account-msn.quarantine.handealp.com Open in urlscan Pro
185.157.41.2  Malicious Activity! Public Scan

Submitted URL: https://nb0m147.web.app/c505th604rin604p802p604109tfl208g802v208703k
Effective URL: https://account-msn.quarantine.handealp.com/.auth/login.php
Submission: On January 18 via manual from GB

Summary

This website contacted 7 IPs in 2 countries across 8 domains to perform 14 HTTP transactions. The main IP is 185.157.41.2, located in Turkey and belongs to RADORE, TR. The main domain is account-msn.quarantine.handealp.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on January 18th 2021. Valid for: 3 months.
This is the only time account-msn.quarantine.handealp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 151.101.65.195 54113 (FASTLY)
1 1 199.188.206.65 22612 (NAMECHEAP...)
1 3 185.157.41.2 42926 (RADORE)
7 152.199.23.37 15133 (EDGECAST)
1 40.126.31.139 8075 (MICROSOFT...)
1 13.224.194.19 16509 (AMAZON-02)
1 2620:1ec:4::156 8068 (MICROSOFT...)
1 2620:1ec:bdf::13 8068 (MICROSOFT...)
14 7
Domain Requested by
7 aadcdn.msftauth.net account-msn.quarantine.handealp.com
3 account-msn.quarantine.handealp.com 1 redirects nb0m147.web.app
account-msn.quarantine.handealp.com
1 aadcdn.msftauthimages.net account-msn.quarantine.handealp.com
1 www.office.com account-msn.quarantine.handealp.com
1 logo.clearbit.com account-msn.quarantine.handealp.com
1 login.live.com account-msn.quarantine.handealp.com
1 hensleyapartments.com 1 redirects
1 nb0m147.web.app
14 8

This site contains links to these domains. Also see Links.

Domain
passwordreset.microsoftonline.com
www.microsoft.com
privacy.microsoft.com
Subject Issuer Validity Valid
web.app
GTS CA 1O1
2020-04-15 -
2021-04-14
a year crt.sh
account-msn.quarantine.handealp.com
cPanel, Inc. Certification Authority
2021-01-18 -
2021-04-18
3 months crt.sh
aadcdn.msftauth.net
DigiCert SHA2 Secure Server CA
2020-07-09 -
2021-07-09
a year crt.sh
graph.windows.net
DigiCert SHA2 Secure Server CA
2020-10-22 -
2021-10-21
a year crt.sh
clearbit.com
Amazon
2020-05-20 -
2021-06-20
a year crt.sh
portal.office.com
GlobalSign Organization Validation CA - SHA256 - G3
2020-05-29 -
2022-05-30
2 years crt.sh
aadcdn.msftauthimages.net
Microsoft Azure TLS Issuing CA 05
2020-09-03 -
2021-08-29
a year crt.sh

This page contains 2 frames:

Primary Page: https://account-msn.quarantine.handealp.com/.auth/login.php
Frame ID: 1153C2C0C8AD52C89709337FE60FEFFF
Requests: 13 HTTP requests in this frame

Frame: https://www.office.com/prefetch/prefetch
Frame ID: 5E27FC8AC7839ADAD48F06A3775F0E6E
Requests: 1 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://nb0m147.web.app/c505th604rin604p802p604109tfl208g802v208703k Page URL
  2. https://hensleyapartments.com/nbm.php?url=https://nb0m147.web.app/c505th604rin604p802p604109tfl208g802v208... HTTP 302
    https://account-msn.quarantine.handealp.com/.ses.php?client-request-id=Y2F0aGVyaW5lcG9wZUB0ZmwuZ292LnVr HTTP 302
    https://account-msn.quarantine.handealp.com/.auth/login.php Page URL

Page Statistics

14
Requests

100 %
HTTPS

25 %
IPv6

8
Domains

8
Subdomains

7
IPs

2
Countries

519 kB
Transfer

967 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://nb0m147.web.app/c505th604rin604p802p604109tfl208g802v208703k Page URL
  2. https://hensleyapartments.com/nbm.php?url=https://nb0m147.web.app/c505th604rin604p802p604109tfl208g802v208703k HTTP 302
    https://account-msn.quarantine.handealp.com/.ses.php?client-request-id=Y2F0aGVyaW5lcG9wZUB0ZmwuZ292LnVr HTTP 302
    https://account-msn.quarantine.handealp.com/.auth/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
c505th604rin604p802p604109tfl208g802v208703k
nb0m147.web.app/
491 B
597 B
Document
General
Full URL
https://nb0m147.web.app/c505th604rin604p802p604109tfl208g802v208703k
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
dcac477de960cc0a893d31ce99b00c9683426951ae323c3ef2d8d37ada61b0da
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

:method
GET
:authority
nb0m147.web.app
:scheme
https
:path
/c505th604rin604p802p604109tfl208g802v208703k
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cache-control
max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
etag
"b561c4f5352c6feecac8dbb0c5978385801c611731e603d5387ce55b6a26e2d0"
last-modified
Mon, 18 Jan 2021 08:45:10 GMT
strict-transport-security
max-age=31556926; includeSubDomains; preload
accept-ranges
bytes
date
Mon, 18 Jan 2021 15:26:47 GMT
x-served-by
cache-cdg20720-CDG
x-cache
MISS
x-cache-hits
0
x-timer
S1610983607.659083,VS0,VE453
vary
x-fh-requested-host, accept-encoding
content-length
290
Primary Request login.php
account-msn.quarantine.handealp.com/.auth/
Redirect Chain
  • https://hensleyapartments.com/nbm.php?url=https://nb0m147.web.app/c505th604rin604p802p604109tfl208g802v208703k
  • https://account-msn.quarantine.handealp.com/.ses.php?client-request-id=Y2F0aGVyaW5lcG9wZUB0ZmwuZ292LnVr
  • https://account-msn.quarantine.handealp.com/.auth/login.php
35 KB
35 KB
Document
General
Full URL
https://account-msn.quarantine.handealp.com/.auth/login.php
Requested by
Host: nb0m147.web.app
URL: https://nb0m147.web.app/c505th604rin604p802p604109tfl208g802v208703k
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.157.41.2 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS
server-185.157.41.2.as42926.net
Software
Apache /
Resource Hash
ed3affe2280d4b5a2f97a1f91541dead2da154e357ee28470b2e5dd7d4f81927

Request headers

Host
account-msn.quarantine.handealp.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
document
Referer
https://nb0m147.web.app/c505th604rin604p802p604109tfl208g802v208703k
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PHPSESSID=ocag82d087rqilta5rsamedcq6
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://nb0m147.web.app/c505th604rin604p802p604109tfl208g802v208703k

Response headers

Date
Mon, 18 Jan 2021 15:26:46 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Redirect headers

Date
Mon, 18 Jan 2021 15:26:46 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Set-Cookie
PHPSESSID=ocag82d087rqilta5rsamedcq6; path=/
Location
/.auth/login.php
Content-Length
0
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
converged.v2.login.min_wixdbz3ubznoegxpcgkfog2.css
account-msn.quarantine.handealp.com/.auth/css/
106 KB
106 KB
Stylesheet
General
Full URL
https://account-msn.quarantine.handealp.com/.auth/css/converged.v2.login.min_wixdbz3ubznoegxpcgkfog2.css
Requested by
Host: account-msn.quarantine.handealp.com
URL: https://account-msn.quarantine.handealp.com/.auth/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.157.41.2 , Turkey, ASN42926 (RADORE, TR),
Reverse DNS
server-185.157.41.2.as42926.net
Software
Apache /
Resource Hash
a96b2b12489a80eafe62cc4bcc04cb367e2b54efc3039e484211c7deec12c0b8

Request headers

Origin
https://account-msn.quarantine.handealp.com
Referer
https://account-msn.quarantine.handealp.com/.auth/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 18 Jan 2021 15:26:46 GMT
Last-Modified
Mon, 12 Oct 2020 06:04:26 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
108310
OldConvergedLogin_PCore_kHhxXOwRKOBKL9wP7RdDrw2.js
aadcdn.msftauth.net/shared/1.0/content/js/
609 KB
155 KB
Script
General
Full URL
https://aadcdn.msftauth.net/shared/1.0/content/js/OldConvergedLogin_PCore_kHhxXOwRKOBKL9wP7RdDrw2.js
Requested by
Host: account-msn.quarantine.handealp.com
URL: https://account-msn.quarantine.handealp.com/.auth/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (lhd/35CE) /
Resource Hash
367bb7199a0cbbddf42d0577f33f6ee494111fcdf3317c8d974f5242e75ebcc7

Request headers

Origin
https://account-msn.quarantine.handealp.com
Referer
https://account-msn.quarantine.handealp.com/.auth/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 18 Jan 2021 15:26:48 GMT
content-encoding
gzip
content-md5
szrfbgOqdDwCjLR4q271nQ==
age
3528602
x-cache
HIT
content-length
158447
x-ms-lease-status
unlocked
last-modified
Thu, 27 Aug 2020 23:52:20 GMT
server
ECAcc (lhd/35CE)
etag
0x8D84AE43D039067
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
c3aa4d4a-b01e-0016-5796-cd876c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
ux.converged.login.strings-en.min_yruqtyo0qslo70l4a-_ung2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/
37 KB
11 KB
Script
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_yruqtyo0qslo70l4a-_ung2.js
Requested by
Host: account-msn.quarantine.handealp.com
URL: https://account-msn.quarantine.handealp.com/.auth/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (lhd/35D1) /
Resource Hash
fff0b1c545c2119a2855b9028567640f4145c079eff9b48da0ddf66dc8d92f6c

Request headers

Origin
https://account-msn.quarantine.handealp.com
Referer
https://account-msn.quarantine.handealp.com/.auth/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 18 Jan 2021 15:26:48 GMT
content-encoding
gzip
content-md5
5Zw7HraGKmMzSIoAiA15xA==
age
3528602
x-cache
HIT
content-length
11322
x-ms-lease-status
unlocked
last-modified
Wed, 12 Aug 2020 03:06:16 GMT
server
ECAcc (lhd/35D1)
etag
0x8D83E6CAD740F66
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
e16369d9-e01e-007c-1696-cd2fdd000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
Me.htm
login.live.com/
0
0
Other
General
Full URL
https://login.live.com/Me.htm?v=3
Requested by
Host: account-msn.quarantine.handealp.com
URL: https://account-msn.quarantine.handealp.com/.auth/login.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.126.31.139 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://account-msn.quarantine.handealp.com/.auth/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

tfl.gov.uk
logo.clearbit.com/
4 KB
4 KB
Image
General
Full URL
https://logo.clearbit.com/tfl.gov.uk
Requested by
Host: account-msn.quarantine.handealp.com
URL: https://account-msn.quarantine.handealp.com/.auth/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.194.19 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-194-19.fra2.r.cloudfront.net
Software
envoy /
Resource Hash
988d849a420148e95117c75dbb706dc5984a20acad240872cc4c3b9a237029ea

Request headers

Referer
https://account-msn.quarantine.handealp.com/.auth/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 25 Dec 2020 05:21:09 GMT
via
1.1 f7bf326347bdd7f275a38a22b5b83724.cloudfront.net (CloudFront)
server
envoy
age
2109939
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
b68u1ZG1umYeZeLkK7vIRuYuaK1DF9K9wB2lZ0tWShjrR0DWdCob2g==
arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
aadcdn.msftauth.net/shared/1.0/content/images/
513 B
752 B
Image
General
Full URL
https://aadcdn.msftauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
Requested by
Host: account-msn.quarantine.handealp.com
URL: https://account-msn.quarantine.handealp.com/.auth/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (lhd/3729) /
Resource Hash
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

Request headers

Referer
https://account-msn.quarantine.handealp.com/.auth/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 18 Jan 2021 15:26:48 GMT
content-encoding
gzip
content-md5
TjUQkZ0p0Y7rbj6LJofS9Q==
age
3591375
x-cache
HIT
content-length
276
x-ms-lease-status
unlocked
last-modified
Thu, 16 Jan 2020 00:32:45 GMT
server
ECAcc (lhd/3729)
etag
0x8D79A1B9B05915D
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
395a59d1-d01e-0027-6c04-cdb818000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg
aadcdn.msftauth.net/shared/1.0/content/images/
915 B
416 B
Image
General
Full URL
https://aadcdn.msftauth.net/shared/1.0/content/images/ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg
Requested by
Host: account-msn.quarantine.handealp.com
URL: https://account-msn.quarantine.handealp.com/.auth/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (lhd/35E3) /
Resource Hash
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea

Request headers

Referer
https://account-msn.quarantine.handealp.com/.auth/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 18 Jan 2021 15:26:48 GMT
content-encoding
gzip
content-md5
HMwsHhNXdtrfirQDkzcqMA==
age
3591375
x-cache
HIT
content-length
263
x-ms-lease-status
unlocked
last-modified
Thu, 16 Jan 2020 00:32:52 GMT
server
ECAcc (lhd/35E3)
etag
0x8D79A1B9F32D8F1
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
c7db69ed-e01e-001e-1004-cda043000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg
aadcdn.msftauth.net/shared/1.0/content/images/
915 B
415 B
Image
General
Full URL
https://aadcdn.msftauth.net/shared/1.0/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg
Requested by
Host: account-msn.quarantine.handealp.com
URL: https://account-msn.quarantine.handealp.com/.auth/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (lhd/3721) /
Resource Hash
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6

Request headers

Referer
https://account-msn.quarantine.handealp.com/.auth/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 18 Jan 2021 15:26:48 GMT
content-encoding
gzip
content-md5
/a3y/mpA+HRaVAiPACrsog==
age
3591377
x-cache
HIT
content-length
263
x-ms-lease-status
unlocked
last-modified
Thu, 16 Jan 2020 00:32:51 GMT
server
ECAcc (lhd/3721)
etag
0x8D79A1B9EFFAEA1
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
2323db99-501e-0089-3f04-cdffe2000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
converged.v2.login.min_wixdbz3ubznoegxpcgkfog2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/
0
19 KB
Other
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_wixdbz3ubznoegxpcgkfog2.css
Requested by
Host: account-msn.quarantine.handealp.com
URL: https://account-msn.quarantine.handealp.com/.auth/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (lhd/3714) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://account-msn.quarantine.handealp.com/.auth/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 18 Jan 2021 15:26:48 GMT
content-encoding
gzip
content-md5
/7H4IR1YAHBHDqgAZw2T1Q==
age
3509760
x-cache
HIT
content-length
19750
x-ms-lease-status
unlocked
last-modified
Tue, 18 Aug 2020 21:44:03 GMT
server
ECAcc (lhd/3714)
etag
0x8D843BFD37E3E8A
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
68457cb2-901e-0023-2ac2-cd53b4000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
ux.converged.login.strings-en.min_yruqtyo0qslo70l4a-_ung2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/
0
11 KB
Other
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_yruqtyo0qslo70l4a-_ung2.js
Requested by
Host: account-msn.quarantine.handealp.com
URL: https://account-msn.quarantine.handealp.com/.auth/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (lhd/35D1) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://account-msn.quarantine.handealp.com/.auth/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 18 Jan 2021 15:26:48 GMT
content-encoding
gzip
content-md5
5Zw7HraGKmMzSIoAiA15xA==
age
3528602
x-cache
HIT
content-length
11322
x-ms-lease-status
unlocked
last-modified
Wed, 12 Aug 2020 03:06:16 GMT
server
ECAcc (lhd/35D1)
etag
0x8D83E6CAD740F66
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
e16369d9-e01e-007c-1696-cd2fdd000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
prefetch
www.office.com/prefetch/ Frame 5E27
0
0
Document
General
Full URL
https://www.office.com/prefetch/prefetch
Requested by
Host: account-msn.quarantine.handealp.com
URL: https://account-msn.quarantine.handealp.com/.auth/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:4::156 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.office.com
:scheme
https
:path
/prefetch/prefetch
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://account-msn.quarantine.handealp.com/.auth/login.php
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://account-msn.quarantine.handealp.com/.auth/login.php

Response headers

cache-control
no-store,no-cache
pragma
no-cache
content-type
text/html; charset=utf-8
content-encoding
gzip
vary
Accept-Encoding
set-cookie
OH.SID=3a85b311-dd59-4576-a933-f221965b8b9c; path=/; secure; samesite=none; httponly OH.DCAffinity=OH-suk; path=/; secure; samesite=none; httponly MUID=1E2471362AC968CC15027EF52BFA6984; path=/; secure; expires=Sat, 12-Feb-2022 15:26:48 GMT; domain=office.com
strict-transport-security
max-age=31536000; includeSubDomains
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge,chrome=1
x-msedge-ref
Ref A: 11B92FAE8D1F4FAC9C495592CE1318E7 Ref B: VIEEDGE2909 Ref C: 2021-01-18T15:26:48Z
date
Mon, 18 Jan 2021 15:26:48 GMT
illustration
aadcdn.msftauthimages.net/dbd5a2dd-sd-nd0bb-0hqs6piuad8-tfrvahzicjpconfdlg07ry/logintenantbranding/0/
174 KB
175 KB
Image
General
Full URL
https://aadcdn.msftauthimages.net/dbd5a2dd-sd-nd0bb-0hqs6piuad8-tfrvahzicjpconfdlg07ry/logintenantbranding/0/illustration?ts=636111043621904566
Requested by
Host: account-msn.quarantine.handealp.com
URL: https://account-msn.quarantine.handealp.com/.auth/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::13 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
5939c16ae9476e3d5b389db734a4a8d88e3dcb95c53e409a7841269790a97586

Request headers

Referer
https://account-msn.quarantine.handealp.com/.auth/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Mon, 18 Jan 2021 15:26:48 GMT
last-modified
Mon, 03 Oct 2016 15:12:43 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5
GZ3FHLUsdGUGQKSHUY8trg==
etag
0x8D3EB9FB975CBD1
x-azure-ref
0uKgFYAAAAAAUJO8m68RjRry/ek10tFIPRlJBRURHRTEwMTAANTk2NjU3MTUtNDI2YS00ZjFjLWEwNTktZDVkZmQ0MGFlNmI5
x-cache
TCP_MISS
content-type
image/*
x-ms-request-id
d41a50ee-d01e-0097-77ae-ed872d000000
cache-control
public, max-age=86400
x-ms-version
2009-09-19
x-azure-ref-originshield
0uKgFYAAAAAA7L+NuXnujS7tiTLqvO/FVTE9OMjFFREdFMDExOAA1OTY2NTcxNS00MjZhLTRmMWMtYTA1OS1kNWRmZDQwYWU2Yjk=
content-length
178228

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| webpackJsonp object| StringRepository object| PROOF boolean| __

5 Cookies

Domain/Path Name / Value
outlook.office365.com/ Name: OIDC
Value: 1
www.office.com/ Name: OH.DCAffinity
Value: OH-suk
www.office.com/ Name: OH.SID
Value: 3a85b311-dd59-4576-a933-f221965b8b9c
outlook.office365.com/ Name: ClientId
Value: 3CB2D941AB4946068DB4690AEEBABE89
account-msn.quarantine.handealp.com/ Name: PHPSESSID
Value: ocag82d087rqilta5rsamedcq6

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload