNIC-ALI...)
1 2a00:1450:400... 15169 (GOOGLE)
11 7
2    52.176.2.229 (Des Moines, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
j90sg-80.azurewebsites.net
2    52.239.214.161 (Redmond, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
outlookloffice365user34k.z13.web.core.windows.net
1    54.148.84.95 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-148-84-95.us-west-2.compute.amazonaws.com
www.sitepoint.com
2    2a00:1450:4001:819::2010 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
storage.googleapis.com
2    104.16.12.231 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdn.discordapp.com
2    47.252.95.97 (San Mateo, United States)

ASN45102 (CNNIC-ALIBABA-CN-NET-AP Alibaba (China) Technology Co., Ltd., CN)
loppa.oss-us-east-1.aliyuncs.com
1    2a00:1450:4001:824::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
ajax.googleapis.com
Domain Requested by
2 loppa.oss-us-east-1.aliyuncs.com outlookloffice365user34k.z13.web.core.windows.net
2 cdn.discordapp.com outlookloffice365user34k.z13.web.core.windows.net
2 storage.googleapis.com outlookloffice365user34k.z13.web.core.windows.net
2 outlookloffice365user34k.z13.web.core.windows.net outlookloffice365user34k.z13.web.core.windows.net
2 j90sg-80.azurewebsites.net 1 redirects
1 ajax.googleapis.com outlookloffice365user34k.z13.web.core.windows.net
1 www.sitepoint.com outlookloffice365user34k.z13.web.core.windows.net
11 7

This site contains no links.

Subject Issuer Validity Valid
*.azurewebsites.net
Microsoft IT TLS CA 4		 2017-12-17 -
2019-12-17		 2 years crt.sh
*.web.core.windows.net
Microsoft IT TLS CA 5		 2018-04-19 -
2020-04-19		 2 years crt.sh
sitepoint.com
SSL.com Premium EV CA		 2018-08-07 -
2019-09-23		 a year crt.sh
*.storage.googleapis.com
Google Internet Authority G3		 2018-12-19 -
2019-03-13		 3 months crt.sh
ssl711320.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2018-10-18 -
2019-04-26		 6 months crt.sh
*.oss.aliyuncs.com
GlobalSign Organization Validation CA - SHA256 - G2		 2018-11-30 -
2019-12-01		 a year crt.sh
*.googleapis.com
Google Internet Authority G3		 2018-12-19 -
2019-03-13		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187
Frame ID: E55E558B10C34B8B4F4B4C6DFF8E82B6
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://j90sg-80.azurewebsites.net/iscaba?dyu=lorri_andrews@lol.com&&63.64.99.58&&cc0_34k3=lol.com&sr=lorri_and... HTTP 301
    https://j90sg-80.azurewebsites.net/iscaba/?dyu=lorri_andrews@lol.com&&63.64.99.58&&cc0_34k3=lol.com&sr=lorri_an... Page URL
  2. https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /IIS(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • headers server /IIS(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • env /^jQuery$/i

Page Statistics

11
Requests

100 %
HTTPS

29 %
IPv6

6
Domains

7
Subdomains

7
IPs

2
Countries

825 kB
Transfer

887 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://j90sg-80.azurewebsites.net/iscaba?dyu=lorri_andrews@lol.com&&63.64.99.58&&cc0_34k3=lol.com&sr=lorri_andrews@lol.com&SMCP7Y9A=lol.com&sc-3d=lorri_andrews@lol.com&&03380800723&&cc0_34k3=lorri%20andrews&sr=lorri_andrews@lol.com&DW75WT0=lol.com&sc-3d=lol_lol@lol.com HTTP 301
    https://j90sg-80.azurewebsites.net/iscaba/?dyu=lorri_andrews@lol.com&&63.64.99.58&&cc0_34k3=lol.com&sr=lorri_andrews@lol.com&SMCP7Y9A=lol.com&sc-3d=lorri_andrews@lol.com&&03380800723&&cc0_34k3=lorri%20andrews&sr=lorri_andrews@lol.com&DW75WT0=lol.com&sc-3d=lol_lol@lol.com Page URL
  2. https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://j90sg-80.azurewebsites.net/iscaba?dyu=lorri_andrews@lol.com&&63.64.99.58&&cc0_34k3=lol.com&sr=lorri_andrews@lol.com&SMCP7Y9A=lol.com&sc-3d=lorri_andrews@lol.com&&03380800723&&cc0_34k3=lorri%20andrews&sr=lorri_andrews@lol.com&DW75WT0=lol.com&sc-3d=lol_lol@lol.com HTTP 301
  • https://j90sg-80.azurewebsites.net/iscaba/?dyu=lorri_andrews@lol.com&&63.64.99.58&&cc0_34k3=lol.com&sr=lorri_andrews@lol.com&SMCP7Y9A=lol.com&sc-3d=lorri_andrews@lol.com&&03380800723&&cc0_34k3=lorri%20andrews&sr=lorri_andrews@lol.com&DW75WT0=lol.com&sc-3d=lol_lol@lol.com

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
j90sg-80.azurewebsites.net/iscaba/
Redirect Chain
  • https://j90sg-80.azurewebsites.net/iscaba?dyu=lorri_andrews@lol.com&&63.64.99.58&&cc0_34k3=lol.com&sr=lorri_andrews@lol.com&SMCP7Y9A=lol.com&sc-3d=lorri_andrews@lol.com&&03380800723&&cc0_34k3=lorri...
  • https://j90sg-80.azurewebsites.net/iscaba/?dyu=lorri_andrews@lol.com&&63.64.99.58&&cc0_34k3=lol.com&sr=lorri_andrews@lol.com&SMCP7Y9A=lol.com&sc-3d=lorri_andrews@lol.com&&03380800723&&cc0_34k3=lorr...
442 B
614 B 		Document
General
Check archive.org
Download Go to
Full URL
https://j90sg-80.azurewebsites.net/iscaba/?dyu=lorri_andrews@lol.com&&63.64.99.58&&cc0_34k3=lol.com&sr=lorri_andrews@lol.com&SMCP7Y9A=lol.com&sc-3d=lorri_andrews@lol.com&&03380800723&&cc0_34k3=lorri%20andrews&sr=lorri_andrews@lol.com&DW75WT0=lol.com&sc-3d=lol_lol@lol.com
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.176.2.229 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / PHP/5.6.38 ASP.NET
Resource Hash
0cc632fa6a1fd3fa30675fdef6f44ee6fa73d23c43fa33f39973df3cfaa4b775

Request headers

Host
j90sg-80.azurewebsites.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate, br
Cookie
ARRAffinity=a2063aba30f62df8e4f3accc78a2eb747c5441b060ca24d3975d72d2736e6432
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Length
373
Content-Type
text/html; charset=UTF-8
Content-Encoding
gzip
Vary
Accept-Encoding
Server
Microsoft-IIS/10.0
X-Powered-By
PHP/5.6.38 ASP.NET
Date
Mon, 14 Jan 2019 14:58:35 GMT

Redirect headers

Content-Length
450
Content-Type
text/html; charset=UTF-8
Location
https://j90sg-80.azurewebsites.net/iscaba/?dyu=lorri_andrews@lol.com&&63.64.99.58&&cc0_34k3=lol.com&sr=lorri_andrews@lol.com&SMCP7Y9A=lol.com&sc-3d=lorri_andrews@lol.com&&03380800723&&cc0_34k3=lorri%20andrews&sr=lorri_andrews@lol.com&DW75WT0=lol.com&sc-3d=lol_lol@lol.com
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
Set-Cookie
ARRAffinity=a2063aba30f62df8e4f3accc78a2eb747c5441b060ca24d3975d72d2736e6432;Path=/;HttpOnly;Domain=j90sg-80.azurewebsites.net
Date
Mon, 14 Jan 2019 14:58:34 GMT
Primary Request f081a21efc523542648674241cbbf187
outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/ 		53 KB
53 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.214.161 Redmond, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
64a79fcdcaf49ceb01bf0ae0115130e3f4da804405b0f05599971963b4045176

Request headers

Host
outlookloffice365user34k.z13.web.core.windows.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://j90sg-80.azurewebsites.net/iscaba/?dyu=lorri_andrews@lol.com&&63.64.99.58&&cc0_34k3=lol.com&sr=lorri_andrews@lol.com&SMCP7Y9A=lol.com&sc-3d=lorri_andrews@lol.com&&03380800723&&cc0_34k3=lorri%20andrews&sr=lorri_andrews@lol.com&DW75WT0=lol.com&sc-3d=lol_lol@lol.com
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://j90sg-80.azurewebsites.net/iscaba/?dyu=lorri_andrews@lol.com&&63.64.99.58&&cc0_34k3=lol.com&sr=lorri_andrews@lol.com&SMCP7Y9A=lol.com&sc-3d=lorri_andrews@lol.com&&03380800723&&cc0_34k3=lorri%20andrews&sr=lorri_andrews@lol.com&DW75WT0=lol.com&sc-3d=lol_lol@lol.com

Response headers

Content-Length
53832
Content-Type
text/html
Vary
Origin
Server
Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
x-ms-error-code
WebContentNotFound
x-ms-request-id
5735c4f9-d01e-0150-0a19-ac357c000000
x-ms-version
2018-03-28
Date
Mon, 14 Jan 2019 14:58:35 GMT
MaskedPassword.js
www.sitepoint.com/examples/password/MaskedPassword/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.sitepoint.com/examples/password/MaskedPassword/MaskedPassword.js
Requested by
Host: outlookloffice365user34k.z13.web.core.windows.net
URL: https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.148.84.95 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-148-84-95.us-west-2.compute.amazonaws.com
Software
Apache/2.2.22 (Debian) /
Resource Hash
7742fb83d98648f94727a40d5c3381b3245805e62b6f998002d933715ac84b6a

Request headers

Referer
https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 14 Jan 2019 14:54:31 GMT
Content-Encoding
gzip
X-Cache-Lookup
HIT from ip-172-31-17-101.us-west-2.compute.internal:3128
Last-Modified
Fri, 15 Oct 2010 00:03:45 GMT
Server
Apache/2.2.22 (Debian)
Age
245
ETag
"680936-4208-4929c8f629a40"
Vary
User-Agent,Accept-Encoding
X-Cache
HIT from ip-172-31-17-101.us-west-2.compute.internal
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
5767
converged.login.min.css
storage.googleapis.com/office2018/public/css/ 		84 KB
85 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://storage.googleapis.com/office2018/public/css/converged.login.min.css
Requested by
Host: outlookloffice365user34k.z13.web.core.windows.net
URL: https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:819::2010 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
UploadServer /
Resource Hash
4f962ec8ae085492d496fcbbd74185ab1c8e377438dbcb5ec4f8517b7bd9293f

Request headers

Referer
https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 14 Jan 2019 14:51:02 GMT
age
454
status
200
x-guploader-uploadid
AEnB2UoGdqGZ2fyb8O918b8sAxUsaemDBpBSYxEzl2hFq34yCKmn5OyGG1GZWE1NgPVWO5D_CQjr8GnYfi2lK2aJgHFw0Mz7Og
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
86425
last-modified
Mon, 12 Feb 2018 02:07:46 GMT
server
UploadServer
etag
"041294f2364ba96d1008aff40415ada5"
x-goog-hash
crc32c=Z3ahJA==, md5=BBKU8jZLqW0QCK/0BBWtpQ==
x-goog-generation
1518401266838995
cache-control
public, max-age=3600
x-goog-stored-content-length
86425
accept-ranges
bytes
content-type
text/css
expires
Mon, 14 Jan 2019 15:51:02 GMT
microsoft_logo.svg
storage.googleapis.com/office2018/public/images/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://storage.googleapis.com/office2018/public/images/microsoft_logo.svg
Requested by
Host: outlookloffice365user34k.z13.web.core.windows.net
URL: https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:819::2010 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
UploadServer /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Referer
https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 14 Jan 2019 14:51:02 GMT
age
454
status
200
x-guploader-uploadid
AEnB2Ur4kxx_lzyHhW433y5cvXalEjWdqLSxVUj7EulBQYMuGcT8V_HvDUwm5WzoTijiq8kIxJY2Ubym9ITZtNOpN7nKjJQEPQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
3651
last-modified
Mon, 12 Feb 2018 02:08:14 GMT
server
UploadServer
etag
"ee5c8d9fb6248c938fd0dc19370e90bd"
x-goog-hash
crc32c=c/EO4g==, md5=7lyNn7YkjJOP0NwZNw6QvQ==
x-goog-generation
1518401294094787
cache-control
public, max-age=3600
x-goog-stored-content-length
3651
accept-ranges
bytes
content-type
image/svg+xml
expires
Mon, 14 Jan 2019 15:51:02 GMT
30.gif
cdn.discordapp.com/attachments/466747916187336706/502092033779957760/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.discordapp.com/attachments/466747916187336706/502092033779957760/30.gif
Requested by
Host: outlookloffice365user34k.z13.web.core.windows.net
URL: https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.16.12.231 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
52600dd842dfe2b1de28fb0e8a9dd948be6b19ac2d9e4905dafaa4aa059802ac

Request headers

Referer
https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 14 Jan 2019 14:58:36 GMT
cf-cache-status
HIT
status
200
x-guploader-uploadid
AEnB2UrUjEHcQ1YmgdUml_F5E7nGdzK0kTGG6Tc_tZiKY_ARRIvm4bpH6IFWVzKstvaptzbz0cD4y6XoJM6BcWww3CdeXRG4ag
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
4684
cf-ray
4990f631a87d7319-AMS
x-robots-tag
noindex, nofollow, noarchive, nocache, noimageindex, noodp
last-modified
Wed, 17 Oct 2018 12:14:29 GMT
server
cloudflare
etag
"e454c93bcb857648c648ea1a8178734e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=7imm8Q==, md5=5FTJO8uFdkjGSOoagXhzTg==
x-goog-generation
1539778469324166
cache-control
public, max-age=31536000
x-goog-stored-content-length
4684
accept-ranges
bytes
content-type
image/gif
expires
Tue, 14 Jan 2020 14:58:36 GMT
microsoft.png
cdn.discordapp.com/attachments/466747916187336706/518045849037701130/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.discordapp.com/attachments/466747916187336706/518045849037701130/microsoft.png
Requested by
Host: outlookloffice365user34k.z13.web.core.windows.net
URL: https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.16.12.231 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f3c40b7dcd551731a8082217fe2859cf3023b0832057b424724032a9b4b9555f

Request headers

Referer
https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 14 Jan 2019 14:58:36 GMT
cf-cache-status
HIT
status
200
x-guploader-uploadid
AEnB2Uq3HP7y6DYWIB5q9Rw8ijQpQIOvssn8uunHf1cI7c3QAK8VLvjz6vC6Tf-bq4QF6TkFIr-kAnHX7wt6xR2cIN_bCgG2PjHgv8TwQNlk2W5lDoUOaa0
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
21353
cf-ray
4990f631a87e7319-AMS
x-robots-tag
noindex, nofollow, noarchive, nocache, noimageindex, noodp
last-modified
Fri, 30 Nov 2018 12:49:15 GMT
server
cloudflare
etag
"447a15a254d0848aa6159f85d780b4ad"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=bG0HFA==, md5=RHoVolTQhIqmFZ+F14C0rQ==
x-goog-generation
1543582155278090
cache-control
public, max-age=31536000
x-goog-stored-content-length
21353
accept-ranges
bytes
content-type
image/png
expires
Tue, 14 Jan 2020 14:58:36 GMT
54b6d9334161a54.png
loppa.oss-us-east-1.aliyuncs.com/ 		753 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://loppa.oss-us-east-1.aliyuncs.com/54b6d9334161a54.png
Requested by
Host: outlookloffice365user34k.z13.web.core.windows.net
URL: https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
47.252.95.97 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-CN-NET-AP Alibaba (China) Technology Co., Ltd., CN),
Reverse DNS
Software
AliyunOSS /
Resource Hash
9dd5e031a96cb31830ef2fb13009f70f2001f7204e8e96faf0999821e7dd67eb

Request headers

Referer
https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-oss-object-type
Normal
Date
Mon, 14 Jan 2019 14:58:36 GMT
x-oss-request-id
5C3CA39C20A94C91ED78AF7A
Last-Modified
Wed, 12 Sep 2018 03:08:41 GMT
Server
AliyunOSS
Content-MD5
3IGZz15lhbXXoDdJbfFpKw==
ETag
"DC8199CF5E6585B5D7A037496DF1692B"
Content-Type
image/png
x-oss-storage-class
Standard
Connection
keep-alive
Accept-Ranges
bytes
x-oss-hash-crc64ecma
14909334537735148911
Content-Length
753
x-oss-server-time
1
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
Requested by
Host: outlookloffice365user34k.z13.web.core.windows.net
URL: https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:824::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 20 Dec 2018 09:58:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2178020
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
30399
x-xss-protection
1; mode=block
last-modified
Thu, 25 Jan 2018 15:33:24 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 20 Dec 2019 09:58:16 GMT
small.jpg
outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/images/ 		53 KB
53 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/images/small.jpg?x=12f4b8b543125cc986c79cd85320812f
Requested by
Host: outlookloffice365user34k.z13.web.core.windows.net
URL: https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.239.214.161 Redmond, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
64a79fcdcaf49ceb01bf0ae0115130e3f4da804405b0f05599971963b4045176

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
outlookloffice365user34k.z13.web.core.windows.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187
Connection
keep-alive
Cache-Control
no-cache
Referer
https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 14 Jan 2019 14:58:35 GMT
Server
Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
x-ms-error-code
WebContentNotFound
Vary
Origin
Content-Type
text/html
x-ms-request-id
5735c542-d01e-0150-4219-ac357c000000
x-ms-version
2018-03-28
Content-Length
53832
760fe41056b0b16.jpg
loppa.oss-us-east-1.aliyuncs.com/ 		566 KB
566 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://loppa.oss-us-east-1.aliyuncs.com/760fe41056b0b16.jpg
Requested by
Host: outlookloffice365user34k.z13.web.core.windows.net
URL: https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
47.252.95.97 San Mateo, United States, ASN45102 (CNNIC-ALIBABA-CN-NET-AP Alibaba (China) Technology Co., Ltd., CN),
Reverse DNS
Software
AliyunOSS /
Resource Hash
7764c38d71f5ee52d39f237f08b4e82b4715c73bfa0afbaee30a60b0dfd058ca

Request headers

Referer
https://outlookloffice365user34k.z13.web.core.windows.net/f081a21efc523542648674241cbbf187/f081a21efc523542648674241cbbf187
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-oss-object-type
Normal
Date
Mon, 14 Jan 2019 14:58:36 GMT
x-oss-request-id
5C3CA39C4C64DC5C7179B5FA
Last-Modified
Wed, 12 Sep 2018 03:04:14 GMT
Server
AliyunOSS
Content-MD5
r4KMjwxdtZ4HLKo9+v4fzQ==
ETag
"AF828C8F0C5DB59E072CAA3DFAFE1FCD"
Content-Type
image/jpeg
x-oss-storage-class
Standard
Connection
keep-alive
Accept-Ranges
bytes
x-oss-hash-crc64ecma
555916454670177095
Content-Length
579468
x-oss-server-time
1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) Microsoft (Consumer)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| MaskedPassword function| $ function| jQuery function| validateEmail function| send_form function| validate_email_input_and_password function| input_on_change function| randomString

0 Cookies