urlscan.io logo urlscan.io
SecurityTrails logo

www.yourfaxweb.com Open in urlscan Pro
52.36.5.197  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Submission: On September 20 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 1 countries across 5 domains to perform 15 HTTP transactions. The main IP is 52.36.5.197, located in Boardman, United States and belongs to AMAZON-02, US. The main domain is www.yourfaxweb.com.
This is the only time www.yourfaxweb.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
2 52.36.5.197 16509 (AMAZON-02)
9 2620:1ec:29:1... 8075 (MICROSOFT...)
1 52.216.144.51 16509 (AMAZON-02)
2 54.191.32.71 16509 (AMAZON-02)
1 40.126.62.131 8075 (MICROSOFT...)
15 5
2    52.36.5.197 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-36-5-197.us-west-2.compute.amazonaws.com
www.yourfaxweb.com
9    2620:1ec:29:1::40 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
aadcdn.msauth.net
1    52.216.144.51 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com
staticmediafiles.s3.amazonaws.com
2    54.191.32.71 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-191-32-71.us-west-2.compute.amazonaws.com
members.ironscales.com
1    40.126.62.131 (Phoenix, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
login.live.com
Apex Domain
Subdomains		 Transfer
9 msauth.net
aadcdn.msauth.net — Cisco Umbrella Rank: 2466
77 KB
2 ironscales.com
members.ironscales.com — Cisco Umbrella Rank: 186785
1 KB
2 yourfaxweb.com
www.yourfaxweb.com
13 KB
1 live.com
login.live.com — Cisco Umbrella Rank: 62
1 amazonaws.com
staticmediafiles.s3.amazonaws.com — Cisco Umbrella Rank: 610100
95 KB
15 5
Domain Requested by
9 aadcdn.msauth.net www.yourfaxweb.com
2 members.ironscales.com www.yourfaxweb.com
2 www.yourfaxweb.com staticmediafiles.s3.amazonaws.com
1 login.live.com www.yourfaxweb.com
1 staticmediafiles.s3.amazonaws.com www.yourfaxweb.com
15 5

This site contains links to these domains. Also see Links.

Domain
members.ironscales.com
Subject Issuer Validity Valid
aadcdn.msauth.net
DigiCert SHA2 Secure Server CA		 2023-07-29 -
2024-07-29		 a year crt.sh
*.s3.amazonaws.com
Amazon RSA 2048 M01		 2023-03-21 -
2023-12-19		 9 months crt.sh
ironscales.com
Amazon RSA 2048 M01		 2023-04-17 -
2024-05-15		 a year crt.sh
login.live.com
DigiCert SHA2 Secure Server CA		 2023-07-03 -
2024-07-03		 a year crt.sh

This page contains 1 frames:

Primary Page: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Frame ID: 3BD27B5A32CBCA1C01E66A5919420855
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

None

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

87 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

5
IPs

1
Countries

186 kB
Transfer

236 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 3675235-RdbD3TZKFuCUsw
www.yourfaxweb.com/ 		12 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
HTTP/1.1
Server
52.36.5.197 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-36-5-197.us-west-2.compute.amazonaws.com
Software
gunicorn/19.7.1 /
Resource Hash
12f4377f12827f3cfc562f8c9ff39b20c3250d3bd961cd55f560e11048b9288f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

Connection
keep-alive
Content-Length
12670
Content-Type
text/html; charset=utf-8
Date
Wed, 20 Sep 2023 22:57:06 GMT
Server
gunicorn/19.7.1
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Cookie
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-UA-Compatible
IE=edge,chrome=1
X-XSS-Protection
1; mode=block
converged.v2.login.min_99ypt2ae9l1eaa2j9r7rkw2.css
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ 		99 KB
19 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_99ypt2ae9l1eaa2j9r7rkw2.css
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
968d3f29171b0c97399611fbcd07bc81db0253fd91ec36dc456d08bb94b9bac7

Request headers

Referer
http://www.yourfaxweb.com/
Origin
http://www.yourfaxweb.com
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 20 Sep 2023 22:57:06 GMT
content-encoding
gzip
x-azure-ref-originshield
0wngLZQAAAABouRz/NAYmT7u4zmxUaxJXTU5aMjIxMDYwNjExMDQ3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-md5
sp4wVTa6EYj34ZhaCXKtvg==
x-cache
TCP_MISS
content-length
18756
x-ms-lease-status
unlocked
last-modified
Tue, 28 Apr 2020 21:29:25 GMT
etag
0x8D7EBBB39E2A763
x-azure-ref
0wngLZQAAAAAoIp3VOpYmRKAa+0AXmnmsQk4xQUEyMDUxMDE4MDUzADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
65a515cc-201e-0095-3a15-ec570e000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
53_8b36337037cff88c3df203bb73d58e41.png
aadcdn.msauth.net/ests/2.1/content/images/applogos/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e4e1e65871749d18aea150643c07e0aab2057da057c6c57ec1c3c43580e1c898

Request headers

accept-language
en-US,en;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 20 Sep 2023 22:57:06 GMT
x-azure-ref-originshield
0wngLZQAAAAAV5nTUWN9MQrbVU8t5d83vTU5aMjIxMDYwNjExMDM5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-md5
izYzcDfP+Iw98gO7c9WOQQ==
x-cache
TCP_MISS
content-length
5139
x-ms-lease-status
unlocked
last-modified
Wed, 12 Feb 2020 22:11:35 GMT
etag
0x8D7B008867A4ADE
x-azure-ref
0wngLZQAAAABB12AiOMI5QbOVQ5WFclp/Qk4xQUEyMDUxMDE4MDMzADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-type
image/png
access-control-allow-origin
*
x-ms-request-id
37af6fa9-901e-0012-1215-ecd155000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msauth.net/ests/2.1/content/images/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

accept-language
en-US,en;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 20 Sep 2023 22:57:06 GMT
content-encoding
gzip
x-azure-ref-originshield
0p0ELZQAAAABwApZ4GMiXQKfOeFwWZv9CTU5aMjIxMDYwNjEyMDM3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-md5
nzaLxFgP7ZB3dfMcaybWzw==
x-cache
TCP_HIT
content-length
1435
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:31 GMT
etag
0x8D64101560D5E58
x-azure-ref
0wngLZQAAAACujpBciE2NTZ380FG7YGt7Qk4xQUEyMDUxMDE4MDMzADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
a095de5d-501e-0076-49f4-eb3f7f000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg
aadcdn.msauth.net/ests/2.1/content/images/ 		2 KB
942 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
a76c08e9cdc3bb87bfb57627ad8f6b46f0e5ef826cc7f046dfbaf25d7b7958ea

Request headers

accept-language
en-US,en;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 20 Sep 2023 22:57:06 GMT
content-encoding
gzip
x-azure-ref-originshield
0wngLZQAAAABxj21EzwpiT62GMvw1hpy7TU5aMjIxMDYwNjEyMDUxADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-md5
6dTbAT1RVL9d6geobv3IJg==
x-cache
TCP_MISS
content-length
606
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:19 GMT
etag
0x8D641014F2C0C35
x-azure-ref
0wngLZQAAAAApHnqMwtE1QqmAAafKuWbdQk4xQUEyMDUxMDE4MDMzADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
86928cf8-d01e-0016-4015-ec7d5d000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg
aadcdn.msauth.net/ests/2.1/content/images/ 		915 B
914 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea

Request headers

accept-language
en-US,en;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 20 Sep 2023 22:57:06 GMT
content-encoding
gzip
x-azure-ref-originshield
0YMAKZQAAAAChbB1YR62LTZLGpcu3HZx+TU5aMjIxMDYwNjExMDI5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-md5
HMwsHhNXdtrfirQDkzcqMA==
x-cache
TCP_HIT
content-length
263
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:24 GMT
etag
0x8D64101521A1ED5
x-azure-ref
0wngLZQAAAAADHMWkNu6CQZzPDW00fZpSQk4xQUEyMDUxMDE4MDMzADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
6a0aa9f4-b01e-0000-0ed6-e83773000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
jquery-1.11.0.min.js
staticmediafiles.s3.amazonaws.com/static/webapp/js/ 		94 KB
95 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://staticmediafiles.s3.amazonaws.com/static/webapp/js/jquery-1.11.0.min.js
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.144.51 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682

Request headers

accept-language
en-US,en;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Date
Wed, 20 Sep 2023 22:57:07 GMT
x-amz-version-id
null
Last-Modified
Mon, 04 Jul 2016 08:58:20 GMT
Server
AmazonS3
x-amz-request-id
0KHRXCNWZFN5FHV8
ETag
"8fc25e27d42774aeae6edbc0a18b72aa"
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
96381
x-amz-id-2
Q0tnhIDHayh8clJZZv7rjzdC2r4OaEp0Z6irfBW1eN6DgH+Ud6QphHbhVDZ3Y56YPU6CPU6vVxs=
create_click_event.js
members.ironscales.com/static/training/js/ 		376 B
553 B 		Script
General
Check archive.org
Download Go to
Full URL
https://members.ironscales.com/static/training/js/create_click_event.js
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.191.32.71 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-191-32-71.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
8aa0dc07e67658e85b668f449655068ffeadaa406a21115acae58dc176c4487b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Wed, 20 Sep 2023 22:57:06 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 14 Sep 2023 09:47:14 GMT
server
nginx
content-encoding
gzip
etag
W/"6502d6a2-178"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge,chrome=1
confirm_data_entry_on_typing.js
members.ironscales.com/static/training/js/ 		848 B
773 B 		Script
General
Check archive.org
Download Go to
Full URL
https://members.ironscales.com/static/training/js/confirm_data_entry_on_typing.js
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.191.32.71 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-191-32-71.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
657348bf276aef9bf7efc01f6dcf6779395c2de5e5e582981c0b450f5a529d14
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date
Wed, 20 Sep 2023 22:57:06 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 14 Sep 2023 09:47:14 GMT
server
nginx
content-encoding
gzip
etag
W/"6502d6a2-350"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge,chrome=1
Me.htm
login.live.com/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://login.live.com/Me.htm?v=3
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.126.62.131 Phoenix, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
en-US,en;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers
converged.v2.login.min_99ypt2ae9l1eaa2j9r7rkw2.css
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ 		0
19 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_99ypt2ae9l1eaa2j9r7rkw2.css
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-US,en;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 20 Sep 2023 22:57:06 GMT
content-encoding
gzip
x-azure-ref-originshield
0wngLZQAAAABouRz/NAYmT7u4zmxUaxJXTU5aMjIxMDYwNjExMDQ3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-md5
sp4wVTa6EYj34ZhaCXKtvg==
x-cache
TCP_MISS
content-length
18756
x-ms-lease-status
unlocked
last-modified
Tue, 28 Apr 2020 21:29:25 GMT
etag
0x8D7EBBB39E2A763
x-azure-ref
0wngLZQAAAAD0pbcoFxAcQbpj11YTSBWLQk4xQUEyMDUxMDE4MDMzADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
65a515cc-201e-0095-3a15-ec570e000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
ux.converged.login.strings-en-gb.min_4i45pxpdp6x6jbo6acwtew2.js
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ 		0
12 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en-gb.min_4i45pxpdp6x6jbo6acwtew2.js
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-US,en;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 20 Sep 2023 22:57:06 GMT
content-encoding
gzip
x-azure-ref-originshield
0wngLZQAAAADUFD76HkzNR6+Fg/dEcntyTU5aMjIxMDYwNjExMDM5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-md5
ZMmSi/YvRPRT+By/2re1MQ==
x-cache
TCP_MISS
content-length
11315
x-ms-lease-status
unlocked
last-modified
Mon, 01 Jun 2020 20:58:49 GMT
etag
0x8D8066E95286BBE
x-azure-ref
0wngLZQAAAAD6v/qgwf6NTp9SNfBVlBb3Qk4xQUEyMDUxMDE4MDMzADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
8316389f-201e-0085-0115-ece72c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg
aadcdn.msauth.net/ests/2.1/content/images/appbackgrounds/ 		987 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
8b34a475187302935336bf43a2bf2a4e0adb9a1e87953ea51f6fcf0ef52a4a1d

Request headers

accept-language
en-US,en;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 20 Sep 2023 22:57:06 GMT
x-azure-ref-originshield
0wngLZQAAAADTvzeIBPInQ5u+IkjPmnyHTU5aMjIxMDYwNjExMDE5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-md5
5YqvyYBhSpzXeWvqe16o8A==
x-cache
TCP_MISS
content-length
987
x-ms-lease-status
unlocked
last-modified
Mon, 30 Mar 2020 02:45:50 GMT
etag
0x8D7D454750E6395
x-azure-ref
0wngLZQAAAABi7kbNw3TVQL7P5gsaNfCgQk4xQUEyMDUxMDE4MDMzADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-type
image/jpeg
access-control-allow-origin
*
x-ms-request-id
3b9c8167-b01e-003c-2815-ece27b000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
49_7916a894ebde7d29c2cc29b267f1299f.jpg
aadcdn.msauth.net/ests/2.1/content/images/appbackgrounds/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg
Requested by
Host: www.yourfaxweb.com
URL: http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:29:1::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3

Request headers

accept-language
en-US,en;q=0.9
Referer
http://www.yourfaxweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 20 Sep 2023 22:57:06 GMT
x-azure-ref-originshield
0wngLZQAAAADbIIQSxYWWTYn1ky2YcSOUTU5aMjIxMDYwNjExMDIzADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-md5
eRaolOvefSnCzCmyZ/Epnw==
x-cache
TCP_MISS
content-length
17453
x-ms-lease-status
unlocked
last-modified
Mon, 30 Mar 2020 02:45:50 GMT
etag
0x8D7D4547537019A
x-azure-ref
0wngLZQAAAACCqy4+D5F9SLI/QkZNmI7NQk4xQUEyMDUxMDE4MDMzADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-type
image/jpeg
access-control-allow-origin
*
x-ms-request-id
1c07a6e4-e01e-0059-2215-ec2753000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
3675235-RdbD3TZKFuCUsw
www.yourfaxweb.com/tracking/create_click_event/ 		21 B
386 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://www.yourfaxweb.com/tracking/create_click_event/3675235-RdbD3TZKFuCUsw
Requested by
Host: staticmediafiles.s3.amazonaws.com
URL: https://staticmediafiles.s3.amazonaws.com/static/webapp/js/jquery-1.11.0.min.js
Protocol
HTTP/1.1
Server
52.36.5.197 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-36-5-197.us-west-2.compute.amazonaws.com
Software
gunicorn/19.7.1 /
Resource Hash
8e348a2876686697c17bc2784470cbebe761146f0bbfc180a67a52793117882d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
http://www.yourfaxweb.com/3675235-RdbD3TZKFuCUsw
X-Requested-With
XMLHttpRequest
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

Date
Wed, 20 Sep 2023 22:57:06 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Server
gunicorn/19.7.1
Vary
Cookie
X-Frame-Options
SAMEORIGIN
Content-Type
application/json
Connection
keep-alive
Content-Length
21
X-XSS-Protection
1; mode=block
X-UA-Compatible
IE=edge,chrome=1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| createClickEvent object| excludedKeyCodes function| confirmDataEntryOnTyping

2 Cookies

Domain/Path Name / Value
.login.live.com/ Name: uaid
Value: cb5feceedb264c598bb17cac0d8c9aee
.login.live.com/ Name: MSPRequ
Value: id=N&lt=1695250626&co=1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block