urlscan.io logo urlscan.io
SecurityTrails logo

login-live-com.office365.apps.maxsolutions.com.au Open in urlscan Pro
13.211.19.151  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=EN-AU&uaid=45cf5aa6ccd64a78ae7d3d3ffb9339b3&lc=3081
Submission: On October 10 via automatic, source openphish — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 13.211.19.151, located in Sydney, Australia and belongs to AMAZON-02, US. The main domain is login-live-com.office365.apps.maxsolutions.com.au.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on March 15th 2022. Valid for: a year.
This is the only time login-live-com.office365.apps.maxsolutions.com.au was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
4 13.211.19.151 16509 (AMAZON-02)
4 1
Domain Requested by
4 login-live-com.office365.apps.maxsolutions.com.au login-live-com.office365.apps.maxsolutions.com.au
4 1

This site contains no links.

Subject Issuer Validity Valid
*.maxsolutions.com.au
DigiCert TLS RSA SHA256 2020 CA1		 2022-03-15 -
2023-04-15		 a year crt.sh

This page contains 1 frames:

Primary Page: https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=EN-AU&uaid=45cf5aa6ccd64a78ae7d3d3ffb9339b3&lc=3081
Frame ID: 65309FC4424F8D9B7207AB9682D48923
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Microsoft account

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

15 kB
Transfer

16 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request jsdisabled.srf
login-live-com.office365.apps.maxsolutions.com.au/ 		5 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=EN-AU&uaid=45cf5aa6ccd64a78ae7d3d3ffb9339b3&lc=3081
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.211.19.151 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-211-19-151.ap-southeast-2.compute.amazonaws.com
Software
/
Resource Hash
f29920fc8c0899ab33e788d4cbb37e59d39b8134635383e38367ba01f23c232a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

Cache-Control
no-store, no-cache
Content-Encoding
gzip
Content-Type
text/html; charset=utf-8
Date
Mon, 10 Oct 2022 14:09:37 GMT
Expires
Mon, 10 Oct 2022 14:08:38 GMT
Link
<https://logincdn.msauth.net>; rel=preconnect; crossorigin <https://acctcdn.msauth.net>; rel=preconnect; crossorigin <https://acctcdn.msftauth.net>; rel=preconnect; crossorigin <https://acctcdn.msauth.net/>; rel=dns-prefetch <https://acctcdn-msftauth-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch <https://acctcdnmsftuswe2-azureedge-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch <https://acctcdnvzeuno-azureedge-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch <https://logincdn.msauth.net/>; rel=dns-prefetch <https://lgincdnvzeuno-azureedge-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch <https://lgincdnmsftuswe2-azureedge-net.office365.apps.maxsolutions.com.au/>; rel=dns-prefetch
P3P
CP="DSP CUR OTPi IND OTRi ONL FIN"
PPServer
PPV: 30 H: BY1PPF823B86621 V: 0
Pragma
no-cache
Referrer-Policy
strict-origin-when-cross-origin
Strict-Transport-Security
max-age=31536000
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-DNS-Prefetch-Control
on
X-Frame-Options
DENY
X-XSS-Protection
1; mode=block
x-ms-request-id
32159396-c1a7-40fd-a35b-9a26bf7c011b
x-ms-route-info
R3_BAY
__sf_event_listener_hook.js
login-live-com.office365.apps.maxsolutions.com.au/__sf_resource/_/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://login-live-com.office365.apps.maxsolutions.com.au/__sf_resource/_/__sf_event_listener_hook.js
Requested by
Host: login-live-com.office365.apps.maxsolutions.com.au
URL: https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=EN-AU&uaid=45cf5aa6ccd64a78ae7d3d3ffb9339b3&lc=3081
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.211.19.151 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-211-19-151.ap-southeast-2.compute.amazonaws.com
Software
/
Resource Hash
a860b9561b1615b3dca00ef253ebc8f398b346e13042dc6bef68ccac5da536ad
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=EN-AU&uaid=45cf5aa6ccd64a78ae7d3d3ffb9339b3&lc=3081
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Cache-Control
max-age=21600
X-Content-Type-Options
nosniff
Content-Length
1849
Content-Type
text/javascript
__sf_ajax_hook.js
login-live-com.office365.apps.maxsolutions.com.au/__sf_resource/_/ 		6 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://login-live-com.office365.apps.maxsolutions.com.au/__sf_resource/_/__sf_ajax_hook.js
Requested by
Host: login-live-com.office365.apps.maxsolutions.com.au
URL: https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=EN-AU&uaid=45cf5aa6ccd64a78ae7d3d3ffb9339b3&lc=3081
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.211.19.151 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-211-19-151.ap-southeast-2.compute.amazonaws.com
Software
/
Resource Hash
198126ad3f4d583b32e828ed9c86a9ef0a3b7e2c8292b1422cd931a722da5418
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=EN-AU&uaid=45cf5aa6ccd64a78ae7d3d3ffb9339b3&lc=3081
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Cache-Control
max-age=21600
X-Content-Type-Options
nosniff
Content-Length
6334
Content-Type
text/javascript
ms-logo-v2.jpg
login-live-com.office365.apps.maxsolutions.com.au/images/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login-live-com.office365.apps.maxsolutions.com.au/images/ms-logo-v2.jpg
Requested by
Host: login-live-com.office365.apps.maxsolutions.com.au
URL: https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=EN-AU&uaid=45cf5aa6ccd64a78ae7d3d3ffb9339b3&lc=3081
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.211.19.151 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-211-19-151.ap-southeast-2.compute.amazonaws.com
Software
/
Resource Hash
bc2b16b51738b77d94ed7591ad1033fa804297ca9faaa35222aa65773f749164
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://login-live-com.office365.apps.maxsolutions.com.au/jsdisabled.srf?mkt=EN-AU&uaid=45cf5aa6ccd64a78ae7d3d3ffb9339b3&lc=3081
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000
Date
Mon, 10 Oct 2022 14:09:38 GMT
X-Content-Type-Options
nosniff
Last-Modified
Fri, 23 Sep 2022 11:44:12 GMT
PPServer
PPV: 30 H: BY1PPF095FBC0D3 V: 0
ETag
"08e9bcc41cfd81:0"
Content-Type
image/jpeg
x-ms-request-id
1e03b6e2-3014-4676-b41d-34b465da398f
Cache-Control
max-age=31536000
Accept-Ranges
bytes
Content-Length
2797
X-XSS-Protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| __sf__initEventListenersHook function| __sfLog function| __sf__redirect function| __sf__handleResponse function| __sf__trackXhr function| __sf__installAjaxHook function| __sf__installFetchHook function| show_verifcation_iframe function| sf_iframe_verification_success object| EventDict function| __sf__addEventListenerBase function| removeAllEventListeners function| __sf__removeEventListenerBase

2 Cookies

Domain/Path Name / Value
.office365.apps.maxsolutions.com.au/ Name: __SF__sessionId
Value: adf5d11cd100a0102bc1bb724bef9b
.apps.maxsolutions.com.au/ Name: __SF__sfbid
Value: RMJO5DJOGWce75a053

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block