detectornqr.ro
Open in
urlscan Pro
193.34.145.202
Malicious Activity!
Public Scan
Submission: On June 27 via automatic, source openphish
Summary
This is the only time detectornqr.ro was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Office 365 (Online) Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 193.34.145.202 193.34.145.202 | 51167 (CONTABO t...) (CONTABO to AS1299 announce AS34933) | |
2 | 2a02:26f0:122... 2a02:26f0:122:39e::fb1 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
11 | 2 |
ASN51167 (CONTABO to AS1299 announce AS34933, DE)
PTR: m3499.contabo.net
detectornqr.ro |
ASN20940 (AKAMAI-ASN1, US)
secure.aadcdn.microsoftonline-p.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
detectornqr.ro
detectornqr.ro |
553 KB |
2 |
microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com |
4 KB |
11 | 2 |
Domain | Requested by | |
---|---|---|
9 | detectornqr.ro |
detectornqr.ro
|
2 | secure.aadcdn.microsoftonline-p.com |
detectornqr.ro
|
11 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
login.live.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
secure.aadcdn.microsoftonline-p.com Symantec Class 3 Secure Server CA - G4 |
2016-09-01 - 2017-09-01 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://detectornqr.ro/offnal/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Frame ID: 18334.1
Requests: 11 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Title: Sign in with a Microsoft account
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Sign-in.php
detectornqr.ro/offnal/ |
29 KB 29 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.css
detectornqr.ro/offnal/files/ |
21 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_hover.css
detectornqr.ro/offnal/files/ |
89 B 89 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
detectornqr.ro/offnal/files/ |
108 KB 108 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aad.js
detectornqr.ro/offnal/files/ |
174 KB 174 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
heroillustration.jpg
detectornqr.ro/offnal/files/ |
199 KB 199 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bannerlogo.png
detectornqr.ro/offnal/files/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
microsoft_logo.png
detectornqr.ro/offnal/files/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_hover.min.css
secure.aadcdn.microsoftonline-p.com/ests/2.1.5898.9/content/cdnbundles/ |
89 B 82 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
watson.min.js
secure.aadcdn.microsoftonline-p.com/ests/2.1.5898.9/content/cdnbundles/ |
10 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
watson
detectornqr.ro/common/handlers/ |
16 KB 17 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Office 365 (Online) Microsoft (Consumer)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
detectornqr.ro/offnal | Name: testcookie Value: testcookie |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
detectornqr.ro
secure.aadcdn.microsoftonline-p.com
193.34.145.202
2a02:26f0:122:39e::fb1
080ff245615e719959bc5537e164ac4495c4b8036462dfee2076dd92f22c8491
784272794b86d17613d2311fa54eab23d223252eebe139ce8113eaca26a03f86
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
91c2b74542e11d0278e02715a980b39582eae2e3b519ddd2d4f9ca939e58109c
923ec15901b92763b4495b512c883bd1154f6f16a435d95290e16aee9b2d1f2e
b849c8da2fb4163b99fb3e45081f8622cba52359d9d68749aa0a6a1db7d7e97f
ca5896e71cda62c2be576048f73ca40094592f9fd2a62f7c2b4d8c94b03191e3
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603