signup-live-com.o365.ams.skyfencenet.com Open in urlscan Pro
157.167.155.205  Malicious Activity! Public Scan

4 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request error.aspx Show response signup-live-com.o365.ams.skyfencenet.com/	294 KB 99 KB	402ms 170ms	Document text/html	157.167.155.205 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://signup-live-com.o365.ams.skyfencenet.com/error.aspx?sru=https&lic=1&uaid=0bb65cefbc96499ba343c9a5a1b365c4&e=404 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 157.167.155.205 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 5771ba0376cfe3a2ab3409782cef89df3b967e22110406ee4af3b66e07a9679c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Accept-Language en-GB,en;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers AMServer eusXXXXgn0000KU Cache-Control no-cache, no-store Content-Encoding gzip Content-Type text/html; charset=utf-8 Date Tue, 16 Apr 2024 15:44:16 GMT Expires -1 Link <https://acctcdn.msftauth.net>; rel=preconnect; crossorigin <https://acctcdn.msftauth.net>; rel=preconnect; crossorigin <https://acctcdn.msftauth.net>; rel=dns-prefetch <https://acctcdn.msauth.net>; rel=dns-prefetch <https://acctcdnmsftuswe2.azureedge.net>; rel=dns-prefetch <https://acctcdnvzeuno.azureedge.net>; rel=dns-prefetch P3P CAO DSP COR ADMa DEV CONo TELo CUR PSA PSD TAI IVDo OUR SAM BUS DEM NAV STA UNI COM INT PHY ONL FIN PRE PUR Pragma no-cache Referrer-Policy strict-origin-when-cross-origin Strict-Transport-Security max-age=31536000; includeSubDomains Transfer-Encoding chunked Vary Accept-Encoding X-Cache CONFIG_NOCACHE X-Content-Type-Options nosniff X-DNS-Prefetch-Control on X-Frame-Options deny X-MSEdge-Ref Ref A: E79E10A0C5B047F5BB27DEEFEE3EBC23 Ref B: LTSEDGE1821 Ref C: 2024-04-16T15:44:16Z X-UA-Compatible IE=edge, chrome=1 X-XSS-Protection 1; mode=block x-ms-amserver eusXXXX00KU (2.0.3295.1) x-ms-amserver-tm 15ms x-ms-request-id e79e10a0-c5b0-47f5-bb27-deefee3ebc23
GET H/1.1	200 OK	__sf_event_listener_hook.js Show response signup-live-com.o365.ams.skyfencenet.com/__sf_resource/_/	2 KB 2 KB	123ms 43ms	Script text/javascript	157.167.155.205 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://signup-live-com.o365.ams.skyfencenet.com/__sf_resource/_/__sf_event_listener_hook.js Requested by Host: signup-live-com.o365.ams.skyfencenet.com URL: https://signup-live-com.o365.ams.skyfencenet.com/error.aspx?sru=https&lic=1&uaid=0bb65cefbc96499ba343c9a5a1b365c4&e=404 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 157.167.155.205 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash a860b9561b1615b3dca00ef253ebc8f398b346e13042dc6bef68ccac5da536ad Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://signup-live-com.o365.ams.skyfencenet.com/error.aspx?sru=https&lic=1&uaid=0bb65cefbc96499ba343c9a5a1b365c4&e=404 Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Cache-Control max-age=21600 X-Content-Type-Options nosniff Content-Length 1849 Content-Type text/javascript
GET H/1.1	200 OK	__sf_ajax_hook.js Show response signup-live-com.o365.ams.skyfencenet.com/__sf_resource/_/	6 KB 6 KB	88ms 46ms	Script text/javascript	157.167.155.205 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://signup-live-com.o365.ams.skyfencenet.com/__sf_resource/_/__sf_ajax_hook.js Requested by Host: signup-live-com.o365.ams.skyfencenet.com URL: https://signup-live-com.o365.ams.skyfencenet.com/error.aspx?sru=https&lic=1&uaid=0bb65cefbc96499ba343c9a5a1b365c4&e=404 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 157.167.155.205 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 198126ad3f4d583b32e828ed9c86a9ef0a3b7e2c8292b1422cd931a722da5418 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://signup-live-com.o365.ams.skyfencenet.com/error.aspx?sru=https&lic=1&uaid=0bb65cefbc96499ba343c9a5a1b365c4&e=404 Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Cache-Control max-age=21600 X-Content-Type-Options nosniff Content-Length 6334 Content-Type text/javascript
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Accept-Language en-GB,en;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET H/1.1	200 OK	oneds_MC5gQfpbTUjLu60sQCwU1w2.js Show response acctcdn-msftauth-net.o365.ams.skyfencenet.com/	267 KB 117 KB	281ms 82ms	Script application/javascript	157.167.155.205 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://acctcdn-msftauth-net.o365.ams.skyfencenet.com/oneds_MC5gQfpbTUjLu60sQCwU1w2.js?v=1 Requested by Host: signup-live-com.o365.ams.skyfencenet.com URL: https://signup-live-com.o365.ams.skyfencenet.com/error.aspx?sru=https&lic=1&uaid=0bb65cefbc96499ba343c9a5a1b365c4&e=404 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 157.167.155.205 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS Software ECAcc (lhc/792B) / Resource Hash 59ab8a81f52e7786ef4e7e5a7b717295b8b1f9d633a790f5ac820fabc98699ab Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://signup-live-com.o365.ams.skyfencenet.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob Date Tue, 16 Apr 2024 15:44:17 GMT Content-Encoding gzip Content-MD5 aLM4Wm3/yNZOAZgyrMkY7Q== Age 208938 Transfer-Encoding chunked X-Cache HIT x-ms-lease-status unlocked Last-Modified Sun, 14 Apr 2024 05:06:45 GMT Server ECAcc (lhc/792B) Etag 0x8DC5C40AE9E9AAB Vary Accept-Encoding Content-Type application/javascript Access-Control-Allow-Origin * x-ms-request-id c8b8ad36-001e-005b-262e-8e1c02000000 Access-Control-Expose-Headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cache-Control public, max-age=604800 x-ms-version 2009-09-19 Accept-Ranges bytes
GET H/1.1	200 OK	favicon.ico signup-live-com.o365.ams.skyfencenet.com/Resources/images/	0 18 KB	194ms 194ms	Other image/x-icon	157.167.155.205 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://signup-live-com.o365.ams.skyfencenet.com/Resources/images/favicon.ico Requested by Host: signup-live-com.o365.ams.skyfencenet.com URL: https://signup-live-com.o365.ams.skyfencenet.com/error.aspx?sru=https&lic=1&uaid=0bb65cefbc96499ba343c9a5a1b365c4&e=404 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 157.167.155.205 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://signup-live-com.o365.ams.skyfencenet.com/error.aspx?sru=https&lic=1&uaid=0bb65cefbc96499ba343c9a5a1b365c4&e=404 Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Strict-Transport-Security max-age=31536000; includeSubDomains Date Tue, 16 Apr 2024 15:44:16 GMT X-Content-Type-Options nosniff Last-Modified Fri, 05 Apr 2024 08:49:04 GMT X-MSEdge-Ref Ref A: B3E87BFECF6D4763BBCCB5AE4E322442 Ref B: LTSEDGE1821 Ref C: 2024-04-16T15:44:16Z ETag "00ae1c3687da1:0" X-Cache CONFIG_NOCACHE P3P CAO DSP COR ADMa DEV CONo TELo CUR PSA PSD TAI IVDo OUR SAM BUS DEM NAV STA UNI COM INT PHY ONL FIN PRE PUR Content-Type image/x-icon Cache-Control public,max-age=31536000 Accept-Ranges bytes AMServer wusXXXXig0000UI Content-Length 17174 X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2.js Show response acctcdn-msftauth-net.o365.ams.skyfencenet.com/	8 KB 5 KB	264ms 72ms	Script application/javascript	157.167.155.205 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://acctcdn-msftauth-net.o365.ams.skyfencenet.com/datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2.js Requested by Host: signup-live-com.o365.ams.skyfencenet.com URL: https://signup-live-com.o365.ams.skyfencenet.com/error.aspx?sru=https&lic=1&uaid=0bb65cefbc96499ba343c9a5a1b365c4&e=404 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 157.167.155.205 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS Software ECAcc (lhc/7914) / Resource Hash 617e32ca57507098771fd30af6b9dcab063448f6d7e0bc6d6557dd1895f80543 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://signup-live-com.o365.ams.skyfencenet.com/ Origin https://signup-live-com.o365.ams.skyfencenet.com Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob Date Tue, 16 Apr 2024 15:44:17 GMT Content-Encoding gzip Content-MD5 GpB463eVzCq5vobQLSGoUw== Age 209226 Transfer-Encoding chunked X-Cache HIT x-ms-lease-status unlocked Last-Modified Sun, 14 Apr 2024 05:06:13 GMT Server ECAcc (lhc/7914) Etag 0x8DC5C409B6EB831 Vary Accept-Encoding Content-Type application/javascript Access-Control-Allow-Origin * x-ms-request-id 1e2ebd9d-301e-00e8-792d-8e1740000000 Access-Control-Expose-Headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cache-Control public, max-age=604800 x-ms-version 2009-09-19 Accept-Ranges bytes
GET H/1.1	200 OK	favicon.ico acctcdn-msftauth-net.o365.ams.skyfencenet.com/images/	17 KB 18 KB	257ms 66ms	Other image/x-icon	157.167.155.205 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://acctcdn-msftauth-net.o365.ams.skyfencenet.com/images/favicon.ico?v=2 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 157.167.155.205 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS Software ECAcc (lhc/78AE) / Resource Hash 90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21 Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://signup-live-com.o365.ams.skyfencenet.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob Date Tue, 16 Apr 2024 15:44:17 GMT Content-MD5 EuPayFgGHQiAI7K9SOL6lg== Age 208907 X-Cache HIT Content-Length 17174 x-ms-lease-status unlocked Last-Modified Sun, 14 Apr 2024 05:06:27 GMT Server ECAcc (lhc/78AE) Etag 0x8DC5C40A389CC38 Content-Type image/x-icon Access-Control-Allow-Origin * x-ms-request-id ec3ac304-e01e-0079-152e-8edb35000000 Access-Control-Expose-Headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cache-Control public, max-age=604800 x-ms-version 2009-09-19 Accept-Ranges bytes
POST H/1.1	200 OK	ReportClientEvent Show response signup-live-com.o365.ams.skyfencenet.com/API/	501 B 2 KB	650ms 649ms	XHR application/json	157.167.155.205 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://signup-live-com.o365.ams.skyfencenet.com/API/ReportClientEvent?sru=https&lic=1&uaid=0bb65cefbc96499ba343c9a5a1b365c4&e=404 Requested by Host: signup-live-com.o365.ams.skyfencenet.com URL: https://signup-live-com.o365.ams.skyfencenet.com/__sf_resource/_/__sf_ajax_hook.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 157.167.155.205 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash af94199efb6fa5312518890660f0cb6acaa734b9dd258275fc3e3b5f4b7891eb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers x-ms-apiVersion 2 uaid 0bb65cefbc96499ba343c9a5a1b365c4 sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Accept-Language en-GB,en;q=0.9;q=0.9 canary NnIuf4qdSASd4QKIZpfBdHTTN8lww26977ZkymZk7gLHTh6klLn9vhVeK5aPou3nU8Qx0dlEZxy0PgJEUuqxr1tS+WX3QzoPxiaubFpadoWiD+IS3v8vUpazM+1YD1zNCjdO8JofWZ9Kh2KU/8b+OI9dmTIlNxbzA3jypChquqJXFUIAYz6lo5QPTrY3p3gTJRCdPgIlL7VwnB2n0f35BgijG6fvHNFvWaKN7/UIkzOWC/Htkkdvk3nky1wJMYiB:2:3c tcxt yyyX/g1lTVynCDUBedJWX2mYKhr1xplCJ94jl0T3P0MdjnjOLJNFKIiZYV43WkkuuJ6E47c7qzQOVb61r/WfYa6tSCclSTs8oDCk37Vx09YHzYijHbOZiRkCpt9+BRcCEDg/PUpPhraYbAH145fxmg==:2:3 x-ms-apiTransport xhr sec-ch-ua-platform "Win32" sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Content-Type application/json hpgid 200202 Accept application/json Referer https://signup-live-com.o365.ams.skyfencenet.com/error.aspx?sru=https&lic=1&uaid=0bb65cefbc96499ba343c9a5a1b365c4&e=404 uiflvr 1001 scid 100145 Response headers Strict-Transport-Security max-age=31536000; includeSubDomains Date Tue, 16 Apr 2024 15:44:17 GMT X-Content-Type-Options nosniff Transfer-Encoding chunked X-Cache CONFIG_NOCACHE P3P CAO DSP COR ADMa DEV CONo TELo CUR PSA PSD TAI IVDo OUR SAM BUS DEM NAV STA UNI COM INT PHY ONL FIN PRE PUR x-ms-amserver-tm 421ms X-XSS-Protection 1; mode=block Pragma no-cache Referrer-Policy strict-origin-when-cross-origin X-MSEdge-Ref Ref A: F1ADDCE799AD401EABCD2B54CF0CA742 Ref B: LTSEDGE1821 Ref C: 2024-04-16T15:44:17Z X-Frame-Options deny Content-Type application/json; charset=utf-8 x-ms-request-id f1addce7-99ad-401e-abcd-2b54cf0ca742 Cache-Control no-cache, no-store x-ms-amserver WCUXXXX00JE (2.0.3302.0) AMServer WCUXXXXIG0000JE Expires -1
POST H/1.1	200 OK	ClientEvents Show response signup-live-com.o365.ams.skyfencenet.com/API/	621 B 2 KB	334ms 334ms	Fetch application/json	157.167.155.205 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://signup-live-com.o365.ams.skyfencenet.com/API/ClientEvents Requested by Host: signup-live-com.o365.ams.skyfencenet.com URL: https://signup-live-com.o365.ams.skyfencenet.com/__sf_resource/_/__sf_ajax_hook.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 157.167.155.205 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash fab3f70abe250ce4b7de1c12c3e82934db8fba37041c5b40c7e48d2aff5dfc09 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers uaid 0bb65cefbc96499ba343c9a5a1b365c4 x-ms-apiVersion 3 sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 canary NnIuf4qdSASd4QKIZpfBdHTTN8lww26977ZkymZk7gLHTh6klLn9vhVeK5aPou3nU8Qx0dlEZxy0PgJEUuqxr1tS+WX3QzoPxiaubFpadoWiD+IS3v8vUpazM+1YD1zNCjdO8JofWZ9Kh2KU/8b+OI9dmTIlNxbzA3jypChquqJXFUIAYz6lo5QPTrY3p3gTJRCdPgIlL7VwnB2n0f35BgijG6fvHNFvWaKN7/UIkzOWC/Htkkdvk3nky1wJMYiB:2:3c Content-Type application/json; charset=utf-8 hpgid 200202 Accept application/json tcxt yyyX/g1lTVynCDUBedJWX2mYKhr1xplCJ94jl0T3P0MdjnjOLJNFKIiZYV43WkkuuJ6E47c7qzQOVb61r/WfYa6tSCclSTs8oDCk37Vx09YHzYijHbOZiRkCpt9+BRcCEDg/PUpPhraYbAH145fxmg==:2:3 Referer https://signup-live-com.o365.ams.skyfencenet.com/error.aspx?sru=https&lic=1&uaid=0bb65cefbc96499ba343c9a5a1b365c4&e=404 x-ms-apiTransport fetch sec-ch-ua-platform "Win32" Response headers Strict-Transport-Security max-age=31536000; includeSubDomains Date Tue, 16 Apr 2024 15:44:17 GMT X-Content-Type-Options nosniff Transfer-Encoding chunked X-Cache CONFIG_NOCACHE P3P CAO DSP COR ADMa DEV CONo TELo CUR PSA PSD TAI IVDo OUR SAM BUS DEM NAV STA UNI COM INT PHY ONL FIN PRE PUR x-ms-amserver-tm 156ms X-XSS-Protection 1; mode=block Pragma no-cache Referrer-Policy strict-origin-when-cross-origin X-MSEdge-Ref Ref A: 6F94446DC0DE4741816E723D4D73C3D6 Ref B: LTSEDGE0919 Ref C: 2024-04-16T15:44:17Z X-Frame-Options deny Content-Type application/json; charset=utf-8 x-ms-request-id 6f94446d-c0de-4741-816e-723d4d73c3d6 Cache-Control no-cache, no-store x-ms-amserver EUSXXXX000I (2.0.3295.1) AMServer EUSXXXXGN00000I Expires -1

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

104 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| __sf__initEventListenersHook object| $PageHelper object| $Debug object| $Do function| $Loader object| EventDict object| $WebWatson object| $OneDs object| Debug function| $setVar function| registerNamespace object| wLive object| $ClientTelemetry object| $Api object| $PltHelper object| $PltTransferBucket function| $AccountEventApi object| $ClientEvents object| $WebVitalsHelper object| $DataRequest function| _ge object| _d object| _dh object| $U function| GetString object| $B object| $Config object| $ReportEvent function| _addEventListener function| _getOrSetPropsOnElements function| _forEachKey function| _parseDataAndHandler function| _parseOnArgs function| _elementFromHtmlString function| _setCacheValue function| _getCacheValue function| _animate function| _isHtmlElementList function| _hasCheckedAttribute function| _isHtmlElementOrDocument function| _createEvent string| c_block string| c_display string| c_none string| c_object string| c_style string| c_string object| w function| jQueryShim function| EventShim function| _ce function| _get object| $Utility object| $Beacon object| $css object| $Cookie object| $edh object| $f object| $footer object| _msaEventShim object| $baseMaster object| $UI object| g_renderDates string| cookieName string| cookieValue boolean| useSameSite boolean| AllowErrorPageRedirect string| phBaseURL string| phMarket string| gCommonQueryStringParams string| gFatalErrorCode function| WizardExternalHelper object| ExternalHelper function| OnNext function| OnBack undefined| CXH object| channel function| __sfLog function| __sf__redirect function| __sf__handleResponse function| __sf__trackXhr function| __sf__installAjaxHook function| __sf__installFetchHook function| show_verifcation_iframe function| sf_iframe_verification_success function| AleGetString object| live object| ale_wlive object| Telemetry object| Microsoft object| telemetry_webpackJsonp object| $Telemetry function| setFocus function| addHeadphonesWarning function| setFocusOnField function| evt_master_onload object| requests object| n function| e function| t object| oneDS function| __sf__addEventListenerBase function| removeAllEventListeners function| __sf__removeEventListenerBase

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			signup-live-com.o365.ams.skyfencenet.com/	1969-12-31 23:59:59	Name: amcanary Value: 0
			.o365.ams.skyfencenet.com/	1969-12-31 23:59:59	Name: __SF__sessionId Value: 52c782278020a64368e1bbd784ecad
			.ams.skyfencenet.com/	1970-01-21 05:30:42	Name: __SF__sfbid Value: rDZCOp8kiTae71510e
			signup-live-com.o365.ams.skyfencenet.com/	1970-01-21 04:40:18	Name: MicrosoftApplicationsTelemetryDeviceId Value: b4a183ca-05f2-4335-bfc3-89b6fd42c5cd
			.o365.ams.skyfencenet.com/	1969-12-31 23:59:59	Name: __SF__.live.com/amsc Value: yrmNsysQCi3FRWR4aq7GrIBFYyDtZjYQyBJKMzacy1k0ET62GSKNbaxbkyYYYik1F+lnD/9ZtSr8Z1pnLzoc1hAGlBKmg1LDWqh7zk5KPA6PS/zT0yu5SU7RIgfG5BiBCCT/jAWaStFP/zdEyDgILMVFNOxS2id1ak7/igqAONB/YzR3U/ADr+nY4QmJL3yltcRaUmpLcRJYVY93B7LdljsQISFLDizOoFn9v/LIlGFU8FVEsRwHhKIyLU2wPGGf7kLTCJGgWFDyke0NpB1LulWa+eo40LQMGdJU9iY+AwQetgpPJ8h5X08V6Eh3p6Fc:2:3c

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

acctcdn-msftauth-net.o365.ams.skyfencenet.com
signup-live-com.o365.ams.skyfencenet.com
157.167.155.205
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
198126ad3f4d583b32e828ed9c86a9ef0a3b7e2c8292b1422cd931a722da5418
5771ba0376cfe3a2ab3409782cef89df3b967e22110406ee4af3b66e07a9679c
59ab8a81f52e7786ef4e7e5a7b717295b8b1f9d633a790f5ac820fabc98699ab
617e32ca57507098771fd30af6b9dcab063448f6d7e0bc6d6557dd1895f80543
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
a860b9561b1615b3dca00ef253ebc8f398b346e13042dc6bef68ccac5da536ad
af94199efb6fa5312518890660f0cb6acaa734b9dd258275fc3e3b5f4b7891eb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fab3f70abe250ce4b7de1c12c3e82934db8fba37041c5b40c7e48d2aff5dfc09