urlscan.io logo urlscan.io
SecurityTrails logo

lmo.teams.secure.sbw.edu Open in urlscan Pro
217.168.40.59  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://lmo.teams.secure.sbw.edu/common/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=5e3...
Submission: On October 17 via automatic, source phishtank — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 217.168.40.59, located in Vernier, Switzerland and belongs to LIBERTYGLOBAL Liberty Global formerly UPC Broadband Holding, aka AORTA, NL. The main domain is lmo.teams.secure.sbw.edu.
TLS certificate: Issued by R3 on October 15th 2021. Valid for: 3 months.
This is the only time lmo.teams.secure.sbw.edu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
2 217.168.40.59 6830 (LIBERTYGL...)
8 2620:1ec:bdf::60 8068 (MICROSOFT...)
10 2
Apex Domain
Subdomains		 Transfer
8 msauth.net
aadcdn.msauth.net
154 KB
2 sbw.edu
lmo.teams.secure.sbw.edu
40 KB
10 2
Domain Requested by
8 aadcdn.msauth.net lmo.teams.secure.sbw.edu
aadcdn.msauth.net
2 lmo.teams.secure.sbw.edu aadcdn.msauth.net
10 2

This site contains links to these domains. Also see Links.

Domain
www.microsoft.com
privacy.microsoft.com
Subject Issuer Validity Valid
secure.sbw.edu
R3		 2021-10-15 -
2022-01-13		 3 months crt.sh
aadcdn.msauth.net
DigiCert SHA2 Secure Server CA		 2021-07-08 -
2022-07-08		 a year crt.sh

This page contains 1 frames:

Primary Page: https://lmo.teams.secure.sbw.edu/common/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=5e3ce6c0-2b1f-4285-8d4b-75ee78787346&redirect_uri=https://teams.secure.sbw.edu/go&state=eyJpZCI6IjY3ZDY0ZDMxLTVkYTUtNGY4MC04YzVhLTBmMjRlNTI5MDk3YSIsInRzIjoxNjM0MzkwNTg4LCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0=&nonce=18622423-5593-451d-b0fa-fc8efa164b91&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&client-request-id=e466567c-7d0d-42d5-a3bd-f98a0a048167&response_mode=fragment&sso_reload=true
Frame ID: DF699332F75C6C34605FAD1BD219666E
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Bei Ihrem Konto anmelden

Page Statistics

10
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

194 kB
Transfer

597 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set authorize
lmo.teams.secure.sbw.edu/common/oauth2/v2.0/ 		153 KB
39 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://lmo.teams.secure.sbw.edu/common/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=5e3ce6c0-2b1f-4285-8d4b-75ee78787346&redirect_uri=https://teams.secure.sbw.edu/go&state=eyJpZCI6IjY3ZDY0ZDMxLTVkYTUtNGY4MC04YzVhLTBmMjRlNTI5MDk3YSIsInRzIjoxNjM0MzkwNTg4LCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0=&nonce=18622423-5593-451d-b0fa-fc8efa164b91&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&client-request-id=e466567c-7d0d-42d5-a3bd-f98a0a048167&response_mode=fragment&sso_reload=true
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
217.168.40.59 Vernier, Switzerland, ASN6830 (LIBERTYGLOBAL Liberty Global formerly UPC Broadband Holding, aka AORTA, NL),
Reverse DNS
217-168-40-59.static.cablecom.ch
Software
/
Resource Hash
fa66f6e394330a8a3724f65192099baf031695e165f6666e97fcfe348d690a69
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Host
lmo.teams.secure.sbw.edu
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Set-Cookie
fpc=As1ZApNMBgRKhJo6UaDz1rU; expires=Tue, 16-Nov-2021 04:06:28 GMT; path=/; secure; HttpOnly; SameSite=None esctx=AQABAAAAAAD--DLA3VO7QrddgJg7WevrJseNTY1YPbHs1oomzzoWxxRj9zk6IQw4eq83S1RQu08EffoRLzmjco_-iVZUKwLjeUUwd9UVXUPkWjlsodQTfckEfMJfCO0sIh4blkum6om8PYudwG5cI4pUG2_tYhfcO4pZujCLaZzFjMyk4t7xsdoHapGIZkNRUdfExSQSHUggAA; domain=.lmo.teams.secure.sbw.edu; path=/; secure; HttpOnly; SameSite=None x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly stsservicecookie=estsfd; path=/; secure; samesite=none; httponly
x-ms-ests-server
2.1.12108.10 - NEULR2 ProdSlices
X-Content-Type-Options
nosniff
Pragma
no-cache
P3P
CP="DSP CUR OTPi IND OTRi ONL FIN"
Date
Sun, 17 Oct 2021 04:06:28 GMT
Referrer-Policy
strict-origin-when-cross-origin
Strict-Transport-Security
max-age=31536000; includeSubDomains
Cache-Control
no-store, no-cache
nel
{"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
Vary
Accept-Encoding
X-DNS-Prefetch-Control
on
Expires
-1
report-to
{"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams1"}]}
x-ms-request-id
29b935d0-757b-4d21-889f-23c68cc08100
Link
<https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch,<https://aadcdn.msftauth.net>; rel=dns-prefetch
Content-Encoding
gzip
Content-Type
text/html;charset=utf-8
Transfer-Encoding
chunked
Keep-Alive
timeout=60
Connection
keep-alive
ConvergedError_Core_u1Ib0bvyN0cft5v_900-wQ2.js
aadcdn.msauth.net/shared/1.0/content/js/ 		373 KB
102 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedError_Core_u1Ib0bvyN0cft5v_900-wQ2.js
Requested by
Host: lmo.teams.secure.sbw.edu
URL: https://lmo.teams.secure.sbw.edu/common/oauth2/v2.0/authorize?response_type=id_token&amp;scope=openid%20profile&amp;client_id=5e3ce6c0-2b1f-4285-8d4b-75ee78787346&amp;redirect_uri=https://teams.secure.sbw.edu/go&amp;state=eyJpZCI6IjY3ZDY0ZDMxLTVkYTUtNGY4MC04YzVhLTBmMjRlNTI5MDk3YSIsInRzIjoxNjM0MzkwNTg4LCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0=&amp;nonce=18622423-5593-451d-b0fa-fc8efa164b91&amp;client_info=1&amp;x-client-SKU=MSAL.JS&amp;x-client-Ver=1.3.4&amp;client-request-id=e466567c-7d0d-42d5-a3bd-f98a0a048167&amp;response_mode=fragment&amp;sso_reload=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::60 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
2b716ec600936d8f25bba23c16319a7f28752e193f6f31b7cc5ecbe3924e3c4d

Request headers

Referer
https://lmo.teams.secure.sbw.edu/
Origin
https://lmo.teams.secure.sbw.edu
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sun, 17 Oct 2021 04:06:28 GMT
content-encoding
gzip
x-azure-ref-originshield
0jCBpYQAAAAB8DV71Y4k4RZl2/1zNf3oOTE9OMjFFREdFMDExMgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-md5
yaGnzAy2fG9pa/VPrbHiYA==
x-cache
TCP_HIT
content-length
103914
x-ms-lease-status
unlocked
last-modified
Fri, 10 Sep 2021 21:01:08 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D9749E1CF3F155
x-azure-ref
0RaFrYQAAAAB73RCxesmmQonx8yxt/dBsRlJBRURHRTEwMTgAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
96af6490-301e-0018-018d-c1df40000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
oneDs_005362965f8408780df6.js
aadcdn.msauth.net/shared/1.0/content/js/ 		62 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msauth.net/shared/1.0/content/js/oneDs_005362965f8408780df6.js
Requested by
Host: aadcdn.msauth.net
URL: https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedError_Core_u1Ib0bvyN0cft5v_900-wQ2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::60 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
d736e2dd18641a9541b23dd4e686bc82b50462013605ee01116a41ee4adcd8df

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://lmo.teams.secure.sbw.edu/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sun, 17 Oct 2021 04:06:29 GMT
content-encoding
gzip
x-azure-ref-originshield
0djphYQAAAABH0k1SS54NR6p8nG5oqzA9TE9OMjFFREdFMDExMAAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-md5
3uhC6s1i3bJlze1D6G2nAg==
x-cache
TCP_HIT
content-length
18733
x-ms-lease-status
unlocked
last-modified
Wed, 19 May 2021 21:22:41 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D91B0C3C423BAB
x-azure-ref
0RaFrYQAAAAB6qTXttIGySZj45mpcT3O/RlJBRURHRTEwMjEAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
f5689f9c-601e-0051-2dd9-bc7f42000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
check_small_c36fa14790dfc6ca22068a958373c2ba.svg
aadcdn.msauth.net/shared/1.0/content/images/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/shared/1.0/content/images/check_small_c36fa14790dfc6ca22068a958373c2ba.svg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::60 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
22d511adce8d3498f842b05df7281ce582fdc6817fe27606ecd21e72277857f3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://lmo.teams.secure.sbw.edu/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sun, 17 Oct 2021 04:06:29 GMT
content-encoding
gzip
x-azure-ref-originshield
0eR5pYQAAAABXul+A7z9BTr4n1Zq0I9iITE9OMjFFREdFMDIxOAAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-md5
iYTzOJM089b1SPwrN/KdOg==
x-cache
TCP_HIT
content-length
1009
x-ms-lease-status
unlocked
last-modified
Fri, 24 Jan 2020 23:50:51 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D7A1283E3AC14D
x-azure-ref
0RaFrYQAAAAC3gQX4zq3JRJ9jq5wmoJqeRlJBRURHRTEwMjEAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
863a97e6-b01e-0068-7989-c12d40000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
close_40eb39126300b56bf66c20ee75b54093.svg
aadcdn.msauth.net/shared/1.0/content/images/ 		270 B
493 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/shared/1.0/content/images/close_40eb39126300b56bf66c20ee75b54093.svg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::60 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
765709425a5b9209e875dccf2217d3161429d2d48159fc1df7b253b77c1574f4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://lmo.teams.secure.sbw.edu/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sun, 17 Oct 2021 04:06:29 GMT
content-encoding
gzip
x-azure-ref-originshield
0D8RlYQAAAACXxOU6Kpk3TaF/9jT2hJvhTE9OMjFFREdFMDExMgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-md5
rp+/fadJKxLUo+jgFmYTeQ==
x-cache
TCP_HIT
content-length
190
x-ms-lease-status
unlocked
last-modified
Fri, 17 Jan 2020 19:28:35 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D79B8372232B84
x-azure-ref
0RaFrYQAAAACmJTaiwyK2SY7AaPF7sPb0RlJBRURHRTEwMjEAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
e14afce3-101e-0036-79f9-beec6e000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
converged.v2.login.min_lgjnfq3xbrj5zvj5ionvww2.css
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ 		0
20 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_lgjnfq3xbrj5zvj5ionvww2.css
Requested by
Host: lmo.teams.secure.sbw.edu
URL: https://lmo.teams.secure.sbw.edu/common/oauth2/v2.0/authorize?response_type=id_token&amp;scope=openid%20profile&amp;client_id=5e3ce6c0-2b1f-4285-8d4b-75ee78787346&amp;redirect_uri=https://teams.secure.sbw.edu/go&amp;state=eyJpZCI6IjY3ZDY0ZDMxLTVkYTUtNGY4MC04YzVhLTBmMjRlNTI5MDk3YSIsInRzIjoxNjM0MzkwNTg4LCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0=&amp;nonce=18622423-5593-451d-b0fa-fc8efa164b91&amp;client_info=1&amp;x-client-SKU=MSAL.JS&amp;x-client-Ver=1.3.4&amp;client-request-id=e466567c-7d0d-42d5-a3bd-f98a0a048167&amp;response_mode=fragment&amp;sso_reload=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::60 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://lmo.teams.secure.sbw.edu/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sun, 17 Oct 2021 04:06:29 GMT
content-encoding
gzip
x-azure-ref-originshield
0gWNgYQAAAAAjgdPGGOu4S7pVCce1QrFVTE9OMjFFREdFMDIwOAAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-md5
mU+G3bfjPvbbh+JW3ypW1g==
x-cache
TCP_HIT
content-length
19835
x-ms-lease-status
unlocked
last-modified
Fri, 04 Jun 2021 23:48:31 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D927B3427B3935
x-azure-ref
0RaFrYQAAAAArduFIIClcR5rPN2ywW4quRlJBRURHRTEwMjEAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
8a724540-601e-0039-601d-bc6571000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
ux.converged.error.strings-de.min_t_irfjrfzwnhghzhovwryg2.js
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ 		0
9 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.error.strings-de.min_t_irfjrfzwnhghzhovwryg2.js
Requested by
Host: lmo.teams.secure.sbw.edu
URL: https://lmo.teams.secure.sbw.edu/common/oauth2/v2.0/authorize?response_type=id_token&amp;scope=openid%20profile&amp;client_id=5e3ce6c0-2b1f-4285-8d4b-75ee78787346&amp;redirect_uri=https://teams.secure.sbw.edu/go&amp;state=eyJpZCI6IjY3ZDY0ZDMxLTVkYTUtNGY4MC04YzVhLTBmMjRlNTI5MDk3YSIsInRzIjoxNjM0MzkwNTg4LCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0=&amp;nonce=18622423-5593-451d-b0fa-fc8efa164b91&amp;client_info=1&amp;x-client-SKU=MSAL.JS&amp;x-client-Ver=1.3.4&amp;client-request-id=e466567c-7d0d-42d5-a3bd-f98a0a048167&amp;response_mode=fragment&amp;sso_reload=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::60 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://lmo.teams.secure.sbw.edu/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sun, 17 Oct 2021 04:06:29 GMT
content-encoding
gzip
x-azure-ref-originshield
0lM1fYQAAAACpwmAyz1EkR7U8nkcAHfChTE9OMjFFREdFMDIxOAAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-md5
vsc/dCMY9tmQrwTmzg23pA==
x-cache
TCP_HIT
content-length
8446
x-ms-lease-status
unlocked
last-modified
Sun, 12 Sep 2021 23:13:51 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D97642FC19AA0C
x-azure-ref
0RaFrYQAAAADGh5QvUphXSpwKnY9vmVfaRlJBRURHRTEwMjEAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
54ecd837-101e-000a-44c2-bb3966000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
2_bc3d32a696895f78c19df6c717586a5d.svg
aadcdn.msauth.net/shared/1.0/content/images/backgrounds/ 		2 KB
974 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::60 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://lmo.teams.secure.sbw.edu/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sun, 17 Oct 2021 04:06:29 GMT
content-encoding
gzip
x-azure-ref-originshield
0UwtpYQAAAACtmmFJ8VTBTbWjdixxK6EaTE9OMjFFREdFMDEwOQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-md5
DhdidjYrlCeaRJJRG/y9mA==
x-cache
TCP_HIT
content-length
673
x-ms-lease-status
unlocked
last-modified
Wed, 12 Feb 2020 22:01:30 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D7B0071D86E386
x-azure-ref
0RaFrYQAAAABmA60vjoweQLelJUhi7NTVRlJBRURHRTEwMjEAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
ea7fc26e-201e-002d-14df-c0795b000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msauth.net/shared/1.0/content/images/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::60 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://lmo.teams.secure.sbw.edu/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sun, 17 Oct 2021 04:06:29 GMT
content-encoding
gzip
x-azure-ref-originshield
0UwtpYQAAAAAGedWkvbF/TIRm4sqwahhKTE9OMjFFREdFMTUxNAAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-md5
nzaLxFgP7ZB3dfMcaybWzw==
x-cache
TCP_HIT
content-length
1435
x-ms-lease-status
unlocked
last-modified
Fri, 17 Jan 2020 19:28:38 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D79B8373CB2849
x-azure-ref
0RaFrYQAAAAB3nY15bavsQoLog/1Qg2OqRlJBRURHRTEwMjEAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
2bc2b82f-e01e-0021-3780-c18d42000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
Cookie set reportpageload
lmo.teams.secure.sbw.edu/common/instrumentation/ 		264 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://lmo.teams.secure.sbw.edu/common/instrumentation/reportpageload?mkt=de-DE
Requested by
Host: aadcdn.msauth.net
URL: https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedError_Core_u1Ib0bvyN0cft5v_900-wQ2.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
217.168.40.59 Vernier, Switzerland, ASN6830 (LIBERTYGLOBAL Liberty Global formerly UPC Broadband Holding, aka AORTA, NL),
Reverse DNS
217-168-40-59.static.cablecom.ch
Software
/
Resource Hash
73cb695d7447f9baf286bdc15932526a2af86a4470cc965cf40290f9f7fec8f9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Sec-Fetch-Mode
cors
Origin
https://lmo.teams.secure.sbw.edu
Accept-Encoding
gzip, deflate, br
Accept-Language
de-DE,de;q=0.9
client-request-id
30dabe7a-f18b-4a87-8058-3ce020e2fab8
canary
AQABAAAAAAD--DLA3VO7QrddgJg7WevrOZF1UgZeokA9Bd1-UvF5tqyoJoszrrnv0DY0Tb2-z8Uswj_r4RuELfBmGLJxNhinjeP4Fk9vpavP-qn2wIZGdAFNPSN2hyPzQqHObPABY9RE074TNgpwy1fga1oqQydwXb1jqUxhuSlKYx8uXYy-NU4F6_dLOg_i6zM5XLgyS-wm4czIs_H1-DuwP6i_m9cVIybKk5hSRRE1YjofYaGYVSAA
Sec-Fetch-Dest
empty
Cookie
fpc=As1ZApNMBgRKhJo6UaDz1rU; esctx=AQABAAAAAAD--DLA3VO7QrddgJg7WevrJseNTY1YPbHs1oomzzoWxxRj9zk6IQw4eq83S1RQu08EffoRLzmjco_-iVZUKwLjeUUwd9UVXUPkWjlsodQTfckEfMJfCO0sIh4blkum6om8PYudwG5cI4pUG2_tYhfcO4pZujCLaZzFjMyk4t7xsdoHapGIZkNRUdfExSQSHUggAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Connection
keep-alive
Content-Length
7045
hpgact
1800
Pragma
no-cache
hpgrequestid
29b935d0-757b-4d21-889f-23c68cc08100
Host
lmo.teams.secure.sbw.edu
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-type
application/json; charset=UTF-8
hpgid
1117
Accept
application/json
Cache-Control
no-cache
Referer
https://lmo.teams.secure.sbw.edu/common/oauth2/v2.0/authorize?response_type=id_token&amp;scope=openid%20profile&amp;client_id=5e3ce6c0-2b1f-4285-8d4b-75ee78787346&amp;redirect_uri=https://teams.secure.sbw.edu/go&amp;state=eyJpZCI6IjY3ZDY0ZDMxLTVkYTUtNGY4MC04YzVhLTBmMjRlNTI5MDk3YSIsInRzIjoxNjM0MzkwNTg4LCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0=&amp;nonce=18622423-5593-451d-b0fa-fc8efa164b91&amp;client_info=1&amp;x-client-SKU=MSAL.JS&amp;x-client-Ver=1.3.4&amp;client-request-id=e466567c-7d0d-42d5-a3bd-f98a0a048167&amp;response_mode=fragment&amp;sso_reload=true
Sec-Fetch-Site
same-origin
hpgrequestid
29b935d0-757b-4d21-889f-23c68cc08100
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
client-request-id
30dabe7a-f18b-4a87-8058-3ce020e2fab8
canary
AQABAAAAAAD--DLA3VO7QrddgJg7WevrOZF1UgZeokA9Bd1-UvF5tqyoJoszrrnv0DY0Tb2-z8Uswj_r4RuELfBmGLJxNhinjeP4Fk9vpavP-qn2wIZGdAFNPSN2hyPzQqHObPABY9RE074TNgpwy1fga1oqQydwXb1jqUxhuSlKYx8uXYy-NU4F6_dLOg_i6zM5XLgyS-wm4czIs_H1-DuwP6i_m9cVIybKk5hSRRE1YjofYaGYVSAA
Content-type
application/json; charset=UTF-8
hpgid
1117
Accept
application/json
Referer
https://lmo.teams.secure.sbw.edu/common/oauth2/v2.0/authorize?response_type=id_token&amp;scope=openid%20profile&amp;client_id=5e3ce6c0-2b1f-4285-8d4b-75ee78787346&amp;redirect_uri=https://teams.secure.sbw.edu/go&amp;state=eyJpZCI6IjY3ZDY0ZDMxLTVkYTUtNGY4MC04YzVhLTBmMjRlNTI5MDk3YSIsInRzIjoxNjM0MzkwNTg4LCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0=&amp;nonce=18622423-5593-451d-b0fa-fc8efa164b91&amp;client_info=1&amp;x-client-SKU=MSAL.JS&amp;x-client-Ver=1.3.4&amp;client-request-id=e466567c-7d0d-42d5-a3bd-f98a0a048167&amp;response_mode=fragment&amp;sso_reload=true
hpgact
1800

Response headers

Date
Sun, 17 Oct 2021 04:06:29 GMT
Access-Control-Allow-Methods
POST, OPTIONS
X-Content-Type-Options
nosniff
nel
{"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
client-request-id
30dabe7a-f18b-4a87-8058-3ce020e2fab8
P3P
CP="DSP CUR OTPi IND OTRi ONL FIN"
Connection
keep-alive
Pragma
no-cache
Referrer-Policy
strict-origin-when-cross-origin
Strict-Transport-Security
max-age=31536000; includeSubDomains
report-to
{"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams1"}]}
Content-Type
application/json;charset=utf-8
Access-Control-Allow-Origin
https://autologon.microsoftazuread-sso.com/
x-ms-request-id
8141dca3-fd92-41cd-a68e-1f8f5d506500
Cache-Control
no-store, no-cache
Transfer-Encoding
chunked
Set-Cookie
fpc=As1ZApNMBgRKhJo6UaDz1rU; expires=Tue, 16-Nov-2021 04:06:30 GMT; path=/; secure; HttpOnly; SameSite=None x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly stsservicecookie=estsfd; path=/; secure; samesite=none; httponly
Access-Control-Allow-Credentials
true
Keep-Alive
timeout=60
x-ms-ests-server
2.1.12108.11 - NEULR2 ProdSlices
Expires
-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B object| ServerData object| webpackJsonp object| ko object| PROOF object| StringRepository boolean| __ConvergedError_Core boolean| __ object| Telemetry object| telemetry_webpackJsonp function| __assign function| __extends

4 Cookies

Domain/Path Name / Value
lmo.teams.secure.sbw.edu/ Name: fpc
Value: As1ZApNMBgRKhJo6UaDz1rU
.lmo.teams.secure.sbw.edu/ Name: esctx
Value: AQABAAAAAAD--DLA3VO7QrddgJg7WevrJseNTY1YPbHs1oomzzoWxxRj9zk6IQw4eq83S1RQu08EffoRLzmjco_-iVZUKwLjeUUwd9UVXUPkWjlsodQTfckEfMJfCO0sIh4blkum6om8PYudwG5cI4pUG2_tYhfcO4pZujCLaZzFjMyk4t7xsdoHapGIZkNRUdfExSQSHUggAA
lmo.teams.secure.sbw.edu/ Name: x-ms-gateway-slice
Value: estsfd
lmo.teams.secure.sbw.edu/ Name: stsservicecookie
Value: estsfd

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff