urlscan.io logo urlscan.io
SecurityTrails logo

ocn-support-ntt.azurefd.net Open in urlscan Pro
2620:1ec:bdf::46  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://ocn-support-ntt.azurefd.net/
Submission: On May 24 via manual from JP — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 4 HTTP transactions. The main IP is 2620:1ec:bdf::46, located in United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is ocn-support-ntt.azurefd.net.
TLS certificate: Issued by Microsoft Azure TLS Issuing CA 01 on May 17th 2022. Valid for: a year.
This is the only time ocn-support-ntt.azurefd.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OCN (Telecommunication)

Domain & IP information

IP Address AS Autonomous System
1 2620:1ec:bdf::46 8068 (MICROSOFT...)
1 2404:6800:400... 15169 (GOOGLE)
2 210.145.245.69 4713 (OCN NTT C...)
4 3
Apex Domain
Subdomains		 Transfer
2 ocn.ne.jp
login.ocn.ne.jp
4 KB
1 gstatic.com
www.gstatic.com
2 KB
1 azurefd.net
ocn-support-ntt.azurefd.net
209 KB
4 3
Domain Requested by
2 login.ocn.ne.jp ocn-support-ntt.azurefd.net
1 www.gstatic.com ocn-support-ntt.azurefd.net
1 ocn-support-ntt.azurefd.net
4 3

This site contains links to these domains. Also see Links.

Domain
www.ntt.com
www.kagoya.jp
Subject Issuer Validity Valid
*.azurefd.net
Microsoft Azure TLS Issuing CA 01		 2022-05-17 -
2023-05-12		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2022-05-04 -
2022-07-27		 3 months crt.sh
login.ocn.ne.jp
DigiCert SHA2 Extended Validation Server CA		 2022-01-27 -
2023-02-27		 a year crt.sh

This page contains 1 frames:

Primary Page: https://ocn-support-ntt.azurefd.net/
Frame ID: 9268D06C32B0F1EE2C7D07CB5F08EFB1
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Statistics

4
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

215 kB
Transfer

213 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
ocn-support-ntt.azurefd.net/ 		208 KB
209 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ocn-support-ntt.azurefd.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::46 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
f1f9e7b0abd133cb8abb1445e999f2178ac2cea1221a93d4cf50cfd7a44cb9f9

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

accept-ranges
bytes
content-length
213149
content-type
text/html
date
Tue, 24 May 2022 07:45:32 GMT
etag
"6287478c-3409d"
last-modified
Fri, 20 May 2022 07:47:24 GMT
x-azure-ref
0HI2MYgAAAADT9pf2H1jAQ7kpexyWXopjVFlPMDFFREdFMjUxMwAxNmFkMmUzNy0xZTVjLTRkMWYtOTZjNy01NmJhYjRmNDU4YmI=
x-cache
CONFIG_NOCACHE
translate_24dp.png
www.gstatic.com/images/branding/product/2x/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/images/branding/product/2x/translate_24dp.png
Requested by
Host: ocn-support-ntt.azurefd.net
URL: https://ocn-support-ntt.azurefd.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:824::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://ocn-support-ntt.azurefd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Mon, 23 May 2022 22:12:03 GMT
x-content-type-options
nosniff
age
34410
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1842
x-xss-protection
0
last-modified
Thu, 14 Oct 2021 09:08:00 GMT
server
sffe
vary
Origin
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Tue, 23 May 2023 22:12:03 GMT
logo_001.gif
login.ocn.ne.jp/auth/s1001/pc/common/images/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login.ocn.ne.jp/auth/s1001/pc/common/images/logo_001.gif
Requested by
Host: ocn-support-ntt.azurefd.net
URL: https://ocn-support-ntt.azurefd.net/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
210.145.245.69 , Japan, ASN4713 (OCN NTT Communications Corporation, JP),
Reverse DNS
login.ocn.ne.jp
Software
/
Resource Hash
b675bafe177ded43cb9b977885eb52781d47208d86d293d2785e8935ff375ac3
Security Headers
Name Value
X-Frame-Options allow-from https://mypage.ntt.com/
X-Xss-Protection 1; mode=block

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://ocn-support-ntt.azurefd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Tue, 24 May 2022 07:45:33 GMT
Last-Modified
Mon, 28 Jun 2021 08:00:00 GMT
ETag
W/"2099-1624867200000"
X-Frame-Options
allow-from https://mypage.ntt.com/
Content-Type
image/gif;charset=UTF-8
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=3, max=100
Content-Length
2099
X-XSS-Protection
1; mode=block
logo_nttcommunications_001.gif
login.ocn.ne.jp/auth/s1001/pc/common/images/ 		920 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login.ocn.ne.jp/auth/s1001/pc/common/images/logo_nttcommunications_001.gif
Requested by
Host: ocn-support-ntt.azurefd.net
URL: https://ocn-support-ntt.azurefd.net/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
210.145.245.69 , Japan, ASN4713 (OCN NTT Communications Corporation, JP),
Reverse DNS
login.ocn.ne.jp
Software
/
Resource Hash
cfe62bca36872c9f754772271aef9c6bc2011ba0ed764e467159c3b5433eaf62
Security Headers
Name Value
X-Frame-Options allow-from https://mypage.ntt.com/
X-Xss-Protection 1; mode=block

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://ocn-support-ntt.azurefd.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Tue, 24 May 2022 07:45:33 GMT
Last-Modified
Mon, 28 Jun 2021 08:00:00 GMT
ETag
W/"920-1624867200000"
X-Frame-Options
allow-from https://mypage.ntt.com/
Content-Type
image/gif;charset=UTF-8
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=3, max=100
Content-Length
920
X-XSS-Protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OCN (Telecommunication)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails function| _0x53347f function| _0x437da9 function| _0x10df function| _0x424aff function| _0x53286e function| _0x297c74 function| _0x1fe6eb function| _0x10d461 function| _0x2a51b3 function| _0x25b395 function| _0x14f895 function| _0x11ac1c function| _0x384d string| hash

0 Cookies