www.account-loginxz2.ml Open in urlscan Pro
162.241.114.206  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response www.account-loginxz2.ml/micro/bmicrosoft/bmicrosoft/MSFT/office/	11 KB 12 KB	348ms 150ms	Document text/html	162.241.114.206 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://www.account-loginxz2.ml/micro/bmicrosoft/bmicrosoft/MSFT/office/ Protocol HTTP/1.1 Server 162.241.114.206 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-114-206.webhostbox.net Software Apache / Resource Hash 5d5f416ad7320775414ef67557aab4066bb07103ed6e517c0a9abcf3cbf8ee1e Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Tue, 06 Sep 2022 13:03:09 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Apache Transfer-Encoding chunked
GET H/1.1	200 OK	converged.login.min.css secure.aadcdn.microsoftonline-p.com/ests/2.1.6573.5/content/cdnbundles/	85 KB 17 KB	766ms 599ms	Stylesheet text/css	2a02:26f0:ea:2a1::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6573.5/content/cdnbundles/converged.login.min.css Requested by Host: www.account-loginxz2.ml URL: http://www.account-loginxz2.ml/micro/bmicrosoft/bmicrosoft/MSFT/office/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:ea:2a1::35c1 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 8b27fcc2fea5fb9a9aa55025aa0ab06244ad613d190b4639c94e1e61449e1d5d Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer http://www.account-loginxz2.ml/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers Date Tue, 06 Sep 2022 13:03:11 GMT Content-Encoding gzip Last-Modified Sat, 18 May 2019 11:24:43 GMT Content-MD5 lu9HFyWNBKBNLBfjv/kwhw== Vary Accept-Encoding Connection keep-alive Content-Type text/css Access-Control-Allow-Origin * Cache-Control public, max-age=604800 Strict-Transport-Security max-age=31536000 Content-Length 16616
GET H/1.1	200 OK	convergedlogin_pcore.min.js Show response secure.aadcdn.microsoftonline-p.com/ests/2.1.6573.5/content/cdnbundles/	292 KB 84 KB	765ms 598ms	Script application/x-javascript	2a02:26f0:ea:2a1::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6573.5/content/cdnbundles/convergedlogin_pcore.min.js Requested by Host: www.account-loginxz2.ml URL: http://www.account-loginxz2.ml/micro/bmicrosoft/bmicrosoft/MSFT/office/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:ea:2a1::35c1 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash dcc86d9a3e74d17423f612e185e84a3fb6211f630d6bdb42332f97b88fdf59d0 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer http://www.account-loginxz2.ml/ Origin http://www.account-loginxz2.ml accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers Date Tue, 06 Sep 2022 13:03:11 GMT Content-Encoding gzip Last-Modified Sat, 18 May 2019 11:24:10 GMT Content-MD5 4xDovjE0ZkWe85ZNq4eCog== Vary Accept-Encoding Connection keep-alive Content-Type application/x-javascript Access-Control-Allow-Origin * Cache-Control public, max-age=604800 Strict-Transport-Security max-age=31536000 Content-Length 85729
GET H/1.1	200 OK	convergedloginpaginatedstrings-en.min.js Show response secure.aadcdn.microsoftonline-p.com/ests/2.1.6573.5/content/cdnbundles/	10 KB 4 KB	767ms 580ms	Script application/x-javascript	2a02:26f0:ea:2a1::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6573.5/content/cdnbundles/convergedloginpaginatedstrings-en.min.js Requested by Host: www.account-loginxz2.ml URL: http://www.account-loginxz2.ml/micro/bmicrosoft/bmicrosoft/MSFT/office/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:ea:2a1::35c1 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash ff309b77bb649de3a33e8cf455eac654972f1116862bd091cc63894a2ddddf46 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer http://www.account-loginxz2.ml/ Origin http://www.account-loginxz2.ml accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers Date Tue, 06 Sep 2022 13:03:11 GMT Content-Encoding gzip Last-Modified Sat, 18 May 2019 11:24:09 GMT Content-MD5 FKeSZWNiaMiApaXFalxxmw== Vary Accept-Encoding Connection keep-alive Content-Type application/x-javascript Access-Control-Allow-Origin * Cache-Control public, max-age=604800 Strict-Transport-Security max-age=31536000 Content-Length 3559
GET H/1.1	200 OK	microsoft_logo.svg secure.aadcdn.microsoftonline-p.com/ests/2.1.6573.5/content/images/	4 KB 2 KB	182ms 182ms	Image image/svg+xml	2a02:26f0:ea:2a1::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6573.5/content/images/microsoft_logo.svg?x=ee5c8d9fb6248c938fd0dc19370e90bd Requested by Host: www.account-loginxz2.ml URL: http://www.account-loginxz2.ml/micro/bmicrosoft/bmicrosoft/MSFT/office/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:ea:2a1::35c1 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer http://www.account-loginxz2.ml/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers Date Tue, 06 Sep 2022 13:03:11 GMT Content-Encoding gzip Last-Modified Sat, 18 May 2019 11:24:01 GMT Content-MD5 nzaLxFgP7ZB3dfMcaybWzw== Vary Accept-Encoding Connection keep-alive Content-Type image/svg+xml Access-Control-Allow-Origin * Cache-Control public, max-age=604800 Strict-Transport-Security max-age=31536000 Content-Length 1435
GET H2	200	prefetch Show response www.office.com/prefetch/ Frame B75E	973 B 1 KB	324ms 62ms	Document text/html	2620:1ec:4::156 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.office.com/prefetch/prefetch Requested by Host: www.account-loginxz2.ml URL: http://www.account-loginxz2.ml/micro/bmicrosoft/bmicrosoft/MSFT/office/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:4::156 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 2ea93b4aad0d8a49e97d41571ca458262f29ff4fde0e4ba4450c780569b27915 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://www.account-loginxz2.ml/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-store,no-cache content-encoding gzip content-type text/html; charset=utf-8 date Tue, 06 Sep 2022 13:03:11 GMT nel { "report_to": "NelOfficeHubUpload1", "max_age": 3600, "include_subdomains":False, "failure_fraction":1, "success_fraction":0,01} pragma no-cache referrer-policy strict-origin-when-cross-origin report-to { "group": "NelOfficeHubUpload1", "max_age": 3600, "endpoints": [{ "url": "https://officehub.nel.measure.office.net/api/report?TenantId=unknown&DestinationEndpoint=weu&FrontEnd=AFD" }],"include_subdomains":False} request-context appId= strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding x-cache CONFIG_NOCACHE x-content-type-options nosniff x-msedge-ref Ref A: 09485B93422D42A583C541FDE1657BBE Ref B: VIEEDGE2205 Ref C: 2022-09-06T13:03:11Z x-ua-compatible IE=edge,chrome=1 x-xss-protection 1; mode=block
GET H/1.1	200 OK	0-small.jpg secure.aadcdn.microsoftonline-p.com/ests/2.1.6573.5/content/images/backgrounds/	1 KB 1 KB	161ms 160ms	Image image/jpeg	2a02:26f0:ea:2a1::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6573.5/content/images/backgrounds/0-small.jpg?x=12f4b8b543125cc986c79cd85320812f Requested by Host: www.account-loginxz2.ml URL: http://www.account-loginxz2.ml/micro/bmicrosoft/bmicrosoft/MSFT/office/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:ea:2a1::35c1 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash c13db279143e1845ee4aaee5afedc5bd75e9f7d50024b63883b45332c4960b3b Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer http://www.account-loginxz2.ml/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers Date Tue, 06 Sep 2022 13:03:11 GMT Last-Modified Sat, 18 May 2019 11:24:25 GMT Content-MD5 EvS4tUMSXMmGx5zYUyCBLw== Strict-Transport-Security max-age=31536000 Content-Type image/jpeg Access-Control-Allow-Origin * Cache-Control public, max-age=604800 Connection keep-alive Content-Length 1029
GET H/1.1	200 OK	0.jpg secure.aadcdn.microsoftonline-p.com/ests/2.1.6573.5/content/images/backgrounds/	291 KB 291 KB	234ms 182ms	Image image/jpeg	2a02:26f0:ea:2a1::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6573.5/content/images/backgrounds/0.jpg?x=f5a9a9531b8f4bcc86eabb19472d15d5 Requested by Host: www.account-loginxz2.ml URL: http://www.account-loginxz2.ml/micro/bmicrosoft/bmicrosoft/MSFT/office/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:ea:2a1::35c1 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language de-DE,de;q=0.9 Referer http://www.account-loginxz2.ml/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers Date Tue, 06 Sep 2022 13:03:11 GMT Last-Modified Sat, 18 May 2019 11:24:08 GMT Content-MD5 9ampUxuPS8yG6rsZRy0V1Q== Strict-Transport-Security max-age=31536000 Content-Type image/jpeg Access-Control-Allow-Origin * Cache-Control public, max-age=604800 Connection keep-alive Content-Length 298105
GET H2	200	polyfills-bundle-222c16c70e81e3f317d7.js res.cdn.office.net/officehub/bundles/ Frame B75E	0 32 KB	191ms 16ms	Other application/javascript	2a02:26f0:3500:18::1724:a287 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://res.cdn.office.net/officehub/bundles/polyfills-bundle-222c16c70e81e3f317d7.js Requested by Host: www.office.com URL: https://www.office.com/prefetch/prefetch Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:18::1724:a287 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.office.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Tue, 06 Sep 2022 13:03:11 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 16 Jun 2022 20:34:26 GMT x-cdn-provider Akamai vary Accept-Encoding content-type application/javascript access-control-allow-origin * x-ms-request-id 70d6d510-a01e-003a-1492-bce5ef000000 access-control-expose-headers date,Akamai-Request-BC cache-control max-age=630720000 strict-transport-security max-age=31536000; includeSubDomains timing-allow-origin * content-length 31873
GET H2	200	sharedscripts-c77f7edec8.js res.cdn.office.net/officehub/bundles/ Frame B75E	0 15 KB	208ms 33ms	Other application/javascript	2a02:26f0:3500:18::1724:a287 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://res.cdn.office.net/officehub/bundles/sharedscripts-c77f7edec8.js Requested by Host: www.office.com URL: https://www.office.com/prefetch/prefetch Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:18::1724:a287 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.office.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Tue, 06 Sep 2022 13:03:11 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 09 May 2022 22:18:52 GMT x-cdn-provider Akamai vary Accept-Encoding content-type application/javascript access-control-allow-origin * x-ms-request-id cb146b6b-701e-0039-75fc-63048b000000 access-control-expose-headers date,Akamai-Request-BC cache-control max-age=630720000 strict-transport-security max-age=31536000; includeSubDomains timing-allow-origin * content-length 15201
GET H2	200	staticscripts-0d945946a7.js res.cdn.office.net/officehub/bundles/ Frame B75E	0 6 KB	220ms 46ms	Other application/javascript	2a02:26f0:3500:18::1724:a287 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://res.cdn.office.net/officehub/bundles/staticscripts-0d945946a7.js Requested by Host: www.office.com URL: https://www.office.com/prefetch/prefetch Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:18::1724:a287 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.office.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Tue, 06 Sep 2022 13:03:11 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 01 Sep 2022 00:21:27 GMT x-cdn-provider Akamai vary Accept-Encoding content-type application/javascript access-control-allow-origin * x-ms-request-id f810caa0-601e-0025-21ff-bd56eb000000 access-control-expose-headers date,Akamai-Request-BC cache-control max-age=630720000 strict-transport-security max-age=31536000; includeSubDomains timing-allow-origin * content-length 5450
GET H2	200	app-bundle-bcfb035f29bc1f1763c6.js res.cdn.office.net/officehub/bundles/ Frame B75E	0 303 KB	222ms 49ms	Other application/javascript	2a02:26f0:3500:18::1724:a287 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://res.cdn.office.net/officehub/bundles/app-bundle-bcfb035f29bc1f1763c6.js Requested by Host: www.office.com URL: https://www.office.com/prefetch/prefetch Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:18::1724:a287 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.office.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Tue, 06 Sep 2022 13:03:11 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 01 Sep 2022 00:21:28 GMT x-cdn-provider Akamai vary Accept-Encoding content-type application/javascript access-control-allow-origin * x-ms-request-id 6f3ad3f6-a01e-0015-79ff-bde824000000 access-control-expose-headers date,Akamai-Request-BC cache-control max-age=630720000 strict-transport-security max-age=31536000; includeSubDomains timing-allow-origin * content-length 309519
GET H2	200	app-bundle-4bb75e216d7731de870b.css res.cdn.office.net/officehub/bundles/ Frame B75E	0 15 KB	224ms 51ms	Other text/css	2a02:26f0:3500:18::1724:a287 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://res.cdn.office.net/officehub/bundles/app-bundle-4bb75e216d7731de870b.css Requested by Host: www.office.com URL: https://www.office.com/prefetch/prefetch Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:18::1724:a287 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.office.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Tue, 06 Sep 2022 13:03:11 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 29 Jun 2022 23:00:52 GMT x-cdn-provider Akamai vary Accept-Encoding content-type text/css access-control-allow-origin * x-ms-request-id aeebb3f5-a01e-0067-644d-8cef6b000000 access-control-expose-headers date,Akamai-Request-BC cache-control max-age=630720000 strict-transport-security max-age=31536000; includeSubDomains timing-allow-origin * content-length 14789
GET H2	200	header-default-desktop-652cc04392.svg res.cdn.office.net/officehub/images/content/images/fluent-background-sources/ Frame B75E	0 2 KB	231ms 58ms	Other image/svg+xml	2a02:26f0:3500:18::1724:a287 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://res.cdn.office.net/officehub/images/content/images/fluent-background-sources/header-default-desktop-652cc04392.svg Requested by Host: www.office.com URL: https://www.office.com/prefetch/prefetch Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:18::1724:a287 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.office.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Tue, 06 Sep 2022 13:03:11 GMT content-encoding gzip last-modified Wed, 01 Sep 2021 01:22:50 GMT x-cdn-provider Akamai vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id ef1ebd1d-101e-003f-6adc-353734000000 access-control-expose-headers date,Akamai-Request-BC cache-control max-age=630720000 strict-transport-security max-age=31536000; includeSubDomains timing-allow-origin * content-length 1403
GET H/1.1	200 OK	prefetch.aspx Show response outlook.office365.com/owa/ Frame 352F	3 KB 3 KB	198ms 53ms	Document text/html	2603:1026:301::2 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://outlook.office365.com/owa/prefetch.aspx Requested by Host: www.office.com URL: https://www.office.com/prefetch/prefetch Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2603:1026:301::2 Vienna, Austria, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / Resource Hash c4fc4724c04599038233e77772bd4d5176f54323aa971c89005316df15110a00 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.office.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Alt-Svc h3=":443",h3-29=":443" Cache-Control private, no-store Content-Encoding gzip Content-Length 1234 Content-Type text/html; charset=utf-8 Date Tue, 06 Sep 2022 13:03:11 GMT NEL {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Report-To {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=VIE"}],"include_subdomains":true} Server Microsoft-IIS/10.0 Strict-Transport-Security max-age=31536000; includeSubDomains; preload Vary Accept-Encoding X-BEServer PR3PR01MB6603 X-BackEnd-Begin 2022-09-06T13:03:11.946 X-BackEnd-End 2022-09-06T13:03:11.946 X-BackEndHttpStatus 200 200 X-BeSku WCS6 X-CalculatedBETarget PR3PR01MB6603.eurprd01.prod.exchangelabs.com X-CalculatedFETarget PR3P191CU002.internal.outlook.com X-Content-Type-Options nosniff X-DiagInfo PR3PR01MB6603 X-FEEFZInfo VIE X-FEProxyInfo VI1PR0102CA0030.EURPRD01.PROD.EXCHANGELABS.COM X-FEServer PR3P191CA0048 VI1PR0102CA0030 X-FirstHopCafeEFZ VIE X-IIDs 0 X-OWA-DiagnosticsInfo 1;0;0 X-OWA-Version 15.20.5588.18 X-Proxy-BackendServerStatus 200 X-Proxy-RoutingCorrectness 1 X-RUM-Validated 1 X-UA-Compatible IE=EmulateIE7 request-id 228fb8b2-cebc-f370-15c3-4cb408125d6e
GET H2	200	boot.worldwide.0.mouse.js r4.res.office365.com/owa/prem/15.20.5588.10/scripts/ Frame 352F	648 KB 176 KB	215ms 24ms	Stylesheet application/x-javascript	2a02:26f0:3500:595::1e0f AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://r4.res.office365.com/owa/prem/15.20.5588.10/scripts/boot.worldwide.0.mouse.js Requested by Host: outlook.office365.com URL: https://outlook.office365.com/owa/prefetch.aspx Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:595::1e0f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash d5238dcd5576de5c01381727798f579c4722e1c0b07f544135fbe537d7ccf94f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://outlook.office365.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Tue, 06 Sep 2022 13:03:12 GMT content-encoding gzip last-modified Sat, 27 Aug 2022 16:49:59 GMT server AkamaiNetStorage vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control public,max-age=630720000, s-maxage=630720000 strict-transport-security max-age=31536000; includeSubDomains accept-ranges bytes timing-allow-origin * content-length 179692
GET H2	200	boot.worldwide.1.mouse.js r4.res.office365.com/owa/prem/15.20.5588.10/scripts/ Frame 352F	644 KB 160 KB	23ms 23ms	Stylesheet application/x-javascript	2a02:26f0:3500:595::1e0f AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://r4.res.office365.com/owa/prem/15.20.5588.10/scripts/boot.worldwide.1.mouse.js Requested by Host: outlook.office365.com URL: https://outlook.office365.com/owa/prefetch.aspx Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:595::1e0f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash c7bcfcd2305204dd3ded9a440c9a0a67b14f8d63224ed72795b23243d90a6771 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://outlook.office365.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Tue, 06 Sep 2022 13:03:12 GMT content-encoding gzip last-modified Sat, 27 Aug 2022 16:49:54 GMT server AkamaiNetStorage vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control public,max-age=630720000, s-maxage=630720000 strict-transport-security max-age=31536000; includeSubDomains accept-ranges bytes timing-allow-origin * content-length 163086
GET H2	200	boot.worldwide.2.mouse.js r4.res.office365.com/owa/prem/15.20.5588.10/scripts/ Frame 352F	647 KB 166 KB	24ms 24ms	Stylesheet application/x-javascript	2a02:26f0:3500:595::1e0f AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://r4.res.office365.com/owa/prem/15.20.5588.10/scripts/boot.worldwide.2.mouse.js Requested by Host: outlook.office365.com URL: https://outlook.office365.com/owa/prefetch.aspx Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:595::1e0f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash 8533d0f21e61506e6a8e9517b63019a16b2af69805c6f2c86c02f6319e14de5d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://outlook.office365.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Tue, 06 Sep 2022 13:03:12 GMT content-encoding gzip last-modified Sat, 27 Aug 2022 16:49:59 GMT server AkamaiNetStorage vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control public,max-age=630720000, s-maxage=630720000 strict-transport-security max-age=31536000; includeSubDomains accept-ranges bytes timing-allow-origin * content-length 169702
GET H2	200	boot.worldwide.3.mouse.js r4.res.office365.com/owa/prem/15.20.5588.10/scripts/ Frame 352F	645 KB 143 KB	55ms 55ms	Stylesheet application/x-javascript	2a02:26f0:3500:595::1e0f AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://r4.res.office365.com/owa/prem/15.20.5588.10/scripts/boot.worldwide.3.mouse.js Requested by Host: outlook.office365.com URL: https://outlook.office365.com/owa/prefetch.aspx Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:595::1e0f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash 3224fc1f03fb8377b0529e4c270b18e9ff8f1720e86ca18530dc4fe551a00aa8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://outlook.office365.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Tue, 06 Sep 2022 13:03:12 GMT content-encoding gzip last-modified Sat, 27 Aug 2022 16:49:55 GMT server AkamaiNetStorage vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control public,max-age=630720000, s-maxage=630720000 strict-transport-security max-age=31536000; includeSubDomains accept-ranges bytes timing-allow-origin * content-length 145619
GET H2	200	sprite1.mouse.png r4.res.office365.com/owa/prem/15.20.5588.10/resources/images/0/ Frame 352F	132 B 336 B	22ms 22ms	Stylesheet image/png	2a02:26f0:3500:595::1e0f AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://r4.res.office365.com/owa/prem/15.20.5588.10/resources/images/0/sprite1.mouse.png Requested by Host: outlook.office365.com URL: https://outlook.office365.com/owa/prefetch.aspx Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:595::1e0f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash 3ab09a213eedd51a0eb0e4bc5e6e96c472032dd937420e7e233ea54775c7e024 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://outlook.office365.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Tue, 06 Sep 2022 13:03:12 GMT last-modified Sat, 27 Aug 2022 16:57:06 GMT server AkamaiNetStorage strict-transport-security max-age=31536000; includeSubDomains content-type image/png access-control-allow-origin * cache-control public,max-age=630720000, s-maxage=630720000 accept-ranges bytes timing-allow-origin * content-length 132
GET H2	200	sprite1.mouse.css r4.res.office365.com/owa/prem/15.20.5588.10/resources/images/0/ Frame 352F	994 B 512 B	28ms 25ms	Stylesheet text/css	2a02:26f0:3500:595::1e0f AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://r4.res.office365.com/owa/prem/15.20.5588.10/resources/images/0/sprite1.mouse.css Requested by Host: outlook.office365.com URL: https://outlook.office365.com/owa/prefetch.aspx Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:595::1e0f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash 6d1be7ed96dd494447f348986317faf64728ccf788be551f2a621b31ddc929ac Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://outlook.office365.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Tue, 06 Sep 2022 13:03:12 GMT content-encoding gzip last-modified Sat, 27 Aug 2022 16:57:09 GMT server AkamaiNetStorage vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control public,max-age=630720000, s-maxage=630720000 strict-transport-security max-age=31536000; includeSubDomains accept-ranges bytes timing-allow-origin * content-length 288
GET H2	200	boot.worldwide.mouse.css r4.res.office365.com/owa/prem/15.20.5588.10/resources/styles/0/ Frame 352F	227 KB 43 KB	30ms 29ms	Stylesheet text/css	2a02:26f0:3500:595::1e0f AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://r4.res.office365.com/owa/prem/15.20.5588.10/resources/styles/0/boot.worldwide.mouse.css Requested by Host: outlook.office365.com URL: https://outlook.office365.com/owa/prefetch.aspx Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:595::1e0f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash 37619b16288166cc76403f0b7df6586349b2d5628de00d5850c815d019b17904 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://outlook.office365.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Tue, 06 Sep 2022 13:03:12 GMT content-encoding gzip last-modified Sat, 27 Aug 2022 16:57:33 GMT server AkamaiNetStorage vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control public,max-age=630720000, s-maxage=630720000 strict-transport-security max-age=31536000; includeSubDomains accept-ranges bytes timing-allow-origin * content-length 44144

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation undefined| g_iSRSFailed undefined| g_sSRSSuccess function| webpackJsonp object| StringRepository boolean| __ function| NE function| NESubmit

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.account-loginxz2.ml/	1969-12-31 23:59:59	Name: PHPSESSID Value: 7109684d31f68bba2c02c1bea185432d
			www.office.com/	1969-12-31 23:59:59	Name: OH.SID Value: ee62a544-33c9-4f07-a753-99be34008e29
			www.office.com/	1970-01-20 05:48:18	Name: OH.DCAffinity Value: OH-weu
			www.office.com/	1970-01-20 14:33:25	Name: OH.FLID Value: 3742cba3-e341-4749-85f9-210cd8b5e32a
			outlook.office365.com/	1970-01-20 14:33:25	Name: ClientId Value: 31F9CC0283FF4D3DBFA0F3C9C189977C
			outlook.office365.com/	1970-01-20 10:08:27	Name: OIDC Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

outlook.office365.com
r4.res.office365.com
res.cdn.office.net
secure.aadcdn.microsoftonline-p.com
www.account-loginxz2.ml
www.office.com
162.241.114.206
2603:1026:301::2
2620:1ec:4::156
2a02:26f0:3500:18::1724:a287
2a02:26f0:3500:595::1e0f
2a02:26f0:ea:2a1::35c1
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
2ea93b4aad0d8a49e97d41571ca458262f29ff4fde0e4ba4450c780569b27915
3224fc1f03fb8377b0529e4c270b18e9ff8f1720e86ca18530dc4fe551a00aa8
37619b16288166cc76403f0b7df6586349b2d5628de00d5850c815d019b17904
3ab09a213eedd51a0eb0e4bc5e6e96c472032dd937420e7e233ea54775c7e024
5d5f416ad7320775414ef67557aab4066bb07103ed6e517c0a9abcf3cbf8ee1e
62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214
6d1be7ed96dd494447f348986317faf64728ccf788be551f2a621b31ddc929ac
8533d0f21e61506e6a8e9517b63019a16b2af69805c6f2c86c02f6319e14de5d
8b27fcc2fea5fb9a9aa55025aa0ab06244ad613d190b4639c94e1e61449e1d5d
c13db279143e1845ee4aaee5afedc5bd75e9f7d50024b63883b45332c4960b3b
c4fc4724c04599038233e77772bd4d5176f54323aa971c89005316df15110a00
c7bcfcd2305204dd3ded9a440c9a0a67b14f8d63224ed72795b23243d90a6771
d5238dcd5576de5c01381727798f579c4722e1c0b07f544135fbe537d7ccf94f
dcc86d9a3e74d17423f612e185e84a3fb6211f630d6bdb42332f97b88fdf59d0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ff309b77bb649de3a33e8cf455eac654972f1116862bd091cc63894a2ddddf46