webapplicationsharepoint.z13.web.core.windows.net
Open in
urlscan Pro
52.239.170.97
Malicious Activity!
Public Scan
Submission: On June 23 via manual from US — Scanned from US
Summary
TLS certificate: Issued by Microsoft RSA TLS CA 02 on March 23rd 2023. Valid for: a year.
This is the only time webapplicationsharepoint.z13.web.core.windows.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 52.239.170.97 52.239.170.97 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 192.229.173.207 192.229.173.207 | 15133 (EDGECAST) (EDGECAST) | |
2 | 2620:1ec:29:1... 2620:1ec:29:1::40 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
4 | 4 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
webapplicationsharepoint.z13.web.core.windows.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
msauth.net
logincdn.msauth.net — Cisco Umbrella Rank: 4303 |
2 KB |
1 |
w3schools.com
www.w3schools.com — Cisco Umbrella Rank: 16740 |
5 KB |
1 |
windows.net
webapplicationsharepoint.z13.web.core.windows.net |
1 MB |
4 | 3 |
Domain | Requested by | |
---|---|---|
2 | logincdn.msauth.net |
webapplicationsharepoint.z13.web.core.windows.net
|
1 | www.w3schools.com |
webapplicationsharepoint.z13.web.core.windows.net
|
1 | webapplicationsharepoint.z13.web.core.windows.net | |
4 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.web.core.windows.net Microsoft RSA TLS CA 02 |
2023-03-23 - 2024-03-23 |
a year | crt.sh |
*.w3schools.com DigiCert TLS RSA SHA256 2020 CA1 |
2023-03-05 - 2024-04-04 |
a year | crt.sh |
identitycdn.msauth.net Microsoft Azure TLS Issuing CA 06 |
2023-03-31 - 2024-03-25 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://webapplicationsharepoint.z13.web.core.windows.net/
Frame ID: AACD55FD788C8D7B20BA803E64AD23DB
Requests: 7 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
4 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
webapplicationsharepoint.z13.web.core.windows.net/ |
1 MB 1 MB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
w3.css
www.w3schools.com/w3css/4/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
144 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
8 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg
logincdn.msauth.net/shared/1.0/content/images/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
logincdn.msauth.net/shared/1.0/content/images/ |
513 B 613 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
591 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend function| ValidateEmail function| _0x24fc function| _0x4676 function| redirrectPage function| hasNull number| counter function| onChangeFunction0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
logincdn.msauth.net
webapplicationsharepoint.z13.web.core.windows.net
www.w3schools.com
192.229.173.207
2620:1ec:29:1::40
52.239.170.97
15b585b75fc1b03ceef04c6e264a24ec8dc1854f92caf10258838135d137bc4c
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
34fd4b603f7537efe5455b4f5456ec684f677e37d7a8f139cd8accbcfabf6d4c
a76c08e9cdc3bb87bfb57627ad8f6b46f0e5ef826cc7f046dfbaf25d7b7958ea
a9a6376c53c5ff9c8a787f549923a2f4fbd2467874d44e76fcb42bb9043e66b3
b49dd2b6a031c9cf4dc1041c8a0a02cf894552868a13c145384e8a1360cbb1b5
c4f2aba13970ecf8303fb9329f97c8824861569273b0aa27acce48abc61d04f5