microsoftonline.logins-oms.com
Open in
urlscan Pro
185.158.251.49
Malicious Activity!
Public Scan
Effective URL: https://microsoftonline.logins-oms.com/login.srf?__smso=jKipzebMRKqnfGieiUSzcA%3D%3D&list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fab...
Submission: On October 06 via manual from GB — Scanned from DE
Summary
TLS certificate: Issued by R3 on October 5th 2021. Valid for: 3 months.
This is the only time microsoftonline.logins-oms.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 91.220.42.215 91.220.42.215 | 42427 (MIMECAST-UK) (MIMECAST-UK) | |
3 | 104.244.42.5 104.244.42.5 | 13414 (TWITTER) (TWITTER) | |
2 2 | 2620:1ec:21::14 2620:1ec:21::14 | 8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 1 | 18.66.97.59 18.66.97.59 | 16509 (AMAZON-02) (AMAZON-02) | |
1 2 | 31.214.157.208 31.214.157.208 | 58329 (RACKPLACE) (RACKPLACE) | |
2 | 35.172.196.51 35.172.196.51 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 2a00:1450:400... 2a00:1450:4001:810::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2603:1026:c03... 2603:1026:c03:645b::2 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2001:67c:4e8:... 2001:67c:4e8:1033:2:100:0:a | 62041 (TELEGRAM) (TELEGRAM) | |
1 1 | 5.181.218.64 5.181.218.64 | 47583 (AS-HOSTINGER) (AS-HOSTINGER) | |
9 | 185.158.251.49 185.158.251.49 | 39378 (SERVINGA) (SERVINGA) | |
22 | 8 |
ASN42427 (MIMECAST-UK, GB)
PTR: eu-api.mimecast.com
protect-eu.mimecast.com |
ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
linkedin.com | |
www.linkedin.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-35-172-196-51.compute-1.amazonaws.com
pastoral-agreeable-heliotrope.glitch.me | |
caterwauling-rift-sandwich.glitch.me |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
outlook.office.com |
ASN39378 (SERVINGA, DE)
www.logins-oms.com | |
microsoftonline.logins-oms.com | |
login-live.logins-oms.com | |
hvrih4llz5bfjdc.logins-oms.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
logins-oms.com
www.logins-oms.com microsoftonline.logins-oms.com login-live.logins-oms.com hvrih4llz5bfjdc.logins-oms.com kaanzsjvdp8io2k.logins-oms.com Failed |
420 KB |
3 |
t.co
t.co |
1 KB |
2 |
glitch.me
pastoral-agreeable-heliotrope.glitch.me caterwauling-rift-sandwich.glitch.me |
19 KB |
2 |
xn--80apugd.com
1 redirects
home.xn--80apugd.com |
29 KB |
2 |
linkedin.com
2 redirects
linkedin.com www.linkedin.com |
2 KB |
2 |
mimecast.com
2 redirects
protect-eu.mimecast.com |
2 KB |
1 |
xn--80asucf0d.com
1 redirects
xn--80asucf0d.com |
507 B |
1 |
telegram.org
api.telegram.org |
619 B |
1 |
office.com
outlook.office.com |
1 KB |
1 |
googleapis.com
ajax.googleapis.com |
30 KB |
1 |
onelink.me
1 redirects
applle.onelink.me |
325 B |
0 |
microsoftonline.com
Failed
login.microsoftonline.com Failed |
|
22 | 12 |
Domain | Requested by | |
---|---|---|
4 | hvrih4llz5bfjdc.logins-oms.com |
microsoftonline.logins-oms.com
|
3 | t.co |
home.xn--80apugd.com
ajax.googleapis.com |
2 | microsoftonline.logins-oms.com |
www.logins-oms.com
microsoftonline.logins-oms.com |
2 | www.logins-oms.com |
t.co
www.logins-oms.com |
2 | home.xn--80apugd.com |
1 redirects
t.co
|
2 | protect-eu.mimecast.com | 2 redirects |
1 | login-live.logins-oms.com |
microsoftonline.logins-oms.com
|
1 | xn--80asucf0d.com | 1 redirects |
1 | api.telegram.org |
t.co
|
1 | caterwauling-rift-sandwich.glitch.me |
t.co
|
1 | outlook.office.com |
t.co
|
1 | ajax.googleapis.com |
pastoral-agreeable-heliotrope.glitch.me
|
1 | pastoral-agreeable-heliotrope.glitch.me |
t.co
|
1 | applle.onelink.me | 1 redirects |
1 | www.linkedin.com | 1 redirects |
1 | linkedin.com | 1 redirects |
0 | kaanzsjvdp8io2k.logins-oms.com Failed |
hvrih4llz5bfjdc.logins-oms.com
|
0 | login.microsoftonline.com Failed |
outlook.office.com
|
22 | 18 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
t.co DigiCert TLS RSA SHA256 2020 CA1 |
2021-02-05 - 2022-02-04 |
a year | crt.sh |
xn--80apugd.com R3 |
2021-09-25 - 2021-12-24 |
3 months | crt.sh |
glitch.com Amazon |
2021-01-18 - 2022-02-15 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2021-09-13 - 2021-11-20 |
2 months | crt.sh |
outlook.com DigiCert Cloud Services CA-1 |
2020-07-02 - 2022-07-02 |
2 years | crt.sh |
api.telegram.org Go Daddy Secure Certificate Authority - G2 |
2020-03-24 - 2022-05-23 |
2 years | crt.sh |
logins-oms.com R3 |
2021-10-05 - 2022-01-03 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://microsoftonline.logins-oms.com/login.srf?__smso=jKipzebMRKqnfGieiUSzcA%3D%3D&list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv&sso_reload=true
Frame ID: 8B75CD8724A30B3D4D8395426BBC7DDD
Requests: 19 HTTP requests in this frame
Frame:
https://login.microsoftonline.com/logout.srf?ct=1633532769&rver=7.0.6737.0&id=260563&ru=https:%2F%2Foutlook.com%2Fowa%2F%3Fexch%3D1%26RpsCsrfState%3Dd01cb5dd-274d-fe52-a6af-cba31aae8e18
Frame ID: 3852F3AA233EEB4854FF8C6E1EFF6D7C
Requests: 2 HTTP requests in this frame
Frame:
https://kaanzsjvdp8io2k.logins-oms.com/Prefetch/Prefetch.aspx
Frame ID: 1792804F5CB36987669492F00EDAF2BF
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://protect-eu.mimecast.com/s/YLxrCoQQpcPDKvAu1moAn?domain=%C2%ADt.co
HTTP 307
https://protect-eu.mimecast.com/redirect/eNqtlNtu20YQhl_F3WuJ3vMuhR7iBgbSNvFF4qJNw0DYo8SIp5LLJErgR-pL9Mk6JO1... HTTP 307
https://t.co/9vkEZ25kay?amp=1 Page URL
-
https://linkedin.com/redirect?url=https%3A%2F%2Fapplle%2Eonelink%2Eme%2FOOkN%2Faeb1fbf4&urlhash=X...
HTTP 301
https://www.linkedin.com/redirect?url=https%3A%2F%2Fapplle%2Eonelink%2Eme%2FOOkN%2Faeb1fbf4&urlhash=X... HTTP 303
https://applle.onelink.me/OOkN/aeb1fbf4 HTTP 302
https://home.xn--80apugd.com/?shortlink=aeb1fbf4&pid=Email&c=apple Page URL
-
https://home.xn--80apugd.com/?shortlink=aeb1fbf4&pid=Email&c=apple
HTTP 302
https://t.co/1EP1DMGUhC?shortlink=aeb1fbf4&pid=Email&c=apple Page URL
- https://pastoral-agreeable-heliotrope.glitch.me/ Page URL
- https://caterwauling-rift-sandwich.glitch.me/ Page URL
-
https://xn--80asucf0d.com/1/?list
HTTP 302
https://www.logins-oms.com/b/HFWuKI/?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv Page URL
- https://microsoftonline.logins-oms.com/login.srf?__smso=jKipzebMRKqnfGieiUSzcA%3D%3D&list=https%3A%2F%2Fedition.cnn... Page URL
- https://microsoftonline.logins-oms.com/login.srf?__smso=jKipzebMRKqnfGieiUSzcA%3D%3D&list=https%3A%2F%2Fedition.cnn... Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://protect-eu.mimecast.com/s/YLxrCoQQpcPDKvAu1moAn?domain=%C2%ADt.co
HTTP 307
https://protect-eu.mimecast.com/redirect/eNqtlNtu20YQhl_F3WuJ3vMuhR7iBgbSNvFF4qJNw0DYo8SIp5LLJErgR-pL9Mk6JO1GNtxe5UbQ7MzO4eP8-xn1rktog_amqsKHUFXvnth9zNp-l40HtEJV69CGrFAfXCi7lMo6gC0ZEwxTLTHG4IMEdIVMSsbtyya2kO9zcWvXoUlDgTZv4CSWVbgydQCzQKk3zVCXw1C2TRbqqkCrAg17Q2av0EybIBXR2tuYW6-iMLnA1mHLuDPECMcZJXe3qJDzPfBwrbnl0ljqQyDKY0917rgVjOZURIkdsZQo7B3HAYtgqSVGa-PzqNycr_ZiThZYlJTkSjpIEL3QJMfYGmcd1LPYz8F926ZXX7sBwHx97BZQdRgGswvFeR-dpnQ9pNHasBQfyk9TEMEE36weEratP2b7VN8nS6Tz2joXiOCCOUId0VRqPjVhdaC5k54FwR-SVUxJaw0gkFSySJlwxvso81x6Z5zDxOUBeDHsmcbKWxslATeDT-cUC_fIWk0wV4pOnJzCMXKvlMotFkRqitljZL9OA6dkU_iYinMgVJ3CpDxn4ubtDWy_L2HvJ3n81IDVlR5QE7lCdkAbqeHEgDrQU5lfEKwhwszBT_fBHX59-Xw5gPWGswvnwBxqM-zBEtESFYTnnFPPoHPMsICJDDeWOEsFNxF7Q6crje_hRlUePpjmOD6pzf5g4MfsxmaX7doMmoKo0b6DqDeXv19fvry6eP727FFBn_1m-qZsdmffwJ1Upxft2MBMaDyk0NcCTZO5-yNN78MXTQOOsitPJN3cLdvPIcazZ3dFZ56hNmU1Ox9tZo7xLQQ1y06ceBb8YZiIcwkbQAWVfKHxpZt_i19Olc5eBTf2ZTo-KP5_6B728F8hZbdoB7OMUpkJkRE1O_btkGaXaVI5dKbOHk1xs_C-aj08nwjPZMsO_t7LCIf1sJtmRt_GQHKtRL4Wgeu1ApWuo8v12mIjGNEEJEofm-j7KcnyYiTYUkQxJQRjCWrHmLC58thX05OfUjdsivPi_O-_Uuba4jx_f7j8g4qDOf5g6u47Mn2CaaF3W7cO2_GAyZbn2_eeQ1fb2xXZ3hYgW7G9XaM1zLcWmEjJlBZTlt04D1Vdqtfy0-v1i-tfriLGoXv2Z_XjBfjdOKS2Dr1b-JxsX9gt-un6NoEU12HMJgk7M0wt1-jmH3uLCck HTTP 307
https://t.co/9vkEZ25kay?amp=1 Page URL
-
https://linkedin.com/redirect?url=https%3A%2F%2Fapplle%2Eonelink%2Eme%2FOOkN%2Faeb1fbf4&urlhash=XtyK&trk
HTTP 301
https://www.linkedin.com/redirect?url=https%3A%2F%2Fapplle%2Eonelink%2Eme%2FOOkN%2Faeb1fbf4&urlhash=XtyK&trk HTTP 303
https://applle.onelink.me/OOkN/aeb1fbf4 HTTP 302
https://home.xn--80apugd.com/?shortlink=aeb1fbf4&pid=Email&c=apple Page URL
-
https://home.xn--80apugd.com/?shortlink=aeb1fbf4&pid=Email&c=apple
HTTP 302
https://t.co/1EP1DMGUhC?shortlink=aeb1fbf4&pid=Email&c=apple Page URL
- https://pastoral-agreeable-heliotrope.glitch.me/ Page URL
- https://caterwauling-rift-sandwich.glitch.me/ Page URL
-
https://xn--80asucf0d.com/1/?list
HTTP 302
https://www.logins-oms.com/b/HFWuKI/?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv Page URL
- https://microsoftonline.logins-oms.com/login.srf?__smso=jKipzebMRKqnfGieiUSzcA%3D%3D&list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv Page URL
- https://microsoftonline.logins-oms.com/login.srf?__smso=jKipzebMRKqnfGieiUSzcA%3D%3D&list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv&sso_reload=true Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://protect-eu.mimecast.com/s/YLxrCoQQpcPDKvAu1moAn?domain=%C2%ADt.co HTTP 307
- https://protect-eu.mimecast.com/redirect/eNqtlNtu20YQhl_F3WuJ3vMuhR7iBgbSNvFF4qJNw0DYo8SIp5LLJErgR-pL9Mk6JO1GNtxe5UbQ7MzO4eP8-xn1rktog_amqsKHUFXvnth9zNp-l40HtEJV69CGrFAfXCi7lMo6gC0ZEwxTLTHG4IMEdIVMSsbtyya2kO9zcWvXoUlDgTZv4CSWVbgydQCzQKk3zVCXw1C2TRbqqkCrAg17Q2av0EybIBXR2tuYW6-iMLnA1mHLuDPECMcZJXe3qJDzPfBwrbnl0ljqQyDKY0917rgVjOZURIkdsZQo7B3HAYtgqSVGa-PzqNycr_ZiThZYlJTkSjpIEL3QJMfYGmcd1LPYz8F926ZXX7sBwHx97BZQdRgGswvFeR-dpnQ9pNHasBQfyk9TEMEE36weEratP2b7VN8nS6Tz2joXiOCCOUId0VRqPjVhdaC5k54FwR-SVUxJaw0gkFSySJlwxvso81x6Z5zDxOUBeDHsmcbKWxslATeDT-cUC_fIWk0wV4pOnJzCMXKvlMotFkRqitljZL9OA6dkU_iYinMgVJ3CpDxn4ubtDWy_L2HvJ3n81IDVlR5QE7lCdkAbqeHEgDrQU5lfEKwhwszBT_fBHX59-Xw5gPWGswvnwBxqM-zBEtESFYTnnFPPoHPMsICJDDeWOEsFNxF7Q6crje_hRlUePpjmOD6pzf5g4MfsxmaX7doMmoKo0b6DqDeXv19fvry6eP727FFBn_1m-qZsdmffwJ1Upxft2MBMaDyk0NcCTZO5-yNN78MXTQOOsitPJN3cLdvPIcazZ3dFZ56hNmU1Ox9tZo7xLQQ1y06ceBb8YZiIcwkbQAWVfKHxpZt_i19Olc5eBTf2ZTo-KP5_6B728F8hZbdoB7OMUpkJkRE1O_btkGaXaVI5dKbOHk1xs_C-aj08nwjPZMsO_t7LCIf1sJtmRt_GQHKtRL4Wgeu1ApWuo8v12mIjGNEEJEofm-j7KcnyYiTYUkQxJQRjCWrHmLC58thX05OfUjdsivPi_O-_Uuba4jx_f7j8g4qDOf5g6u47Mn2CaaF3W7cO2_GAyZbn2_eeQ1fb2xXZ3hYgW7G9XaM1zLcWmEjJlBZTlt04D1Vdqtfy0-v1i-tfriLGoXv2Z_XjBfjdOKS2Dr1b-JxsX9gt-un6NoEU12HMJgk7M0wt1-jmH3uLCck HTTP 307
- https://t.co/9vkEZ25kay?amp=1
- https://linkedin.com/redirect?url=https%3A%2F%2Fapplle%2Eonelink%2Eme%2FOOkN%2Faeb1fbf4&urlhash=XtyK&trk HTTP 301
- https://www.linkedin.com/redirect?url=https%3A%2F%2Fapplle%2Eonelink%2Eme%2FOOkN%2Faeb1fbf4&urlhash=XtyK&trk HTTP 303
- https://applle.onelink.me/OOkN/aeb1fbf4 HTTP 302
- https://home.xn--80apugd.com/?shortlink=aeb1fbf4&pid=Email&c=apple
- https://home.xn--80apugd.com/?shortlink=aeb1fbf4&pid=Email&c=apple HTTP 302
- https://t.co/1EP1DMGUhC?shortlink=aeb1fbf4&pid=Email&c=apple
- https://xn--80asucf0d.com/1/?list HTTP 302
- https://www.logins-oms.com/b/HFWuKI/?list=https%3A%2F%2Fedition.cnn.com%2Fspecials%2Fabout-live-tv
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
9vkEZ25kay
t.co/ Redirect Chain
|
483 B 563 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
home.xn--80apugd.com/ Redirect Chain
|
72 KB 29 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1EP1DMGUhC
t.co/ Redirect Chain
|
295 B 365 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
pastoral-agreeable-heliotrope.glitch.me/ |
10 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logoff.owa
outlook.office.com/owa/ Frame 3852 |
291 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bl0i5UYz17
t.co/ |
286 B 562 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
caterwauling-rift-sandwich.glitch.me/ |
9 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
logout.srf
login.microsoftonline.com/ Frame 3852 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
getUpdates
api.telegram.org/bot1979842486:AAF89aRlkOwL9ElYyRXZMbl7p7AZ33IKhhg/ |
372 B 619 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.logins-oms.com/b/HFWuKI/ Redirect Chain
|
111 KB 24 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
www.logins-oms.com/b/HFWuKI/ |
307 B 422 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.srf
microsoftonline.logins-oms.com/ |
435 KB 119 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
login.srf
microsoftonline.logins-oms.com/ |
480 KB 115 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Me.htm
login-live.logins-oms.com/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ConvergedLogin_PCore_K6sxFOiq5RA7iKp07WnW3g2.js
hvrih4llz5bfjdc.logins-oms.com/shared/1.0/content/js/ |
458 KB 126 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Prefetch.aspx
kaanzsjvdp8io2k.logins-oms.com/Prefetch/ Frame 1792 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
converged.v2.login.min_lgjnfq3xbrj5zvj5ionvww2.css
hvrih4llz5bfjdc.logins-oms.com/ests/2.1/content/cdnbundles/ |
0 20 KB |
Other
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ux.converged.login.strings-de.min_gehy6aj7foxflw5sgkgr-a2.js
hvrih4llz5bfjdc.logins-oms.com/ests/2.1/content/cdnbundles/ |
0 14 KB |
Other
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2_bc3d32a696895f78c19df6c717586a5d.svg
hvrih4llz5bfjdc.logins-oms.com/shared/1.0/content/images/backgrounds/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
hvrih4llz5bfjdc.logins-oms.com/shared/1.0/content/images/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
signin-options_4e48046ce74f4b89d45037c90576bfac.svg
hvrih4llz5bfjdc.logins-oms.com/shared/1.0/content/images/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- login.microsoftonline.com
- URL
- https://login.microsoftonline.com/logout.srf?ct=1633532769&rver=7.0.6737.0&id=260563&ru=https:%2F%2Foutlook.com%2Fowa%2F%3Fexch%3D1%26RpsCsrfState%3Dd01cb5dd-274d-fe52-a6af-cba31aae8e18
- Domain
- kaanzsjvdp8io2k.logins-oms.com
- URL
- https://kaanzsjvdp8io2k.logins-oms.com/Prefetch/Prefetch.aspx
- Domain
- hvrih4llz5bfjdc.logins-oms.com
- URL
- https://hvrih4llz5bfjdc.logins-oms.com/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
- Domain
- hvrih4llz5bfjdc.logins-oms.com
- URL
- https://hvrih4llz5bfjdc.logins-oms.com/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
19 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.t.co/ | Name: muc Value: 07197e5a-6114-44e7-a74a-eabded49d2d3 |
|
.www.linkedin.com/ | Name: JSESSIONID Value: ajax:5406043888353721596 |
|
.linkedin.com/ | Name: lang Value: v=2&lang=de-de |
|
.linkedin.com/ | Name: bcookie Value: "v=2&55fdea76-eed5-4310-857c-b72c6a518863" |
|
.www.linkedin.com/ | Name: bscookie Value: "v=1&20211006150607ad368cce-4b1c-4be5-8acc-5f7219419740AQEtPE8zDR1BXA7Hvu4TPegErI5Kp1_D" |
|
.linkedin.com/ | Name: li_gc Value: MTswOzE2MzM1MzI3Njc7MjswMjElR4qfJuBqlY3tTV6rW4YVACYimY3XZkSCpcHLcDavFw== |
|
.linkedin.com/ | Name: lidc Value: "b=OGST00:s=O:r=O:a=O:p=O:g=2550:u=1:x=1:i=1633532767:t=1633619167:v=2:sig=AQEowtdoCSW5VFCMKTdMWS931CY2tLu1" |
|
.xn--80apugd.com/ | Name: __6ClM Value: y5hz5tRTSZu2sSbz0mnVSw== |
|
outlook.office.com/ | Name: RpsCsrfState.rIaND5DfTMXNRmVJiN_PnmhHGwY9gmzF2smV3KPUUA0 Value: d01cb5dd-274d-fe52-a6af-cba31aae8e18 |
|
xn--80asucf0d.com/ | Name: PHPSESSID Value: ebb51d8d4ccbf326b041470b0b115725 |
|
.logins-oms.com/ | Name: __smso Value: jKipzebMRKqnfGieiUSzcA== |
|
microsoftonline.logins-oms.com/ | Name: stsservicecookie Value: estsfd |
|
microsoftonline.logins-oms.com/ | Name: x-ms-gateway-slice Value: estsfd |
|
.microsoftonline.logins-oms.com/ | Name: AADSSO Value: NA|NoExtension |
|
microsoftonline.logins-oms.com/ | Name: SSOCOOKIEPULLED Value: 1 |
|
microsoftonline.logins-oms.com/ | Name: esctx Value: AQABAAAAAAD--DLA3VO7QrddgJg7WevrQ53tc9nSTqjED3ofBKHU4i7AtL0gI4M9I60SzVNqJh5JAY3XuArdmeQzm4PWjEtCSIUWSYZ-HKT3-3NZZzK8XxLGlKqqRe2ttm8wFaTFZTy-3GehYYQbzVk3j7aFIWCmh3-V_zilX91FzdVDM5-naTVBliXz1VKC-gwZ8duhbPggAA |
|
microsoftonline.logins-oms.com/ | Name: ExternalIdpStateHash Value: IKTGOXENfJIsC3k3e8h4cxfnIfekU9_-lu9384zvdgY |
|
microsoftonline.logins-oms.com/ | Name: buid Value: 0.ASIAqzBRR7ViQUKp00fjfJvCFakreHKQRANPjYJWI3DqNWYBAAA.AQABAAEAAAD--DLA3VO7QrddgJg7WevrLI8i17gLkLoeEtsNiBmNYJrHG62Gor7XH6Nd-5j7w1ZJYjKTSvPmQVIVszfm8gOhxRlA4OibmULatrqRmOUmlTklbY7OffVUFG2krFPr_88gAA |
|
microsoftonline.logins-oms.com/ | Name: fpc Value: AkxnVq2d2aVPq0v6yCMqUDC4vjNwAQAAAGOy79gOAAAA |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=0 |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
api.telegram.org
applle.onelink.me
caterwauling-rift-sandwich.glitch.me
home.xn--80apugd.com
hvrih4llz5bfjdc.logins-oms.com
kaanzsjvdp8io2k.logins-oms.com
linkedin.com
login-live.logins-oms.com
login.microsoftonline.com
microsoftonline.logins-oms.com
outlook.office.com
pastoral-agreeable-heliotrope.glitch.me
protect-eu.mimecast.com
t.co
www.linkedin.com
www.logins-oms.com
xn--80asucf0d.com
hvrih4llz5bfjdc.logins-oms.com
kaanzsjvdp8io2k.logins-oms.com
login.microsoftonline.com
104.244.42.5
18.66.97.59
185.158.251.49
2001:67c:4e8:1033:2:100:0:a
2603:1026:c03:645b::2
2620:1ec:21::14
2a00:1450:4001:810::200a
31.214.157.208
35.172.196.51
5.181.218.64
91.220.42.215
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
113ba48deea5ab6fdb783bc109f7bc1201395fe859ec3be9c9c8ce9973fef166
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
474c01edc0c8fdc6d4c8c32f74bd887ff4e998a75becb7fa127991043630ffc0
ab42df3d29f575c5ebc51b7a3a1aafb4191c5dc7086c9b7160e834da44fdd5cc
c49b6dafffbc56fe4efedee6beef26614c964faebea2c0e0fb006872526c05b6
d7565752c12dd71ccf2efe712444cfdfa5a7dd77ff87b9297055bf2f1cdb437d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f76a09fd66a0ac4487e7a02012df611c5ba341b017d452f6e1ae26db28752642
f88c087cfd2f9837da1da8436b7f79fb484bf4db53deea7acbf966061e082447