login.microsoftonline-int.com Open in urlscan Pro
2603:1030:c02:2::39b  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response login.microsoftonline-int.com/	20 KB 6 KB	348ms 178ms	Document text/html	2603:1030:c02:2::39b Microsoft Corpora...
General Check archive.org Show headers Download Go to Full URL http://login.microsoftonline-int.com/ Protocol HTTP/1.1 Server 2603:1030:c02:2::39b , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US), Reverse DNS Software / Resource Hash e5f59fb0fbd6fba82cd908e7fc829f68a92ebd41c979670956128d08f6da38ad Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 0 Request headers Host login.microsoftonline-int.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Cache-Control no-cache Pragma no-cache Content-Type text/html; charset=utf-8 Content-Encoding gzip Expires -1 Vary Accept-Encoding X-XSS-Protection 0 Strict-Transport-Security max-age=31536000 P3P CP="DSP CUR OTPi IND OTRi ONL FIN" Set-Cookie orgid-request-id=1f518496-1dea-4ef2-818f-e49e6c9760a9; expires=Thu, 04-Oct-2018 10:46:55 GMT;domain=login.microsoftonline-int.com;path=/;HTTPOnly= ;version=1 MSPRequ=lt=1538649715&co=1&id=N; path=/;version=1 MSPOK=$uuid-efc5f2f2-a31c-4371-b6a2-a7d2d03b58f2; domain=login.microsoftonline-int.com;path=/;version=1 x-ms-gateway-slice=OrgIdInt1; path=/; secure; HttpOnly stsservicecookie=OrgIdInt; path=/; secure; HttpOnly X-Frame-Options deny X-Content-Type-Options nosniff PPServer PPV: 30 H: CO2INTIDOALGN12 V: 0 Date Thu, 04 Oct 2018 10:41:55 GMT Content-Length 5622
GET H/1.1	200 OK	login.ltr.css secure.aadcdn.microsoftonline-p.com/aad/20.200.20150/css/	27 KB 5 KB	734ms 685ms	Stylesheet text/css	2a02:26f0:6c00:283::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://secure.aadcdn.microsoftonline-p.com/aad/20.200.20150/css/login.ltr.css Requested by Host: login.microsoftonline-int.com URL: http://login.microsoftonline-int.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash f902d8b3484872d0bb6fdb71084823e6363905e3f0ebaeeafa6cb373acd28350 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer http://login.microsoftonline-int.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 04 Oct 2018 10:41:56 GMT Content-Encoding gzip Last-Modified Mon, 01 Jun 2015 21:51:32 GMT Vary Accept-Encoding Connection keep-alive Content-Type text/css Access-Control-Allow-Origin * Access-Control-Expose-Headers x-ms-request-id,x-ms-version,x-ms-lease-status,x-ms-blob-type Cache-Control public, max-age=604800 Strict-Transport-Security max-age=31536000 Content-Length 4712
GET H/1.1	200 OK	jquery-1.11.2.min.js Show response secure.aadcdn.microsoftonline-p.com/aad/20.200.20150/js/	94 KB 33 KB	652ms 602ms	Script application/x-javascript	2a02:26f0:6c00:283::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://secure.aadcdn.microsoftonline-p.com/aad/20.200.20150/js/jquery-1.11.2.min.js Requested by Host: login.microsoftonline-int.com URL: http://login.microsoftonline-int.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash a271a3f9e3cae897ced669d6652699e947928ef095e56384c4f9dd04bbb942ec Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer http://login.microsoftonline-int.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 04 Oct 2018 10:41:56 GMT Content-Encoding gzip Last-Modified Mon, 01 Jun 2015 21:52:50 GMT Vary Accept-Encoding Connection keep-alive Content-Type application/x-javascript Access-Control-Allow-Origin * Access-Control-Expose-Headers x-ms-request-id,x-ms-version,x-ms-lease-status,x-ms-blob-type Cache-Control public, max-age=604800 Strict-Transport-Security max-age=31536000 Content-Length 33332
GET H/1.1	200 OK	jquery-migrate-1.2.1.min.js Show response secure.aadcdn.microsoftonline-p.com/aad/20.200.20150/js/	7 KB 3 KB	312ms 263ms	Script application/x-javascript	2a02:26f0:6c00:283::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://secure.aadcdn.microsoftonline-p.com/aad/20.200.20150/js/jquery-migrate-1.2.1.min.js Requested by Host: login.microsoftonline-int.com URL: http://login.microsoftonline-int.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash c4d24f6b27cc7ceea56fbec786bb1f486fdad9a1f998f760f76d1f44671e105c Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer http://login.microsoftonline-int.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 04 Oct 2018 10:41:56 GMT Content-Encoding gzip Last-Modified Mon, 01 Jun 2015 21:52:50 GMT Vary Accept-Encoding Connection keep-alive Content-Type application/x-javascript Access-Control-Allow-Origin * Access-Control-Expose-Headers x-ms-request-id,x-ms-version,x-ms-lease-status,x-ms-blob-type Cache-Control public, max-age=604800 Strict-Transport-Security max-age=31536000 Content-Length 3068
GET H/1.1	200 OK	aad.login.js Show response secure.aadcdn.microsoftonline-p.com/aad/20.200.20150/js/	126 KB 28 KB	307ms 257ms	Script application/x-javascript	2a02:26f0:6c00:283::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://secure.aadcdn.microsoftonline-p.com/aad/20.200.20150/js/aad.login.js Requested by Host: login.microsoftonline-int.com URL: http://login.microsoftonline-int.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash 0764cd74693cbf231ec1841cea80d3308cb39892dacdf906044ad6c0622cada2 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer http://login.microsoftonline-int.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 04 Oct 2018 10:41:56 GMT Content-Encoding gzip Last-Modified Mon, 01 Jun 2015 21:52:49 GMT Vary Accept-Encoding Connection keep-alive Content-Type application/x-javascript Access-Control-Allow-Origin * Access-Control-Expose-Headers x-ms-request-id,x-ms-version,x-ms-lease-status,x-ms-blob-type Cache-Control public, max-age=604800 Strict-Transport-Security max-age=31536000 Content-Length 28486
GET H/1.1	200 OK	jquery.easing.1.3.js Show response secure.aadcdn.microsoftonline-p.com/aad/20.200.20150/js/	9 KB 3 KB	652ms 602ms	Script application/x-javascript	2a02:26f0:6c00:283::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://secure.aadcdn.microsoftonline-p.com/aad/20.200.20150/js/jquery.easing.1.3.js Requested by Host: login.microsoftonline-int.com URL: http://login.microsoftonline-int.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash e9f76a23a17184eec1ee54b5fa9d25ae90439b9f8edf31391ee19332010fb698 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer http://login.microsoftonline-int.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 04 Oct 2018 10:41:56 GMT Content-Encoding gzip Last-Modified Mon, 01 Jun 2015 21:52:50 GMT Vary Accept-Encoding Connection keep-alive Content-Type application/x-javascript Access-Control-Allow-Origin * Access-Control-Expose-Headers x-ms-request-id,x-ms-version,x-ms-lease-status,x-ms-blob-type Cache-Control public, max-age=604800 Strict-Transport-Security max-age=31536000 Content-Length 2264
GET H/1.1	200 OK	AD_Glyph_Footer_30x30.png secure.aadcdn.microsoftonline-p.com/aad/20.200.20150/images/	4 KB 4 KB	687ms 639ms	Image image/png	2a02:26f0:6c00:283::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://secure.aadcdn.microsoftonline-p.com/aad/20.200.20150/images/AD_Glyph_Footer_30x30.png Requested by Host: login.microsoftonline-int.com URL: http://login.microsoftonline-int.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash b3c4fd39a0c96930c595c60d3bd41ed0fb032380017fb367db5e7c4c9cf0bf52 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer http://login.microsoftonline-int.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 04 Oct 2018 10:41:56 GMT Last-Modified Mon, 01 Jun 2015 21:52:29 GMT Strict-Transport-Security max-age=31536000 Content-Type image/png Access-Control-Allow-Origin * Access-Control-Expose-Headers x-ms-request-id,x-ms-version,x-ms-lease-status,x-ms-blob-type Cache-Control public, max-age=604800 Connection keep-alive Content-Length 3863
GET H/1.1	200 OK	logo.png secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/Office365/	4 KB 5 KB	24ms 6ms	Image image/png	2a02:26f0:6c00:283::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/Office365/logo.png Requested by Host: login.microsoftonline-int.com URL: http://login.microsoftonline-int.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer http://login.microsoftonline-int.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 04 Oct 2018 10:41:57 GMT Last-Modified Fri, 23 Aug 2013 05:49:53 GMT Strict-Transport-Security max-age=31536000 Content-Type image/png Access-Control-Allow-Origin * Access-Control-Expose-Headers x-ms-request-id,x-ms-version,x-ms-lease-status,x-ms-blob-type Cache-Control public, max-age=404130 Connection keep-alive Content-Length 4585
GET H/1.1	200 OK	illustration.jpg secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/Office365/	199 KB 199 KB	10ms 7ms	Image image/jpeg	2a02:26f0:6c00:283::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://secure.aadcdn.microsoftonline-p.com/aadbranding/1.0.1/aadlogin/Office365/illustration.jpg Requested by Host: login.microsoftonline-int.com URL: http://login.microsoftonline-int.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:283::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash 7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer http://login.microsoftonline-int.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 04 Oct 2018 10:41:57 GMT Last-Modified Fri, 23 Aug 2013 05:49:52 GMT Strict-Transport-Security max-age=31536000 Content-Type image/jpeg Access-Control-Allow-Origin * Access-Control-Expose-Headers x-ms-request-id,x-ms-version,x-ms-lease-status,x-ms-blob-type Cache-Control public, max-age=417015 Connection keep-alive Content-Length 203294

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

37 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| msViewportStyle function| $ function| jQuery object| ErrorCodes object| Constants object| Context object| Background object| Logo object| Instrument object| User object| tenant_info function| pageOnReady object| Util object| PostType object| LoginOption object| Post function| origHide function| origShow function| origAddClass function| origRemoveClass object| Support object| users object| Tiles object| HIP object| EmailDiscovery object| ProofUp object| StrongAuthCheck object| ThirdPartyCookieStates object| TenantBranding object| MSLogin object| jQuery111202621143191736517 object| HIP_MODE object| MSStrongAuth object| MSLogout object| body string| alt_logo_image string| alt_background_image

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

login.microsoftonline-int.com
secure.aadcdn.microsoftonline-p.com
2603:1030:c02:2::39b
2a02:26f0:6c00:283::35c1
0764cd74693cbf231ec1841cea80d3308cb39892dacdf906044ad6c0622cada2
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
a271a3f9e3cae897ced669d6652699e947928ef095e56384c4f9dd04bbb942ec
b3c4fd39a0c96930c595c60d3bd41ed0fb032380017fb367db5e7c4c9cf0bf52
c4d24f6b27cc7ceea56fbec786bb1f486fdad9a1f998f760f76d1f44671e105c
e5f59fb0fbd6fba82cd908e7fc829f68a92ebd41c979670956128d08f6da38ad
e9f76a23a17184eec1ee54b5fa9d25ae90439b9f8edf31391ee19332010fb698
f902d8b3484872d0bb6fdb71084823e6363905e3f0ebaeeafa6cb373acd28350
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603