enterprise.responsemodeformpostresponsetypecode.entsyss.com

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 5 HTTP transactions. The main IP is 104.168.11.85, located in San Jose, United States and belongs to AS-COLOCROSSING - ColoCrossing, US. The main domain is enterprise.responsemodeformpostresponsetypecode.entsyss.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on June 26th 2019. Valid for: 3 months.

This is the only time enterprise.responsemodeformpostresponsetypecode.entsyss.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
3	104.168.11.85 104.168.11.85	36352 (AS-COLOCR...) (AS-COLOCROSSING - ColoCrossing)
1	2606:4700::68... 2606:4700::6813:c397	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
5	3

3 104.168.11.85 (San Jose, United States)

ASN36352 (AS-COLOCROSSING - ColoCrossing, US)
PTR: 104-168-11-85-host.colocrossing.com

enterprise.responsemodeformpostresponsetypecode.entsyss.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:c397 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	entsyss.com enterprise.responsemodeformpostresponsetypecode.entsyss.com	286 KB
1	cloudflare.com cdnjs.cloudflare.com	7 KB
0	clearbit.com Failed logo.clearbit.com Failed
5	3

	Domain	Requested by
3	enterprise.responsemodeformpostresponsetypecode.entsyss.com	enterprise.responsemodeformpostresponsetypecode.entsyss.com
1	cdnjs.cloudflare.com	enterprise.responsemodeformpostresponsetypecode.entsyss.com
0	logo.clearbit.com Failed	enterprise.responsemodeformpostresponsetypecode.entsyss.com
5	3

This site contains links to these domains. Also see Links.

Domain
login.live.com

Subject Issuer	Validity	Valid
enterprise.responsemodeformpostresponsetypecode.entsyss.com Let's Encrypt Authority X3	`2019-06-26` - `2019-09-24`	3 months	crt.sh
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-03-02` - `2019-09-08`	6 months	crt.sh

This page contains 1 frames:

Primary Page: https://enterprise.responsemodeformpostresponsetypecode.entsyss.com/IdConnectAuthenticationProperties3d4E9rGg9bb3sVGyxPReNBYLcvZ7QaDndRp53tN5afJgJttMRxjWztLb16SalAKu92w5oZMkFjb61h4dAfUC3gNuNbkzWkz2nAHrxXJLIUaeIHzStA8jPIb08wwUNDxFtGPGuxyS7QlC2X7nAiQrUChc1PwgcNZW41G2P1ufNPrZ/index.php?email=april.wilson@ampf.com
Frame ID: 61619121F9754BEB47F47632397694D9
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Page Statistics

5
Requests

80 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

293 kB
Transfer

320 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://login.live.com/gls.srf?urlID=WinLiveTermsOfUse&mkt=EN-US&vv=1600
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://login.live.com/gls.srf?urlID=MSNPrivacyStatement&mkt=EN-US&vv=1600
Title: Privacy & cookies

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request index.php Show response
enterprise.responsemodeformpostresponsetypecode.entsyss.com/IdConnectAuthenticationProperties3d4E9rGg9bb3sVGyxPReNBYLcvZ7QaDndRp53tN5afJgJttMRxjWztLb16SalAKu92w5oZMkFjb61h4dAfUC3gNuNbkzWkz2nAHrxXJL... 7 KB
2 KB 3615ms
173ms Document
text/html 104.168.11.85
ColoCrossing

General

Check archive.org

Show headers Download Go to

Full URL: https://enterprise.responsemodeformpostresponsetypecode.entsyss.com/IdConnectAuthenticationProperties3d4E9rGg9bb3sVGyxPReNBYLcvZ7QaDndRp53tN5afJgJttMRxjWztLb16SalAKu92w5oZMkFjb61h4dAfUC3gNuNbkzWkz2nAHrxXJLIUaeIHzStA8jPIb08wwUNDxFtGPGuxyS7QlC2X7nAiQrUChc1PwgcNZW41G2P1ufNPrZ/index.php?email=april.wilson@ampf.com
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.168.11.85 San Jose, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS: 104-168-11-85-host.colocrossing.com
Software: nginx /
Resource Hash: 08720809233bc47ea5de15da0aa5988c01803abdcb9ecd880e88d02cf91354d9

Request headers

Host: enterprise.responsemodeformpostresponsetypecode.entsyss.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server: nginx
Date: Wed, 26 Jun 2019 16:49:10 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 2212
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
Content-Encoding: gzip

GET
H2 200 font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 30 KB
7 KB 32ms
19ms Stylesheet
text/css 2606:4700::6813:c397
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: enterprise.responsemodeformpostresponsetypecode.entsyss.com
URL: https://enterprise.responsemodeformpostresponsetypecode.entsyss.com/IdConnectAuthenticationProperties3d4E9rGg9bb3sVGyxPReNBYLcvZ7QaDndRp53tN5afJgJttMRxjWztLb16SalAKu92w5oZMkFjb61h4dAfUC3gNuNbkzWkz2nAHrxXJLIUaeIHzStA8jPIb08wwUNDxFtGPGuxyS7QlC2X7nAiQrUChc1PwgcNZW41G2P1ufNPrZ/index.php?email=april.wilson@ampf.com

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:c397 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://enterprise.responsemodeformpostresponsetypecode.entsyss.com/IdConnectAuthenticationProperties3d4E9rGg9bb3sVGyxPReNBYLcvZ7QaDndRp53tN5afJgJttMRxjWztLb16SalAKu92w5oZMkFjb61h4dAfUC3gNuNbkzWkz2nAHrxXJLIUaeIHzStA8jPIb08wwUNDxFtGPGuxyS7QlC2X7nAiQrUChc1PwgcNZW41G2P1ufNPrZ/index.php?email=april.wilson@ampf.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 26 Jun 2019 16:49:11 GMT
content-encoding: br
cf-cache-status: HIT
age: 6201693
cf-ray: 4ed0ac4bfdfcd6d1-FRA
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
last-modified: Thu, 17 May 2018 09:19:53 GMT
server: cloudflare
etag: W/"5afd4939-7918"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
expires: Mon, 15 Jun 2020 16:49:11 GMT
cache-control: public, max-age=30672000
timing-allow-origin: *
served-in-seconds: 0.016

GET ampf.com
logo.clearbit.com/ 0
0

GET
H/1.1 200
OK back.png
enterprise.responsemodeformpostresponsetypecode.entsyss.com/IdConnectAuthenticationProperties3d4E9rGg9bb3sVGyxPReNBYLcvZ7QaDndRp53tN5afJgJttMRxjWztLb16SalAKu92w5oZMkFjb61h4dAfUC3gNuNbkzWkz2nAHrxXJL... 9 KB
10 KB 159ms
159ms Image
image/png 104.168.11.85
ColoCrossing

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://enterprise.responsemodeformpostresponsetypecode.entsyss.com/IdConnectAuthenticationProperties3d4E9rGg9bb3sVGyxPReNBYLcvZ7QaDndRp53tN5afJgJttMRxjWztLb16SalAKu92w5oZMkFjb61h4dAfUC3gNuNbkzWkz2nAHrxXJLIUaeIHzStA8jPIb08wwUNDxFtGPGuxyS7QlC2X7nAiQrUChc1PwgcNZW41G2P1ufNPrZ/images/back.png
Requested by: Host: enterprise.responsemodeformpostresponsetypecode.entsyss.com
URL: https://enterprise.responsemodeformpostresponsetypecode.entsyss.com/IdConnectAuthenticationProperties3d4E9rGg9bb3sVGyxPReNBYLcvZ7QaDndRp53tN5afJgJttMRxjWztLb16SalAKu92w5oZMkFjb61h4dAfUC3gNuNbkzWkz2nAHrxXJLIUaeIHzStA8jPIb08wwUNDxFtGPGuxyS7QlC2X7nAiQrUChc1PwgcNZW41G2P1ufNPrZ/index.php?email=april.wilson@ampf.com
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.168.11.85 San Jose, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS: 104-168-11-85-host.colocrossing.com
Software: nginx /
Resource Hash: dcdf98e6a106b81b62e0bc700b74ba46e41ee7c74dda24d05fce5535ff576685

Request headers

Referer: https://enterprise.responsemodeformpostresponsetypecode.entsyss.com/IdConnectAuthenticationProperties3d4E9rGg9bb3sVGyxPReNBYLcvZ7QaDndRp53tN5afJgJttMRxjWztLb16SalAKu92w5oZMkFjb61h4dAfUC3gNuNbkzWkz2nAHrxXJLIUaeIHzStA8jPIb08wwUNDxFtGPGuxyS7QlC2X7nAiQrUChc1PwgcNZW41G2P1ufNPrZ/index.php?email=april.wilson@ampf.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 16:49:11 GMT
Last-Modified: Wed, 26 Jun 2019 11:28:36 GMT
Server: nginx
ETag: "5d1356e4-257c"
Content-Type: image/png
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=60
Content-Length: 9596
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK c.jpg
enterprise.responsemodeformpostresponsetypecode.entsyss.com/IdConnectAuthenticationProperties3d4E9rGg9bb3sVGyxPReNBYLcvZ7QaDndRp53tN5afJgJttMRxjWztLb16SalAKu92w5oZMkFjb61h4dAfUC3gNuNbkzWkz2nAHrxXJL... 273 KB
274 KB 432ms
312ms Image
image/jpeg 104.168.11.85
ColoCrossing

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://enterprise.responsemodeformpostresponsetypecode.entsyss.com/IdConnectAuthenticationProperties3d4E9rGg9bb3sVGyxPReNBYLcvZ7QaDndRp53tN5afJgJttMRxjWztLb16SalAKu92w5oZMkFjb61h4dAfUC3gNuNbkzWkz2nAHrxXJLIUaeIHzStA8jPIb08wwUNDxFtGPGuxyS7QlC2X7nAiQrUChc1PwgcNZW41G2P1ufNPrZ/images/c.jpg
Requested by: Host: enterprise.responsemodeformpostresponsetypecode.entsyss.com
URL: https://enterprise.responsemodeformpostresponsetypecode.entsyss.com/IdConnectAuthenticationProperties3d4E9rGg9bb3sVGyxPReNBYLcvZ7QaDndRp53tN5afJgJttMRxjWztLb16SalAKu92w5oZMkFjb61h4dAfUC3gNuNbkzWkz2nAHrxXJLIUaeIHzStA8jPIb08wwUNDxFtGPGuxyS7QlC2X7nAiQrUChc1PwgcNZW41G2P1ufNPrZ/index.php?email=april.wilson@ampf.com
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.168.11.85 San Jose, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US),
Reverse DNS: 104-168-11-85-host.colocrossing.com
Software: nginx /
Resource Hash: 6bde963a562ffd594492bdff280c01e9e6518856aa3a9f14b96fcad867ce2f0f

Request headers

Referer: https://enterprise.responsemodeformpostresponsetypecode.entsyss.com/IdConnectAuthenticationProperties3d4E9rGg9bb3sVGyxPReNBYLcvZ7QaDndRp53tN5afJgJttMRxjWztLb16SalAKu92w5oZMkFjb61h4dAfUC3gNuNbkzWkz2nAHrxXJLIUaeIHzStA8jPIb08wwUNDxFtGPGuxyS7QlC2X7nAiQrUChc1PwgcNZW41G2P1ufNPrZ/index.php?email=april.wilson@ampf.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 26 Jun 2019 16:49:11 GMT
Last-Modified: Wed, 26 Jun 2019 11:28:41 GMT
Server: nginx
ETag: "5d1356e9-44521"
Content-Type: image/jpeg
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=60
Content-Length: 279841
Expires: Thu, 31 Dec 2037 23:55:55 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: logo.clearbit.com
URL: https://logo.clearbit.com/ampf.com

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| unhideBody

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
enterprise.responsemodeformpostresponsetypecode.entsyss.com
logo.clearbit.com
logo.clearbit.com
104.168.11.85
2606:4700::6813:c397
08720809233bc47ea5de15da0aa5988c01803abdcb9ecd880e88d02cf91354d9
6bde963a562ffd594492bdff280c01e9e6518856aa3a9f14b96fcad867ce2f0f
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
dcdf98e6a106b81b62e0bc700b74ba46e41ee7c74dda24d05fce5535ff576685

enterprise.responsemodeformpostresponsetypecode.entsyss.com Open in urlscan Pro 104.168.11.85 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

80 %HTTPS

50 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

293 kBTransfer

320 kBSize

0 Cookies

2 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

enterprise.responsemodeformpostresponsetypecode.entsyss.com Open in urlscan Pro
104.168.11.85 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

80 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

293 kB
Transfer

320 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!