![](/screenshots/a0f3941e-001e-4ebb-b76f-d66bdaf11a57.png)
873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live
Open in
urlscan Pro
192.119.111.108
Malicious Activity!
Public Scan
Effective URL: https://873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3...
Submission Tags: falconsandbox
Submission: On February 17 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on February 15th 2023. Valid for: 3 months.
This is the only time 873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 213.202.235.8 213.202.235.8 | 24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG) | |
1 1 | 2a00:1450:400... 2a00:1450:400d:80a::2002 | 15169 (GOOGLE) (GOOGLE) | |
1 | 217.69.142.100 217.69.142.100 | 47764 (VK-AS) (VK-AS) | |
1 3 | 192.119.111.108 192.119.111.108 | 54290 (HOSTWINDS) (HOSTWINDS) | |
2 | 20.190.160.13 20.190.160.13 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
13 | 2620:1ec:4e:1... 2620:1ec:4e:1::44 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
18 | 4 |
ASN47764 (VK-AS, RU)
PTR: hotbox.cldmail.ru
loginauthorizeclientid-vbbmv97mbhoz5gawkjigxxfzna6q755s8p4bqoek.hb.bizmrg.com |
ASN54290 (HOSTWINDS, US)
PTR: hwsrv-1040915.hostwindsdns.com
873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
msauth.net
aadcdn.msauth.net — Cisco Umbrella Rank: 1172 |
199 KB |
3 |
873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live
1 redirects
873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live |
108 KB |
2 |
live.com
login.live.com — Cisco Umbrella Rank: 90 |
2 KB |
1 |
bizmrg.com
loginauthorizeclientid-vbbmv97mbhoz5gawkjigxxfzna6q755s8p4bqoek.hb.bizmrg.com |
843 B |
1 |
doubleclick.net
1 redirects
adx.g.doubleclick.net — Cisco Umbrella Rank: 2821 |
678 B |
1 |
exactag.com
1 redirects
m.exactag.com — Cisco Umbrella Rank: 11824 |
2 KB |
18 | 6 |
Domain | Requested by | |
---|---|---|
13 | aadcdn.msauth.net |
873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live
aadcdn.msauth.net |
3 | 873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live |
1 redirects
loginauthorizeclientid-vbbmv97mbhoz5gawkjigxxfzna6q755s8p4bqoek.hb.bizmrg.com
873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live |
2 | login.live.com |
873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live
aadcdn.msauth.net |
1 | loginauthorizeclientid-vbbmv97mbhoz5gawkjigxxfzna6q755s8p4bqoek.hb.bizmrg.com | |
1 | adx.g.doubleclick.net | 1 redirects |
1 | m.exactag.com | 1 redirects |
18 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.microsoft.com |
privacy.microsoft.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.bizmrg.com GlobalSign RSA OV SSL CA 2018 |
2022-07-13 - 2023-08-14 |
a year | crt.sh |
873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live R3 |
2023-02-15 - 2023-05-16 |
3 months | crt.sh |
login.live.com DigiCert SHA2 Secure Server CA |
2023-01-02 - 2024-01-02 |
a year | crt.sh |
aadcdn.msauth.net DigiCert SHA2 Secure Server CA |
2023-01-27 - 2024-01-27 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637929903776466681.Y2Y4YjNjOWItNWRlMi00NWRmLWEyNGEtNGMxM2RhNjhmMmY1NTI3YmM5OTMtOWEyNi00YWJjLTg5ZDAtYmYyMjgwOWFjMWUx&ui_locales=en-US&mkt=en-US&state=G-VlqctyXJoQazNds6PWnW7GHB_JRMNCQNIscmNm49y8wyBm0ioAbPHzBE3jzPLGCyk2xLKOAqbJtwTLTLDUqnAJFuN5Si8AFjBXKydzhb6x4EIi3_N0oFy9vVNHYBjWByDP66t5m5Ra01fSIg5C_SimIq8o1nplzEjy9Yh5zzJM6YRiEI82IK6PzXyy32HA_42pbx0DvZw525HpcuVgMA1VWPZiCKFly3JEnMPTh7Ldfoo6w-4xJkUhkywZlP-WulmpO3prRseGYKBIVVplJw&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&qrc=fpriou%40ipgarde.com&sso_reload=true
Frame ID: ABC906C609A232F38809F2B2103D1776
Requests: 17 HTTP requests in this frame
Frame:
https://login.live.com/Me.htm?v=3
Frame ID: D98003764D21E54A6541D0628E92020D
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/a0f3941e-001e-4ebb-b76f-d66bdaf11a57.png)
Page Title
Sign in to your accountPage URL History Show full URLs
-
https://m.exactag.com/cl.aspx?extProvApi=sixt-crm_recurring&extProvId=313&extPu=nl_rac_&extLi=CRM_...
HTTP 302
https://adx.g.doubleclick.net//pcs/view?xai=AKAOjsvSc_HvuQdRvX1aSoLPMgMMy-T8xM65Y_09AIvG1ApfApuPo9FtYnF9W2... HTTP 302
https://loginauthorizeclientid-vbbmv97mbhoz5gawkjigxxfzna6q755s8p4bqoek.hb.bizmrg.com/index.html Page URL
-
https://873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live/?zmsk&qrc=fpriou@ipgarde.com
HTTP 302
https://873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&... Page URL
- https://873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&... Page URL
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Terms of use
Search URL Search Domain Scan URL
Title: Privacy & cookies
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://m.exactag.com/cl.aspx?extProvApi=sixt-crm_recurring&extProvId=313&extPu=nl_rac_&extLi=CRM_B2C_Jubilee_Recurring_RENT_2020_&extCr=navigation_rent&extSi=nl_rac__2010_%20&url=https%3A%2F%2Fadx%E2%80%8B.g%E2%80%8B.doubleclick.net%2F%2Fpcs%2Fview%3Fxai%3DAKAOjsvSc_HvuQdRvX1aSoLPMgMMy-T8xM65Y_09AIvG1ApfApuPo9FtYnF9W2EEqi6GwE47pf6Th4xg4FDvHaAKOPaQtQr4xJKBJ08mjD4W7LwmVigyiXIBwAQ9Ga5qLY2ORq_WeFgyIWJSATEw4kSs6iyyE2VnWoVF9g8X4brSZg-d2kHwxDG0kckzm_IBbsku6Nh62dAZfWL-lHrXgRphSSKKd6Y1I4VMYqP0oHOKcOJeyFNW4nOJQAXibQCw0CJ4E55vFlHRK6xhA7WDmVjY1LQsVW9a7ArJ_CC7RxC6OkK7Rw%26sig%3DCg0ArKJSzPyCsO5VugncEAE%26urlfix%3D1%26adurl%3Dhttps%3A%2F%2Floginauthorizeclientid-vbbmv97mbhoz5gawkjigxxfzna6q755s8p4bqoek.hb.bizmrg%E2%80%8B%E2%80%8B.com%2Findex.html%23fpriou%40ipgarde.com
HTTP 302
https://adx.g.doubleclick.net//pcs/view?xai=AKAOjsvSc_HvuQdRvX1aSoLPMgMMy-T8xM65Y_09AIvG1ApfApuPo9FtYnF9W2EEqi6GwE47pf6Th4xg4FDvHaAKOPaQtQr4xJKBJ08mjD4W7LwmVigyiXIBwAQ9Ga5qLY2ORq_WeFgyIWJSATEw4kSs6iyyE2VnWoVF9g8X4brSZg-d2kHwxDG0kckzm_IBbsku6Nh62dAZfWL-lHrXgRphSSKKd6Y1I4VMYqP0oHOKcOJeyFNW4nOJQAXibQCw0CJ4E55vFlHRK6xhA7WDmVjY1LQsVW9a7ArJ_CC7RxC6OkK7Rw&sig=Cg0ArKJSzPyCsO5VugncEAE&urlfix=1&adurl=https://loginauthorizeclientid-vbbmv97mbhoz5gawkjigxxfzna6q755s8p4bqoek.hb.bizmrg%E2%80%8B%E2%80%8B.com/index.html HTTP 302
https://loginauthorizeclientid-vbbmv97mbhoz5gawkjigxxfzna6q755s8p4bqoek.hb.bizmrg.com/index.html Page URL
-
https://873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live/?zmsk&qrc=fpriou@ipgarde.com
HTTP 302
https://873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637929903776466681.Y2Y4YjNjOWItNWRlMi00NWRmLWEyNGEtNGMxM2RhNjhmMmY1NTI3YmM5OTMtOWEyNi00YWJjLTg5ZDAtYmYyMjgwOWFjMWUx&ui_locales=en-US&mkt=en-US&state=G-VlqctyXJoQazNds6PWnW7GHB_JRMNCQNIscmNm49y8wyBm0ioAbPHzBE3jzPLGCyk2xLKOAqbJtwTLTLDUqnAJFuN5Si8AFjBXKydzhb6x4EIi3_N0oFy9vVNHYBjWByDP66t5m5Ra01fSIg5C_SimIq8o1nplzEjy9Yh5zzJM6YRiEI82IK6PzXyy32HA_42pbx0DvZw525HpcuVgMA1VWPZiCKFly3JEnMPTh7Ldfoo6w-4xJkUhkywZlP-WulmpO3prRseGYKBIVVplJw&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&qrc=fpriou%40ipgarde.com Page URL
- https://873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637929903776466681.Y2Y4YjNjOWItNWRlMi00NWRmLWEyNGEtNGMxM2RhNjhmMmY1NTI3YmM5OTMtOWEyNi00YWJjLTg5ZDAtYmYyMjgwOWFjMWUx&ui_locales=en-US&mkt=en-US&state=G-VlqctyXJoQazNds6PWnW7GHB_JRMNCQNIscmNm49y8wyBm0ioAbPHzBE3jzPLGCyk2xLKOAqbJtwTLTLDUqnAJFuN5Si8AFjBXKydzhb6x4EIi3_N0oFy9vVNHYBjWByDP66t5m5Ra01fSIg5C_SimIq8o1nplzEjy9Yh5zzJM6YRiEI82IK6PzXyy32HA_42pbx0DvZw525HpcuVgMA1VWPZiCKFly3JEnMPTh7Ldfoo6w-4xJkUhkywZlP-WulmpO3prRseGYKBIVVplJw&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&qrc=fpriou%40ipgarde.com&sso_reload=true Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://m.exactag.com/cl.aspx?extProvApi=sixt-crm_recurring&extProvId=313&extPu=nl_rac_&extLi=CRM_B2C_Jubilee_Recurring_RENT_2020_&extCr=navigation_rent&extSi=nl_rac__2010_%20&url=https%3A%2F%2Fadx%E2%80%8B.g%E2%80%8B.doubleclick.net%2F%2Fpcs%2Fview%3Fxai%3DAKAOjsvSc_HvuQdRvX1aSoLPMgMMy-T8xM65Y_09AIvG1ApfApuPo9FtYnF9W2EEqi6GwE47pf6Th4xg4FDvHaAKOPaQtQr4xJKBJ08mjD4W7LwmVigyiXIBwAQ9Ga5qLY2ORq_WeFgyIWJSATEw4kSs6iyyE2VnWoVF9g8X4brSZg-d2kHwxDG0kckzm_IBbsku6Nh62dAZfWL-lHrXgRphSSKKd6Y1I4VMYqP0oHOKcOJeyFNW4nOJQAXibQCw0CJ4E55vFlHRK6xhA7WDmVjY1LQsVW9a7ArJ_CC7RxC6OkK7Rw%26sig%3DCg0ArKJSzPyCsO5VugncEAE%26urlfix%3D1%26adurl%3Dhttps%3A%2F%2Floginauthorizeclientid-vbbmv97mbhoz5gawkjigxxfzna6q755s8p4bqoek.hb.bizmrg%E2%80%8B%E2%80%8B.com%2Findex.html%23fpriou%40ipgarde.com HTTP 302
- https://adx.g.doubleclick.net//pcs/view?xai=AKAOjsvSc_HvuQdRvX1aSoLPMgMMy-T8xM65Y_09AIvG1ApfApuPo9FtYnF9W2EEqi6GwE47pf6Th4xg4FDvHaAKOPaQtQr4xJKBJ08mjD4W7LwmVigyiXIBwAQ9Ga5qLY2ORq_WeFgyIWJSATEw4kSs6iyyE2VnWoVF9g8X4brSZg-d2kHwxDG0kckzm_IBbsku6Nh62dAZfWL-lHrXgRphSSKKd6Y1I4VMYqP0oHOKcOJeyFNW4nOJQAXibQCw0CJ4E55vFlHRK6xhA7WDmVjY1LQsVW9a7ArJ_CC7RxC6OkK7Rw&sig=Cg0ArKJSzPyCsO5VugncEAE&urlfix=1&adurl=https://loginauthorizeclientid-vbbmv97mbhoz5gawkjigxxfzna6q755s8p4bqoek.hb.bizmrg%E2%80%8B%E2%80%8B.com/index.html HTTP 302
- https://loginauthorizeclientid-vbbmv97mbhoz5gawkjigxxfzna6q755s8p4bqoek.hb.bizmrg.com/index.html
- https://873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live/?zmsk&qrc=fpriou@ipgarde.com HTTP 302
- https://873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637929903776466681.Y2Y4YjNjOWItNWRlMi00NWRmLWEyNGEtNGMxM2RhNjhmMmY1NTI3YmM5OTMtOWEyNi00YWJjLTg5ZDAtYmYyMjgwOWFjMWUx&ui_locales=en-US&mkt=en-US&state=G-VlqctyXJoQazNds6PWnW7GHB_JRMNCQNIscmNm49y8wyBm0ioAbPHzBE3jzPLGCyk2xLKOAqbJtwTLTLDUqnAJFuN5Si8AFjBXKydzhb6x4EIi3_N0oFy9vVNHYBjWByDP66t5m5Ra01fSIg5C_SimIq8o1nplzEjy9Yh5zzJM6YRiEI82IK6PzXyy32HA_42pbx0DvZw525HpcuVgMA1VWPZiCKFly3JEnMPTh7Ldfoo6w-4xJkUhkywZlP-WulmpO3prRseGYKBIVVplJw&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&qrc=fpriou%40ipgarde.com
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
index.html
loginauthorizeclientid-vbbmv97mbhoz5gawkjigxxfzna6q755s8p4bqoek.hb.bizmrg.com/ Redirect Chain
|
925 B 843 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
authorize
873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live/common/oauth2/v2.0/ Redirect Chain
|
153 KB 55 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
authorize
873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live/common/oauth2/v2.0/ |
202 KB 52 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Me.htm
login.live.com/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ConvergedLogin_PCore_107jr3BDJx7vcmkFlFtgbQ2.js
aadcdn.msauth.net/shared/1.0/content/js/ |
394 KB 111 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
convergedlogin_pcustomizationloader_f226dd7c4f08045ad544.js
aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/ |
107 KB 32 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
converged.v2.login.min_8owwt4u-33ps0wawi7tmow2.css
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ |
0 20 KB |
Other
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ux.converged.login.strings-en.min_drcggiwi0cystfohuwx04a2.js
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ |
0 14 KB |
Other
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
convergedlogin_pfetchsessionsprogress_c5a6836c2ce669861590.js
aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/ |
15 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
marching_ants_white_166de53471265253ab3a456defe6da23.gif
aadcdn.msauth.net/shared/1.0/content/images/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif
aadcdn.msauth.net/shared/1.0/content/images/ |
4 KB 4 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2_bc3d32a696895f78c19df6c717586a5d.svg
aadcdn.msauth.net/shared/1.0/content/images/backgrounds/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msauth.net/shared/1.0/content/images/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
marching_ants_white_166de53471265253ab3a456defe6da23.gif
aadcdn.msauth.net/shared/1.0/content/images/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif
aadcdn.msauth.net/shared/1.0/content/images/ |
4 KB 4 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Me.htm
login.live.com/ Frame D980 |
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
converged.v2.login.min_8owwt4u-33ps0wawi7tmow2.css
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ |
108 KB 0 |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ux.converged.login.strings-en.min_drcggiwi0cystfohuwx04a2.js
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ |
47 KB 0 |
Fetch
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)23 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 boolean| credentialless object| oncontentvisibilityautostatechange object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B object| ServerData object| webpackJsonp object| ko object| PROOF object| StringRepository object| Telemetry object| telemetry_webpackJsonp boolean| __ConvergedLogin_PCore boolean| __ boolean| __convergedlogin_pcustomizationloader_f226dd7c4f08045ad544 boolean| __convergedlogin_pfetchsessionsprogress_c5a6836c2ce66986159017 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
m.exactag.com/ | Name: exactag_new_gk Value: 73dd3df3aca242b6bf68c94c9ca0c63e%7c18.04.2023+03%3a27%3a45 |
|
m.exactag.com/ | Name: exactag_new_uk Value: 3307d4800b124650b22e8d9a4c6e493b%7c |
|
m.exactag.com/ | Name: exactag_new_user Value: 1751%7c1%7c626ef968ed8db5d35d9c5f5d6b0fcc89%7c01.01.0001+00%3a00%3a00%7c01.01.0001+00%3a00%3a00%7c%7c621443%7c74787%7cFalse |
|
m.exactag.com/ | Name: session_session Value: 334173b6a9a64e58a0ca1f18 |
|
m.exactag.com/ | Name: exactag_new_cpv Value: 1751%7cc1dd1aac813b3592e5fb653bc868936d%7c%7c%7c%7c17.02.2023+03%3a27%3a46%7cFalse%7cFalse |
|
.doubleclick.net/ | Name: test_cookie Value: CheckForPermission |
|
873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live/ | Name: qPdM Value: VwAwZ3i2zoMV |
|
873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live/ | Name: x-ms-gateway-slice Value: estsfd |
|
873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live/ | Name: stsservicecookie Value: estsfd |
|
.873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live/ | Name: AADSSO Value: NA|NoExtension |
|
873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live/ | Name: SSOCOOKIEPULLED Value: 1 |
|
873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live/ | Name: buid Value: 0.ASYAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAD--DLA3VO7QrddgJg7WevruY9RGSwK3r8en20kmaz71IYyDCeYEs3Hc1Bg64QwkPEl0_sAUBXP8Wjj2Ts4P6QJ_ZsSMiXUN9_WRiFrihsduzgU22kO5Cd83sIfy8JESKEgAA |
|
873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live/ | Name: fpc Value: AqR3ur5z4WBLlNwHFHXmkym8Ae7AAQAAADTrgNsOAAAA |
|
.873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live/ | Name: esctx Value: PAQABAAEAAAD--DLA3VO7QrddgJg7Wevrq70wurgun2Q6ATPBa_Wr_zPPiEm3gMPfoRGz6RLWv_P65qEna--XBM2vDitwVcyxaR-zVPBBYsmgMV-lpKM7pRZ2_RhQ06OS60zaGZO1evXU9faE0yH6LaFHIOFIRPPlkBbNtRGd8JFiSU5pB6947Eviy-SuPt8UB5Ia-xyaXnAgAA |
|
.873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live/ | Name: brcap Value: 0 |
|
.login.live.com/ | Name: uaid Value: ce198f34fa6d498dbc2c59e3eb2b43ba |
|
.login.live.com/ | Name: MSPRequ Value: id=N<=1676604470&co=2 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
873949645b-m3msgqm-bslo1zuth2permissionbb8g3-outh2-clientid.live
aadcdn.msauth.net
adx.g.doubleclick.net
login.live.com
loginauthorizeclientid-vbbmv97mbhoz5gawkjigxxfzna6q755s8p4bqoek.hb.bizmrg.com
m.exactag.com
192.119.111.108
20.190.160.13
213.202.235.8
217.69.142.100
2620:1ec:4e:1::44
2a00:1450:400d:80a::2002
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
318ed5818c392eaab9b13fb9288cea5037dff420c1dc75c71ceb6bf32dbc469e
3410242720de50b090d07a23aee2dad879b31d36f2615732962ec4cfa8a9d458
77436d4b20d98dcbe4078094facf1b20c46b2496ce2fa4460d2ad0cbfaaba128
7882199766af67996985bc27a2da42c974810bb9e4f04e093d5ecb64bf64182e
8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d
a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13
b22fc156c87081fbd745b1742898bbba5755a779d86ada9489c08196cd4d55c8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fa1a1c106b7fd3043a3713cccc8069dfffb9b870c8e6c3e568d35967ad734128