![](/screenshots/8322f2b9-944c-4f7e-9a6d-b0c9de4bd774.png)
live-email-visitante.jelastic.regruhosting.ru
Open in
urlscan Pro
151.248.124.254
Malicious Activity!
Public Scan
Effective URL: http://live-email-visitante.jelastic.regruhosting.ru/syllWvoB10j37P34957WtaLCKi8mIdX4NcoImmfrLW5A3jMvbTFt1TSOZVRdccDWDdIVJP87IVlHfvXn2D4RtQpbc2d3NZUN...
Submission: On November 08 via manual from BR — Scanned from DE
Summary
This is the only time live-email-visitante.jelastic.regruhosting.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 5 | 151.248.124.254 151.248.124.254 | 197695 (AS-REG) (AS-REG) | |
7 | 192.229.221.185 192.229.221.185 | 15133 (EDGECAST) (EDGECAST) | |
1 | 20.190.159.68 20.190.159.68 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
12 | 3 |
ASN197695 (AS-REG, RU)
live-email-visitante.jelastic.regruhosting.ru |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
msauth.net
logincdn.msauth.net — Cisco Umbrella Rank: 3665 |
21 KB |
5 |
regruhosting.ru
1 redirects
live-email-visitante.jelastic.regruhosting.ru |
41 KB |
1 |
live.com
login.live.com — Cisco Umbrella Rank: 64 |
2 KB |
12 | 3 |
Domain | Requested by | |
---|---|---|
7 | logincdn.msauth.net |
live-email-visitante.jelastic.regruhosting.ru
|
5 | live-email-visitante.jelastic.regruhosting.ru |
1 redirects
live-email-visitante.jelastic.regruhosting.ru
|
1 | login.live.com |
live-email-visitante.jelastic.regruhosting.ru
|
12 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
signup.live.com |
login.live.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
identitycdn.msauth.net Microsoft Azure TLS Issuing CA 06 |
2022-08-23 - 2023-08-18 |
a year | crt.sh |
graph.windows.net DigiCert SHA2 Secure Server CA |
2022-10-19 - 2023-10-19 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
http://live-email-visitante.jelastic.regruhosting.ru/syllWvoB10j37P34957WtaLCKi8mIdX4NcoImmfrLW5A3jMvbTFt1TSOZVRdccDWDdIVJP87IVlHfvXn2D4RtQpbc2d3NZUNBUNdZi43F58GdkkuDCb0Z8JH7x1kKY4INcR4YARnLroMxiHwVLsrIS1fkJK9tt01mbpvnbiXeYOmR.php
Frame ID: 27767BDCC6DDD1E6677D6D9A000B03FB
Requests: 11 HTTP requests in this frame
Frame:
https://login.live.com/Me.htm?v=1&uaid=e52f753aa5184927ab11e578045c61f0
Frame ID: F3FE75490EA4EC6E1BB401B1186F3325
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/8322f2b9-944c-4f7e-9a6d-b0c9de4bd774.png)
Page Title
Entrar to your Microsoft accountPage URL History Show full URLs
-
http://live-email-visitante.jelastic.regruhosting.ru/
HTTP 302
http://live-email-visitante.jelastic.regruhosting.ru/syllWvoB10j37P34957WtaLCKi8mIdX4NcoImmfrLW5A3jMvbTFt1TSOZVRdccDWDdIVJP87IVlH... Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: Crie uma!
Search URL Search Domain Scan URL
Title: Entrar com uma chave de segurança
Search URL Search Domain Scan URL
Title: Terms of use
Search URL Search Domain Scan URL
Title: Privacy & cookies
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://live-email-visitante.jelastic.regruhosting.ru/
HTTP 302
http://live-email-visitante.jelastic.regruhosting.ru/syllWvoB10j37P34957WtaLCKi8mIdX4NcoImmfrLW5A3jMvbTFt1TSOZVRdccDWDdIVJP87IVlHfvXn2D4RtQpbc2d3NZUNBUNdZi43F58GdkkuDCb0Z8JH7x1kKY4INcR4YARnLroMxiHwVLsrIS1fkJK9tt01mbpvnbiXeYOmR.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
syllWvoB10j37P34957WtaLCKi8mIdX4NcoImmfrLW5A3jMvbTFt1TSOZVRdccDWDdIVJP87IVlHfvXn2D4RtQpbc2d3NZUNBUNdZi43F58GdkkuDCb0Z8JH7x1kKY4INcR4YARnLroMxiHwVLsrIS1fkJK9tt01mbpvnbiXeYOmR.php
live-email-visitante.jelastic.regruhosting.ru/ Redirect Chain
|
79 KB 24 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Converged_v21033.css
logincdn.msauth.net/16.000.28230.00/ |
98 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ConvergedLoginPaginatedStrings.en
logincdn.msauth.net/16.000.28230.00/ |
0 0 |
Script
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ConvergedLogin_PCore
logincdn.msauth.net/16.000.28230.00/ |
0 0 |
Script
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ip2.php
live-email-visitante.jelastic.regruhosting.ru/ |
196 B 196 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo.svg
logincdn.msauth.net/16.000.28230.00/images/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ellipsis_white.svg
logincdn.msauth.net/16.000.28230.00/images/ |
915 B 417 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ellipsis_grey.svg
logincdn.msauth.net/16.000.28230.00/images/ |
915 B 393 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ConvergedLogin_PCore
logincdn.msauth.net/16.000.28230.00/ |
0 0 |
Other
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0-small.jpg
live-email-visitante.jelastic.regruhosting.ru/ |
866 B 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0.jpg
live-email-visitante.jelastic.regruhosting.ru/ |
13 KB 14 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Me.htm
login.live.com/ Frame F3FE |
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)20 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation object| PROOF function| $Loader object| $Do function| $DepLoader object| g_dtFirstByte object| g_objPageMode number| g_iSRSFailed string| g_sSRSSuccess function| SRSRetry object| ServerData object| UXResourceDependencies function| WhenAllLoaded3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
live-email-visitante.jelastic.regruhosting.ru/ | Name: PHPSESSID Value: c57d65447a639614b21633742b61cec3 |
|
.login.live.com/ | Name: uaid Value: e52f753aa5184927ab11e578045c61f0 |
|
.login.live.com/ | Name: MSPRequ Value: id=N<=1667916264&co=1 |
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block; |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
live-email-visitante.jelastic.regruhosting.ru
login.live.com
logincdn.msauth.net
151.248.124.254
192.229.221.185
20.190.159.68
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6
1c87372ebae47bf26d36ab71e87f596f4e0b3c98472873bbfa7dcbbd48e9e7bb
3410242720de50b090d07a23aee2dad879b31d36f2615732962ec4cfa8a9d458
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
690dcfd884c2a06d8f6e929d93c9d8f6b3615159e0a3092d9432981c47053792
7e3296fe8ced35d23645abd5aa81bcef778fd860656bf13f9608c2de82d67a11
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
daa22c93e218c3bf4bfb7acae044754661fc1dcf32e75bfa05950b9a50ecffef