afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org
Open in
urlscan Pro
107.174.244.100
Malicious Activity!
Public Scan
URL:
http://afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org/b-rossiz@hotmail.com-a48c8392c1c6e82be83824ca1c0aaa50bbd4b9bd0a10879e5f286fa102f8d047049d45c5c9e...
Submission: On September 07 via automatic, source openphish — Scanned from DE
Submission: On September 07 via automatic, source openphish — Scanned from DE
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 20 HTTP transactions.
The main IP is 107.174.244.100, located in
Seattle, United States and
belongs to AS-COLOCROSSING, US.
The main domain is afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org.
This is the only time afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org was scanned on urlscan.io!
This is the only time afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 13 | 107.174.244.100 107.174.244.100 | 36352 (AS-COLOCR...) (AS-COLOCROSSING) | |
| 7 | 2a02:26f0:350... 2a02:26f0:3500:597::1e0f | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 20 | 2 |
13
107.174.244.100
(Seattle, United States)
ASN36352 (AS-COLOCROSSING, US)
PTR: requestdisk.net
ASN36352 (AS-COLOCROSSING, US)
PTR: requestdisk.net
| afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org |
7
2a02:26f0:3500:597::1e0f
(Frankfurt am Main, Germany)
ASN20940 (AKAMAI-ASN1, NL)
ASN20940 (AKAMAI-ASN1, NL)
| r4.res.office365.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 13 |
duckdns.org
afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org |
721 KB |
| 7 |
office365.com
r4.res.office365.com — Cisco Umbrella Rank: 227 |
689 KB |
| 20 | 2 |
| Domain | Requested by | |
|---|---|---|
| 13 | afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org |
afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org
|
| 7 | r4.res.office365.com |
afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org
|
| 20 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| account.live.com |
| login.live.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.res.outlook.com Microsoft RSA TLS CA 01 |
2022-06-02 - 2023-06-02 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
http://afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org/b-rossiz@hotmail.com-a48c8392c1c6e82be83824ca1c0aaa50bbd4b9bd0a10879e5f286fa102f8d047049d45c5c9e9-7drOc76FwBGxg2jBsNavrdtte50hyAwd4v6htJoqH6Ma9uzk78rmuLChupHvIIl5E6jn-gcv2JEtpA0B4vgetsz1GoD4Ixbg5sLaDNywrggBhFhCnzfrOu7fJAGHsh56dKhI78d8ue
Frame ID: 24AFAE023333DD3752E976CD25EAAA29
Requests: 5 HTTP requests in this frame
Frame:
http://afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org/index_files/prefetch.html
Frame ID: 208DF8E8F16571562FD2F2BF9CC755F1
Requests: 15 HTTP requests in this frame
4 Outgoing links
These are links going to different origins than the main page.
URL: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.0%26rpsnv%3d13%26ct%3d1656833062%26rver%3d7.0.6737.0%26wp%3dMBI_SSL%26wreply%3dhttps%253a%252f%252foutlook.live.com%252fowa%252f%253fnlp%253d1%2526RpsCsrfState%253d35340c1c-a1d2-0d0e-66c7-594c53195c15%26id%3d292841%26aadredir%3d1%26CBCXT%3dout%26lw%3d1%26fl%3ddob%252cflname%252cwld%26cobrandid%3d90015%26contextid%3d8D5C6AB3BB51DD9D%26bk%3d1656833065&id=292841&uiflavor=web&cobrandid=90015&uaid=08a0fa7920204a4a91ebc382b61ced29&mkt=EN-US&lc=1033&bk=1656833065
Title: Forgot password?
Title: Forgot password?
Search URL Search Domain Scan URL
URL: https://login.live.com/gls.srf?urlID=WinLiveTermsOfUse&mkt=EN-US&uaid=08a0fa7920204a4a91ebc382b61ced29
Title: Terms of use
Title: Terms of use
Search URL Search Domain Scan URL
URL: https://login.live.com/gls.srf?urlID=MSNPrivacyStatement&mkt=EN-US&uaid=08a0fa7920204a4a91ebc382b61ced29
Title: Privacy & cookies
Title: Privacy & cookies
Search URL Search Domain Scan URL
URL: https://login.live.com/
Title: ...
Title: ...
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
20 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
b-rossiz@hotmail.com-a48c8392c1c6e82be83824ca1c0aaa50bbd4b9bd0a10879e5f286fa102f8d047049d45c5c9e9-7drOc76FwBGxg2jBsNavrdtte50hyAwd4v6htJoqH6Ma9uzk78rmuLChupHvIIl5E6jn-gcv2JEtpA0B4vgetsz1GoD4Ixbg5sL...
afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org/ |
26 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Converged_v21033_-__Cqeow2darz41wUymj4A2.css
afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org/index_files/ |
107 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org/index_files/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org/index_files/ |
513 B 586 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
prefetch.html
afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org/index_files/ Frame 208D |
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
2_bc3d32a696895f78c19df6c717586a5d.svg
afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org/images/backgrounds/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
boot.worldwide.0.mouse.js.download
afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org/index_files/ Frame 208D |
648 KB 176 KB |
Stylesheet
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
boot.worldwide.1.mouse.js.download
afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org/index_files/ Frame 208D |
644 KB 160 KB |
Stylesheet
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
boot.worldwide.2.mouse.js.download
afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org/index_files/ Frame 208D |
647 KB 166 KB |
Stylesheet
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
boot.worldwide.3.mouse.js.download
afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org/index_files/ Frame 208D |
645 KB 143 KB |
Stylesheet
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sprite1.mouse.png
afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org/index_files/ Frame 208D |
132 B 391 B |
Stylesheet
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sprite1.mouse.css
afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org/index_files/ Frame 208D |
994 B 599 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
boot.worldwide.mouse.css
afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org/index_files/ Frame 208D |
227 KB 44 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
boot.worldwide.0.mouse.js
r4.res.office365.com/owa/prem/15.20.5395.18/scripts/ Frame 208D |
648 KB 176 KB |
Stylesheet
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
boot.worldwide.1.mouse.js
r4.res.office365.com/owa/prem/15.20.5395.18/scripts/ Frame 208D |
644 KB 160 KB |
Stylesheet
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
boot.worldwide.2.mouse.js
r4.res.office365.com/owa/prem/15.20.5395.18/scripts/ Frame 208D |
647 KB 166 KB |
Stylesheet
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
boot.worldwide.3.mouse.js
r4.res.office365.com/owa/prem/15.20.5395.18/scripts/ Frame 208D |
645 KB 143 KB |
Stylesheet
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sprite1.mouse.png
r4.res.office365.com/owa/prem/15.20.5395.18/resources/images/0/ Frame 208D |
132 B 336 B |
Stylesheet
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sprite1.mouse.css
r4.res.office365.com/owa/prem/15.20.5395.18/resources/images/0/ Frame 208D |
994 B 512 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
boot.worldwide.mouse.css
r4.res.office365.com/owa/prem/15.20.5395.18/resources/styles/0/ Frame 208D |
227 KB 43 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org/ | Name: OWAPF Value: p:undefined11111111& |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.8b1b4e8bb6f005e0c929a07ab9c994277da754.afee86f47129ce2738480b04dc71f04451dc04cb983e5d62aefb3d.iodfipiwpoer.duckdns.org
r4.res.office365.com
107.174.244.100
2a02:26f0:3500:597::1e0f
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
27776b8e1698f8280e3b06cbc1c08b7237e456e65261da92ab6d8796eb9883c6
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
37619b16288166cc76403f0b7df6586349b2d5628de00d5850c815d019b17904
3ab09a213eedd51a0eb0e4bc5e6e96c472032dd937420e7e233ea54775c7e024
6d1be7ed96dd494447f348986317faf64728ccf788be551f2a621b31ddc929ac
7dd9c089f7909b7ee8b3787f170f541f2e163ec13bb08dc5881d8b8c5b70f017
8533d0f21e61506e6a8e9517b63019a16b2af69805c6f2c86c02f6319e14de5d
b1b08d26879a443eca979de557de8442e1d37e5933ecbd4a84b035df43ed9f60
bfe219e443da96ae24e940af6d2780cd7f6796d5d85ccf7716a19c274a90165a
c7bcfcd2305204dd3ded9a440c9a0a67b14f8d63224ed72795b23243d90a6771
d5238dcd5576de5c01381727798f579c4722e1c0b07f544135fbe537d7ccf94f
de0f92ef7a4af7309ba09f3496b162eaf397c6b2a4bf0b91bb8db0f8e1d0241f