uat-rc-conv.powerappsportals.com
Open in
urlscan Pro
40.69.106.97
Malicious Activity!
Public Scan
Effective URL: https://uat-rc-conv.powerappsportals.com//en
Submission: On June 26 via api from US — Scanned from CA
Summary
TLS certificate: Issued by Microsoft Azure RSA TLS Issuing CA 04 on April 19th 2024. Valid for: a year.
This is the only time uat-rc-conv.powerappsportals.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Canadian Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 40.69.106.97 40.69.106.97 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
8 | 20.60.43.235 20.60.43.235 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2607:f8b0:400... 2607:f8b0:4004:c06::5f | 15169 (GOOGLE) (GOOGLE) | |
1 | 2600:1408:ec0... 2600:1408:ec00:108b::fe9 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 2a04:4e42:200... 2a04:4e42:200::485 | 54113 (FASTLY) (FASTLY) | |
1 | 2607:f8b0:400... 2607:f8b0:400d:c1d::61 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:2800:11f... 2606:2800:11f:17a5:191a:18d5:537:22f9 | 15133 (EDGECAST) (EDGECAST) | |
2 | 52.188.247.149 52.188.247.149 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
18 | 8 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
uat-rc-conv.powerappsportals.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
clouduatrcconv.blob.core.windows.net |
ASN15133 (EDGECAST, US)
az416426.vo.msecnd.net |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
dc.services.visualstudio.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
windows.net
clouduatrcconv.blob.core.windows.net |
680 KB |
3 |
powerappsportals.com
uat-rc-conv.powerappsportals.com |
9 KB |
2 |
visualstudio.com
dc.services.visualstudio.com — Cisco Umbrella Rank: 563 |
200 B |
1 |
msecnd.net
az416426.vo.msecnd.net — Cisco Umbrella Rank: 2932 |
22 KB |
1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 81 |
49 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 381 |
1 KB |
1 |
canada.ca
www.canada.ca — Cisco Umbrella Rank: 42551 |
38 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 469 |
33 KB |
18 | 8 |
Domain | Requested by | |
---|---|---|
8 | clouduatrcconv.blob.core.windows.net |
uat-rc-conv.powerappsportals.com
clouduatrcconv.blob.core.windows.net |
3 | uat-rc-conv.powerappsportals.com |
uat-rc-conv.powerappsportals.com
|
2 | dc.services.visualstudio.com |
az416426.vo.msecnd.net
|
1 | az416426.vo.msecnd.net |
uat-rc-conv.powerappsportals.com
|
1 | www.googletagmanager.com |
uat-rc-conv.powerappsportals.com
|
1 | cdn.jsdelivr.net |
uat-rc-conv.powerappsportals.com
|
1 | www.canada.ca |
uat-rc-conv.powerappsportals.com
|
1 | ajax.googleapis.com |
uat-rc-conv.powerappsportals.com
|
18 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.canada.ca |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.powerappsportals.com Microsoft Azure RSA TLS Issuing CA 04 |
2024-04-19 - 2025-04-14 |
a year | crt.sh |
*.blob.core.windows.net Microsoft Azure RSA TLS Issuing CA 03 |
2024-04-05 - 2025-03-31 |
a year | crt.sh |
upload.video.google.com WR2 |
2024-06-03 - 2024-08-26 |
3 months | crt.sh |
*.canada.ca GeoTrust RSA CA 2018 |
2024-01-24 - 2025-01-23 |
a year | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3 |
2023-09-27 - 2024-10-28 |
a year | crt.sh |
*.google-analytics.com WR2 |
2024-06-03 - 2024-08-26 |
3 months | crt.sh |
*.vo.msecnd.net DigiCert SHA2 Secure Server CA |
2024-06-06 - 2025-06-06 |
a year | crt.sh |
prod.ai.ingestion.msftcloudes.com Microsoft Azure RSA TLS Issuing CA 04 |
2024-04-19 - 2025-04-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://uat-rc-conv.powerappsportals.com//en
Frame ID: 19341AB242B54D759287630E0900A237
Requests: 17 HTTP requests in this frame
Screenshot
Page Title
Convergence Portal / Portail ConvergencePage URL History Show full URLs
-
http://uat-rc-conv.powerappsportals.com//en
HTTP 307
https://uat-rc-conv.powerappsportals.com//en Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtag/js
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Terms and conditions
Search URL Search Domain Scan URL
Title: Avis
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://uat-rc-conv.powerappsportals.com//en
HTTP 307
https://uat-rc-conv.powerappsportals.com//en Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
en
uat-rc-conv.powerappsportals.com// Redirect Chain
|
8 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.css
clouduatrcconv.blob.core.windows.net/xrmportal-webfiles/ |
313 KB 313 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
glyphicons-font-awesome-migrate.min.css
uat-rc-conv.powerappsportals.com/css/ |
13 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
default.bundle.css
uat-rc-conv.powerappsportals.com/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
theme.min.css
clouduatrcconv.blob.core.windows.net/xrmportal-webfiles/css/ |
297 KB 298 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
RP.css
clouduatrcconv.blob.core.windows.net/xrmportal-webfiles/ |
25 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.9.1/ |
90 KB 33 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sp-bg-10.jpg
www.canada.ca/content/dam/canada/splash/ |
38 KB 38 KB |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sig-blk-en.svg
clouduatrcconv.blob.core.windows.net/xrmportal-webfiles/assets/ |
10 KB 11 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wmms-blk.svg
clouduatrcconv.blob.core.windows.net/xrmportal-webfiles/assets/ |
5 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.cookie.min.js
cdn.jsdelivr.net/npm/jquery.cookie@1.4.1/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
RP.Common.js
clouduatrcconv.blob.core.windows.net/xrmportal-webfiles/ |
4 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
127 KB 49 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
glyphicons-halflings-regular.woff2
clouduatrcconv.blob.core.windows.net/xrmportal-webfiles/fonts/ |
18 KB 18 KB |
Font
application/x-font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ai.0.js
az416426.vo.msecnd.net/scripts/a/ |
94 KB 22 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
clouduatrcconv.blob.core.windows.net/xrmportal-webfiles/ |
5 KB 6 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
track
dc.services.visualstudio.com/v2/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
track
dc.services.visualstudio.com/v2/ |
96 B 200 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Canadian Government (Government)18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage function| $ function| jQuery function| parseQueryString function| buildSelectIntoList function| getDecodedHtml function| decodeHtml function| gtag object| dataLayer object| appInsights object| google_tag_manager object| google_tag_data object| AI object| Microsoft function| __extends function| _endsWith5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
uat-rc-conv.powerappsportals.com/ | Name: Dynamics365PortalAnalytics Value: pUdlU41TpSq37nWu_21v0o9WjvhzODsDFuQiZo5ldtiz59R_nrkM4x6G-fL89gj36LpYbKPYt8tw_aXhfb47hlK3FwTMUeg7t6H42AGY9XGMcR9SpmmvcBFPG2XuunWYMqFUcBlEvenjSf696LN0WQ2 |
|
.uat-rc-conv.powerappsportals.com/ | Name: ARRAffinity Value: 49c0bd41fb96f514d1bbc23a938815b45339fecaea7611b589a5f6ef130b394a |
|
.uat-rc-conv.powerappsportals.com/ | Name: ARRAffinitySameSite Value: 49c0bd41fb96f514d1bbc23a938815b45339fecaea7611b589a5f6ef130b394a |
|
uat-rc-conv.powerappsportals.com/ | Name: ai_user Value: LP4JV|2024-06-26T18:49:01.787Z |
|
uat-rc-conv.powerappsportals.com/ | Name: ai_session Value: v8P/l|1719427741890.2|1719427741890.2 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload |
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
az416426.vo.msecnd.net
cdn.jsdelivr.net
clouduatrcconv.blob.core.windows.net
dc.services.visualstudio.com
uat-rc-conv.powerappsportals.com
www.canada.ca
www.googletagmanager.com
20.60.43.235
2600:1408:ec00:108b::fe9
2606:2800:11f:17a5:191a:18d5:537:22f9
2607:f8b0:4004:c06::5f
2607:f8b0:400d:c1d::61
2a04:4e42:200::485
40.69.106.97
52.188.247.149
00982f89c26d7393e8cbb3eb0daa7a7d900aa446f9eb8364b566d79421328ab8
17bd399546c5e7f08eba561df22d42b1466e7089d97df177adaf3ee5b68d81d3
1a83bcab05ffe3c5e5e8cd52e99a53be12d7af34eb14ab9be929184be9523a2b
22ad692f8d408db2cb6ed5a9e6bc01926c4ea04a74704c61407aefeb492c6366
5034923843dc5d27b9e1556fd8205aac74a4776532c05107e6fccac51c447f71
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e
6ecb3da4b4b5adae0b627fafbf31366a07c33c047452ee750822e34b14dd1fb2
6f219a41d1febd262a1b60828f396fac0b387cce94870361a8b2fe8ad9b5d191
6fcbb08a78aa7780c639f0e3e1943e0a0f7af03043aa82f745d103c215b1feab
73ee363ee4285da90c0fd36eced60110c468f3b01c8a6a44aac6a9e7195231f3
a16b8f94c0dd6233e7fa1902016419db82226479133ef7e4b5a72823b88dd4f5
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
cd91c486b38b1b32bc4ce7168a6f258c536d2958366f6982ceb577138e70bfd5
dc827f391db1b0a6917a1773e98731ab7901dd9897f0ad46c0f797f27f279487
ede8178f5d7e3f8bafa83702d2c54ae6f6e3bfb12f8acda98d5181a63365c81f
fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c