![](/screenshots/80decaa9-a24e-4eb8-b70e-eab5f8f65cac.png)
amazoniapress.com.br
Open in
urlscan Pro
2606:4700:3037::6815:4bfa
Malicious Activity!
Public Scan
Effective URL: https://amazoniapress.com.br/venus/MicrosoftAccount.html
Submission Tags: falconsandbox
Submission: On June 15 via api from US
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 24th 2021. Valid for: a year.
This is the only time amazoniapress.com.br was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Office 365 (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 67.199.248.10 67.199.248.10 | 396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD) | |
1 | 2606:4700:303... 2606:4700:3037::6815:4bfa | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 129.215.55.224 129.215.55.224 | 786 (JANET Jis...) (JANET Jisc Services Limited) | |
2 | 2a02:26f0:6c0... 2a02:26f0:6c00:2b4::35c1 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 141.193.213.21 141.193.213.21 | 209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare) | |
6 | 4 |
ASN786 (JANET Jisc Services Limited, GB)
PTR: edadfed.ed.ac.uk
edadfed.ed.ac.uk |
ASN20940 (AKAMAI-ASN1, NL)
secure.aadcdn.microsoftonline-p.com |
ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)
blogs.microsoft.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com |
204 KB |
2 |
ed.ac.uk
edadfed.ed.ac.uk |
188 KB |
1 |
microsoft.com
blogs.microsoft.com |
42 KB |
1 |
amazoniapress.com.br
amazoniapress.com.br |
5 KB |
1 |
bit.ly
1 redirects
bit.ly |
272 B |
6 | 5 |
Domain | Requested by | |
---|---|---|
2 | secure.aadcdn.microsoftonline-p.com |
amazoniapress.com.br
|
2 | edadfed.ed.ac.uk |
amazoniapress.com.br
|
1 | blogs.microsoft.com |
amazoniapress.com.br
|
1 | amazoniapress.com.br | |
1 | bit.ly | 1 redirects |
6 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-05-24 - 2022-05-23 |
a year | crt.sh |
edadfed.ed.ac.uk QuoVadis Europe EV SSL CA G1 |
2020-11-24 - 2021-11-24 |
a year | crt.sh |
secure.aadcdn.microsoftonline-p.com Microsoft RSA TLS CA 01 |
2020-12-22 - 2021-12-22 |
a year | crt.sh |
blogs.microsoft.com Microsoft RSA TLS CA 01 |
2020-11-20 - 2021-11-20 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://amazoniapress.com.br/venus/MicrosoftAccount.html
Frame ID: FCBDB785C85EFE7CE140FEB3ED1D6070
Requests: 6 HTTP requests in this frame
Screenshot
![](/screenshots/80decaa9-a24e-4eb8-b70e-eab5f8f65cac.png)
Page URL History Show full URLs
-
https://bit.ly/2SAXaa4
HTTP 301
https://amazoniapress.com.br/venus/MicrosoftAccount.html Page URL
Detected technologies
Detected patterns
- headers server /^cloudflare$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://bit.ly/2SAXaa4
HTTP 301
https://amazoniapress.com.br/venus/MicrosoftAccount.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
MicrosoftAccount.html
amazoniapress.com.br/venus/ Redirect Chain
|
17 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
edadfed.ed.ac.uk/adfs/portal/css/ |
8 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
heroillustration
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-6ybrougjmflxqw910ieyohr7wb4x4-yvoixrlaidmz4/appbranding/askzfdsqe20i-bcjwporaywega7vbt4acqnn1hiliiw/0/ |
199 KB 199 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bannerlogo
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-6ybrougjmflxqw910ieyohr7wb4x4-yvoixrlaidmz4/appbranding/askzfdsqe20i-bcjwporaywega7vbt4acqnn1hiliiw/0/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
8867.Microsoft_5F00_Logo_2D00_for_2D00_screen.jpg
blogs.microsoft.com/wp-content/uploads/2012/08/ |
41 KB 42 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
illustration.jpg
edadfed.ed.ac.uk/adfs/portal/illustration/ |
185 KB 186 KB |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Office 365 (Online)20 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| InputUtil function| validateForm function| SelectOption function| Login undefined| emails undefined| msViewportStyle undefined| viewport function| getStyle function| computeLoadIllustration0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
amazoniapress.com.br
bit.ly
blogs.microsoft.com
edadfed.ed.ac.uk
secure.aadcdn.microsoftonline-p.com
129.215.55.224
141.193.213.21
2606:4700:3037::6815:4bfa
2a02:26f0:6c00:2b4::35c1
67.199.248.10
47c8b22935bc876849dbb14cbe8e2e5166bed47df9e72dfd5a4050e80efc46e8
545a890c02df6d162184db5d5c76ddaf945c773d76c83f3a4e54d431a1d6cbd0
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
c8cacda511a49c08ad9a96b42082e40539ecd67c697955d4cd72fc730d34fcde
cf5edf607626ff9059a47a7a955b02ce097c255f75bc54232650a0db0fb9d794
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603