login.microsoftonline.com.office.o365test.anuk.myshn.net Open in urlscan Pro
64.94.98.143  Malicious Activity! Public Scan

URL: https://login.microsoftonline.com.office.o365test.anuk.myshn.net/common/oauth2/authorize?client_id=4345a7b9-9a63-4910-a426-35363201d503&response_mode=form_po...
Submission Tags: @ipnigh
Submission: On June 26 via api from GB

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 12 HTTP transactions. The main IP is 64.94.98.143, located in United States and belongs to SHNAC1 - Skyhigh Networks Inc, US. The main domain is login.microsoftonline.com.office.o365test.anuk.myshn.net.
TLS certificate: Issued by GlobalSign Organization Validation CA... on January 10th 2019. Valid for: a year.
This is the only time login.microsoftonline.com.office.o365test.anuk.myshn.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
2 64.94.98.143 14807 (SHNAC1)
8 152.199.23.37 15133 (EDGECAST)
12 3
Domain Requested by
8 aadcdn.msftauth.net login.microsoftonline.com.office.o365test.anuk.myshn.net
aadcdn.msftauth.net
2 login.microsoftonline.com.office.o365test.anuk.myshn.net aadcdn.msftauth.net
0 www.office.com.office.o365test.anuk.myshn.net Failed aadcdn.msftauth.net
0 login.live.com.office.o365test.anuk.myshn.net Failed aadcdn.msftauth.net
12 4
Subject Issuer Validity Valid
office.o365test.anuk.myshn.net
GlobalSign Organization Validation CA - SHA256 - G2
2019-01-10 -
2020-01-11
a year crt.sh
aadcdn.msftauth.net
Microsoft IT TLS CA 5
2018-11-07 -
2020-11-07
2 years crt.sh

This page contains 3 frames:

Primary Page: https://login.microsoftonline.com.office.o365test.anuk.myshn.net/common/oauth2/authorize?client_id=4345a7b9-9a63-4910-a426-35363201d503&response_mode=form_post&response_type=codeid_token&scope=openidprofile&state=OpenIdConnect.AuthenticationProperties=1nBuxJyjkk-TP2dUojh84OAW45Sd6g7m6V6oZ8IDjzKwgF1CrG9wlyd6oqHKf37CPaejOD9hpHTElBCfvZvqgTlY9mfUhXL_S7T6jLsAIK6tC09Gq-zZaylRHV1e2_LK&nonce=636968167130483044.N2IzN2U3ZGYtMWE4NC00ODI5LTg4YTktMmIzNzQ5ZWE1ZGQxZTQ1NWE2ZTctMDc2Ny00N2E1LWFmNjUtZDI5NDQwMGM3ODgw&redirect_uri=https://www.office.com.office.o365test.anuk.myshn.net/&ui_locales=en-US&mkt=en-US
Frame ID: 77A1414F0985536B693712E7DF126DEB
Requests: 10 HTTP requests in this frame

Frame: https://login.live.com.office.o365test.anuk.myshn.net/Me.htm?v=1
Frame ID: 4978F6EE637C1F9C73C9F55AE02D2C9F
Requests: 1 HTTP requests in this frame

Frame: https://www.office.com.office.o365test.anuk.myshn.net/prefetch/prefetch
Frame ID: 64ACBB68C75FE9C8EA6350CB12C4A66A
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

12
Requests

83 %
HTTPS

0 %
IPv6

2
Domains

4
Subdomains

3
IPs

1
Countries

469 kB
Transfer

999 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Cookie set authorize
login.microsoftonline.com.office.o365test.anuk.myshn.net/common/oauth2/
29 KB
13 KB
Document
General
Full URL
https://login.microsoftonline.com.office.o365test.anuk.myshn.net/common/oauth2/authorize?client_id=4345a7b9-9a63-4910-a426-35363201d503&response_mode=form_post&response_type=codeid_token&scope=openidprofile&state=OpenIdConnect.AuthenticationProperties=1nBuxJyjkk-TP2dUojh84OAW45Sd6g7m6V6oZ8IDjzKwgF1CrG9wlyd6oqHKf37CPaejOD9hpHTElBCfvZvqgTlY9mfUhXL_S7T6jLsAIK6tC09Gq-zZaylRHV1e2_LK&nonce=636968167130483044.N2IzN2U3ZGYtMWE4NC00ODI5LTg4YTktMmIzNzQ5ZWE1ZGQxZTQ1NWE2ZTctMDc2Ny00N2E1LWFmNjUtZDI5NDQwMGM3ODgw&redirect_uri=https://www.office.com.office.o365test.anuk.myshn.net/&ui_locales=en-US&mkt=en-US
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.94.98.143 , United States, ASN14807 (SHNAC1 - Skyhigh Networks Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
a00f18805ae2901a2d8c9313ec2e0a0dbf52ae0f3446f9ec04fe2d0ee01f467f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Host
login.microsoftonline.com.office.o365test.anuk.myshn.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server
nginx
Date
Wed, 26 Jun 2019 11:51:23 GMT
Content-Type
text/html; charset=utf-8
Content-Length
11604
Connection
keep-alive
Cache-Control
no-cache, no-store
Content-Encoding
gzip
Expires
-1
Link
<https://aadcdn.msftauth.net>; rel=preconnect; crossorigin <https://aadcdn.msftauth.net>; rel=dns-prefetch <https://aadcdn.msauth.net>; rel=dns-prefetch
P3P
CP="DSP CUR OTPi IND OTRi ONL FIN"
Pragma
no-cache
Set-Cookie
buid=AQABAAEAAADCoMpjJXrxTq9VG9te-7FXSxIzSJ_nkEns1jx7bKhTUgZzJvqxgis2uIhqbu2XfsU61KLW6oX7BrSzLclftnlrw-ceAc7srzlY98pDG8m6WZDTWr37HVYf2jrbUL81G7UgAA; Expires=Fri, 26-Jul-2019 11:51:23 GMT; Path=/; Secure; HTTPOnly fpc=Ak0T8Nfpb3FLkwBsJYd-6DdFBk5dAQAAADtTpdQOAAAA; Expires=Fri, 26-Jul-2019 11:51:23 GMT; Path=/; Secure; HTTPOnly esctx=AQABAAAAAADCoMpjJXrxTq9VG9te-7FXqxq2WMi-DXb1-lOEdUWhLOy6FogfUDFiMWFsd-KRDwWAsBPDAgKo2E2YkutEwS4kel2s6Hwo4kdPFpju9Kgp04EbSb_iDc7cw7aNe8srBBPqDpaMGHKVfu3zOjTvsT5eM3X2SW0H72R3sLBUGi3AMrKG1ds3ebcCbwy69nQBLQ8gAA; Path=/; Domain=.login.microsoftonline.com.office.o365test.anuk.myshn.net; Secure; HTTPOnly x-ms-gateway-slice=prod; Path=/; Secure; HTTPOnly stsservicecookie=ests; Path=/; Secure; HTTPOnly
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-DNS-Prefetch-Control
on
X-Frame-Options
DENY
x-ms-request-id
eb5ef268-4e24-492b-b130-b217602e1000
X-Robots-Tag
none
X-SkyHigh-Version
BuildNumber=23, BuildDate=2019-06-20 12:12
converged.v2.login.min_bxeixgi3llnj-nuc4-xqwa2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/
98 KB
19 KB
Stylesheet
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_bxeixgi3llnj-nuc4-xqwa2.css
Requested by
Host: login.microsoftonline.com.office.o365test.anuk.myshn.net
URL: https://login.microsoftonline.com.office.o365test.anuk.myshn.net/common/oauth2/authorize?client_id=4345a7b9-9a63-4910-a426-35363201d503&amp;response_mode=form_post&amp;response_type=codeid_token&amp;scope=openidprofile&amp;state=OpenIdConnect.AuthenticationProperties=1nBuxJyjkk-TP2dUojh84OAW45Sd6g7m6V6oZ8IDjzKwgF1CrG9wlyd6oqHKf37CPaejOD9hpHTElBCfvZvqgTlY9mfUhXL_S7T6jLsAIK6tC09Gq-zZaylRHV1e2_LK&amp;nonce=636968167130483044.N2IzN2U3ZGYtMWE4NC00ODI5LTg4YTktMmIzNzQ5ZWE1ZGQxZTQ1NWE2ZTctMDc2Ny00N2E1LWFmNjUtZDI5NDQwMGM3ODgw&amp;redirect_uri=https://www.office.com.office.o365test.anuk.myshn.net/&amp;ui_locales=en-US&amp;mkt=en-US
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8E91) /
Resource Hash
21cc48423ee47207382cc9c1c3885913079be17805e6ff81e76e0e7165ca32cd

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://login.microsoftonline.com.office.o365test.anuk.myshn.net/common/oauth2/authorize?client_id=4345a7b9-9a63-4910-a426-35363201d503&amp;response_mode=form_post&amp;response_type=codeid_token&amp;scope=openidprofile&amp;state=OpenIdConnect.AuthenticationProperties=1nBuxJyjkk-TP2dUojh84OAW45Sd6g7m6V6oZ8IDjzKwgF1CrG9wlyd6oqHKf37CPaejOD9hpHTElBCfvZvqgTlY9mfUhXL_S7T6jLsAIK6tC09Gq-zZaylRHV1e2_LK&amp;nonce=636968167130483044.N2IzN2U3ZGYtMWE4NC00ODI5LTg4YTktMmIzNzQ5ZWE1ZGQxZTQ1NWE2ZTctMDc2Ny00N2E1LWFmNjUtZDI5NDQwMGM3ODgw&amp;redirect_uri=https://www.office.com.office.o365test.anuk.myshn.net/&amp;ui_locales=en-US&amp;mkt=en-US
Origin
https://login.microsoftonline.com.office.o365test.anuk.myshn.net

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 26 Jun 2019 11:51:24 GMT
content-encoding
gzip
content-md5
/QTIvWAmch1jyMIGqgKwLw==
x-cache
HIT
status
200
content-length
18549
x-ms-lease-status
unlocked
last-modified
Sat, 18 May 2019 01:23:39 GMT
server
ECAcc (frc/8E91)
etag
0x8D6DB2F75734207
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
3792fdde-801e-006a-0a27-0f7634000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
ux.converged.login.pcore.min_4myuo72mlhdkjc9hn1du5g2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/
555 KB
144 KB
Script
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.pcore.min_4myuo72mlhdkjc9hn1du5g2.js
Requested by
Host: login.microsoftonline.com.office.o365test.anuk.myshn.net
URL: https://login.microsoftonline.com.office.o365test.anuk.myshn.net/common/oauth2/authorize?client_id=4345a7b9-9a63-4910-a426-35363201d503&amp;response_mode=form_post&amp;response_type=codeid_token&amp;scope=openidprofile&amp;state=OpenIdConnect.AuthenticationProperties=1nBuxJyjkk-TP2dUojh84OAW45Sd6g7m6V6oZ8IDjzKwgF1CrG9wlyd6oqHKf37CPaejOD9hpHTElBCfvZvqgTlY9mfUhXL_S7T6jLsAIK6tC09Gq-zZaylRHV1e2_LK&amp;nonce=636968167130483044.N2IzN2U3ZGYtMWE4NC00ODI5LTg4YTktMmIzNzQ5ZWE1ZGQxZTQ1NWE2ZTctMDc2Ny00N2E1LWFmNjUtZDI5NDQwMGM3ODgw&amp;redirect_uri=https://www.office.com.office.o365test.anuk.myshn.net/&amp;ui_locales=en-US&amp;mkt=en-US
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8E94) /
Resource Hash
d35725073bba404de01fb101757d1eae3a7f08346f44d56e671ae59930c046b6

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://login.microsoftonline.com.office.o365test.anuk.myshn.net/common/oauth2/authorize?client_id=4345a7b9-9a63-4910-a426-35363201d503&amp;response_mode=form_post&amp;response_type=codeid_token&amp;scope=openidprofile&amp;state=OpenIdConnect.AuthenticationProperties=1nBuxJyjkk-TP2dUojh84OAW45Sd6g7m6V6oZ8IDjzKwgF1CrG9wlyd6oqHKf37CPaejOD9hpHTElBCfvZvqgTlY9mfUhXL_S7T6jLsAIK6tC09Gq-zZaylRHV1e2_LK&amp;nonce=636968167130483044.N2IzN2U3ZGYtMWE4NC00ODI5LTg4YTktMmIzNzQ5ZWE1ZGQxZTQ1NWE2ZTctMDc2Ny00N2E1LWFmNjUtZDI5NDQwMGM3ODgw&amp;redirect_uri=https://www.office.com.office.o365test.anuk.myshn.net/&amp;ui_locales=en-US&amp;mkt=en-US
Origin
https://login.microsoftonline.com.office.o365test.anuk.myshn.net

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 26 Jun 2019 11:51:24 GMT
content-encoding
gzip
content-md5
pCZto1Uv5dyg9kd9tydtWA==
x-cache
HIT
status
200
content-length
146875
x-ms-lease-status
unlocked
last-modified
Fri, 31 May 2019 03:41:27 GMT
server
ECAcc (frc/8E94)
etag
0x8D6E579DCDC340B
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
f89d60ce-e01e-0039-031f-23c6de000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
ux.converged.login.strings-en.min_veg9zg4gq7m3vyno9nzqga2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/
31 KB
10 KB
Script
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_veg9zg4gq7m3vyno9nzqga2.js
Requested by
Host: login.microsoftonline.com.office.o365test.anuk.myshn.net
URL: https://login.microsoftonline.com.office.o365test.anuk.myshn.net/common/oauth2/authorize?client_id=4345a7b9-9a63-4910-a426-35363201d503&amp;response_mode=form_post&amp;response_type=codeid_token&amp;scope=openidprofile&amp;state=OpenIdConnect.AuthenticationProperties=1nBuxJyjkk-TP2dUojh84OAW45Sd6g7m6V6oZ8IDjzKwgF1CrG9wlyd6oqHKf37CPaejOD9hpHTElBCfvZvqgTlY9mfUhXL_S7T6jLsAIK6tC09Gq-zZaylRHV1e2_LK&amp;nonce=636968167130483044.N2IzN2U3ZGYtMWE4NC00ODI5LTg4YTktMmIzNzQ5ZWE1ZGQxZTQ1NWE2ZTctMDc2Ny00N2E1LWFmNjUtZDI5NDQwMGM3ODgw&amp;redirect_uri=https://www.office.com.office.o365test.anuk.myshn.net/&amp;ui_locales=en-US&amp;mkt=en-US
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F11) /
Resource Hash
018a144e28538b05538acee6936f56c65bf0dc35adabb29914e252506968f207

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://login.microsoftonline.com.office.o365test.anuk.myshn.net/common/oauth2/authorize?client_id=4345a7b9-9a63-4910-a426-35363201d503&amp;response_mode=form_post&amp;response_type=codeid_token&amp;scope=openidprofile&amp;state=OpenIdConnect.AuthenticationProperties=1nBuxJyjkk-TP2dUojh84OAW45Sd6g7m6V6oZ8IDjzKwgF1CrG9wlyd6oqHKf37CPaejOD9hpHTElBCfvZvqgTlY9mfUhXL_S7T6jLsAIK6tC09Gq-zZaylRHV1e2_LK&amp;nonce=636968167130483044.N2IzN2U3ZGYtMWE4NC00ODI5LTg4YTktMmIzNzQ5ZWE1ZGQxZTQ1NWE2ZTctMDc2Ny00N2E1LWFmNjUtZDI5NDQwMGM3ODgw&amp;redirect_uri=https://www.office.com.office.o365test.anuk.myshn.net/&amp;ui_locales=en-US&amp;mkt=en-US
Origin
https://login.microsoftonline.com.office.o365test.anuk.myshn.net

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 26 Jun 2019 11:51:24 GMT
content-encoding
gzip
content-md5
U1n25vMNIGp66ek1ktkRiQ==
x-cache
HIT
status
200
content-length
10161
x-ms-lease-status
unlocked
last-modified
Fri, 24 May 2019 04:18:28 GMT
server
ECAcc (frc/8F11)
etag
0x8D6DFFEDFCFDF3D
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
de873f4c-001e-002c-37cc-176c57000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
Me.htm
login.live.com.office.o365test.anuk.myshn.net/ Frame 4978
0
0

prefetch
www.office.com.office.o365test.anuk.myshn.net/prefetch/ Frame 64AC
0
0

microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msftauth.net/ests/2.1/content/images/
4 KB
2 KB
Image
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F3A) /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Referer
https://login.microsoftonline.com.office.o365test.anuk.myshn.net/common/oauth2/authorize?client_id=4345a7b9-9a63-4910-a426-35363201d503&amp;response_mode=form_post&amp;response_type=codeid_token&amp;scope=openidprofile&amp;state=OpenIdConnect.AuthenticationProperties=1nBuxJyjkk-TP2dUojh84OAW45Sd6g7m6V6oZ8IDjzKwgF1CrG9wlyd6oqHKf37CPaejOD9hpHTElBCfvZvqgTlY9mfUhXL_S7T6jLsAIK6tC09Gq-zZaylRHV1e2_LK&amp;nonce=636968167130483044.N2IzN2U3ZGYtMWE4NC00ODI5LTg4YTktMmIzNzQ5ZWE1ZGQxZTQ1NWE2ZTctMDc2Ny00N2E1LWFmNjUtZDI5NDQwMGM3ODgw&amp;redirect_uri=https://www.office.com.office.o365test.anuk.myshn.net/&amp;ui_locales=en-US&amp;mkt=en-US
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 26 Jun 2019 11:51:32 GMT
content-encoding
gzip
content-md5
nzaLxFgP7ZB3dfMcaybWzw==
x-cache
HIT
status
200
content-length
1435
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:22 GMT
server
ECAcc (frc/8F3A)
etag
0x8D64101507E84BD
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
8c820fa3-b01e-0031-31fa-28e1f1000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes
ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg
aadcdn.msftauth.net/ests/2.1/content/images/
915 B
407 B
Image
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F5C) /
Resource Hash
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea

Request headers

Referer
https://login.microsoftonline.com.office.o365test.anuk.myshn.net/common/oauth2/authorize?client_id=4345a7b9-9a63-4910-a426-35363201d503&amp;response_mode=form_post&amp;response_type=codeid_token&amp;scope=openidprofile&amp;state=OpenIdConnect.AuthenticationProperties=1nBuxJyjkk-TP2dUojh84OAW45Sd6g7m6V6oZ8IDjzKwgF1CrG9wlyd6oqHKf37CPaejOD9hpHTElBCfvZvqgTlY9mfUhXL_S7T6jLsAIK6tC09Gq-zZaylRHV1e2_LK&amp;nonce=636968167130483044.N2IzN2U3ZGYtMWE4NC00ODI5LTg4YTktMmIzNzQ5ZWE1ZGQxZTQ1NWE2ZTctMDc2Ny00N2E1LWFmNjUtZDI5NDQwMGM3ODgw&amp;redirect_uri=https://www.office.com.office.o365test.anuk.myshn.net/&amp;ui_locales=en-US&amp;mkt=en-US
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 26 Jun 2019 11:51:32 GMT
content-encoding
gzip
content-md5
HMwsHhNXdtrfirQDkzcqMA==
x-cache
HIT
status
200
content-length
263
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:15 GMT
server
ECAcc (frc/8F5C)
etag
0x8D641014CC1CD9F
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
3e015f81-601e-0091-11a0-2867e5000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes
ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg
aadcdn.msftauth.net/ests/2.1/content/images/
915 B
405 B
Image
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F60) /
Resource Hash
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6

Request headers

Referer
https://login.microsoftonline.com.office.o365test.anuk.myshn.net/common/oauth2/authorize?client_id=4345a7b9-9a63-4910-a426-35363201d503&amp;response_mode=form_post&amp;response_type=codeid_token&amp;scope=openidprofile&amp;state=OpenIdConnect.AuthenticationProperties=1nBuxJyjkk-TP2dUojh84OAW45Sd6g7m6V6oZ8IDjzKwgF1CrG9wlyd6oqHKf37CPaejOD9hpHTElBCfvZvqgTlY9mfUhXL_S7T6jLsAIK6tC09Gq-zZaylRHV1e2_LK&amp;nonce=636968167130483044.N2IzN2U3ZGYtMWE4NC00ODI5LTg4YTktMmIzNzQ5ZWE1ZGQxZTQ1NWE2ZTctMDc2Ny00N2E1LWFmNjUtZDI5NDQwMGM3ODgw&amp;redirect_uri=https://www.office.com.office.o365test.anuk.myshn.net/&amp;ui_locales=en-US&amp;mkt=en-US
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 26 Jun 2019 11:51:32 GMT
content-encoding
gzip
content-md5
/a3y/mpA+HRaVAiPACrsog==
x-cache
HIT
status
200
content-length
263
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:14 GMT
server
ECAcc (frc/8F60)
etag
0x8D641014C1EFD89
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
0909968e-c01e-002b-6d52-28749b000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes
0-small_138bcee624fa04ef9b75e86211a9fe0d.jpg
aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/
3 KB
3 KB
Image
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/0-small_138bcee624fa04ef9b75e86211a9fe0d.jpg
Requested by
Host: aadcdn.msftauth.net
URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.pcore.min_4myuo72mlhdkjc9hn1du5g2.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8EA0) /
Resource Hash
f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea

Request headers

Referer
https://login.microsoftonline.com.office.o365test.anuk.myshn.net/common/oauth2/authorize?client_id=4345a7b9-9a63-4910-a426-35363201d503&amp;response_mode=form_post&amp;response_type=codeid_token&amp;scope=openidprofile&amp;state=OpenIdConnect.AuthenticationProperties=1nBuxJyjkk-TP2dUojh84OAW45Sd6g7m6V6oZ8IDjzKwgF1CrG9wlyd6oqHKf37CPaejOD9hpHTElBCfvZvqgTlY9mfUhXL_S7T6jLsAIK6tC09Gq-zZaylRHV1e2_LK&amp;nonce=636968167130483044.N2IzN2U3ZGYtMWE4NC00ODI5LTg4YTktMmIzNzQ5ZWE1ZGQxZTQ1NWE2ZTctMDc2Ny00N2E1LWFmNjUtZDI5NDQwMGM3ODgw&amp;redirect_uri=https://www.office.com.office.o365test.anuk.myshn.net/&amp;ui_locales=en-US&amp;mkt=en-US
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 26 Jun 2019 11:50:59 GMT
content-md5
E4vO5iT6BO+bdehiEan+DQ==
x-cache
HIT
status
200
content-length
3006
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:26:15 GMT
server
ECAcc (frc/8EA0)
etag
0x8D64101700C3AB4
content-type
image/jpeg
access-control-allow-origin
*
x-ms-request-id
61b555d0-501e-0005-1b53-28cb24000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes
0_a5dbd4393ff6a725c7e62b61df7e72f0.jpg
aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/
277 KB
277 KB
Image
General
Full URL
https://aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/0_a5dbd4393ff6a725c7e62b61df7e72f0.jpg
Requested by
Host: aadcdn.msftauth.net
URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.pcore.min_4myuo72mlhdkjc9hn1du5g2.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.37 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F10) /
Resource Hash
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb

Request headers

Referer
https://login.microsoftonline.com.office.o365test.anuk.myshn.net/common/oauth2/authorize?client_id=4345a7b9-9a63-4910-a426-35363201d503&amp;response_mode=form_post&amp;response_type=codeid_token&amp;scope=openidprofile&amp;state=OpenIdConnect.AuthenticationProperties=1nBuxJyjkk-TP2dUojh84OAW45Sd6g7m6V6oZ8IDjzKwgF1CrG9wlyd6oqHKf37CPaejOD9hpHTElBCfvZvqgTlY9mfUhXL_S7T6jLsAIK6tC09Gq-zZaylRHV1e2_LK&amp;nonce=636968167130483044.N2IzN2U3ZGYtMWE4NC00ODI5LTg4YTktMmIzNzQ5ZWE1ZGQxZTQ1NWE2ZTctMDc2Ny00N2E1LWFmNjUtZDI5NDQwMGM3ODgw&amp;redirect_uri=https://www.office.com.office.o365test.anuk.myshn.net/&amp;ui_locales=en-US&amp;mkt=en-US
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 26 Jun 2019 11:51:32 GMT
content-md5
pdvUOT/2pyXH5ith335y8A==
x-cache
HIT
status
200
content-length
283351
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:26:15 GMT
server
ECAcc (frc/8F10)
etag
0x8D64101702F5B97
content-type
image/jpeg
access-control-allow-origin
*
x-ms-request-id
9bf940dd-901e-0066-6f32-29bab7000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes
reportpageload
login.microsoftonline.com.office.o365test.anuk.myshn.net/common/instrumentation/
444 B
2 KB
XHR
General
Full URL
https://login.microsoftonline.com.office.o365test.anuk.myshn.net/common/instrumentation/reportpageload?mkt=en-US
Requested by
Host: aadcdn.msftauth.net
URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.pcore.min_4myuo72mlhdkjc9hn1du5g2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.94.98.143 , United States, ASN14807 (SHNAC1 - Skyhigh Networks Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
4b278ba9878c26410d429374ce40062f6d76ae349a15484c0b70988b98259b74
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

hpgrequestid
eb5ef268-4e24-492b-b130-b217602e1000
Origin
https://login.microsoftonline.com.office.o365test.anuk.myshn.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
client-request-id
607df1c2-e04d-40e3-81d9-ced08756cba9
canary
AQABAAAAAADCoMpjJXrxTq9VG9te-7FXetfoL8Wr-6X0mvv46Paf_H4HH53kjTR8HUpLm97HEVVS2jkzdue97F9uFC1UeQgrzmrhHXMQ4RQOEBI686Qv5MpC0l5l4-0InkdQ5ZuAYt-lb1AN_oV7-IBOMhB0GwwFLkC45jnckbBXagpYGYDcnhhkHfYGSmMd4q66Pi3tgc1pbvjXyvfI2y1WM4ITZP9ljocK58EA0_lTWqgn7-XBgCAA
Content-type
application/json; charset=UTF-8
hpgid
1104
Accept
application/json
Referer
https://login.microsoftonline.com.office.o365test.anuk.myshn.net/common/oauth2/authorize?client_id=4345a7b9-9a63-4910-a426-35363201d503&amp;response_mode=form_post&amp;response_type=codeid_token&amp;scope=openidprofile&amp;state=OpenIdConnect.AuthenticationProperties=1nBuxJyjkk-TP2dUojh84OAW45Sd6g7m6V6oZ8IDjzKwgF1CrG9wlyd6oqHKf37CPaejOD9hpHTElBCfvZvqgTlY9mfUhXL_S7T6jLsAIK6tC09Gq-zZaylRHV1e2_LK&amp;nonce=636968167130483044.N2IzN2U3ZGYtMWE4NC00ODI5LTg4YTktMmIzNzQ5ZWE1ZGQxZTQ1NWE2ZTctMDc2Ny00N2E1LWFmNjUtZDI5NDQwMGM3ODgw&amp;redirect_uri=https://www.office.com.office.o365test.anuk.myshn.net/&amp;ui_locales=en-US&amp;mkt=en-US
hpgact
1800

Response headers

Date
Wed, 26 Jun 2019 11:51:25 GMT
X-Content-Type-Options
nosniff
client-request-id
607df1c2-e04d-40e3-81d9-ced08756cba9
P3P
CP="DSP CUR OTPi IND OTRi ONL FIN"
Connection
keep-alive
Content-Length
444
Pragma
no-cache
Server
nginx
Strict-Transport-Security
max-age=31536000; includeSubDomains
Access-Control-Allow-Methods
POST, OPTIONS
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://autologon.microsoftazuread-sso.com/
x-ms-request-id
9c5f86b2-ffee-461d-84fc-3d2503b81000
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
X-SkyHigh-Version
BuildNumber=23, BuildDate=2019-06-20 12:12
X-Robots-Tag
none
Expires
-1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
login.live.com.office.o365test.anuk.myshn.net
URL
https://login.live.com.office.o365test.anuk.myshn.net/Me.htm?v=1
Domain
www.office.com.office.o365test.anuk.myshn.net
URL
https://www.office.com.office.o365test.anuk.myshn.net/prefetch/prefetch

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B object| ServerData function| webpackJsonp object| ko object| PROOF object| StringRepository boolean| __ConvergedLogin_PCore boolean| __

1 Cookies

Domain/Path Name / Value
login.microsoftonline.com.office.o365test.anuk.myshn.net/common/oauth2 Name: CkTst
Value: G1561549884957

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY