login.microsoftonline.com.office.o365test.anuk.myshn.net
Open in
urlscan Pro
64.94.98.143
Malicious Activity!
Public Scan
Effective URL: https://login.microsoftonline.com.office.o365test.anuk.myshn.net/common/oauth2/authorize?client_id=4345a7b9-9a63-4910-a426-35363201d503&response_mode=form_po...
Submission: On June 26 via automatic, source phishtank
Summary
TLS certificate: Issued by GlobalSign Organization Validation CA... on January 10th 2019. Valid for: a year.
This is the only time login.microsoftonline.com.office.o365test.anuk.myshn.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 64.94.98.143 64.94.98.143 | 14807 (SHNAC1) (SHNAC1 - Skyhigh Networks Inc) | |
3 | 152.199.23.37 152.199.23.37 | 15133 (EDGECAST) (EDGECAST - MCI Communications Services) | |
11 | 3 |
ASN14807 (SHNAC1 - Skyhigh Networks Inc, US)
login.microsoftonline.com.office.o365test.anuk.myshn.net |
ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)
aadcdn.msftauth.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
msftauth.net
aadcdn.msftauth.net |
172 KB |
1 |
myshn.net
login.microsoftonline.com.office.o365test.anuk.myshn.net login.live.com.office.o365test.anuk.myshn.net Failed www.office.com.office.o365test.anuk.myshn.net Failed |
13 KB |
11 | 2 |
Domain | Requested by | |
---|---|---|
3 | aadcdn.msftauth.net |
login.microsoftonline.com.office.o365test.anuk.myshn.net
aadcdn.msftauth.net |
1 | login.microsoftonline.com.office.o365test.anuk.myshn.net | |
0 | www.office.com.office.o365test.anuk.myshn.net Failed |
aadcdn.msftauth.net
|
0 | login.live.com.office.o365test.anuk.myshn.net Failed |
aadcdn.msftauth.net
|
11 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
login.live.com.office.o365test.anuk.myshn.net |
www.microsoft.com.office.o365test.anuk.myshn.net |
privacy.microsoft.com.office.o365test.anuk.myshn.net |
Subject Issuer | Validity | Valid | |
---|---|---|---|
office.o365test.anuk.myshn.net GlobalSign Organization Validation CA - SHA256 - G2 |
2019-01-10 - 2020-01-11 |
a year | crt.sh |
aadcdn.msftauth.net Microsoft IT TLS CA 5 |
2018-11-07 - 2020-11-07 |
2 years | crt.sh |
This page contains 3 frames:
Primary Page:
https://login.microsoftonline.com.office.o365test.anuk.myshn.net/common/oauth2/authorize?client_id=4345a7b9-9a63-4910-a426-35363201d503&response_mode=form_post&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties=1nBuxJyjkk-TP2dUojh84OAW45Sd6g7m6V6oZ8IDjzKwgF1CrG9wlyd6oqHKf37CPaejOD9hpHTElBCfvZvqgTlY9mfUhXL_S7T6jLsAIK6tC09Gq-zZaylRHV1e2_LK&nonce=636968167130483044.N2IzN2U3ZGYtMWE4NC00ODI5LTg4YTktMmIzNzQ5ZWE1ZGQxZTQ1NWE2ZTctMDc2Ny00N2E1LWFmNjUtZDI5NDQwMGM3ODgw&redirect_uri=https://www.office.com.office.o365test.anuk.myshn.net/&ui_locales=en-US&mkt=en-US
Frame ID: FF2104FB3CEAB808BA262B7DAE4ECAB3
Requests: 9 HTTP requests in this frame
Frame:
https://login.live.com.office.o365test.anuk.myshn.net/Me.htm?v=1
Frame ID: 2C2EABD5445E6F79B4AE8828A22BBE9B
Requests: 1 HTTP requests in this frame
Frame:
https://www.office.com.office.o365test.anuk.myshn.net/prefetch/prefetch
Frame ID: CF3DFBA56560E42DB53D478962FE21CA
Requests: 1 HTTP requests in this frame
3 Outgoing links
These are links going to different origins than the main page.
Title: Create one!
Search URL Search Domain Scan URL
Title: Terms of use
Search URL Search Domain Scan URL
Title: Privacy & cookies
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
authorize
login.microsoftonline.com.office.o365test.anuk.myshn.net/common/oauth2/ |
29 KB 13 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
converged.v2.login.min_bxeixgi3llnj-nuc4-xqwa2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
98 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ux.converged.login.pcore.min_4myuo72mlhdkjc9hn1du5g2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
555 KB 144 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ux.converged.login.strings-en.min_veg9zg4gq7m3vyno9nzqga2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
31 KB 10 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Me.htm
login.live.com.office.o365test.anuk.myshn.net/ Frame 2C2E |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
prefetch
www.office.com.office.o365test.anuk.myshn.net/prefetch/ Frame CF3D |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msftauth.net/ests/2.1/content/images/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg
aadcdn.msftauth.net/ests/2.1/content/images/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg
aadcdn.msftauth.net/ests/2.1/content/images/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
0-small_138bcee624fa04ef9b75e86211a9fe0d.jpg
aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
0_a5dbd4393ff6a725c7e62b61df7e72f0.jpg
aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- login.live.com.office.o365test.anuk.myshn.net
- URL
- https://login.live.com.office.o365test.anuk.myshn.net/Me.htm?v=1
- Domain
- www.office.com.office.o365test.anuk.myshn.net
- URL
- https://www.office.com.office.o365test.anuk.myshn.net/prefetch/prefetch
- Domain
- aadcdn.msftauth.net
- URL
- https://aadcdn.msftauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
- Domain
- aadcdn.msftauth.net
- URL
- https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg
- Domain
- aadcdn.msftauth.net
- URL
- https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg
- Domain
- aadcdn.msftauth.net
- URL
- https://aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/0-small_138bcee624fa04ef9b75e86211a9fe0d.jpg
- Domain
- aadcdn.msftauth.net
- URL
- https://aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/0_a5dbd4393ff6a725c7e62b61df7e72f0.jpg
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B object| ServerData function| webpackJsonp object| ko object| PROOF object| StringRepository boolean| __ConvergedLogin_PCore boolean| __1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
login.microsoftonline.com.office.o365test.anuk.myshn.net/common/oauth2 | Name: CkTst Value: G1561566018541 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msftauth.net
login.live.com.office.o365test.anuk.myshn.net
login.microsoftonline.com.office.o365test.anuk.myshn.net
www.office.com.office.o365test.anuk.myshn.net
aadcdn.msftauth.net
login.live.com.office.o365test.anuk.myshn.net
www.office.com.office.o365test.anuk.myshn.net
152.199.23.37
64.94.98.143
018a144e28538b05538acee6936f56c65bf0dc35adabb29914e252506968f207
21cc48423ee47207382cc9c1c3885913079be17805e6ff81e76e0e7165ca32cd
7ad89447944ee9605f404979731b8856f431983df385de4d1fc65bca21995330
d35725073bba404de01fb101757d1eae3a7f08346f44d56e671ae59930c046b6