login-microsoftonline.onlinemailservices.email
Open in
urlscan Pro
185.189.149.142
Malicious Activity!
Public Scan
Effective URL: https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3...
Submission: On May 27 via manual from AT — Scanned from DE
Summary
TLS certificate: Issued by R3 on May 27th 2022. Valid for: 3 months.
This is the only time login-microsoftonline.onlinemailservices.email was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 20 | 185.189.149.142 185.189.149.142 | 51395 (AS-SOFTPLUS) (AS-SOFTPLUS) | |
18 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
20 |
onlinemailservices.email
3 redirects
login-microsoftonline.onlinemailservices.email www-office.onlinemailservices.email login-live.onlinemailservices.email aadcdn-msftauth-7e6ac4aa.onlinemailservices.email |
392 KB |
18 | 1 |
Domain | Requested by | |
---|---|---|
11 | aadcdn-msftauth-7e6ac4aa.onlinemailservices.email |
login-microsoftonline.onlinemailservices.email
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email |
6 | login-microsoftonline.onlinemailservices.email |
2 redirects
login-microsoftonline.onlinemailservices.email
|
2 | login-live.onlinemailservices.email |
login-microsoftonline.onlinemailservices.email
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email |
1 | www-office.onlinemailservices.email | 1 redirects |
18 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
login-live.onlinemailservices.email |
www-microsoft.onlinemailservices.email |
privacy-microsoft-7e6ac4aa.onlinemailservices.email |
Subject Issuer | Validity | Valid | |
---|---|---|---|
onlinemailservices.email R3 |
2022-05-27 - 2022-08-25 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww-office.onlinemailservices.email%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww-office.onlinemailservices.email%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637892884903445095.ZTk5OGQ3NmUtMjMyYy00YmQ3LTk2NGMtZmMwYjBlYWRlNjU1YTE0OTUyOWEtYjlmZC00NTg0LWJlZmItN2Q4YjlhODM0YmQ3&ui_locales=de-DE&mkt=de-DE&state=s3Pk1rT07VC1kotUWfqXmYp6FAo9p967eKcG7smumEdWLek4YfHPbSD-LXtncYVEcYjVngrGxSiN5FBMaIg3NWuKZuy87J8NBO7qZ6W-pxzy5cYVzHf_Bj72jh8Boao3ZvJe9EZRE8r09-wh07p40lNCvC2Ejs8v20llvA7B1sXuVjfIphJrY8a9KygzASbRUWjD_lytp4IVoGULVInIvFodNtG2y_vlXtEnrhOboeXSKzKSb5Px2s7RYxmolnI3ar-Jz310gB7JF5kMm-okiQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true
Frame ID: E25DD2DB1F551530F8FDDEF9D3BAF37D
Requests: 16 HTTP requests in this frame
Frame:
https://login-live.onlinemailservices.email/Me.htm?v=3
Frame ID: 49D58F9A2E2DDE77B30A9D50B86456B0
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Bei Ihrem Konto anmeldenPage URL History Show full URLs
-
http://login-microsoftonline.onlinemailservices.email/
HTTP 301
https://login-microsoftonline.onlinemailservices.email/ Page URL
-
https://login-microsoftonline.onlinemailservices.email/
HTTP 302
https://www-office.onlinemailservices.email/login HTTP 302
https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&... Page URL
- https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&... Page URL
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: Erstellen Sie jetzt eins!
Search URL Search Domain Scan URL
Title: Nutzungsbedingungen
Search URL Search Domain Scan URL
Title: Datenschutz & Cookies
Search URL Search Domain Scan URL
Title: Haftungsausschluss
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://login-microsoftonline.onlinemailservices.email/
HTTP 301
https://login-microsoftonline.onlinemailservices.email/ Page URL
-
https://login-microsoftonline.onlinemailservices.email/
HTTP 302
https://www-office.onlinemailservices.email/login HTTP 302
https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww-office.onlinemailservices.email%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww-office.onlinemailservices.email%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637892884903445095.ZTk5OGQ3NmUtMjMyYy00YmQ3LTk2NGMtZmMwYjBlYWRlNjU1YTE0OTUyOWEtYjlmZC00NTg0LWJlZmItN2Q4YjlhODM0YmQ3&ui_locales=de-DE&mkt=de-DE&state=s3Pk1rT07VC1kotUWfqXmYp6FAo9p967eKcG7smumEdWLek4YfHPbSD-LXtncYVEcYjVngrGxSiN5FBMaIg3NWuKZuy87J8NBO7qZ6W-pxzy5cYVzHf_Bj72jh8Boao3ZvJe9EZRE8r09-wh07p40lNCvC2Ejs8v20llvA7B1sXuVjfIphJrY8a9KygzASbRUWjD_lytp4IVoGULVInIvFodNtG2y_vlXtEnrhOboeXSKzKSb5Px2s7RYxmolnI3ar-Jz310gB7JF5kMm-okiQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0 Page URL
- https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww-office.onlinemailservices.email%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww-office.onlinemailservices.email%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637892884903445095.ZTk5OGQ3NmUtMjMyYy00YmQ3LTk2NGMtZmMwYjBlYWRlNjU1YTE0OTUyOWEtYjlmZC00NTg0LWJlZmItN2Q4YjlhODM0YmQ3&ui_locales=de-DE&mkt=de-DE&state=s3Pk1rT07VC1kotUWfqXmYp6FAo9p967eKcG7smumEdWLek4YfHPbSD-LXtncYVEcYjVngrGxSiN5FBMaIg3NWuKZuy87J8NBO7qZ6W-pxzy5cYVzHf_Bj72jh8Boao3ZvJe9EZRE8r09-wh07p40lNCvC2Ejs8v20llvA7B1sXuVjfIphJrY8a9KygzASbRUWjD_lytp4IVoGULVInIvFodNtG2y_vlXtEnrhOboeXSKzKSb5Px2s7RYxmolnI3ar-Jz310gB7JF5kMm-okiQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://login-microsoftonline.onlinemailservices.email/ HTTP 301
- https://login-microsoftonline.onlinemailservices.email/
- https://login-microsoftonline.onlinemailservices.email/ HTTP 302
- https://www-office.onlinemailservices.email/login HTTP 302
- https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww-office.onlinemailservices.email%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww-office.onlinemailservices.email%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637892884903445095.ZTk5OGQ3NmUtMjMyYy00YmQ3LTk2NGMtZmMwYjBlYWRlNjU1YTE0OTUyOWEtYjlmZC00NTg0LWJlZmItN2Q4YjlhODM0YmQ3&ui_locales=de-DE&mkt=de-DE&state=s3Pk1rT07VC1kotUWfqXmYp6FAo9p967eKcG7smumEdWLek4YfHPbSD-LXtncYVEcYjVngrGxSiN5FBMaIg3NWuKZuy87J8NBO7qZ6W-pxzy5cYVzHf_Bj72jh8Boao3ZvJe9EZRE8r09-wh07p40lNCvC2Ejs8v20llvA7B1sXuVjfIphJrY8a9KygzASbRUWjD_lytp4IVoGULVInIvFodNtG2y_vlXtEnrhOboeXSKzKSb5Px2s7RYxmolnI3ar-Jz310gB7JF5kMm-okiQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
login-microsoftonline.onlinemailservices.email/ Redirect Chain
|
72 KB 25 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
authorize
login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/ Redirect Chain
|
291 KB 85 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
reportbssotelemetry
login-microsoftonline.onlinemailservices.email/common/instrumentation/ |
264 B 846 B |
Ping
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
authorize
login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/ |
344 KB 82 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Me.htm
login-live.onlinemailservices.email/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ConvergedLogin_PCore_Ab4Yaj5a0D_cjcCwxd3oDw2.js
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/js/ |
379 KB 108 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
converged.v2.login.min_ziytf8dzt9eg1s6-ohhleg2.css
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/ests/2.1/content/cdnbundles/ |
0 20 KB |
Other
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ux.converged.login.strings-de.min_dleyhmk9dgvufebxr4oyiq2.js
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/ests/2.1/content/cdnbundles/ |
0 15 KB |
Other
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
convergedlogin_pfetchsessionsprogress_5ae001837875e6d5d706.js
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/js/asyncchunk/ |
15 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
marching_ants_white_166de53471265253ab3a456defe6da23.gif
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/images/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/images/ |
4 KB 4 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
convergedlogin_pcustomizationloader_1adab4c9a8227bd729f8.js
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/js/asyncchunk/ |
107 KB 32 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2_bc3d32a696895f78c19df6c717586a5d.svg
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/images/backgrounds/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/images/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
marching_ants_white_166de53471265253ab3a456defe6da23.gif
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/images/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Me.htm
login-live.onlinemailservices.email/ Frame 49D5 |
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
signin-options_4e48046ce74f4b89d45037c90576bfac.svg
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/images/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)29 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B object| ServerData object| webpackJsonp object| ko object| PROOF object| StringRepository boolean| __ConvergedLogin_PCore boolean| __ function| setImmediate function| clearImmediate object| Telemetry object| telemetry_webpackJsonp boolean| __convergedlogin_pfetchsessionsprogress_5ae001837875e6d5d706 boolean| __convergedlogin_pcustomizationloader_1adab4c9a8227bd729f89 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.onlinemailservices.email/ | Name: __kvjC Value: N2U2YWM0YWEtOTk1OS00MjJhLWE2YjYtMTJkZWQyYTA4MGQwOmYxMjhiNzA3LTQzM2EtNGJhOC1iY2Q4LTY2MGIwZDU5NmYxNg== |
|
.onlinemailservices.email/ | Name: MUID Value: 2C3726E68B9166E7205B37578A48670A |
|
www-office.onlinemailservices.email/ | Name: .AspNetCore.Correlation.OpenIdConnectV2.5i46rkuZPgu5Q_un3Y3zp-kYPjh2ZQ7RIXf7QGSxB68 Value: N |
|
www-office.onlinemailservices.email/ | Name: .AspNetCore.OpenIdConnect.Nonce.d0a2dJey905aJqEzeqJaUT9z7P701IaKLXERFQwWiJt7LHF2wxLMGaviv-ZCWNg-ud7NpSWoPg_-937dIBE8g6GIgzHBguLFkGikz22yAtTt-7qZ9wuAu472AYuNhpLFPI_CHEKaPTEQmOMPywCD8zIoja0nOWD0kl3466F6lCke5rJCoYwWg5qwtHUPLnkCExDgx-InA5v0inxrYysjZN_Tzoytri5ij_a2dub_hkaCkcAm1tNEVpY_iNn9daI8 Value: N |
|
www-office.onlinemailservices.email/ | Name: OH.DCAffinity Value: OH-weu |
|
www-office.onlinemailservices.email/ | Name: OH.FLID Value: b1c7da3d-6f0c-428d-a0ac-7ffee231f3b3 |
|
.login-microsoftonline.onlinemailservices.email/ | Name: AADSSO Value: NA|NoExtension |
|
login-microsoftonline.onlinemailservices.email/ | Name: SSOCOOKIEPULLED Value: 1 |
|
.login-microsoftonline.onlinemailservices.email/ | Name: brcap Value: 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email
login-live.onlinemailservices.email
login-microsoftonline.onlinemailservices.email
www-office.onlinemailservices.email
185.189.149.142
037758b0f935c8e9062b3c5a6e9ce51ed2b84e366585aa77a3641fb6597a222e
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
2c0cd347e7ec499e9274b56efcdca69dc07b64e53722c789bab97da89667ea1f
42f05dd3cc62b4e335cf734e9a067a005f7998306230aab2d763dd4ecceac164
5cfde8e8595058b7a784030000ee5b3b1aa8f5a34156838ddda37ff96e5b0ce0
6a685f793c0105f2cd8981c13892f97ec6209a648deede365d8d6282859b9b34
8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
9540587fbcbd439db6603b2b014f4ff8584040af358b77994bbd83ec522537db
a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13
e22acba126f852f2106d6c9dd32b96e4a95f5f50b769b63a2ef94c327427a48e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855