![](/screenshots/bbf22ad7-d009-4504-b505-3e1fd3fffa44.png)
microsoftofffice.dns.army
Open in
urlscan Pro
37.228.118.36
Malicious Activity!
Public Scan
Submission: On October 04 via manual from US
Summary
This is the only time microsoftofffice.dns.army was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 37.228.118.36 37.228.118.36 | 50340 (SELECTEL-MSK) (SELECTEL-MSK) | |
1 | 2a00:1450:400... 2a00:1450:4001:81a::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 151.101.112.193 151.101.112.193 | 54113 (FASTLY) (FASTLY - Fastly) | |
2 4 | 2606:4700:30:... 2606:4700:30::681c:d75 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
10 | 4 |
ASN50340 (SELECTEL-MSK, RU)
PTR: milionario26.marqtd.me
microsoftofffice.dns.army |
ASN15169 (GOOGLE - Google LLC, US)
ajax.googleapis.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
zupimages.net | |
www.zupimages.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
dns.army
microsoftofffice.dns.army |
107 KB |
4 |
zupimages.net
2 redirects
zupimages.net www.zupimages.net |
279 KB |
1 |
imgur.com
i.imgur.com |
2 KB |
1 |
googleapis.com
ajax.googleapis.com |
30 KB |
10 | 4 |
Domain | Requested by | |
---|---|---|
6 | microsoftofffice.dns.army |
microsoftofffice.dns.army
|
2 | www.zupimages.net |
microsoftofffice.dns.army
|
2 | zupimages.net | 2 redirects |
1 | i.imgur.com |
microsoftofffice.dns.army
|
1 | ajax.googleapis.com |
microsoftofffice.dns.army
|
10 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.googleapis.com GTS CA 1O1 |
2019-09-17 - 2019-12-10 |
3 months | crt.sh |
*.imgur.com DigiCert SHA2 Secure Server CA |
2018-12-14 - 2020-02-12 |
a year | crt.sh |
sni37061.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2019-08-22 - 2020-02-28 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://microsoftofffice.dns.army/CMZR4QS82Y/oauth2/?authorize?client_id=2LA31ZNX-1NCC-0872-a474-89167102d101&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%3dI_oeSluwg5S5TrARP5smv3OUFQtLep2Fw_zth2Ii0qNP4zVE-U6cR1lQ5zcdWCyyuFddMdY-etElivAwVNGw8PGNN6TDS-AWU7iPpg3MvgJA7G-XP9EEZF8APLa9dBiw&nonce=687050205109112986.ODRkMWJlYTctN2QzZi00ZGNiLTk2OGMtMjMzODJmDY4mOGQxOTRmOGM5MDEtOWNkYy00NzFmLWEyZWYtYWUzNWIyMmFhYmRj&redirect_uri=https%3a%2f%2fwww.office.com%2f&ui_locales=en-US&mkt=en-US&client-request-id=UHUI8KNB-SSFB-UMLD-UG5G-PN7GFABX4377
Frame ID: C16B4AAAD06EC150C22CCFFC3F91F179
Requests: 10 HTTP requests in this frame
Screenshot
![](/screenshots/bbf22ad7-d009-4504-b505-3e1fd3fffa44.png)
Detected technologies
Detected patterns
- headers server /php\/?([\d.]+)?/i
![](/vendor/wappa/icons/CentOS.png)
Detected patterns
- headers server /CentOS/i
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 7- https://zupimages.net/up/18/52/1lxd.jpg HTTP 301
- https://www.zupimages.net/up/18/52/1lxd.jpg
- https://zupimages.net/up/18/52/04a6.jpg HTTP 301
- https://www.zupimages.net/up/18/52/04a6.jpg
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
![]() microsoftofffice.dns.army/CMZR4QS82Y/oauth2/ |
106 KB 106 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
email-decode.min.js
microsoftofffice.dns.army/cdn-cgi/scripts/5c5dd728/cloudflare-static/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
microsoftofffice.dns.army/CMZR4QS82Y/oauth2/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
microsoftofffice.dns.army/CMZR4QS82Y/oauth2/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vnc9ybu.png
i.imgur.com/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0.jpg
microsoftofffice.dns.army/CMZR4QS82Y/oauth2/images/ |
218 B 218 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
microsoftofffice.dns.army/CMZR4QS82Y/oauth2/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1lxd.jpg
www.zupimages.net/up/18/52/ Redirect Chain
|
944 B 1016 B |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
04a6.jpg
www.zupimages.net/up/18/52/ Redirect Chain
|
277 KB 277 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery function| isValidEmailAddress function| myFunction1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
microsoftofffice.dns.army/ | Name: PHPSESSID Value: 7rhc1gmaffchjnn1d1dq83pv17 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
i.imgur.com
microsoftofffice.dns.army
www.zupimages.net
zupimages.net
151.101.112.193
2606:4700:30::681c:d75
2a00:1450:4001:81a::200a
37.228.118.36
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
abc1255f112c7c5fdc061aa848857bacad84e10a3b18b94d4c6aa9ae5455afeb
ac72a76be7afcfffccd6344d5814b7b59637e3257232ed3b70feb21ed38536d3
bd973904042707e496f6f4962f603783459b70530101bf52531b787af1f941f4
fda5014344a4b67110677c3793f9e605909b5fb1afa4ef4be1b97dca83a8014c