login-appoitmentoulook.redirectpages-app.com Open in urlscan Pro
107.180.115.183 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://login-appoitmentoulook.redirectpages-app.com/
Submission: On July 19 via api (July 19th 2024, 3:05:38 am UTC) from US — Scanned from GB

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 11 HTTP transactions. The main IP is 107.180.115.183, located in Ashburn, United States and belongs to GO-DADDY-COM-LLC, US. The main domain is login-appoitmentoulook.redirectpages-app.com.
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on July 18th 2024. Valid for: 3 months.

This is the only time login-appoitmentoulook.redirectpages-app.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

	IP Address	AS Autonomous System
3	107.180.115.183 107.180.115.183	398101 (GO-DADDY-...) (GO-DADDY-COM-LLC)
1 2	95.100.135.112 95.100.135.112	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a02:26f0:ab0... 2a02:26f0:ab00::214:8f39	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2a02:26f0:ab0... 2a02:26f0:ab00:48e::228b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
11	5

3 107.180.115.183 (Ashburn, United States)

ASN398101 (GO-DADDY-COM-LLC, US)
PTR: 183.115.180.107.host.secureserver.net

login-appoitmentoulook.redirectpages-app.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 95.100.135.112 (Frankfurt am Main, Germany) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)
PTR: a95-100-135-112.deploy.static.akamaitechnologies.com

img1.wsimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:ab00::214:8f39 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

events.api.secureserver.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:ab00:48e::228b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

csp.secureserver.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	secureserver.net events.api.secureserver.net — Cisco Umbrella Rank: 20700 csp.secureserver.net — Cisco Umbrella Rank: 20670	604 B
3	redirectpages-app.com login-appoitmentoulook.redirectpages-app.com	15 KB
2	wsimg.com 1 redirects img1.wsimg.com — Cisco Umbrella Rank: 15358	21 KB
0	state.ma.us Failed email.state.ma.us Failed
11	4

	Domain	Requested by
4	csp.secureserver.net	img1.wsimg.com
3	login-appoitmentoulook.redirectpages-app.com	login-appoitmentoulook.redirectpages-app.com
2	events.api.secureserver.net	img1.wsimg.com
2	img1.wsimg.com	1 redirects login-appoitmentoulook.redirectpages-app.com
0	email.state.ma.us Failed
11	5

This site contains no links.

Subject Issuer	Validity	Valid
login-appoitmentoulook.redirectpages-app.com ZeroSSL RSA Domain Secure Site CA	`2024-07-18` - `2024-10-16`	3 months	crt.sh
*.api.secureserver.net Starfield Secure Certificate Authority - G2	`2024-07-15` - `2025-08-16`	a year	crt.sh
*.secureserver.net Starfield Secure Certificate Authority - G2	`2023-10-10` - `2024-11-10`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://login-appoitmentoulook.redirectpages-app.com/
Frame ID: 20B7C42C9EBCFAE727A87BECB223BDD1
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Outlook Web App

Page Statistics

11
Requests

82 %
HTTPS

50 %
IPv6

4
Domains

5
Subdomains

5
IPs

2
Countries

36 kB
Transfer

152 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://img1.wsimg.com/traffic-assets/js/tccl.min.js HTTP 301
https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js

11 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
login-appoitmentoulook.redirectpages-app.com/ 24 KB
13 KB 1067ms
303ms Document
text/html 107.180.115.183
GO-DADDY-COM-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://login-appoitmentoulook.redirectpages-app.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.180.115.183 Ashburn, United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS: 183.115.180.107.host.secureserver.net
Software: Apache / PHP/8.2.20
Resource Hash: 294fa524690080588e6ee5caf34c3e6f65d66f14694e7a60aef3d6b8231f34a3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-length: 12756
content-type: text/html; charset=UTF-8
date: Fri, 19 Jul 2024 03:05:30 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.2.20

GET
H2 200 main.css
login-appoitmentoulook.redirectpages-app.com/ 11 KB
2 KB 216ms
215ms Stylesheet
text/css 107.180.115.183
GO-DADDY-COM-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://login-appoitmentoulook.redirectpages-app.com/main.css
Requested by: Host: login-appoitmentoulook.redirectpages-app.com
URL: https://login-appoitmentoulook.redirectpages-app.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.180.115.183 Ashburn, United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS: 183.115.180.107.host.secureserver.net
Software: Apache /
Resource Hash: ad48b2947dfc14547d41db87252d893b92417680f60dae7eceefc7fa1f69fb16

Request headers

Referer: https://login-appoitmentoulook.redirectpages-app.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Fri, 19 Jul 2024 03:05:30 GMT
content-encoding: br
last-modified: Sat, 24 Apr 2021 04:04:16 GMT
server: Apache
etag: "7c01512-2a81-5c0b00187b000-br"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 2185

GET
H2

200

scc-c2.min.js Show response
img1.wsimg.com/signals/js/clients/scc-c2/
Redirect Chain

https://img1.wsimg.com/traffic-assets/js/tccl.min.js
https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js

105 KB
21 KB

95ms
95ms

Script
text/javascript

95.100.135.112
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js
Requested by: Host: login-appoitmentoulook.redirectpages-app.com
URL: https://login-appoitmentoulook.redirectpages-app.com/
Protocol: H2
Server: 95.100.135.112 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a95-100-135-112.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 8f7092c94ef904c57584706cdb5f1fd9fe1efce52ce3105e99b9a7def487f09f

Request headers

Referer: https://login-appoitmentoulook.redirectpages-app.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-amz-version-id: VDVeY4oO8ClQrknn.k4OgPWK0heF1LAr
content-encoding: gzip
date: Fri, 19 Jul 2024 03:05:31 GMT
x-amz-request-id: EG7SRCGQMKHN0Y15
x-amz-server-side-encryption: AES256
x-amz-meta-version: 0.4.0
content-length: 20848
x-amz-id-2: qbL2XflhAIrcjDKgIWVGGm8coZ3qKl3kBB+8oMyFUXRvo9Thm1AjqYWhzyv4M+KQeN3JIADYzYQ=
last-modified: Fri, 17 May 2024 22:31:26 GMT
etag: "ace51bdb3b35a6b66c74fa115d4caa3f"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=1800
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 19 Jul 2024 03:35:31 GMT

Redirect headers

location: https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js
access-control-allow-origin: *
date: Fri, 19 Jul 2024 03:05:31 GMT
cache-control: max-age=31536000
timing-allow-origin: *
content-length: 0
expires: Sat, 19 Jul 2025 03:05:31 GMT

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 6 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 404 segoeui-regular.ttf
login-appoitmentoulook.redirectpages-app.com/owa/auth/15.0.1497/themes/resources/ 0
0 177ms
173ms Font
text/html 107.180.115.183
GO-DADDY-COM-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://login-appoitmentoulook.redirectpages-app.com/owa/auth/15.0.1497/themes/resources/segoeui-regular.ttf
Requested by: Host: login-appoitmentoulook.redirectpages-app.com
URL: https://login-appoitmentoulook.redirectpages-app.com/main.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.180.115.183 Ashburn, United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS: 183.115.180.107.host.secureserver.net
Software: Apache /
Resource Hash

Request headers

Referer: https://login-appoitmentoulook.redirectpages-app.com/main.css
Origin: https://login-appoitmentoulook.redirectpages-app.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Fri, 19 Jul 2024 03:05:31 GMT
content-encoding: br
server: Apache
accept-ranges: bytes
content-length: 703
vary: Accept-Encoding
content-type: text/html

GET
H2 200 event Show response
events.api.secureserver.net/t/1/tl/ 43 B
302 B 1087ms
600ms Fetch
image/gif 2a02:26f0:ab00::214:8f39
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:ab00::214:8f39 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://login-appoitmentoulook.redirectpages-app.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
date: Fri, 19 Jul 2024 03:05:32 GMT
x-content-type-options: nosniff
x-frame-options: DENY
content-type: image/gif
access-control-allow-origin: https://login-appoitmentoulook.redirectpages-app.com
cache-control: private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
content-length: 43
x-xss-protection: 1; mode=block

GET
H2 200 event Show response
events.api.secureserver.net/t/1/tl/ 43 B
302 B 899ms
414ms Fetch
image/gif 2a02:26f0:ab00::214:8f39
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://events.api.secureserver.net/t/1/tl/event?dh=login-appoitmentoulook.redirectpages-app.com&dr=&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F126.0.0.0%20Safari%2F537.36&client_name=scc-c2&cv=0.4.0&vg=e62b3909-60d8-4c92-81a8-89abbe62c4d6&vtg=e62b3909-60d8-4c92-81a8-89abbe62c4d6&dp=%2F&trace_id=75911cded8784816a3b449bf0c72f3ae&cts=2024-07-19T03%3A05%3A31.334Z&hit_id=e3454c58-4a95-4373-807e-411bd62638a7&ea=pageperf&ht=perf&eid=traffic.tcc.instrumentation.navigation.timing&trfd=%7B%22ap%22%3A%22cpsh-oh%22%2C%22server%22%3A%22p3plzcpnl505915%22%2C%22dcenter%22%3A%22p3%22%2C%22cp_id%22%3A%229989968%22%2C%22cp_cl%22%3A%228%22%7D&ap=cpsh-oh&vci=1276168441&z=129962572&tce=1721358330546&tcs=1721358329794&tdc=1721358331325&tdclee=1721358331316&tdcles=1721358331316&tdi=1721358331316&tdl=1721358330857&tdle=1721358329794&tdls=1721358329794&tfs=1721358329781&tns=1721358329780&trqs=1721358330546&tre=1721358330851&trps=1721358330848&tles=1721358331325&tlee=0&nt=navigate&nav_type=hard

Requested by

Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:ab00::214:8f39 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://login-appoitmentoulook.redirectpages-app.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
date: Fri, 19 Jul 2024 03:05:32 GMT
x-content-type-options: nosniff
x-frame-options: DENY
content-type: image/gif
access-control-allow-origin: https://login-appoitmentoulook.redirectpages-app.com
cache-control: private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
content-length: 43
x-xss-protection: 1; mode=block

GET favicon.ico
email.state.ma.us/owa/auth/15.0.1497/themes/resources/ 0
0

POST
H/1.1 202
Accepted eventbus
csp.secureserver.net/ 0
0 460ms
458ms Fetch
application/json 2a02:26f0:ab00:48e::228b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://csp.secureserver.net/eventbus

Requested by

Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:ab00:48e::228b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains ; preload

Request headers

Referer: https://login-appoitmentoulook.redirectpages-app.com/
Authorization: api-key b18ef4f046435b64a469b32c3c1c20a3
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

Pragma: no-cache
Date: Fri, 19 Jul 2024 03:05:32 GMT
Strict-Transport-Security: max-age=86400 ; includeSubDomains ; preload
x-amzn-trace-id: Root=1-6699d7fc-0423422c6b8021665beab3d5
x-amzn-requestid: 036dad2b-2404-438b-9319-a7ae41836e70
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
x-envoy-upstream-service-time: 103
Connection: keep-alive
x-amz-apigw-id: bI6vbGtUIAMErrQ=
Content-Length: 0
Expires: Fri, 19 Jul 2024 03:05:32 GMT

POST
H/1.1 202
Accepted eventbus
csp.secureserver.net/ 0
0 243ms
242ms Fetch
application/json 2a02:26f0:ab00:48e::228b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://csp.secureserver.net/eventbus

Requested by

Host: img1.wsimg.com
URL: https://img1.wsimg.com/traffic-assets/js/tccl.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:ab00:48e::228b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains ; preload

Request headers

Referer: https://login-appoitmentoulook.redirectpages-app.com/
Authorization: api-key 8da2217409854bee82e12dc4ca0b39fb
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

Pragma: no-cache
Date: Fri, 19 Jul 2024 03:05:32 GMT
Strict-Transport-Security: max-age=86400 ; includeSubDomains ; preload
x-amzn-trace-id: Root=1-6699d7fc-24c067344e27588032c142be
x-amzn-requestid: e26dc328-d699-47a0-beac-5b22edcfcbd1
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
x-envoy-upstream-service-time: 111
Connection: keep-alive
x-amz-apigw-id: bI6vbF26oAMEFgQ=
Content-Length: 0
Expires: Fri, 19 Jul 2024 03:05:32 GMT

OPTIONS
H/1.1 200
OK eventbus
csp.secureserver.net/ 0
0 395ms
154ms Preflight
application/json 2a02:26f0:ab00:48e::228b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://csp.secureserver.net/eventbus

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:ab00:48e::228b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains ; preload

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://login-appoitmentoulook.redirectpages-app.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Headers: content-type,authorization
Access-Control-Allow-Methods: OPTIONS,POST
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 0
Content-Type: application/json
Date: Fri, 19 Jul 2024 03:05:31 GMT
Expires: Fri, 19 Jul 2024 03:05:31 GMT
Pragma: no-cache
Strict-Transport-Security: max-age=86400 ; includeSubDomains ; preload
x-amz-apigw-id: bI6vaHjXIAMEV3A=
x-amzn-requestid: 00e596f2-378f-448b-880a-e631f417775e
x-amzn-trace-id: Root=1-6699d7fb-2d6e6fd5750c1a8746a4dcea
x-envoy-upstream-service-time: 6

OPTIONS
H/1.1 200
OK eventbus
csp.secureserver.net/ 0
0 393ms
153ms Preflight
application/json 2a02:26f0:ab00:48e::228b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://csp.secureserver.net/eventbus

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:ab00:48e::228b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains ; preload

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://login-appoitmentoulook.redirectpages-app.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Headers: content-type,authorization
Access-Control-Allow-Methods: OPTIONS,POST
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 0
Content-Type: application/json
Date: Fri, 19 Jul 2024 03:05:31 GMT
Expires: Fri, 19 Jul 2024 03:05:31 GMT
Pragma: no-cache
Strict-Transport-Security: max-age=86400 ; includeSubDomains ; preload
x-amz-apigw-id: bI6vaG9bIAMEWAw=
x-amzn-requestid: c9188a7b-8515-4d1b-91ed-17d9d7e902c1
x-amzn-trace-id: Root=1-6699d7fb-5230aadc3bfc572a2c47e2c4
x-envoy-upstream-service-time: 7

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: email.state.ma.us
URL: https://email.state.ma.us/owa/auth/15.0.1497/themes/resources/favicon.ico

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
login-appoitmentoulook.redirectpages-app.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 7hc9i7tb2m4cq2sr54uuevffm9
.redirectpages-app.com/	1970-01-21 06:54:54	Name: _tccl_visitor Value: e62b3909-60d8-4c92-81a8-89abbe62c4d6
.redirectpages-app.com/	1970-01-20 22:09:20	Name: _tccl_visit Value: e62b3909-60d8-4c92-81a8-89abbe62c4d6
.redirectpages-app.com/	1970-01-20 22:09:19	Name: _scc_session Value: pc=1&C_TOUCH=2024-07-19T03:05:31.308Z

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://login-appoitmentoulook.redirectpages-app.com/owa/auth/15.0.1497/themes/resources/segoeui-regular.ttf Message: Failed to load resource: the server responded with a status of 404 ()
recommendation	verbose	URL: https://login-appoitmentoulook.redirectpages-app.com/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

csp.secureserver.net
email.state.ma.us
events.api.secureserver.net
img1.wsimg.com
login-appoitmentoulook.redirectpages-app.com
email.state.ma.us
107.180.115.183
2a02:26f0:ab00:48e::228b
2a02:26f0:ab00::214:8f39
95.100.135.112
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
294fa524690080588e6ee5caf34c3e6f65d66f14694e7a60aef3d6b8231f34a3
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717
8f7092c94ef904c57584706cdb5f1fd9fe1efce52ce3105e99b9a7def487f09f
ad48b2947dfc14547d41db87252d893b92417680f60dae7eceefc7fa1f69fb16
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

login-appoitmentoulook.redirectpages-app.com Open in urlscan Pro 107.180.115.183 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

11 Requests

82 %HTTPS

50 %IPv6

4 Domains

5 Subdomains

5 IPs

2 Countries

36 kBTransfer

152 kBSize

4 Cookies

0 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

4 Cookies

2 Console Messages

Indicators

login-appoitmentoulook.redirectpages-app.com Open in urlscan Pro
107.180.115.183 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

82 %
HTTPS

50 %
IPv6

4
Domains

5
Subdomains

5
IPs

2
Countries

36 kB
Transfer

152 kB
Size

4
Cookies

11 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!