livelogin.info
Open in
urlscan Pro
104.27.150.120
Malicious Activity!
Public Scan
Submission: On March 14 via automatic, source twitter_illegalFawn
Summary
This is the only time livelogin.info was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 104.27.150.120 104.27.150.120 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 172.217.21.234 172.217.21.234 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
5 | 104.27.151.120 104.27.151.120 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
2 | 104.111.251.169 104.111.251.169 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
10 | 4 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
livelogin.info |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s13-in-f10.1e100.net
ajax.googleapis.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
livelogin.info |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-251-169.deploy.static.akamaitechnologies.com
auth.gfx.ms |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
livelogin.info
livelogin.info |
42 KB |
2 |
gfx.ms
auth.gfx.ms |
293 KB |
1 |
googleapis.com
ajax.googleapis.com |
30 KB |
10 | 3 |
Domain | Requested by | |
---|---|---|
7 | livelogin.info |
livelogin.info
|
2 | auth.gfx.ms |
livelogin.info
|
1 | ajax.googleapis.com |
livelogin.info
|
10 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
account.live.com |
login.live.com |
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://livelogin.info/
Frame ID: 391E3774E281FD5B8FD6F171829DE682
Requests: 10 HTTP requests in this frame
Screenshot
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /cloudflare/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Title: Create one!
Search URL Search Domain Scan URL
Title: Forgot my password
Search URL Search Domain Scan URL
Title: Sign in with a different Microsoft account
Search URL Search Domain Scan URL
Title: Terms of use
Search URL Search Domain Scan URL
Title: Privacy & cookies
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
/
livelogin.info/ |
45 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Converged1033.css
livelogin.info/ourlook_files/ |
86 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Kernel.js
livelogin.info/ourlook_files/ |
19 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.css
livelogin.info/ourlook_files/ |
672 B 667 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
foreground.js
livelogin.info/ourlook_files/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
microsoft_logo.svg
livelogin.info/ourlook_files/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
picker_account_msa.svg
livelogin.info/ourlook_files/ |
379 B 675 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0.jpg
auth.gfx.ms/16.000.27537.1/images/Backgrounds/ |
291 KB 291 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0-small.jpg
auth.gfx.ms/16.000.27537.1/images/Backgrounds/ |
1 KB 1 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| PROOF function| $ function| jQuery number| g_iSRSFailed string| g_sSRSSuccess function| SRSRetry object| g_dtFirstByte object| g_objPageMode object| ServerData object| $2C6A44CB_AD42_4731_A544_3FBD3D83AB5B_ function| idSIButton9_click function| idBtn_Back_click function| check_login1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.livelogin.info/ | Name: __cfduid Value: dac6c89ef8e565a84bfa5aa6f7d4aca991521035476 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
auth.gfx.ms
livelogin.info
104.111.251.169
104.27.150.120
104.27.151.120
172.217.21.234
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
34d8da073f47030ee94b99d84fbe68e3345bd8aaa37ea909ff2da00238447486
374815c3015585ef512d266ad148f74e1793b4a882d5c1d24d61c6a1969ec2f1
62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
9937e3dc7fbd8bfec6dde8a4902301d5823eaace9a8055c6a32f404c7abfa8fd
a3f124fe4d3ac3868ff78084960386db25f0033e7e5e8ddde7be98b5f878d3e0
b4bcf75eec9c807c7e5c061a6bf35b1abf568bd3917fd4e254ae3f9db84fff92
c13db279143e1845ee4aaee5afedc5bd75e9f7d50024b63883b45332c4960b3b
cffd17aa12d2cbc84454c54c27af660e3737c257a4eb4c47bfabca06aa281539