microsoftonline.officefileauthentication.com Open in urlscan Pro
195.242.110.146 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://securemsg.docsx.fastmail.fm/
Effective URL:
https://microsoftonline.officefileauthentication.com/login.srf?__smso=Qd5Hyr72SDSbS0LVXnaXHw%3D%3D&username=%EF%BF%BD%EF%BF%BDe&sso_reload=true
Submission: On March 01 via api (March 1st 2022, 8:24:09 am UTC) from IE — Scanned from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 5 domains to perform 8 HTTP transactions. The main IP is 195.242.110.146, located in Belize and belongs to INTERNET-IT, SC. The main domain is microsoftonline.officefileauthentication.com.
TLS certificate: Issued by R3 on February 28th 2022. Valid for: 3 months.

This is the only time microsoftonline.officefileauthentication.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	66.111.4.53 66.111.4.53	19151 (BBO-1) (BBO-1)
1	66.111.4.86 66.111.4.86	19151 (BBO-1) (BBO-1)
1 2	195.242.111.113 195.242.111.113	200313 (INTERNET-IT) (INTERNET-IT)
1 1	195.242.111.121 195.242.111.121	200313 (INTERNET-IT) (INTERNET-IT)
4	195.242.110.146 195.242.110.146	200313 (INTERNET-IT) (INTERNET-IT)
8	4

1 66.111.4.53 (United States) 1 redirects

ASN19151 (BBO-1, US)
PTR: web.messagingengine.com

securemsg.docsx.fastmail.fm	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.111.4.86 (United States)

ASN19151 (BBO-1, US)
PTR: user.fm

securemsg.docsx.fastmail.fm.user.fm	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 195.242.111.113 (Belize) 1 redirects

ASN200313 (INTERNET-IT, SC)
PTR: reverse2.prohoster.info

onedrive.sharedownload.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 195.242.111.121 (Belize) 1 redirects

ASN200313 (INTERNET-IT, SC)
PTR: centos.prohoster.info

officefiles.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 195.242.110.146 (Belize)

ASN200313 (INTERNET-IT, SC)
PTR: reverse.prohoster.info

www.officefileauthentication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
microsoftonline.officefileauthentication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	officefileauthentication.com www.officefileauthentication.com microsoftonline.officefileauthentication.com login-live.officefileauthentication.com Failed nadqxokiiwgsprb.officefileauthentication.com Failed	259 KB
2	sharedownload.cc 1 redirects onedrive.sharedownload.cc	29 KB
1	officefiles.cc 1 redirects officefiles.cc	274 B
1	user.fm securemsg.docsx.fastmail.fm.user.fm	671 B
1	fastmail.fm 1 redirects securemsg.docsx.fastmail.fm	283 B
8	5

	Domain	Requested by
2	microsoftonline.officefileauthentication.com	www.officefileauthentication.com microsoftonline.officefileauthentication.com
2	www.officefileauthentication.com	onedrive.sharedownload.cc www.officefileauthentication.com
2	onedrive.sharedownload.cc	1 redirects securemsg.docsx.fastmail.fm.user.fm
1	officefiles.cc	1 redirects
1	securemsg.docsx.fastmail.fm.user.fm
1	securemsg.docsx.fastmail.fm	1 redirects
0	nadqxokiiwgsprb.officefileauthentication.com Failed	microsoftonline.officefileauthentication.com
0	login-live.officefileauthentication.com Failed	microsoftonline.officefileauthentication.com
8	8

This site contains no links.

Subject Issuer	Validity	Valid
sharedownload.cc R3	`2022-02-17` - `2022-05-18`	3 months	crt.sh
officefileauthentication.com R3	`2022-02-28` - `2022-05-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://microsoftonline.officefileauthentication.com/login.srf?__smso=Qd5Hyr72SDSbS0LVXnaXHw%3D%3D&username=%EF%BF%BD%EF%BF%BDe&sso_reload=true
Frame ID: C1356B345362A84C4BFBF5D19FC63D70
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://securemsg.docsx.fastmail.fm/ HTTP 301
http://securemsg.docsx.fastmail.fm.user.fm/ Page URL
https://onedrive.sharedownload.cc/?sJW3Zv=id&document=null Page URL
https://onedrive.sharedownload.cc/?sJW3Zv=id&document=null HTTP 302
http://officefiles.cc/document/?document=null HTTP 302
https://www.officefileauthentication.com/b/20QEsO/?username=%9E%E9e Page URL
https://microsoftonline.officefileauthentication.com/login.srf?__smso=Qd5Hyr72SDSbS0LVXnaXHw%3D%3D&username=%EF%BF%BD%EF%BF%BDe Page URL
https://microsoftonline.officefileauthentication.com/login.srf?__smso=Qd5Hyr72SDSbS0LVXnaXHw%3D%3D&username=%EF%BF%BD%EF%BF%BDe&s... Page URL

Page Statistics

8
Requests

63 %
HTTPS

0 %
IPv6

5
Domains

8
Subdomains

4
IPs

2
Countries

289 kB
Transfer

1105 kB
Size

7
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://securemsg.docsx.fastmail.fm/ HTTP 301
http://securemsg.docsx.fastmail.fm.user.fm/ Page URL
https://onedrive.sharedownload.cc/?sJW3Zv=id&document=null Page URL
https://onedrive.sharedownload.cc/?sJW3Zv=id&document=null HTTP 302
http://officefiles.cc/document/?document=null HTTP 302
https://www.officefileauthentication.com/b/20QEsO/?username=%9E%E9e Page URL
https://microsoftonline.officefileauthentication.com/login.srf?__smso=Qd5Hyr72SDSbS0LVXnaXHw%3D%3D&username=%EF%BF%BD%EF%BF%BDe Page URL
https://microsoftonline.officefileauthentication.com/login.srf?__smso=Qd5Hyr72SDSbS0LVXnaXHw%3D%3D&username=%EF%BF%BD%EF%BF%BDe&sso_reload=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://securemsg.docsx.fastmail.fm/ HTTP 301
http://securemsg.docsx.fastmail.fm.user.fm/

Request Chain 2

https://onedrive.sharedownload.cc/?sJW3Zv=id&document=null HTTP 302
http://officefiles.cc/document/?document=null HTTP 302
https://www.officefileauthentication.com/b/20QEsO/?username=%9E%E9e

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/ Show response
securemsg.docsx.fastmail.fm.user.fm/
Redirect Chain

http://securemsg.docsx.fastmail.fm/
http://securemsg.docsx.fastmail.fm.user.fm/

262 B
671 B

505ms
97ms

Document
text/html

66.111.4.86
BBO-1

General

Check archive.org

Show headers Download Go to

Full URL: http://securemsg.docsx.fastmail.fm.user.fm/
Protocol: HTTP/1.1
Server: 66.111.4.86 , United States, ASN19151 (BBO-1, US),
Reverse DNS: user.fm
Software: nginx /
Resource Hash: 88715b7a7ec5f40521e4e0a60c702abe6963f54b2f32db072365117f7569450b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Server: nginx
Date: Tue, 01 Mar 2022 08:24:04 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
x-backend: web2 web2
etag: W/"433456ee1b18d0521cdac7f070113342c76d3fbf"
content-disposition: inline
access-control-allow-origin: *
last-modified: Thu, 24 Feb 2022 05:19:49 GMT
X-Frontend: frontend2
X-Trace-Id: ti_5bfd0cc535d36a14e9825afd37375b79
Content-Encoding: gzip

Redirect headers

Server: nginx
Date: Tue, 01 Mar 2022 08:24:04 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: http://securemsg.docsx.fastmail.fm.user.fm/
X-Frontend: frontend1
X-Trace-Id: ti_cb780d33a16e272041b0b23ca588ad44

GET
H2 200 / Show response
onedrive.sharedownload.cc/ 72 KB
29 KB 204ms
120ms Document
text/html 195.242.111.113
INTERNET-IT

General

Check archive.org

Show headers Download Go to

Full URL

https://onedrive.sharedownload.cc/?sJW3Zv=id&document=null

Requested by

Host: securemsg.docsx.fastmail.fm.user.fm
URL: http://securemsg.docsx.fastmail.fm.user.fm/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

195.242.111.113 , Belize, ASN200313 (INTERNET-IT, SC),

Reverse DNS

reverse2.prohoster.info

Software

nginx/1.17.10 /

Resource Hash

5b053405dc218cff42e7172ce1c0566f5486728c94a47b10b06ee4bfedcc9f7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://securemsg.docsx.fastmail.fm.user.fm/

Response headers

server: nginx/1.17.10
date: Tue, 01 Mar 2022 08:24:05 GMT
content-type: text/html; charset=utf-8
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip

GET
H2

200

/ Show response
www.officefileauthentication.com/b/20QEsO/
Redirect Chain

https://onedrive.sharedownload.cc/?sJW3Zv=id&document=null
http://officefiles.cc/document/?document=null
https://www.officefileauthentication.com/b/20QEsO/?username=%9E%E9e

111 KB
24 KB

284ms
154ms

Document
text/html

195.242.110.146
INTERNET-IT

General

Check archive.org

Show headers Download Go to

Full URL

https://www.officefileauthentication.com/b/20QEsO/?username=%9E%E9e

Requested by

Host: onedrive.sharedownload.cc
URL: https://onedrive.sharedownload.cc/?sJW3Zv=id&document=null

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

195.242.110.146 , Belize, ASN200313 (INTERNET-IT, SC),

Reverse DNS

reverse.prohoster.info

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

4e57e8689e5dc34c7ff369eb6831f5c84bd992ba28b223e46ed78fc58fd1e254

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://onedrive.sharedownload.cc/?sJW3Zv=id&document=null

Response headers

server: nginx/1.18.0 (Ubuntu)
date: Tue, 01 Mar 2022 08:24:06 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip

Redirect headers

Date: Tue, 01 Mar 2022 08:24:05 GMT
Server: Apache
Location: https://www.officefileauthentication.com/b/20QEsO/?username=e
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

POST
H2 200 /
www.officefileauthentication.com/b/20QEsO/ 297 B
414 B 115ms
115ms XHR
application/json 195.242.110.146
INTERNET-IT

General

Check archive.org

Show headers Download Go to

Full URL

https://www.officefileauthentication.com/b/20QEsO/?username=%9E%E9e

Requested by

Host: www.officefileauthentication.com
URL: https://www.officefileauthentication.com/b/20QEsO/?username=%9E%E9e

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

195.242.110.146 , Belize, ASN200313 (INTERNET-IT, SC),

Reverse DNS

reverse.prohoster.info

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.officefileauthentication.com/b/20QEsO/?username=%9E%E9e
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Tue, 01 Mar 2022 08:24:06 GMT
content-encoding: gzip
vary: Accept-Encoding
server: nginx/1.18.0 (Ubuntu)
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json

GET
H2 200 login.srf Show response
microsoftonline.officefileauthentication.com/ 437 KB
120 KB 1661ms
1630ms Document
text/html 195.242.110.146
INTERNET-IT

General

Check archive.org

Show headers Download Go to

Full URL

https://microsoftonline.officefileauthentication.com/login.srf?__smso=Qd5Hyr72SDSbS0LVXnaXHw%3D%3D&username=%EF%BF%BD%EF%BF%BDe

Requested by

Host: www.officefileauthentication.com
URL: https://www.officefileauthentication.com/b/20QEsO/?username=%9E%E9e

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

195.242.110.146 , Belize, ASN200313 (INTERNET-IT, SC),

Reverse DNS

reverse.prohoster.info

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

3a27c75302ccd0c2f39c1397ebda38295d69c3805c0c6cb7c98893c7cfd35af3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.officefileauthentication.com/

Response headers

server: nginx/1.18.0 (Ubuntu)
date: Tue, 01 Mar 2022 08:24:08 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding Accept-Encoding
cache-control: no-store, no-cache
pragma: no-cache
p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
x-ms-request-id: 64a6c668-ce65-47e7-98e5-aa316dc57100
x-ms-ests-server: 2.1.12470.13 - NEULR1 ProdSlices
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]}
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
referrer-policy: strict-origin-when-cross-origin
access-control-allow-origin: *
access-control-allow-headers: *
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip

GET
H2 200 Primary Request login.srf Show response
microsoftonline.officefileauthentication.com/ 484 KB
116 KB 982ms
982ms Document
text/html 195.242.110.146
INTERNET-IT

General

Check archive.org

Show headers Download Go to

Full URL

https://microsoftonline.officefileauthentication.com/login.srf?__smso=Qd5Hyr72SDSbS0LVXnaXHw%3D%3D&username=%EF%BF%BD%EF%BF%BDe&sso_reload=true

Requested by

Host: microsoftonline.officefileauthentication.com
URL: https://microsoftonline.officefileauthentication.com/login.srf?__smso=Qd5Hyr72SDSbS0LVXnaXHw%3D%3D&username=%EF%BF%BD%EF%BF%BDe

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

195.242.110.146 , Belize, ASN200313 (INTERNET-IT, SC),

Reverse DNS

reverse.prohoster.info

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

0abb0cbfedfb685db2642e0b06d53bc0a71fbdb3386f64959ca6cf383d9a9238

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://microsoftonline.officefileauthentication.com/login.srf?__smso=Qd5Hyr72SDSbS0LVXnaXHw%3D%3D&username=%EF%BF%BD%EF%BF%BDe

Response headers

server: nginx/1.18.0 (Ubuntu)
date: Tue, 01 Mar 2022 08:24:09 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding Accept-Encoding
cache-control: no-store, no-cache
pragma: no-cache
p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
x-ms-request-id: bece0a8a-96ea-4ca3-aaae-15f1ac6e8e00
x-ms-ests-server: 2.1.12470.13 - WEULR2 ProdSlices
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]}
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
referrer-policy: strict-origin-when-cross-origin
access-control-allow-origin: *
access-control-allow-headers: *
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip

GET Me.htm
login-live.officefileauthentication.com/ 0
0

GET ConvergedLogin_PCore_DzSOUEvrcCbogVJQe7hGlg2.js
nadqxokiiwgsprb.officefileauthentication.com/shared/1.0/content/js/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: login-live.officefileauthentication.com
URL: https://login-live.officefileauthentication.com/Me.htm?v=3

Domain: nadqxokiiwgsprb.officefileauthentication.com
URL: https://nadqxokiiwgsprb.officefileauthentication.com/shared/1.0/content/js/ConvergedLogin_PCore_DzSOUEvrcCbogVJQe7hGlg2.js

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.sharedownload.cc/	1970-01-20 10:00:59	Name: __F2GP Value: kT6ucDPSR4SaZj4UEK3rPw==
.officefileauthentication.com/	1970-01-20 01:36:59	Name: __smso Value: Qd5Hyr72SDSbS0LVXnaXHw==
microsoftonline.officefileauthentication.com/	1970-02-08 03:13:58	Name: fpc Value: AnUdVB8t_-JAjyiCt_JS18M
microsoftonline.officefileauthentication.com/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd
microsoftonline.officefileauthentication.com/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
.microsoftonline.officefileauthentication.com/	1969-12-31 23:59:59	Name: AADSSO Value: NA\|NoExtension
microsoftonline.officefileauthentication.com/	1970-01-20 01:15:23	Name: SSOCOOKIEPULLED Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

login-live.officefileauthentication.com
microsoftonline.officefileauthentication.com
nadqxokiiwgsprb.officefileauthentication.com
officefiles.cc
onedrive.sharedownload.cc
securemsg.docsx.fastmail.fm
securemsg.docsx.fastmail.fm.user.fm
www.officefileauthentication.com
login-live.officefileauthentication.com
nadqxokiiwgsprb.officefileauthentication.com
195.242.110.146
195.242.111.113
195.242.111.121
66.111.4.53
66.111.4.86
0abb0cbfedfb685db2642e0b06d53bc0a71fbdb3386f64959ca6cf383d9a9238
3a27c75302ccd0c2f39c1397ebda38295d69c3805c0c6cb7c98893c7cfd35af3
4e57e8689e5dc34c7ff369eb6831f5c84bd992ba28b223e46ed78fc58fd1e254
5b053405dc218cff42e7172ce1c0566f5486728c94a47b10b06ee4bfedcc9f7a
88715b7a7ec5f40521e4e0a60c702abe6963f54b2f32db072365117f7569450b

microsoftonline.officefileauthentication.com Open in urlscan Pro 195.242.110.146 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

8 Requests

63 %HTTPS

0 %IPv6

5 Domains

8 Subdomains

4 IPs

2 Countries

289 kBTransfer

1105 kBSize

7 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

7 Cookies

Indicators

microsoftonline.officefileauthentication.com Open in urlscan Pro
195.242.110.146 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

63 %
HTTPS

0 %
IPv6

5
Domains

8
Subdomains

4
IPs

2
Countries

289 kB
Transfer

1105 kB
Size

7
Cookies

8 HTTP transactions
0 data transactions