msupdating.com
Open in
urlscan Pro
64.191.166.201
Malicious Activity!
Public Scan
Submission: On July 20 via api from US — Scanned from DE
Summary
This is the only time msupdating.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 9 | 64.191.166.201 64.191.166.201 | 13776 (QX-NET-ASN-1) (QX-NET-ASN-1) | |
1 | 104.17.25.14 104.17.25.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700:303... 2606:4700:3036::6815:1b98 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a02:6ea0:c70... 2a02:6ea0:c700::17 | 60068 (CDN77 _) (CDN77 _) | |
2 | 64.191.166.198 64.191.166.198 | 13776 (QX-NET-ASN-1) (QX-NET-ASN-1) | |
14 | 5 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
msupdating.com
1 redirects
msupdating.com |
207 KB |
2 |
assetboxes.com
cdn.assetboxes.com — Cisco Umbrella Rank: 550549 |
1 MB |
2 |
fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 1950 |
26 KB |
1 |
icons8.com
maxcdn.icons8.com — Cisco Umbrella Rank: 255416 |
6 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 336 |
18 KB |
14 | 5 |
Domain | Requested by | |
---|---|---|
9 | msupdating.com |
1 redirects
msupdating.com
|
2 | cdn.assetboxes.com |
msupdating.com
|
2 | use.fontawesome.com |
msupdating.com
use.fontawesome.com |
1 | maxcdn.icons8.com |
msupdating.com
|
1 | cdnjs.cloudflare.com |
msupdating.com
|
14 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
cdnjs.cloudflare.com E1 |
2024-06-02 - 2024-08-31 |
3 months | crt.sh |
use.fontawesome.com Cloudflare Inc ECC CA-3 |
2023-10-12 - 2024-10-10 |
a year | crt.sh |
1220595937.rsc.cdn77.org R3 |
2024-05-15 - 2024-08-13 |
3 months | crt.sh |
cdn.assetboxes.com R10 |
2024-07-01 - 2024-09-29 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://msupdating.com/66732e053bae2/110c08bdfe1167bab11786c085501b683f682ced
Frame ID: 6BEED54DBA641EEFB32A8269B677982E
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
Sign in to your Microsoft accountPage URL History Show full URLs
-
http://msupdating.com/66732e053bae2/110c08bdfe1167bab11786c085501b683f682ced
HTTP 307
https://msupdating.com/66732e053bae2/110c08bdfe1167bab11786c085501b683f682ced HTTP 307
http://msupdating.com/66732e053bae2/110c08bdfe1167bab11786c085501b683f682ced Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://msupdating.com/66732e053bae2/110c08bdfe1167bab11786c085501b683f682ced
HTTP 307
https://msupdating.com/66732e053bae2/110c08bdfe1167bab11786c085501b683f682ced HTTP 307
http://msupdating.com/66732e053bae2/110c08bdfe1167bab11786c085501b683f682ced Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 12- http://msupdating.com/assets/img/favicon.ico HTTP 302
- http://msupdating.com/assets/img/missing.php
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
110c08bdfe1167bab11786c085501b683f682ced
msupdating.com/66732e053bae2/ Redirect Chain
|
20 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fontawesome.min.css
msupdating.com/assets/fonts/font-awesome/css/ |
87 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.1.1.min.js
msupdating.com/assets/js/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery_ui.js
msupdating.com/assets/js/ |
509 KB 122 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.css
msupdating.com/assets/bootstrap/bootstrap-3.3.7/css/ |
118 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap-theme.min.css
msupdating.com/assets/bootstrap/bootstrap-3.3.7/css/ |
23 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.js
msupdating.com/assets/bootstrap/bootstrap-3.3.7/js/ |
36 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.css
cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.5.0/css/ |
157 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.css
use.fontawesome.com/releases/v5.12.0/css/ |
56 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
line-awesome.min.css
maxcdn.icons8.com/fonts/line-awesome/1.1/css/ |
27 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
admslogopng164078335361cc5df9c45db848938146.png
cdn.assetboxes.com/c/8961/images/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
microsoftbackgroundlppng161607202160534d55e1fda616167359.png
cdn.assetboxes.com/c/8961/images/ |
1 MB 1 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fa-regular-400.woff2
use.fontawesome.com/releases/v5.12.0/webfonts/ |
13 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
missing.php
msupdating.com/assets/img/ Redirect Chain
|
202 B 397 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| anchorClickHandler object| rawData function| nullifyInputs function| resetInputsToRawData function| displayCompletionMessage function| submitHandler0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.assetboxes.com
cdnjs.cloudflare.com
maxcdn.icons8.com
msupdating.com
use.fontawesome.com
104.17.25.14
2606:4700:3036::6815:1b98
2a02:6ea0:c700::17
64.191.166.198
64.191.166.201
03fe8060722a878643594898a32ea7eb947f4ca6e3b978d9f9ca0ca31d4ab393
1bf4686be65431946ebbc1cb07b0be92c7dadd35b31d3189cd5ec9f4c742da15
1e8638f605575bd335d49efa95e165adf7ef06dda8e367661ac2517a0a3a96b4
24c68a968e99d841f446d6953d3eb15109b286de77fbbaf60a0577375d0d9a16
279c37ee8d44e0888bcb68dadc8e57651065678f590630f114edfc77a32705f9
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
653e073e97423adda5bc3917a241ee8497dd38a48f14bcde0098a4e54fd0fa5e
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c
7162e4718b70ab98408c656e6b3404d20df3c0d6facf3c8471c5b1a2a88d5529
86e496b536b26ba60cdb68df9dd9143b19a63b65e30e373b0321833aab1295d6
c73281a7dfb7bf222e4032d23df1751286cbc70382edbe18c22f84c5b398701b
c9b46437d7418e1712daaad6d73fa17c2c6afb5681770c90339c25428415b7fd
ce7b8581fa1acfca82e0fa4d24b2b786e467fc863420e6eef50a05238947adb2
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c