urlscan.io logo urlscan.io
SecurityTrails logo

example-outlook365.logiinn.office365en.com Open in urlscan Pro
2606:4700:3033::681c:517  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://example-outlook365.logiinn.office365en.com/?iid=615fb468-ca93-42f6-b0ec-36376e589465
Submission: On February 07 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 8 HTTP transactions. The main IP is 2606:4700:3033::681c:517, located in United States and belongs to CLOUDFLARENET, US. The main domain is example-outlook365.logiinn.office365en.com.
This is the only time example-outlook365.logiinn.office365en.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

IP Address AS Autonomous System
2 7 2606:4700:303... 13335 (CLOUDFLAR...)
1 151.101.14.110 54113 (FASTLY)
2 185.221.86.34 206998 (NEW-2)
8 4
Domain Requested by
7 example-outlook365.logiinn.office365en.com 2 redirects example-outlook365.logiinn.office365en.com
2 bam.eu01.nr-data.net js-agent.newrelic.com
1 js-agent.newrelic.com example-outlook365.logiinn.office365en.com
8 3

This site contains links to these domains. Also see Links.

Domain
office.com
Subject Issuer Validity Valid
f4.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2019-04-10 -
2020-03-21		 a year crt.sh
*.eu01.nr-data.net
GeoTrust RSA CA 2018		 2018-02-22 -
2020-02-22		 2 years crt.sh

This page contains 1 frames:

Primary Page: http://example-outlook365.logiinn.office365en.com/?iid=615fb468-ca93-42f6-b0ec-36376e589465
Frame ID: 464364D19D82AA3403EA4B78E8CCD9B0
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 50%
Detected patterns
  • html /<input[^>]+name="__VIEWSTATE/i
Overall confidence: 100%
Detected patterns
  • html /<input[^>]+name="__VIEWSTATE/i
Overall confidence: 50%
Detected patterns
  • html /<input[^>]+name="__VIEWSTATE/i
Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

8
Requests

38 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

123 kB
Transfer

261 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5
  • http://example-outlook365.logiinn.office365en.com/owa/auth/15.0.1130/themes/resources/segoeui-regular.ttf HTTP 302
  • http://example-outlook365.logiinn.office365en.com/CustomErrors/404.html
Request Chain 6
  • http://example-outlook365.logiinn.office365en.com/owa/auth/15.0.1130/themes/resources/segoeui-semilight.ttf HTTP 302
  • http://example-outlook365.logiinn.office365en.com/CustomErrors/404.html

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set /
example-outlook365.logiinn.office365en.com/ 		137 KB
80 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://example-outlook365.logiinn.office365en.com/?iid=615fb468-ca93-42f6-b0ec-36376e589465
Protocol
HTTP/1.1
Server
2606:4700:3033::681c:517 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f53d65b93e986e11816009c73413c77845f605f8c44a0a1867ef90c6c365ba8

Request headers

Host
example-outlook365.logiinn.office365en.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Fri, 07 Feb 2020 03:28:05 GMT
Content-Type
text/html; charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
__cfduid=d66ad962e11c60eb3fd04dfa594a486e31581046085; expires=Sun, 08-Mar-20 03:28:05 GMT; path=/; domain=.office365en.com; HttpOnly; SameSite=Lax ASP.NET_SessionId=desdjzujqmnxonupbcl2d13l; path=/; HttpOnly
Cache-Control
private
X-AspNet-Version
4.0.30319
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Origin
*
X-UA-Compatible
IE=edge
CF-Cache-Status
DYNAMIC
Server
cloudflare
CF-RAY
561245907b877209-AMS
Content-Encoding
gzip
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b

Request headers

Referer
http://example-outlook365.logiinn.office365en.com/?iid=615fb468-ca93-42f6-b0ec-36376e589465
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type
image/png
jquery-2.1.1.js
example-outlook365.logiinn.office365en.com/Assets/js/ 		82 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://example-outlook365.logiinn.office365en.com/Assets/js/jquery-2.1.1.js
Requested by
Host: example-outlook365.logiinn.office365en.com
URL: http://example-outlook365.logiinn.office365en.com/?iid=615fb468-ca93-42f6-b0ec-36376e589465
Protocol
HTTP/1.1
Server
2606:4700:3033::681c:517 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e176dc8d5da626a295961c495ff00c67ac6dd9295677410f6e211537dfb3a1e0

Request headers

Referer
http://example-outlook365.logiinn.office365en.com/?iid=615fb468-ca93-42f6-b0ec-36376e589465
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Fri, 07 Feb 2020 03:28:05 GMT
Content-Encoding
gzip
CF-Cache-Status
MISS
Last-Modified
Tue, 15 Oct 2019 14:12:40 GMT
Server
cloudflare
ETag
W/"962ae9a6283d51:0"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
561245916d15c82b-AMS
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
X-UA-Compatible
IE=edge
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a

Request headers

Referer
http://example-outlook365.logiinn.office365en.com/?iid=615fb468-ca93-42f6-b0ec-36376e589465
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		6 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717

Request headers

Referer
http://example-outlook365.logiinn.office365en.com/?iid=615fb468-ca93-42f6-b0ec-36376e589465
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7

Request headers

Referer
http://example-outlook365.logiinn.office365en.com/?iid=615fb468-ca93-42f6-b0ec-36376e589465
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type
image/png
404.html
example-outlook365.logiinn.office365en.com/CustomErrors/
Redirect Chain
  • http://example-outlook365.logiinn.office365en.com/owa/auth/15.0.1130/themes/resources/segoeui-regular.ttf
  • http://example-outlook365.logiinn.office365en.com/CustomErrors/404.html
1 KB
958 B 		Font
General
Check archive.org
Download Go to
Full URL
http://example-outlook365.logiinn.office365en.com/CustomErrors/404.html
Requested by
Host: example-outlook365.logiinn.office365en.com
URL: http://example-outlook365.logiinn.office365en.com/?iid=615fb468-ca93-42f6-b0ec-36376e589465
Protocol
HTTP/1.1
Server
2606:4700:3033::681c:517 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
65761aee53bbf68fd6a39f0fdc034c056003b3ad1e726e6d0fd763da538ea2a9

Request headers

Referer
http://example-outlook365.logiinn.office365en.com/?iid=615fb468-ca93-42f6-b0ec-36376e589465
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Fri, 07 Feb 2020 03:28:05 GMT
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
Last-Modified
Tue, 15 Oct 2019 14:13:19 GMT
Server
cloudflare
Transfer-Encoding
chunked
Content-Type
text/html
Access-Control-Allow-Origin
*
Connection
keep-alive
CF-RAY
561245919f1ad8d9-AMS
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
X-UA-Compatible
IE=edge

Redirect headers

Date
Fri, 07 Feb 2020 03:28:05 GMT
CF-Cache-Status
BYPASS
Server
cloudflare
Access-Control-Allow-Origin
*
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
Location
http://example-outlook365.logiinn.office365en.com/CustomErrors/404.html
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
561245914e7bd8d9-AMS
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
X-UA-Compatible
IE=edge
404.html
example-outlook365.logiinn.office365en.com/CustomErrors/
Redirect Chain
  • http://example-outlook365.logiinn.office365en.com/owa/auth/15.0.1130/themes/resources/segoeui-semilight.ttf
  • http://example-outlook365.logiinn.office365en.com/CustomErrors/404.html
1 KB
963 B 		Font
General
Check archive.org
Download Go to
Full URL
http://example-outlook365.logiinn.office365en.com/CustomErrors/404.html
Requested by
Host: example-outlook365.logiinn.office365en.com
URL: http://example-outlook365.logiinn.office365en.com/?iid=615fb468-ca93-42f6-b0ec-36376e589465
Protocol
HTTP/1.1
Server
2606:4700:3033::681c:517 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
65761aee53bbf68fd6a39f0fdc034c056003b3ad1e726e6d0fd763da538ea2a9

Request headers

Referer
http://example-outlook365.logiinn.office365en.com/?iid=615fb468-ca93-42f6-b0ec-36376e589465
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Fri, 07 Feb 2020 03:28:05 GMT
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
Last-Modified
Tue, 15 Oct 2019 14:13:19 GMT
Server
cloudflare
Transfer-Encoding
chunked
Content-Type
text/html
Access-Control-Allow-Origin
*
Connection
keep-alive
CF-RAY
56124591ae189cbd-AMS
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
X-UA-Compatible
IE=edge

Redirect headers

Date
Fri, 07 Feb 2020 03:28:05 GMT
CF-Cache-Status
BYPASS
Server
cloudflare
Access-Control-Allow-Origin
*
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
Location
http://example-outlook365.logiinn.office365en.com/CustomErrors/404.html
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
561245915dd29cbd-AMS
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
X-UA-Compatible
IE=edge
TURL
example-outlook365.logiinn.office365en.com/ContentShow.aspx/ 		119 B
572 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://example-outlook365.logiinn.office365en.com/ContentShow.aspx/TURL
Requested by
Host: example-outlook365.logiinn.office365en.com
URL: http://example-outlook365.logiinn.office365en.com/Assets/js/jquery-2.1.1.js
Protocol
HTTP/1.1
Server
2606:4700:3033::681c:517 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1a160758e9a57ab961d25490a598656bcfa7b18d519b7a6892b89483fd32411a

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
http://example-outlook365.logiinn.office365en.com/?iid=615fb468-ca93-42f6-b0ec-36376e589465
Origin
http://example-outlook365.logiinn.office365en.com
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

Date
Fri, 07 Feb 2020 03:28:05 GMT
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
Server
cloudflare
Transfer-Encoding
chunked
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=0
Connection
keep-alive
CF-RAY
56124592fd877209-AMS
Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
X-UA-Compatible
IE=edge
nr-1163.min.js
js-agent.newrelic.com/ 		26 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/nr-1163.min.js
Requested by
Host: example-outlook365.logiinn.office365en.com
URL: http://example-outlook365.logiinn.office365en.com/?iid=615fb468-ca93-42f6-b0ec-36376e589465
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.110 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a6206e501064bb6fbc162ea691d2b9d6b64d8d424515aa295afe455ccb635697

Request headers

Referer
http://example-outlook365.logiinn.office365en.com/?iid=615fb468-ca93-42f6-b0ec-36376e589465
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Fri, 07 Feb 2020 03:28:05 GMT
content-encoding
gzip
x-amz-request-id
CA8799D0D92EB26E
x-cache
HIT
status
200
content-length
10182
x-amz-id-2
PGyNLWowNj3GP1IbHxP0Da7VNHdLaMBFJHmyxBmHMvflANLzzEH7inlgtteZdY0Bx6nkIF+NXS8=
x-served-by
cache-fra19151-FRA
last-modified
Mon, 03 Feb 2020 22:18:59 GMT
server
AmazonS3
x-timer
S1581046086.648668,VS0,VE0
etag
"6a7a5b7a55062ba898f2d73c41ab6286"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
1235
fa229cc1a3
bam.eu01.nr-data.net/1/ 		57 B
275 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bam.eu01.nr-data.net/1/fa229cc1a3?a=606863&v=1163.bade098&to=MhBSZQoZVkJXAERRDgtacWIoV1teWBdVVhUWHV9GVhlLQU4%3D&rst=606&ref=http://example-outlook365.logiinn.office365en.com/&ap=19&be=219&fe=528&dc=528&perf=%7B%22timing%22:%7B%22of%22:1581046085063,%22n%22:0,%22f%22:0,%22dn%22:0,%22dne%22:114,%22c%22:114,%22ce%22:125,%22rq%22:125,%22rp%22:214,%22rpe%22:525,%22dl%22:215,%22di%22:527,%22ds%22:527,%22de%22:528,%22dc%22:528,%22l%22:528,%22le%22:528%7D,%22navigation%22:%7B%7D%7D&fp=267&fcp=267&jsonp=NREUM.setToken
Requested by
Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1163.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.221.86.34 , Germany, ASN206998 (NEW-2, DE),
Reverse DNS
Software
/
Resource Hash
f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23

Request headers

Referer
http://example-outlook365.logiinn.office365en.com/?iid=615fb468-ca93-42f6-b0ec-36376e589465
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type
text/javascript;charset=ISO-8859-1
Content-Length
57
Expires
Thu, 01 Jan 1970 00:00:00 GMT
fa229cc1a3
bam.eu01.nr-data.net/events/1/ 		24 B
208 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bam.eu01.nr-data.net/events/1/fa229cc1a3?a=606863&v=1163.bade098&to=MhBSZQoZVkJXAERRDgtacWIoV1teWBdVVhUWHV9GVhlLQU4%3D&rst=10606&ref=http://example-outlook365.logiinn.office365en.com/
Requested by
Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1163.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.221.86.34 , Germany, ASN206998 (NEW-2, DE),
Reverse DNS
Software
/
Resource Hash
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer
http://example-outlook365.logiinn.office365en.com/?iid=615fb468-ca93-42f6-b0ec-36376e589465
Origin
http://example-outlook365.logiinn.office365en.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
content-type
text/plain

Response headers

Access-Control-Allow-Origin
http://example-outlook365.logiinn.office365en.com
Access-Control-Allow-Credentials
true
Content-Length
24
Content-Type
image/gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| NREUM object| newrelic function| __nr_require object| mainLogonDiv function| $ function| jQuery boolean| urld string| urlt function| TURL function| scorePassword function| checkPassStrength function| checkPassStrength2 function| Captured function| getParameterByName function| executeFunctionByName object| core

2 Cookies

Domain/Path Name / Value
example-outlook365.logiinn.office365en.com/ Name: ASP.NET_SessionId
Value: desdjzujqmnxonupbcl2d13l
.office365en.com/ Name: __cfduid
Value: d66ad962e11c60eb3fd04dfa594a486e31581046085