login-onedrivernicrosottfserrvee.tiiny.site Open in urlscan Pro
99.84.108.109 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://login-onedrivernicrosottfserrvee.tiiny.site/?common=GEP8EOS5Y6R8LITX6DWW0KDPGM5L4&oauth2=C30CB5a187CB28764c01273Cb0cc6406b&authorize=241aA0c...
Submission: On July 26 via api (July 26th 2024, 10:35:38 pm UTC) from BE — Scanned from CA

Summary HTTP 13 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 6 domains to perform 13 HTTP transactions. The main IP is 99.84.108.109, located in United States and belongs to AMAZON-02, US. The main domain is login-onedrivernicrosottfserrvee.tiiny.site.
TLS certificate: Issued by Amazon RSA 2048 M02 on January 11th 2024. Valid for: a year.

This is the only time login-onedrivernicrosottfserrvee.tiiny.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	99.84.108.109 99.84.108.109	16509 (AMAZON-02) (AMAZON-02)
1	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.71.121.197 52.71.121.197	14618 (AMAZON-AES) (AMAZON-AES)
1	104.26.4.15 104.26.4.15	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	13.107.246.38 13.107.246.38	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	152.195.19.97 152.195.19.97	15133 (EDGECAST) (EDGECAST)
13	6

1 99.84.108.109 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-108-109.iad79.r.cloudfront.net

login-onedrivernicrosottfserrvee.tiiny.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.71.121.197 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-71-121-197.compute-1.amazonaws.com

daffy-first-fiber.glitch.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.26.4.15 (None, )

ASN13335 (CLOUDFLARENET, US)

api.db-ip.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 13.107.246.38 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 152.195.19.97 (San Jose, United States)

ASN15133 (EDGECAST, US)

aadcdn.msftauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	msauth.net aadcdn.msauth.net — Cisco Umbrella Rank: 2218	48 KB
1	msftauth.net aadcdn.msftauth.net — Cisco Umbrella Rank: 2274	2 KB
1	db-ip.com api.db-ip.com — Cisco Umbrella Rank: 146975	674 B
1	glitch.me daffy-first-fiber.glitch.me	95 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 336	29 KB
1	tiiny.site login-onedrivernicrosottfserrvee.tiiny.site	4 KB
13	6

	Domain	Requested by
8	aadcdn.msauth.net	daffy-first-fiber.glitch.me login-onedrivernicrosottfserrvee.tiiny.site
1	aadcdn.msftauth.net	login-onedrivernicrosottfserrvee.tiiny.site
1	api.db-ip.com	cdnjs.cloudflare.com
1	daffy-first-fiber.glitch.me	login-onedrivernicrosottfserrvee.tiiny.site
1	cdnjs.cloudflare.com	login-onedrivernicrosottfserrvee.tiiny.site
1	login-onedrivernicrosottfserrvee.tiiny.site
13	6

This site contains links to these domains. Also see Links.

Domain
signup.live.com
go.microsoft.com

Subject Issuer	Validity	Valid
*.tiiny.site Amazon RSA 2048 M02	`2024-01-11` - `2025-02-07`	a year	crt.sh
cdnjs.cloudflare.com E1	`2024-06-02` - `2024-08-31`	3 months	crt.sh
glitch.com Amazon RSA 2048 M03	`2023-12-04` - `2025-01-01`	a year	crt.sh
db-ip.com WE1	`2024-07-13` - `2024-10-11`	3 months	crt.sh
aadcdn.msauth.net DigiCert SHA2 Secure Server CA	`2024-04-30` - `2025-04-30`	a year	crt.sh
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA	`2024-05-25` - `2025-05-25`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://login-onedrivernicrosottfserrvee.tiiny.site/?common=GEP8EOS5Y6R8LITX6DWW0KDPGM5L4&oauth2=C30CB5a187CB28764c01273Cb0cc6406b&authorize=241aA0c9a3679aa288B2140Cc2205a
Frame ID: 0C656B985C621C3A8FDC4E9E0099A2F3
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your account

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

178 kB
Transfer

333 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://signup.live.com/signup?contextid=FB2A4AE87A4785C5&bk=1674444508&ru=https://login.live.com/login.srf%3fcontextid%3dFB2A4AE87A4785C5%26mkt%3dEN-US%26lc%3d1033%26bk%3d1674444508%26uaid%3d7df079e1db12426fa65f7fb024b7b26f&uiflavor=web&lic=1&mkt=EN-US&lc=1033&uaid=7df079e1db12426fa65f7fb024b7b26f
Title: Create one!

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/p/?LinkId=708614
Title: More information

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
login-onedrivernicrosottfserrvee.tiiny.site/ 3 KB
4 KB 393ms
252ms Document
text/html 99.84.108.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://login-onedrivernicrosottfserrvee.tiiny.site/?common=GEP8EOS5Y6R8LITX6DWW0KDPGM5L4&oauth2=C30CB5a187CB28764c01273Cb0cc6406b&authorize=241aA0c9a3679aa288B2140Cc2205a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.108.109 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-108-109.iad79.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 60017dbc43727bb42b87b46eae00f25e49e031f28a65a28987a313bbed365cad

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-length: 3469
content-type: text/html
date: Fri, 26 Jul 2024 22:35:34 GMT
etag: "d131a06b11c79a8f704387bd81349dcc"
last-modified: Mon, 08 Jul 2024 10:29:30 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 4085d0fb63bcf1447db3c47a72df12a4.cloudfront.net (CloudFront)
x-amz-cf-id: Foql0u1MmeXSqvpxnDIHvrEcSOkPuqU8cfzQHgYsofdMMMey9h1jvg==
x-amz-cf-pop: IAD79-C2
x-amz-id-2: uutZMaruZXp1NTxgKbBDGidLVJza/hRXdjzCNOjdDSHgm0jyFxY7szXAoqFRS8G5wDoVRyvOCKk=
x-amz-request-id: FVR81BSTNB3N4ZFB
x-amz-version-id: 8H6pSV.ZcRVuufXrZaABgbobtYLqhjUx
x-cache: Miss from cloudfront

GET
H3 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/ 90 KB
29 KB 66ms
34ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.min.js

Requested by

Host: login-onedrivernicrosottfserrvee.tiiny.site
URL: https://login-onedrivernicrosottfserrvee.tiiny.site/?common=GEP8EOS5Y6R8LITX6DWW0KDPGM5L4&oauth2=C30CB5a187CB28764c01273Cb0cc6406b&authorize=241aA0c9a3679aa288B2140Cc2205a

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://login-onedrivernicrosottfserrvee.tiiny.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Fri, 26 Jul 2024 22:35:33 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 720837
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 29363
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-169d5"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3yVb4CLwclEHmN7bGbSPEJweMbZtOt8WjESMYNZSX1rPth2UriiB9H1HllvuQuUE83Bn1oFT6brEhk6OIFfUDF77GL3hpCE3uFY%2B1pAulswuLPay6e8T1ufSrJTyXj%2FN0547SDyp"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8a97dd0e190c36eb-YYZ
expires: Wed, 16 Jul 2025 22:35:33 GMT

GET
H2 200 script.js Show response
daffy-first-fiber.glitch.me/ 94 KB
95 KB 248ms
152ms Script
application/javascript 52.71.121.197
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://daffy-first-fiber.glitch.me/script.js
Requested by: Host: login-onedrivernicrosottfserrvee.tiiny.site
URL: https://login-onedrivernicrosottfserrvee.tiiny.site/?common=GEP8EOS5Y6R8LITX6DWW0KDPGM5L4&oauth2=C30CB5a187CB28764c01273Cb0cc6406b&authorize=241aA0c9a3679aa288B2140Cc2205a
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.71.121.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-121-197.compute-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 656fc307bee986f6e3bca509444421f6ef799cc932423a6311dd4993b68e416a

Request headers

Referer: https://login-onedrivernicrosottfserrvee.tiiny.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Fri, 26 Jul 2024 22:35:33 GMT
x-amz-version-id: kKrfBnqE4NR8PRnataEV.TeFU.ZrZ5Lm
last-modified: Thu, 06 Jun 2024 18:15:22 GMT
server: AmazonS3
x-amz-request-id: FVR2SBW4Y9S43YMW
etag: "424a275da4044fd6773d80dcbd4c8a95"
x-amz-server-side-encryption: AES256
content-type: application/javascript; charset=utf-8
cache-control: no-cache
accept-ranges: bytes
content-length: 96459
x-amz-id-2: Gn9ZqWCcJWHMjmNmie83A0gAy7LDNBAKCM2IWcvW//kg9CZ7FqnHgVVwplU0jvSQ1HHCMOar71U=

GET
H3 200 self Show response
api.db-ip.com/v2/free/ 233 B
674 B 134ms
60ms XHR
application/json 104.26.4.15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.db-ip.com/v2/free/self
Requested by: Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.26.4.15 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e9818a897a640a2ea403051f1c710d8db8d7e576d4d33d4575f2af066123d6cf

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://login-onedrivernicrosottfserrvee.tiiny.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Fri, 26 Jul 2024 22:35:33 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Fri, 26 Jul 2024 22:35:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-iplb-request-id: AC4582B2:2FB6_93878F2E:0050_66A424B5_1A47EB34:4F34
x-iplb-instance: 59215
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cw%2B7ahaWmcqQyVZ24wJ0aFGPoX4J7%2F7R8dzFrYSeWCbcCkSpe9%2FeCeF3TrW1snuvxMNUruXiJUel%2FGhKCu%2F0WvvEbaV1NQHLmrsSUPIeOab6wpF5Cm2VjilSecdCel4%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=1800
cf-ray: 8a97dd10795e36a4-YYZ
alt-svc: h3=":443"; ma=86400

GET
H2 200 converged.v2.login.min_ziytf8dzt9eg1s6-ohhleg2.css
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ 108 KB
20 KB 392ms
87ms Stylesheet
text/css 13.107.246.38
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_ziytf8dzt9eg1s6-ohhleg2.css
Requested by: Host: daffy-first-fiber.glitch.me
URL: https://daffy-first-fiber.glitch.me/script.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.38 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 1304c5090f063c677a5b3720fe7b97ef4d9ea102e2bdd837ce399df6057fe385

Request headers

Referer: https://login-onedrivernicrosottfserrvee.tiiny.site/
Origin: https://login-onedrivernicrosottfserrvee.tiiny.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 26 Jul 2024 22:35:34 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 0
content-length: 19953
x-ms-lease-status: unlocked
last-modified: Mon, 18 Apr 2022 21:18:26 GMT
etag: 0x8DA2180FA29F5AF
x-azure-ref: 20240726T223534Z-17fd6bb7c96btc44srexpnr67w00000002ag000000006b93
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 0f358b86-301e-0051-607b-deadaf000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msftauth.net/ests/2.1/content/images/ 4 KB
2 KB 211ms
50ms Image
image/svg+xml 152.195.19.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Requested by: Host: login-onedrivernicrosottfserrvee.tiiny.site
URL: https://login-onedrivernicrosottfserrvee.tiiny.site/?common=GEP8EOS5Y6R8LITX6DWW0KDPGM5L4&oauth2=C30CB5a187CB28764c01273Cb0cc6406b&authorize=241aA0c9a3679aa288B2140Cc2205a
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.19.97 San Jose, United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (chd/0799) /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Referer: https://login-onedrivernicrosottfserrvee.tiiny.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 26 Jul 2024 22:35:33 GMT
content-encoding: gzip
content-md5: nzaLxFgP7ZB3dfMcaybWzw==
age: 92483
x-cache: HIT
content-length: 1435
x-ms-lease-status: unlocked
last-modified: Fri, 02 Nov 2018 20:25:22 GMT
server: ECAcc (chd/0799)
etag: 0x8D64101507E84BD
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 6444079c-201e-0002-4ad4-de7494000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=604800
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 marching_ants_white_166de53471265253ab3a456defe6da23.gif
aadcdn.msauth.net/shared/1.0/content/images/ 3 KB
3 KB 344ms
42ms Image
image/gif 13.107.246.38
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif
Requested by: Host: login-onedrivernicrosottfserrvee.tiiny.site
URL: https://login-onedrivernicrosottfserrvee.tiiny.site/?common=GEP8EOS5Y6R8LITX6DWW0KDPGM5L4&oauth2=C30CB5a187CB28764c01273Cb0cc6406b&authorize=241aA0c9a3679aa288B2140Cc2205a
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.38 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13

Request headers

Referer: https://login-onedrivernicrosottfserrvee.tiiny.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 26 Jul 2024 22:35:34 GMT
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 0
content-length: 2672
x-ms-lease-status: unlocked
last-modified: Fri, 17 Jan 2020 19:28:37 GMT
etag: 0x8D79B83739984DD
x-azure-ref: 20240726T223534Z-17fd6bb7c969h8jkc4ufgkgg8400000002f000000000ak9k
content-type: image/gif
access-control-allow-origin: *
x-ms-request-id: 21156f28-601e-0075-2588-dedfc5000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
aadcdn.msauth.net/shared/1.0/content/images/ 513 B
817 B 344ms
43ms Image
image/svg+xml 13.107.246.38
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
Requested by: Host: login-onedrivernicrosottfserrvee.tiiny.site
URL: https://login-onedrivernicrosottfserrvee.tiiny.site/?common=GEP8EOS5Y6R8LITX6DWW0KDPGM5L4&oauth2=C30CB5a187CB28764c01273Cb0cc6406b&authorize=241aA0c9a3679aa288B2140Cc2205a
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.38 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

Request headers

Referer: https://login-onedrivernicrosottfserrvee.tiiny.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 26 Jul 2024 22:35:34 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 0
content-length: 276
x-ms-lease-status: unlocked
last-modified: Fri, 17 Jan 2020 19:28:34 GMT
etag: 0x8D79B8371B97A82
x-azure-ref: 20240726T223534Z-17fd6bb7c969h8jkc4ufgkgg8400000002f000000000ak9m
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: a0b9758b-801e-006d-218c-de00a2000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg
aadcdn.msauth.net/shared/1.0/content/images/ 7 KB
3 KB 344ms
43ms Image
image/svg+xml 13.107.246.38
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg
Requested by: Host: login-onedrivernicrosottfserrvee.tiiny.site
URL: https://login-onedrivernicrosottfserrvee.tiiny.site/?common=GEP8EOS5Y6R8LITX6DWW0KDPGM5L4&oauth2=C30CB5a187CB28764c01273Cb0cc6406b&authorize=241aA0c9a3679aa288B2140Cc2205a
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.38 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8

Request headers

Referer: https://login-onedrivernicrosottfserrvee.tiiny.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 26 Jul 2024 22:35:34 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 0
content-length: 2407
x-ms-lease-status: unlocked
last-modified: Fri, 11 Mar 2022 11:11:29 GMT
etag: 0x8DA034FE445C10D
x-azure-ref: 20240726T223534Z-17fd6bb7c969h8jkc4ufgkgg8400000002f000000000ak9n
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 08a845b6-501e-002f-078c-defdb2000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg
aadcdn.msauth.net/shared/1.0/content/images/ 3 KB
2 KB 381ms
80ms Image
image/svg+xml 13.107.246.38
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg
Requested by: Host: login-onedrivernicrosottfserrvee.tiiny.site
URL: https://login-onedrivernicrosottfserrvee.tiiny.site/?common=GEP8EOS5Y6R8LITX6DWW0KDPGM5L4&oauth2=C30CB5a187CB28764c01273Cb0cc6406b&authorize=241aA0c9a3679aa288B2140Cc2205a
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.38 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1

Request headers

Referer: https://login-onedrivernicrosottfserrvee.tiiny.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 26 Jul 2024 22:35:34 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 0
content-length: 1173
x-ms-lease-status: unlocked
last-modified: Fri, 17 Jan 2020 19:28:39 GMT
etag: 0x8D79B83749623C9
x-azure-ref: 20240726T223534Z-17fd6bb7c969h8jkc4ufgkgg8400000002f000000000ak9p
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 5ae4f542-e01e-0054-4e8c-de2aa5000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 signin-options_4e48046ce74f4b89d45037c90576bfac.svg
aadcdn.msauth.net/shared/1.0/content/images/ 2 KB
1 KB 342ms
41ms Image
image/svg+xml 13.107.246.38
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg
Requested by: Host: login-onedrivernicrosottfserrvee.tiiny.site
URL: https://login-onedrivernicrosottfserrvee.tiiny.site/?common=GEP8EOS5Y6R8LITX6DWW0KDPGM5L4&oauth2=C30CB5a187CB28764c01273Cb0cc6406b&authorize=241aA0c9a3679aa288B2140Cc2205a
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.38 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93

Request headers

Referer: https://login-onedrivernicrosottfserrvee.tiiny.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 26 Jul 2024 22:35:34 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 0
content-length: 621
x-ms-lease-status: unlocked
last-modified: Tue, 10 Nov 2020 03:41:24 GMT
etag: 0x8D8852A7FA6B761
x-azure-ref: 20240726T223534Z-17fd6bb7c969h8jkc4ufgkgg8400000002f000000000ak9g
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 8722f5c5-501e-0003-10fc-de9898000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 2_bc3d32a696895f78c19df6c717586a5d.svg
aadcdn.msauth.net/shared/1.0/content/images/backgrounds/ 2 KB
1 KB 336ms
42ms Image
image/svg+xml 13.107.246.38
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Requested by: Host: login-onedrivernicrosottfserrvee.tiiny.site
URL: https://login-onedrivernicrosottfserrvee.tiiny.site/?common=GEP8EOS5Y6R8LITX6DWW0KDPGM5L4&oauth2=C30CB5a187CB28764c01273Cb0cc6406b&authorize=241aA0c9a3679aa288B2140Cc2205a
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.38 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

Referer: https://login-onedrivernicrosottfserrvee.tiiny.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 26 Jul 2024 22:35:34 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 0
content-length: 673
x-ms-lease-status: unlocked
last-modified: Wed, 12 Feb 2020 22:01:30 GMT
etag: 0x8D7B0071D86E386
x-azure-ref: 20240726T223534Z-17fd6bb7c969h8jkc4ufgkgg8400000002f000000000ak9h
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 74cf03e5-201e-0030-287c-dec48f000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 favicon_a_eupayfgghqiai7k9sol6lg2.ico
aadcdn.msauth.net/shared/1.0/content/images/ 17 KB
17 KB 51ms
51ms Other
image/x-icon 13.107.246.38
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.38 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

Request headers

Referer: https://login-onedrivernicrosottfserrvee.tiiny.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 26 Jul 2024 22:35:34 GMT
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 4554691
content-length: 17174
x-ms-lease-status: unlocked
last-modified: Sun, 18 Oct 2020 03:02:03 GMT
etag: 0x8D8731230C851A6
x-azure-ref: 20240726T223534Z-17fd6bb7c969h8jkc4ufgkgg8400000002f000000000ak9u
content-type: image/x-icon
access-control-allow-origin: *
x-ms-request-id: 1292a41a-601e-0017-13f7-dc1de2000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://login-onedrivernicrosottfserrvee.tiiny.site/?common=GEP8EOS5Y6R8LITX6DWW0KDPGM5L4&oauth2=C30CB5a187CB28764c01273Cb0cc6406b&authorize=241aA0c9a3679aa288B2140Cc2205a Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
aadcdn.msftauth.net
api.db-ip.com
cdnjs.cloudflare.com
daffy-first-fiber.glitch.me
login-onedrivernicrosottfserrvee.tiiny.site
104.17.25.14
104.26.4.15
13.107.246.38
152.195.19.97
52.71.121.197
99.84.108.109
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
1304c5090f063c677a5b3720fe7b97ef4d9ea102e2bdd837ce399df6057fe385
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1
60017dbc43727bb42b87b46eae00f25e49e031f28a65a28987a313bbed365cad
656fc307bee986f6e3bca509444421f6ef799cc932423a6311dd4993b68e416a
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13
a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
e9818a897a640a2ea403051f1c710d8db8d7e576d4d33d4575f2af066123d6cf

login-onedrivernicrosottfserrvee.tiiny.site Open in urlscan Pro 99.84.108.109 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

0 %IPv6

6 Domains

6 Subdomains

6 IPs

2 Countries

178 kBTransfer

333 kBSize

0 Cookies

2 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

22 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

login-onedrivernicrosottfserrvee.tiiny.site Open in urlscan Pro
99.84.108.109 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

178 kB
Transfer

333 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!