myaccount.account-info.email Open in urlscan Pro
35.160.211.80  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
6 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request 6903680-jj5N7BHtWDE-bA Show response myaccount.account-info.email/	212 KB 212 KB	450ms 226ms	Document text/html	35.160.211.80 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://myaccount.account-info.email/6903680-jj5N7BHtWDE-bA Protocol HTTP/1.1 Server 35.160.211.80 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-160-211-80.us-west-2.compute.amazonaws.com Software gunicorn/19.7.1 / Resource Hash 3489c095041bcb941a65b800d20423bd0e6bb0401f395dfa674dabd84e7a5ae2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection keep-alive Content-Length 216623 Content-Type text/html; charset=utf-8 Date Mon, 21 Aug 2023 22:36:58 GMT Server gunicorn/19.7.1 Strict-Transport-Security max-age=31536000; includeSubDomains Vary Cookie X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-UA-Compatible IE=edge,chrome=1 X-XSS-Protection 1; mode=block
GET H2	200	illustration aadcdn.msauthimages.net/dbd5a2dd-sqoguwsljet6dpgzkzdxg4nezztiratydhhtxvlnzwy/logintenantbranding/0/	28 KB 28 KB	126ms 27ms	Image image/png	2606:2800:233:3d10:442f:fac8:6d32:4c87 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauthimages.net/dbd5a2dd-sqoguwsljet6dpgzkzdxg4nezztiratydhhtxvlnzwy/logintenantbranding/0/illustration?ts=635920885442510623 Requested by Host: myaccount.account-info.email URL: http://myaccount.account-info.email/6903680-jj5N7BHtWDE-bA Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:3d10:442f:fac8:6d32:4c87 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frb/671C) / Resource Hash 2df0d6ddc18f559bf6470bef654cbf71e7bdbdc0d3e24153e376afd43a94899e Request headers accept-language de-DE,de;q=0.9 Referer http://myaccount.account-info.email/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob date Mon, 21 Aug 2023 22:36:59 GMT last-modified Fri, 26 Feb 2016 13:02:24 GMT server ECAcc (frb/671C) content-md5 pnRHWHAiOVLnD2Ht0fMxvA== age 66872 etag 0x8D33EAD1242DADB x-cache HIT content-type image/png x-ms-request-id 2705a60f-e01e-0059-80e4-d3c461000000 cache-control public, max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes content-length 28479
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c Request headers accept-language de-DE,de;q=0.9 Referer http://myaccount.account-info.email/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers Content-Type image/png
GET H2	200	bannerlogo aadcdn.msauthimages.net/dbd5a2dd-sqoguwsljet6dpgzkzdxg4nezztiratydhhtxvlnzwy/logintenantbranding/0/	2 KB 2 KB	125ms 28ms	Image image/png	2606:2800:233:3d10:442f:fac8:6d32:4c87 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauthimages.net/dbd5a2dd-sqoguwsljet6dpgzkzdxg4nezztiratydhhtxvlnzwy/logintenantbranding/0/bannerlogo?ts=635919201122335675 Requested by Host: myaccount.account-info.email URL: http://myaccount.account-info.email/6903680-jj5N7BHtWDE-bA Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:3d10:442f:fac8:6d32:4c87 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frb/6685) / Resource Hash d2a74c71792a90a40da4a8cc2c3be38b926f93b39ed1a9150f2d817da825dc0c Request headers accept-language de-DE,de;q=0.9 Referer http://myaccount.account-info.email/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob date Mon, 21 Aug 2023 22:36:59 GMT last-modified Wed, 24 Feb 2016 14:15:11 GMT server ECAcc (frb/6685) content-md5 uYxYeg0YNLMYZ0ODKK38eA== age 33514 etag 0x8D33D24E882B32B x-cache HIT content-type image/png x-ms-request-id e495cc0a-e01e-0049-0431-d40109000000 cache-control public, max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes content-length 2281
GET DATA	200 OK	truncated /	756 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69 Request headers accept-language de-DE,de;q=0.9 Referer http://myaccount.account-info.email/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	899 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2 Request headers accept-language de-DE,de;q=0.9 Referer http://myaccount.account-info.email/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	222 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2 Request headers accept-language de-DE,de;q=0.9 Referer http://myaccount.account-info.email/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	513 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58 Request headers accept-language de-DE,de;q=0.9 Referer http://myaccount.account-info.email/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	915 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea Request headers accept-language de-DE,de;q=0.9 Referer http://myaccount.account-info.email/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers Content-Type image/svg+xml
GET H/1.1	200 OK	jquery-1.11.0.min.js Show response staticmediafiles.s3.amazonaws.com/static/webapp/js/	94 KB 95 KB	410ms 137ms	Script application/javascript	3.5.6.204 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://staticmediafiles.s3.amazonaws.com/static/webapp/js/jquery-1.11.0.min.js Requested by Host: myaccount.account-info.email URL: http://myaccount.account-info.email/6903680-jj5N7BHtWDE-bA Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.5.6.204 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682 Request headers accept-language de-DE,de;q=0.9 Referer http://myaccount.account-info.email/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers Date Mon, 21 Aug 2023 22:37:00 GMT x-amz-version-id null Last-Modified Mon, 04 Jul 2016 08:58:20 GMT Server AmazonS3 x-amz-request-id Z7ZQXHC8K5W7GC4K ETag "8fc25e27d42774aeae6edbc0a18b72aa" Content-Type application/javascript Accept-Ranges bytes Content-Length 96381 x-amz-id-2 QHvhRaen8o3XQe+HGpZZ1gD2nSANHez13utAntSBU7xHlyvkqcLTog1wlF2YdvvWwCBMQMVHpimVsiEyJuqeKw==
GET H2	200	create_click_event.js Show response members.ironscales.com/static/training/js/	376 B 554 B	612ms 195ms	Script application/javascript	52.27.240.204 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://members.ironscales.com/static/training/js/create_click_event.js Requested by Host: myaccount.account-info.email URL: http://myaccount.account-info.email/6903680-jj5N7BHtWDE-bA Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.27.240.204 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-27-240-204.us-west-2.compute.amazonaws.com Software nginx / Resource Hash 8aa0dc07e67658e85b668f449655068ffeadaa406a21115acae58dc176c4487b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer http://myaccount.account-info.email/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Mon, 21 Aug 2023 22:36:59 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Sun, 20 Aug 2023 11:20:04 GMT server nginx content-encoding gzip etag W/"64e1f6e4-178" vary Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript x-xss-protection 1; mode=block x-ua-compatible IE=edge,chrome=1
GET H2	200	confirm_data_entry_on_typing.js Show response members.ironscales.com/static/training/js/	848 B 772 B	612ms 196ms	Script application/javascript	52.27.240.204 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://members.ironscales.com/static/training/js/confirm_data_entry_on_typing.js Requested by Host: myaccount.account-info.email URL: http://myaccount.account-info.email/6903680-jj5N7BHtWDE-bA Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.27.240.204 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-27-240-204.us-west-2.compute.amazonaws.com Software nginx / Resource Hash 657348bf276aef9bf7efc01f6dcf6779395c2de5e5e582981c0b450f5a529d14 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer http://myaccount.account-info.email/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Mon, 21 Aug 2023 22:36:59 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Sun, 20 Aug 2023 11:20:04 GMT server nginx content-encoding gzip etag W/"64e1f6e4-350" vary Accept-Encoding x-frame-options SAMEORIGIN content-type application/javascript x-xss-protection 1; mode=block x-ua-compatible IE=edge,chrome=1
POST H/1.1	200 OK	6903680-jj5N7BHtWDE-bA Show response myaccount.account-info.email/tracking/create_click_event/	21 B 386 B	214ms 214ms	XHR application/json	35.160.211.80 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://myaccount.account-info.email/tracking/create_click_event/6903680-jj5N7BHtWDE-bA Requested by Host: staticmediafiles.s3.amazonaws.com URL: https://staticmediafiles.s3.amazonaws.com/static/webapp/js/jquery-1.11.0.min.js Protocol HTTP/1.1 Server 35.160.211.80 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-160-211-80.us-west-2.compute.amazonaws.com Software gunicorn/19.7.1 / Resource Hash 8e348a2876686697c17bc2784470cbebe761146f0bbfc180a67a52793117882d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept application/json, text/javascript, */*; q=0.01 Referer http://myaccount.account-info.email/6903680-jj5N7BHtWDE-bA X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Content-Type application/json; charset=UTF-8 Response headers Date Mon, 21 Aug 2023 22:37:00 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Server gunicorn/19.7.1 Vary Cookie X-Frame-Options SAMEORIGIN Content-Type application/json Connection keep-alive Content-Length 21 X-XSS-Protection 1; mode=block X-UA-Compatible IE=edge,chrome=1

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| createClickEvent object| excludedKeyCodes function| confirmDataEntryOnTyping

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauthimages.net
members.ironscales.com
myaccount.account-info.email
staticmediafiles.s3.amazonaws.com
2606:2800:233:3d10:442f:fac8:6d32:4c87
3.5.6.204
35.160.211.80
52.27.240.204
2df0d6ddc18f559bf6470bef654cbf71e7bdbdc0d3e24153e376afd43a94899e
3489c095041bcb941a65b800d20423bd0e6bb0401f395dfa674dabd84e7a5ae2
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
657348bf276aef9bf7efc01f6dcf6779395c2de5e5e582981c0b450f5a529d14
749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2
8aa0dc07e67658e85b668f449655068ffeadaa406a21115acae58dc176c4487b
8e348a2876686697c17bc2784470cbebe761146f0bbfc180a67a52793117882d
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c
b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2
d2a74c71792a90a40da4a8cc2c3be38b926f93b39ed1a9150f2d817da825dc0c