login.de-microsoft365.com Open in urlscan Pro
188.111.120.180  Malicious Activity! Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response login.de-microsoft365.com/	222 KB 56 KB	62ms 55ms	Document text/html	188.111.120.180 VODANET Internati...
General Check archive.org Show headers Download Go to Full URL http://login.de-microsoft365.com/ Protocol HTTP/1.1 Server 188.111.120.180 Heilbronn, Germany, ASN3209 (VODANET International IP-Backbone of Vodafone, DE), Reverse DNS business-188-111-120-180.static.arcor-ip.net Software Apache/2.4.48 (Debian) / Resource Hash e88ded564b3659c96654a396ab7191bc55ef47fe406b4690f7521a46e3315d9e Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Sun, 28 Nov 2021 02:28:42 GMT Server Apache/2.4.48 (Debian) Last-Modified Wed, 24 Nov 2021 12:47:24 GMT ETag "3771d-5d18842734176-gzip" Accept-Ranges bytes Vary Accept-Encoding Content-Encoding gzip Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html
GET H/1.1	200 OK	Me.htm login.live.com/	0 0	265ms 115ms	Other text/html	40.126.31.8 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://login.live.com/Me.htm?v=3 Requested by Host: login.de-microsoft365.com URL: http://login.de-microsoft365.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 40.126.31.8 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer http://login.de-microsoft365.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers
GET H/1.1	404 Not Found	ConvergedLogin_PCore_Mo4A0Fxm-KbAvsKDen15VQ2.js login.de-microsoft365.com/Sign%20in%20to%20your%20account_files/	0 0	48ms 47ms	Script text/html	188.111.120.180 VODANET Internati...
General Check archive.org Show headers Download Go to Full URL http://login.de-microsoft365.com/Sign%20in%20to%20your%20account_files/ConvergedLogin_PCore_Mo4A0Fxm-KbAvsKDen15VQ2.js Requested by Host: login.de-microsoft365.com URL: http://login.de-microsoft365.com/ Protocol HTTP/1.1 Server 188.111.120.180 Heilbronn, Germany, ASN3209 (VODANET International IP-Backbone of Vodafone, DE), Reverse DNS business-188-111-120-180.static.arcor-ip.net Software Apache/2.4.48 (Debian) / Resource Hash Request headers Referer http://login.de-microsoft365.com/ Origin http://login.de-microsoft365.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Sun, 28 Nov 2021 02:28:42 GMT Server Apache/2.4.48 (Debian) Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 287 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	convergedlogin_ppassword_2fbf6b08b73b1ba49bfa.js login.de-microsoft365.com/Sign%20in%20to%20your%20account_files/	0 0	23ms 23ms	Script text/html	188.111.120.180 VODANET Internati...
General Check archive.org Show headers Download Go to Full URL http://login.de-microsoft365.com/Sign%20in%20to%20your%20account_files/convergedlogin_ppassword_2fbf6b08b73b1ba49bfa.js Requested by Host: login.de-microsoft365.com URL: http://login.de-microsoft365.com/ Protocol HTTP/1.1 Server 188.111.120.180 Heilbronn, Germany, ASN3209 (VODANET International IP-Backbone of Vodafone, DE), Reverse DNS business-188-111-120-180.static.arcor-ip.net Software Apache/2.4.48 (Debian) / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer http://login.de-microsoft365.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Sun, 28 Nov 2021 02:28:42 GMT Server Apache/2.4.48 (Debian) Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 287 Content-Type text/html; charset=iso-8859-1
GET H2	200	microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg aadcdn.msftauth.net/shared/1.0/content/images/	4 KB 2 KB	49ms 12ms	Image image/svg+xml	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg Requested by Host: login.de-microsoft365.com URL: http://login.de-microsoft365.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8E9E) / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Accept-Language de-DE,de;q=0.9 Referer http://login.de-microsoft365.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sun, 28 Nov 2021 02:28:08 GMT content-encoding gzip content-md5 nzaLxFgP7ZB3dfMcaybWzw== age 18219939 x-cache HIT content-length 1435 x-ms-lease-status unlocked last-modified Thu, 16 Jan 2020 00:32:52 GMT server ECAcc (frc/8E9E) etag 0x8D79A1B9F5E121A vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 0c55977d-f01e-0098-2849-3ebec7000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg aadcdn.msftauth.net/shared/1.0/content/images/	513 B 753 B	18ms 12ms	Image image/svg+xml	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg Requested by Host: login.de-microsoft365.com URL: http://login.de-microsoft365.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8F6C) / Resource Hash 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58 Request headers Accept-Language de-DE,de;q=0.9 Referer http://login.de-microsoft365.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sun, 28 Nov 2021 02:28:08 GMT content-encoding gzip content-md5 TjUQkZ0p0Y7rbj6LJofS9Q== age 15803043 x-cache HIT content-length 276 x-ms-lease-status unlocked last-modified Thu, 16 Jan 2020 00:32:45 GMT server ECAcc (frc/8F6C) etag 0x8D79A1B9B05915D vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id c711e8bd-e01e-0094-3b45-547244000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H/1.1	404 Not Found	ConvergedLogin_PCore_Mo4A0Fxm-KbAvsKDen15VQ2.js login.de-microsoft365.com/Sign%20in%20to%20your%20account_files/	0 0	24ms 23ms	Script text/html	188.111.120.180 VODANET Internati...
General Check archive.org Show headers Download Go to Full URL http://login.de-microsoft365.com/Sign%20in%20to%20your%20account_files/ConvergedLogin_PCore_Mo4A0Fxm-KbAvsKDen15VQ2.js Requested by Host: login.de-microsoft365.com URL: http://login.de-microsoft365.com/ Protocol HTTP/1.1 Server 188.111.120.180 Heilbronn, Germany, ASN3209 (VODANET International IP-Backbone of Vodafone, DE), Reverse DNS business-188-111-120-180.static.arcor-ip.net Software Apache/2.4.48 (Debian) / Resource Hash Request headers Referer http://login.de-microsoft365.com/ Origin http://login.de-microsoft365.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Sun, 28 Nov 2021 02:28:42 GMT Server Apache/2.4.48 (Debian) Connection Keep-Alive Keep-Alive timeout=5, max=98 Content-Length 287 Content-Type text/html; charset=iso-8859-1
GET H2	200	watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js Show response aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	117 KB 40 KB	29ms 9ms	Script application/x-javascript	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js Requested by Host: login.de-microsoft365.com URL: http://login.de-microsoft365.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8F2C) / Resource Hash df2aa8537c1992c94846a0ffffaa9031d430d9d0210b9e396ec059aff62627e0 Request headers Referer http://login.de-microsoft365.com/ Origin http://login.de-microsoft365.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sun, 28 Nov 2021 02:28:08 GMT content-encoding gzip content-md5 HWW92uTq7vx3y5z+zFZbXQ== age 8465503 x-cache HIT content-length 40454 x-ms-lease-status unlocked last-modified Fri, 26 Feb 2021 06:18:37 GMT server ECAcc (frc/8F2C) etag 0x8D8DA1E5A71125A vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 85852b0a-b01e-009a-2201-97b3aa000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	converged.v2.login.min_lgjnfq3xbrj5zvj5ionvww2.css aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	0 20 KB	18ms 13ms	Other text/css	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_lgjnfq3xbrj5zvj5ionvww2.css Requested by Host: login.de-microsoft365.com URL: http://login.de-microsoft365.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8E94) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer http://login.de-microsoft365.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sun, 28 Nov 2021 02:28:08 GMT content-encoding gzip content-md5 mU+G3bfjPvbbh+JW3ypW1g== age 2306555 x-cache HIT content-length 19835 x-ms-lease-status unlocked last-modified Fri, 04 Jun 2021 23:47:30 GMT server ECAcc (frc/8E94) etag 0x8D927B31E2905FD vary Accept-Encoding content-type text/css access-control-allow-origin * x-ms-request-id eb9e6b20-a01e-0090-3f05-cf99e8000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	ux.converged.login.strings-en.min__vnug8v1o1-mkptmkuydsg2.js aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	0 12 KB	18ms 13ms	Other application/x-javascript	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min__vnug8v1o1-mkptmkuydsg2.js Requested by Host: login.de-microsoft365.com URL: http://login.de-microsoft365.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8F6F) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer http://login.de-microsoft365.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sun, 28 Nov 2021 02:28:08 GMT content-encoding gzip content-md5 8VdQovyys05wHikC7akm0w== age 10977715 x-cache HIT content-length 12611 x-ms-lease-status unlocked last-modified Fri, 04 Jun 2021 20:56:46 GMT server ECAcc (frc/8F6F) etag 0x8D9279B443DE09D vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id f7b174d2-901e-0066-4b28-80bab7000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H/1.1	404 Not Found	convergedlogin_ppassword_2fbf6b08b73b1ba49bfa.js login.de-microsoft365.com/Sign%20in%20to%20your%20account_files/	0 0	24ms 24ms	Script text/html	188.111.120.180 VODANET Internati...
General Check archive.org Show headers Download Go to Full URL http://login.de-microsoft365.com/Sign%20in%20to%20your%20account_files/convergedlogin_ppassword_2fbf6b08b73b1ba49bfa.js Requested by Host: login.de-microsoft365.com URL: http://login.de-microsoft365.com/ Protocol HTTP/1.1 Server 188.111.120.180 Heilbronn, Germany, ASN3209 (VODANET International IP-Backbone of Vodafone, DE), Reverse DNS business-188-111-120-180.static.arcor-ip.net Software Apache/2.4.48 (Debian) / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer http://login.de-microsoft365.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Sun, 28 Nov 2021 02:28:42 GMT Server Apache/2.4.48 (Debian) Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 287 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	prefetch.html Show response login.de-microsoft365.com/Sign%20in%20to%20your%20account_files/ Frame C3F1	287 B 503 B	23ms 23ms	Document text/html	188.111.120.180 VODANET Internati...
General Check archive.org Show headers Download Go to Full URL http://login.de-microsoft365.com/Sign%20in%20to%20your%20account_files/prefetch.html Requested by Host: login.de-microsoft365.com URL: http://login.de-microsoft365.com/ Protocol HTTP/1.1 Server 188.111.120.180 Heilbronn, Germany, ASN3209 (VODANET International IP-Backbone of Vodafone, DE), Reverse DNS business-188-111-120-180.static.arcor-ip.net Software Apache/2.4.48 (Debian) / Resource Hash 1617f15d3f644421e61a48d8d2156e3699bfcb6f6892a309a10182a22659c8b2 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer http://login.de-microsoft365.com/ Response headers Date Sun, 28 Nov 2021 02:28:42 GMT Server Apache/2.4.48 (Debian) Content-Length 287 Keep-Alive timeout=5, max=98 Connection Keep-Alive Content-Type text/html; charset=iso-8859-1
GET H2	200	2_bc3d32a696895f78c19df6c717586a5d.svg aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/	2 KB 825 B	15ms 14ms	Image image/svg+xml	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg Requested by Host: login.de-microsoft365.com URL: http://login.de-microsoft365.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8FE5) / Resource Hash 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68 Request headers Accept-Language de-DE,de;q=0.9 Referer http://login.de-microsoft365.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sun, 28 Nov 2021 02:28:08 GMT content-encoding gzip content-md5 DhdidjYrlCeaRJJRG/y9mA== age 12006125 x-cache HIT content-length 673 x-ms-lease-status unlocked last-modified Wed, 12 Feb 2020 22:01:50 GMT server ECAcc (frc/8FE5) etag 0x8D7B007297AE131 vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 1528e04b-101e-0063-5ccd-76af16000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H/1.1	404 Not Found	ConvergedLogin_PCore_Mo4A0Fxm-KbAvsKDen15VQ2.js login.de-microsoft365.com/Sign%20in%20to%20your%20account_files/	0 0	24ms 23ms	Script text/html	188.111.120.180 VODANET Internati...
General Check archive.org Show headers Download Go to Full URL http://login.de-microsoft365.com/Sign%20in%20to%20your%20account_files/ConvergedLogin_PCore_Mo4A0Fxm-KbAvsKDen15VQ2.js Requested by Host: login.de-microsoft365.com URL: http://login.de-microsoft365.com/ Protocol HTTP/1.1 Server 188.111.120.180 Heilbronn, Germany, ASN3209 (VODANET International IP-Backbone of Vodafone, DE), Reverse DNS business-188-111-120-180.static.arcor-ip.net Software Apache/2.4.48 (Debian) / Resource Hash Request headers Referer http://login.de-microsoft365.com/ Origin http://login.de-microsoft365.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Sun, 28 Nov 2021 02:28:42 GMT Server Apache/2.4.48 (Debian) Connection Keep-Alive Keep-Alive timeout=5, max=97 Content-Length 287 Content-Type text/html; charset=iso-8859-1
GET H2	200	frameworksupport.min_oadrnc13magb009k4d20lg2.js Show response aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	12 KB 5 KB	9ms 9ms	Script application/x-javascript	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js Requested by Host: login.de-microsoft365.com URL: http://login.de-microsoft365.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8FA2) / Resource Hash c8cef105fcaf7cbf3f8682c861045505c24d41cf6686c20c1c03e14031a3db69 Request headers Referer http://login.de-microsoft365.com/ Origin http://login.de-microsoft365.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sun, 28 Nov 2021 02:28:08 GMT content-encoding gzip content-md5 A8dgUeRfi6/VknMbox6Cuw== age 5007782 x-cache HIT content-length 4880 x-ms-lease-status unlocked last-modified Thu, 22 Oct 2020 20:43:24 GMT server ECAcc (frc/8FA2) etag 0x8D876CB1F3EA0D9 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 3fdbc8ca-001e-000d-7573-b6ec0b000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	watson.min_ybdb1ixzkv-fkor2mu6q6w2.js Show response aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	9 KB 4 KB	9ms 9ms	Script application/x-javascript	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/watson.min_ybdb1ixzkv-fkor2mu6q6w2.js Requested by Host: login.de-microsoft365.com URL: http://login.de-microsoft365.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8E8A) / Resource Hash 58eacd6958675b2640b9efb0344cace3298b5d60a4b2b6bb5654b7ebf15891a2 Request headers Referer http://login.de-microsoft365.com/ Origin http://login.de-microsoft365.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sun, 28 Nov 2021 02:28:08 GMT content-encoding gzip content-md5 0amdmc4DC3wTGNS/ckG9zw== age 10196902 x-cache HIT content-length 3871 x-ms-lease-status unlocked last-modified Thu, 22 Oct 2020 20:49:15 GMT server ECAcc (frc/8E8A) etag 0x8D876CBF0105F18 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 7f7ea0ef-301e-0099-4842-8740ca000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	converged.v2.login.min_lgjnfq3xbrj5zvj5ionvww2.css aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	0 19 KB	8ms 7ms	Other text/css	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_lgjnfq3xbrj5zvj5ionvww2.css Requested by Host: login.de-microsoft365.com URL: http://login.de-microsoft365.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8E94) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer http://login.de-microsoft365.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sun, 28 Nov 2021 02:28:08 GMT content-encoding gzip content-md5 mU+G3bfjPvbbh+JW3ypW1g== age 2306555 x-cache HIT content-length 19835 x-ms-lease-status unlocked last-modified Fri, 04 Jun 2021 23:47:30 GMT server ECAcc (frc/8E94) etag 0x8D927B31E2905FD vary Accept-Encoding content-type text/css access-control-allow-origin * x-ms-request-id eb9e6b20-a01e-0090-3f05-cf99e8000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	ux.converged.login.strings-en.min__vnug8v1o1-mkptmkuydsg2.js aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	0 12 KB	8ms 8ms	Other application/x-javascript	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min__vnug8v1o1-mkptmkuydsg2.js Requested by Host: login.de-microsoft365.com URL: http://login.de-microsoft365.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8F6F) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer http://login.de-microsoft365.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Sun, 28 Nov 2021 02:28:08 GMT content-encoding gzip content-md5 8VdQovyys05wHikC7akm0w== age 10977715 x-cache HIT content-length 12611 x-ms-lease-status unlocked last-modified Fri, 04 Jun 2021 20:56:46 GMT server ECAcc (frc/8F6F) etag 0x8D9279B443DE09D vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id f7b174d2-901e-0066-4b28-80bab7000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
POST H/1.1	404 Not Found	watson Show response login.de-microsoft365.com/common/handlers/	287 B 503 B	29ms 29ms	XHR text/html	188.111.120.180 VODANET Internati...
General Check archive.org Show headers Download Go to Full URL http://login.de-microsoft365.com/common/handlers/watson Requested by Host: aadcdn.msftauth.net URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js Protocol HTTP/1.1 Server 188.111.120.180 Heilbronn, Germany, ASN3209 (VODANET International IP-Backbone of Vodafone, DE), Reverse DNS business-188-111-120-180.static.arcor-ip.net Software Apache/2.4.48 (Debian) / Resource Hash 1617f15d3f644421e61a48d8d2156e3699bfcb6f6892a309a10182a22659c8b2 Request headers Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 client-request-id ca16c0b1-4c55-420f-bff4-d84220787b2c canary AQABAAAAAAD--DLA3VO7QrddgJg7Wevrj83YLokolnf0vkldSbPNzhOKI3Tuqy6ZVKnfKFDb60Y_LNnFrHfBkF1ZNlieivcf-itLr057Nc9a1-LzPqAF50Si2gobq0MxS7RlKH4_9Bp_r23uMpyFlmBe2J2FUz28TRX0bOTcLQtgu9kMvW-oeVlPVzKLGT9XwKohekmoJ3kbLjBY3g-RdjWeh0dJ-tvd2y3pLI8eeRMMGIXQ2YnqNyAA Content-Type application/json; charset=UTF-8 hpgid 1104 Accept application/json Referer http://login.de-microsoft365.com/ X-Requested-With XMLHttpRequest hpgact 1800 Response headers Date Sun, 28 Nov 2021 02:28:43 GMT Server Apache/2.4.48 (Debian) Connection Keep-Alive Keep-Alive timeout=5, max=96 Content-Length 287 Content-Type text/html; charset=iso-8859-1
POST H/1.1	404 Not Found	watson Show response login.de-microsoft365.com/common/handlers/	287 B 503 B	29ms 29ms	XHR text/html	188.111.120.180 VODANET Internati...
General Check archive.org Show headers Download Go to Full URL http://login.de-microsoft365.com/common/handlers/watson Requested by Host: aadcdn.msftauth.net URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js Protocol HTTP/1.1 Server 188.111.120.180 Heilbronn, Germany, ASN3209 (VODANET International IP-Backbone of Vodafone, DE), Reverse DNS business-188-111-120-180.static.arcor-ip.net Software Apache/2.4.48 (Debian) / Resource Hash 1617f15d3f644421e61a48d8d2156e3699bfcb6f6892a309a10182a22659c8b2 Request headers Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 client-request-id ca16c0b1-4c55-420f-bff4-d84220787b2c canary AQABAAAAAAD--DLA3VO7QrddgJg7Wevrj83YLokolnf0vkldSbPNzhOKI3Tuqy6ZVKnfKFDb60Y_LNnFrHfBkF1ZNlieivcf-itLr057Nc9a1-LzPqAF50Si2gobq0MxS7RlKH4_9Bp_r23uMpyFlmBe2J2FUz28TRX0bOTcLQtgu9kMvW-oeVlPVzKLGT9XwKohekmoJ3kbLjBY3g-RdjWeh0dJ-tvd2y3pLI8eeRMMGIXQ2YnqNyAA Content-Type application/json; charset=UTF-8 hpgid 1104 Accept application/json Referer http://login.de-microsoft365.com/ X-Requested-With XMLHttpRequest hpgact 1800 Response headers Date Sun, 28 Nov 2021 02:28:43 GMT Server Apache/2.4.48 (Debian) Connection Keep-Alive Keep-Alive timeout=5, max=97 Content-Length 287 Content-Type text/html; charset=iso-8859-1
POST H/1.1	404 Not Found	watson Show response login.de-microsoft365.com/common/handlers/	287 B 504 B	51ms 50ms	XHR text/html	188.111.120.180 VODANET Internati...
General Check archive.org Show headers Download Go to Full URL http://login.de-microsoft365.com/common/handlers/watson Requested by Host: aadcdn.msftauth.net URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js Protocol HTTP/1.1 Server 188.111.120.180 Heilbronn, Germany, ASN3209 (VODANET International IP-Backbone of Vodafone, DE), Reverse DNS business-188-111-120-180.static.arcor-ip.net Software Apache/2.4.48 (Debian) / Resource Hash 1617f15d3f644421e61a48d8d2156e3699bfcb6f6892a309a10182a22659c8b2 Request headers Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 client-request-id ca16c0b1-4c55-420f-bff4-d84220787b2c canary AQABAAAAAAD--DLA3VO7QrddgJg7Wevrj83YLokolnf0vkldSbPNzhOKI3Tuqy6ZVKnfKFDb60Y_LNnFrHfBkF1ZNlieivcf-itLr057Nc9a1-LzPqAF50Si2gobq0MxS7RlKH4_9Bp_r23uMpyFlmBe2J2FUz28TRX0bOTcLQtgu9kMvW-oeVlPVzKLGT9XwKohekmoJ3kbLjBY3g-RdjWeh0dJ-tvd2y3pLI8eeRMMGIXQ2YnqNyAA Content-Type application/json; charset=UTF-8 hpgid 1104 Accept application/json Referer http://login.de-microsoft365.com/ X-Requested-With XMLHttpRequest hpgact 1800 Response headers Date Sun, 28 Nov 2021 02:28:43 GMT Server Apache/2.4.48 (Debian) Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 287 Content-Type text/html; charset=iso-8859-1

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B object| ServerData object| StringRepository object| PROOF boolean| __ function| $ function| jQuery object| $Api

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.login.live.com/	1969-12-31 23:59:59	Name: uaid Value: f46aeda1153141618428450bd6af8e69
			.login.live.com/	1969-12-31 23:59:59	Name: MSPRequ Value: id=N&lt=1638066488&co=1

9 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://login.de-microsoft365.com/Sign%20in%20to%20your%20account_files/convergedlogin_ppassword_2fbf6b08b73b1ba49bfa.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://login.de-microsoft365.com/Sign%20in%20to%20your%20account_files/ConvergedLogin_PCore_Mo4A0Fxm-KbAvsKDen15VQ2.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://login.de-microsoft365.com/Sign%20in%20to%20your%20account_files/convergedlogin_ppassword_2fbf6b08b73b1ba49bfa.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://login.de-microsoft365.com/Sign%20in%20to%20your%20account_files/ConvergedLogin_PCore_Mo4A0Fxm-KbAvsKDen15VQ2.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://login.de-microsoft365.com/Sign%20in%20to%20your%20account_files/prefetch.html Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://login.de-microsoft365.com/Sign%20in%20to%20your%20account_files/ConvergedLogin_PCore_Mo4A0Fxm-KbAvsKDen15VQ2.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://login.de-microsoft365.com/common/handlers/watson Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://login.de-microsoft365.com/common/handlers/watson Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://login.de-microsoft365.com/common/handlers/watson Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msftauth.net
login.de-microsoft365.com
login.live.com
152.199.23.37
188.111.120.180
40.126.31.8
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
1617f15d3f644421e61a48d8d2156e3699bfcb6f6892a309a10182a22659c8b2
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
58eacd6958675b2640b9efb0344cace3298b5d60a4b2b6bb5654b7ebf15891a2
c8cef105fcaf7cbf3f8682c861045505c24d41cf6686c20c1c03e14031a3db69
df2aa8537c1992c94846a0ffffaa9031d430d9d0210b9e396ec059aff62627e0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e88ded564b3659c96654a396ab7191bc55ef47fe406b4690f7521a46e3315d9e