chelseahouse.ca
Open in
urlscan Pro
162.249.2.226
Malicious Activity!
Public Scan
URL:
https://chelseahouse.ca/bit/
Submission: On December 11 via manual from US
Submission: On December 11 via manual from US
Summary
This website contacted 13 IPs
in 3 countries
across 9 domains to perform 36 HTTP transactions.
The main IP is 162.249.2.226, located in
Ann Arbor, United States and
belongs to A2HOSTING, US.
The main domain is chelseahouse.ca.
TLS certificate: Issued by R3 on December 7th 2020. Valid for: 3 months.
This is the only time chelseahouse.ca was scanned on urlscan.io!
TLS certificate: Issued by R3 on December 7th 2020. Valid for: 3 months.
This is the only time chelseahouse.ca was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Office 365 (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 2 | 162.249.2.226 162.249.2.226 | 55293 (A2HOSTING) (A2HOSTING) | |
| 19 | 104.79.89.91 104.79.89.91 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
| 3 | 2a02:26f0:170... 2a02:26f0:1700:1aa::356e | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 1 | 2.16.186.41 2.16.186.41 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 1 | 2a02:26f0:6c0... 2a02:26f0:6c00::210:ba28 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 1 | 2a02:26f0:170... 2a02:26f0:1700:181::37 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 1 | 20.190.129.130 20.190.129.130 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 1 | 20.190.129.160 20.190.129.160 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 2 | 40.77.226.250 40.77.226.250 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 3 | 2a02:26f0:eb:... 2a02:26f0:eb:384::356e | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 1 2 | 52.142.114.2 52.142.114.2 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 1 1 | 2620:1ec:c11:... 2620:1ec:c11::200 | 8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 2 | 52.114.159.32 52.114.159.32 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 36 | 13 |
2
162.249.2.226
(Ann Arbor, United States)
ASN55293 (A2HOSTING, US)
PTR: server.sdfsdcsxczx.com
ASN55293 (A2HOSTING, US)
PTR: server.sdfsdcsxczx.com
| chelseahouse.ca |
19
104.79.89.91
(United States)
ASN16625 (AKAMAI-AS, US)
PTR: a104-79-89-91.deploy.static.akamaitechnologies.com
ASN16625 (AKAMAI-AS, US)
PTR: a104-79-89-91.deploy.static.akamaitechnologies.com
| blobs.officehome.msocdn.com |
1
2.16.186.41
(Ascension Island)
ASN20940 (AKAMAI-ASN1, EU)
PTR: a2-16-186-41.deploy.static.akamaitechnologies.com
ASN20940 (AKAMAI-ASN1, EU)
PTR: a2-16-186-41.deploy.static.akamaitechnologies.com
| statics-marketingsites-neu-ms-com.akamaized.net |
1
2a02:26f0:6c00::210:ba28
(Ascension Island)
ASN20940 (AKAMAI-ASN1, EU)
ASN20940 (AKAMAI-ASN1, EU)
| img-prod-cms-rt-microsoft-com.akamaized.net |
1
20.190.129.160
(Dublin, Ireland)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
| login.microsoftonline.com |
2
40.77.226.250
(Dublin, Ireland)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
| web.vortex.data.microsoft.com |
2
52.114.159.32
(San Jose, United States)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
| browser.pipe.aria.microsoft.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 19 |
msocdn.com
blobs.officehome.msocdn.com |
351 KB |
| 9 |
microsoft.com
1 redirects
www.microsoft.com web.vortex.data.microsoft.com c1.microsoft.com browser.pipe.aria.microsoft.com |
84 KB |
| 3 |
s-microsoft.com
c.s-microsoft.com |
92 KB |
| 2 |
akamaized.net
statics-marketingsites-neu-ms-com.akamaized.net img-prod-cms-rt-microsoft-com.akamaized.net |
5 KB |
| 2 |
chelseahouse.ca
1 redirects
chelseahouse.ca |
65 KB |
| 1 |
bing.com
1 redirects
c.bing.com |
505 B |
| 1 |
microsoftonline.com
login.microsoftonline.com |
|
| 1 |
live.com
login.live.com |
|
| 1 |
gfx.ms
mem.gfx.ms |
10 KB |
| 36 | 9 |
| Domain | Requested by | |
|---|---|---|
| 19 | blobs.officehome.msocdn.com |
chelseahouse.ca
|
| 3 | c.s-microsoft.com |
www.microsoft.com
|
| 3 | www.microsoft.com |
chelseahouse.ca
www.microsoft.com |
| 2 | browser.pipe.aria.microsoft.com |
blobs.officehome.msocdn.com
|
| 2 | c1.microsoft.com | 1 redirects |
| 2 | web.vortex.data.microsoft.com |
blobs.officehome.msocdn.com
|
| 2 | chelseahouse.ca | 1 redirects |
| 1 | c.bing.com | 1 redirects |
| 1 | login.microsoftonline.com |
blobs.officehome.msocdn.com
|
| 1 | login.live.com |
blobs.officehome.msocdn.com
|
| 1 | mem.gfx.ms |
chelseahouse.ca
|
| 1 | img-prod-cms-rt-microsoft-com.akamaized.net |
chelseahouse.ca
|
| 1 | statics-marketingsites-neu-ms-com.akamaized.net |
chelseahouse.ca
|
| 36 | 13 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.microsoft.com |
| www.office.com |
| products.office.com |
| go.microsoft.com |
| blogs.office.com |
| templates.office.com |
| support.office.com |
| office.live.com |
| www.linkedin.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| www.chelseahouse.ca R3 |
2020-12-07 - 2021-03-07 |
3 months | crt.sh |
| *.officehome.msocdn.com DigiCert Cloud Services CA-1 |
2020-10-19 - 2021-10-18 |
a year | crt.sh |
| www.microsoft.com Microsoft RSA TLS CA 01 |
2020-08-28 - 2021-08-28 |
a year | crt.sh |
| a248.e.akamai.net DigiCert Secure Site ECC CA-1 |
2020-07-15 - 2021-09-13 |
a year | crt.sh |
| mem.gfx.ms Microsoft RSA TLS CA 02 |
2020-11-11 - 2021-11-11 |
a year | crt.sh |
| graph.windows.net DigiCert SHA2 Secure Server CA |
2020-10-22 - 2021-10-21 |
a year | crt.sh |
| stamp2.login.microsoftonline.com DigiCert SHA2 Secure Server CA |
2020-10-13 - 2021-10-12 |
a year | crt.sh |
| *.vortex.data.microsoft.com Microsoft RSA TLS CA 02 |
2020-10-05 - 2021-10-05 |
a year | crt.sh |
| c.msn.com Microsoft RSA TLS CA 01 |
2020-10-07 - 2021-10-07 |
a year | crt.sh |
| *.events.data.microsoft.com Microsoft Azure TLS Issuing CA 01 |
2020-09-14 - 2021-09-09 |
a year | crt.sh |
This page contains 3 frames:
Primary Page:
https://chelseahouse.ca/bit/
Frame ID: 836703E936CE0F6BBF1D539A1C82421F
Requests: 36 HTTP requests in this frame
Frame:
https://login.live.com/Me.srf?wa=wsignin1.0&wreply=https://www.office.com/
Frame ID: 9311A0BC8CEC580FCDF270C3D2481E63
Requests: 1 HTTP requests in this frame
Frame:
https://login.microsoftonline.com/savedusers?wreply=https://www.office.com/&appid=4345a7b9-9a63-4910-a426-35363201d503
Frame ID: A8B94585D2F694AC83A4B8C5785EFB3B
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://chelseahouse.ca/bit
HTTP 301
https://chelseahouse.ca/bit/ Page URL
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
37 Outgoing links
These are links going to different origins than the main page.
URL: https://www.microsoft.com/
Title: Microsoft
Title: Microsoft
Search URL Search Domain Scan URL
URL: https://www.office.com/
Title: Office
Title: Office
Search URL Search Domain Scan URL
URL: https://products.office.com/compare-all-microsoft-office-products?tab=1
Title: Plans & pricing
Title: Plans & pricing
Search URL Search Domain Scan URL
URL: https://products.office.com/office-365-home
Title: For households
Title: For households
Search URL Search Domain Scan URL
URL: https://products.office.com/office-365-personal
Title: For individuals
Title: For individuals
Search URL Search Domain Scan URL
URL: https://products.office.com/office-online/documents-spreadsheets-presentations-office-online
Title: Office Online
Title: Office Online
Search URL Search Domain Scan URL
URL: https://products.office.com/compare-all-microsoft-office-products?tab=2
Title: Plans & pricing
Title: Plans & pricing
Search URL Search Domain Scan URL
URL: https://products.office.com/business/explore-office-365-for-business
Title: Small business
Title: Small business
Search URL Search Domain Scan URL
URL: https://products.office.com/business/enterprise-productivity-tools
Title: Enterprise
Title: Enterprise
Search URL Search Domain Scan URL
URL: https://products.office.com/business/enterprise-firstline-workers
Title: Firstline workers
Title: Firstline workers
Search URL Search Domain Scan URL
URL: https://products.office.com/business/office
Title: See all business
Title: See all business
Search URL Search Domain Scan URL
URL: https://products.office.com/student/office-in-education
Title: For students & teachers
Title: For students & teachers
Search URL Search Domain Scan URL
URL: https://products.office.com/academic/compare-office-365-education-plans
Title: For schools
Title: For schools
Search URL Search Domain Scan URL
URL: https://products.office.com/outlook/email-and-calendar-software-microsoft-outlook
Title: Outlook
Title: Outlook
Search URL Search Domain Scan URL
URL: https://products.office.com/onedrive-for-business/online-cloud-storage
Title: OneDrive
Title: OneDrive
Search URL Search Domain Scan URL
URL: https://products.office.com/word
Title: Word
Title: Word
Search URL Search Domain Scan URL
URL: https://products.office.com/excel
Title: Excel
Title: Excel
Search URL Search Domain Scan URL
URL: https://products.office.com/powerpoint
Title: PowerPoint
Title: PowerPoint
Search URL Search Domain Scan URL
URL: https://products.office.com/onenote
Title: OneNote
Title: OneNote
Search URL Search Domain Scan URL
URL: https://products.office.com/sharepoint/collaboration
Title: SharePoint
Title: SharePoint
Search URL Search Domain Scan URL
URL: https://products.office.com/microsoft-teams/group-chat-software
Title: Microsoft Teams
Title: Microsoft Teams
Search URL Search Domain Scan URL
URL: https://products.office.com/products
Title: See all Office products
Title: See all Office products
Search URL Search Domain Scan URL
URL: https://products.office.com/business/office-365-customer-stories-office-testimonials
Title: Customer stories
Title: Customer stories
Search URL Search Domain Scan URL
URL: https://products.office.com/microsoft-office-for-home-and-school-faq
Title: Frequently asked questions
Title: Frequently asked questions
Search URL Search Domain Scan URL
URL: https://go.microsoft.com/fwlink/p/?LinkID=717124
Title: Install Office
Title: Install Office
Search URL Search Domain Scan URL
URL: https://products.office.com/business/office-for-it-pros
Title: IT Pro resources
Title: IT Pro resources
Search URL Search Domain Scan URL
URL: https://blogs.office.com/
Title: Office blog
Title: Office blog
Search URL Search Domain Scan URL
URL: https://products.office.com/business/office-365-trust-center-welcome
Title: Security & compliance
Title: Security & compliance
Search URL Search Domain Scan URL
URL: https://products.office.com/office-system-requirements
Title: System requirements
Title: System requirements
Search URL Search Domain Scan URL
URL: https://templates.office.com/
Title: Templates
Title: Templates
Search URL Search Domain Scan URL
URL: https://support.office.com/
Title: Support
Title: Support
Search URL Search Domain Scan URL
URL: https://office.live.com/start/MyAccount.aspx
Title: My account
Title: My account
Search URL Search Domain Scan URL
URL: https://products.office.com/en-US/student/office-in-education
Title: For education
Title: For education
Search URL Search Domain Scan URL
URL: https://www.linkedin.com/company/3509299
Title:
Title:
Search URL Search Domain Scan URL
URL: https://go.microsoft.com/fwlink/p/?LinkID=506743
Title:
Title:
Search URL Search Domain Scan URL
URL: https://go.microsoft.com/fwlink/p/?LinkId=506744
Title:
Title:
Search URL Search Domain Scan URL
URL: https://go.microsoft.com/fwlink/p/?LinkId=524828
Title:
Title:
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://chelseahouse.ca/bit
HTTP 301
https://chelseahouse.ca/bit/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 34- https://c1.microsoft.com/c.gif?DI=4050&did=1&t= HTTP 302
- https://c.bing.com/c.gif?DI=4050&did=1&t=&CtsSyncId=28AF198B5E30409EBA6995E366C3C088&RedC=c1.microsoft.com&MXFR=291EB9F71CB5698D05C9B66A18B56FFA HTTP 302
- https://c1.microsoft.com/c.gif?DI=4050&did=1&t=&CtsSyncId=28AF198B5E30409EBA6995E366C3C088&MUID=39907E3FD8DE6D15227371A2D90C6C29
36 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
chelseahouse.ca/bit/ Redirect Chain
|
64 KB 65 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
segoeui_light.woff2
blobs.officehome.msocdn.com/versionless/webfonts/ |
10 KB 11 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
segoeui_regular.woff2
blobs.officehome.msocdn.com/versionless/webfonts/ |
11 KB 11 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
segoeui_semibold.woff2
blobs.officehome.msocdn.com/versionless/webfonts/ |
11 KB 12 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
segoeui_semilight.woff2
blobs.officehome.msocdn.com/versionless/webfonts/ |
12 KB 12 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
unauth-e4d944594c.css
blobs.officehome.msocdn.com/bundles/ |
109 KB 51 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sharedfontstyles-30d1fc43fd.css
blobs.officehome.msocdn.com/bundles/ |
1 KB 736 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
63-a07f4c
www.microsoft.com/onerfstatics/marketingsites-neu-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/ec-7c12d3/e8-384624/b6-34f58f/1f-2a061b/b4-7baaf4/66-04254c/dd-fa624e/ |
161 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
override.css
statics-marketingsites-neu-ms-com.akamaized.net/statics/ |
1 KB 907 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
RE1Mu3b
img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
hero-still-image-desktop-89e7da971f.jpg
blobs.officehome.msocdn.com/images/content/images/ |
154 KB 155 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
unauth-vendor-320f34a99e.js
blobs.officehome.msocdn.com/bundles/ |
103 KB 34 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sharedscripts-ef479d1217.js
blobs.officehome.msocdn.com/bundles/ |
51 KB 15 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
unauth-2fbd03ce5d.js
blobs.officehome.msocdn.com/bundles/ |
57 KB 19 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
d6-c4d640
www.microsoft.com/onerfstatics/marketingsites-neu-prod/shell/_scrf/js/themes=default/54-af9f9f/c0-247156/de-099401/e1-a50eee/e7-954872/d8-97d509/f0-251fe2/46-be1318/77-04a268/11-240c7b/63-077520/a4... |
125 KB 34 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
meversion
mem.gfx.ms/ |
27 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
 Cookie set
Me.srf
login.live.com/ Frame 9311 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Cookie set
savedusers
login.microsoftonline.com/ Frame A8B9 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
t.js
web.vortex.data.microsoft.com/collect/v1/ |
281 B 966 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
whatisoffice365-apps-2436adcc5c.svg
blobs.officehome.msocdn.com/images/content/images/ |
39 KB 10 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
whatisoffice365-desktop-f9430c19c4.svg
blobs.officehome.msocdn.com/images/content/images/ |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
whatisoffice365-devices-30e7961e2b.svg
blobs.officehome.msocdn.com/images/content/images/ |
41 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
whatisoffice365-cloud-18ca1aa8fd.svg
blobs.officehome.msocdn.com/images/content/images/ |
10 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
whatisoffice365-communication-3f0c951d80.svg
blobs.officehome.msocdn.com/images/content/images/ |
23 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
linkedin-fdeba31cd0.svg
blobs.officehome.msocdn.com/images/content/images/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
facebook-ceb4e4780d.svg
blobs.officehome.msocdn.com/images/content/images/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
twitter-2da9a1163b.svg
blobs.officehome.msocdn.com/images/content/images/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
instagram-bccebd657e.svg
blobs.officehome.msocdn.com/images/content/images/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/ |
33 KB 34 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
mwfmdl2-v3.54.woff
www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/ |
26 KB 26 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
11 KB 11 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semibold/ |
29 KB 29 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Bold/ |
29 KB 30 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
v1
web.vortex.data.microsoft.com/collect/ |
0 0 |
Other
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
c.gif
c1.microsoft.com/ Redirect Chain
|
42 B 197 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
/
browser.pipe.aria.microsoft.com/Collector/3.0/ |
0 397 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
/
browser.pipe.aria.microsoft.com/Collector/3.0/ |
0 397 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Office 365 (Online)83 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| getDefaultAadUser function| getDefaultMsaUser function| findDefaultSignedInUser function| convertAadUserData function| convertMsaUserData function| isValidMsaUser function| isValidAadUser function| getAadData function| getMsaData function| getAadMsaData function| getAccount object| AuthType object| Operation object| ErrorCode object| TimerUtils object| IframeUtils object| Constants object| LoggingUtils function| IdpUserResult function| DefaultSignInOptions boolean| enableConsoleLog boolean| msaFedEnabled function| $ function| jQuery object| StandaloneAriaLogger object| AWTPropertyType object| AWTPiiKind object| AWTEventPriority object| AWTEventsDroppedReason object| AWTEventsRejectedReason object| AWTCustomerContentKind object| AWTUserIdType object| AWTSessionState string| AWT_BEST_EFFORT string| AWT_NEAR_REAL_TIME string| AWT_REAL_TIME function| AWTEventProperties function| AWTLogger function| AWTLogManager function| AWTTransmissionManager function| AWTSerializer function| AWTSemanticContext string| AWT_COLLECTOR_URL_UNITED_STATES string| AWT_COLLECTOR_URL_GERMANY string| AWT_COLLECTOR_URL_JAPAN string| AWT_COLLECTOR_URL_AUSTRALIA string| AWT_COLLECTOR_URL_EUROPE string| AWT_COLLECTOR_URL_USGOV_DOD string| AWT_COLLECTOR_URL_USGOV_DOJ function| __awaiter function| __generator object| HomePage object| awa string| behaviorKey object| DefaultSignInHandler string| signInUrl string| viewType object| myConfigOptions function| setShellOptions function| SendMeControlSignInEvent function| SetConsent object| shellOptions object| onShellReadyToLoad string| aadUserForgetUrlFormat function| clearStorage object| msCommonShell object| MSA object| MeControl function| MeControlDefine function| MeControlImport object| lazyImages number| lazyLoadAnimationId9 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| login.microsoftonline.com/ | Name: x-ms-gateway-slice Value: estsfd |
|
| .login.microsoftonline.com/ | Name: esctx Value: AQABAAAAAAB2UyzwtQEKR7-rWbgdcBZIvkVMsFBgPENDFqMR3BmshaWj00RhuDVH8uJw08GlOOUgeKeBVMZDMksCqvxu8JRvvaXlWHroi6rJqf8R7CjZmNzp6TnYHC4h7CHlPr6q5pb02z4agZjrGIof8WcBLxXeoQvktmdXgPLgFMUdGj4bdWf6mRV3un844lL7OJHk8kogAA |
|
| login.microsoftonline.com/ | Name: fpc Value: AhoePbMP6XpHnURF5s2S_kI |
|
| login.microsoftonline.com/ | Name: stsservicecookie Value: estsfd |
|
| chelseahouse.ca/bit | Name: MicrosoftApplicationsTelemetryFirstLaunchTime Value: 2020-12-11T16:03:28.500Z |
|
| .login.live.com/ | Name: uaid Value: 4b5b4c06c6304ccaa497221cc917cfd9 |
|
| chelseahouse.ca/ | Name: MSFPC Value: GUID=1e236613ea014e1780e7552f080e6ae3&HASH=1e23&LV=202012&V=4&LU=1607702608725 |
|
| .login.live.com/ | Name: MSPRequ Value: id=N<=1607702608&co=1 |
|
| chelseahouse.ca/bit | Name: MicrosoftApplicationsTelemetryDeviceId Value: 90f0dde8-4a4b-4ad2-8933-9e338166331e |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
blobs.officehome.msocdn.com
browser.pipe.aria.microsoft.com
c.bing.com
c.s-microsoft.com
c1.microsoft.com
chelseahouse.ca
img-prod-cms-rt-microsoft-com.akamaized.net
login.live.com
login.microsoftonline.com
mem.gfx.ms
statics-marketingsites-neu-ms-com.akamaized.net
web.vortex.data.microsoft.com
www.microsoft.com
104.79.89.91
162.249.2.226
2.16.186.41
20.190.129.130
20.190.129.160
2620:1ec:c11::200
2a02:26f0:1700:181::37
2a02:26f0:1700:1aa::356e
2a02:26f0:6c00::210:ba28
2a02:26f0:eb:384::356e
40.77.226.250
52.114.159.32
52.142.114.2
03adaae97c2e84886a7a3aee1d3a603be518f870edbe8c4c332678e7a3342a3d
099d88645d5c051b01e35bd64f58474ace99f185692dd8245b5a3b3c2e8bf4a3
0bd288d5397a69ead391875b422bf2cbdcc4f795d64aa2f780aff45768d78248
10b0e6df22e65ccc9fa66d823e53e240a4ead7efff73e7e4c71ad3e53b9a9ec6
110497e2da11a94faf8088bfa8d24739dfe7b5188cc41679a2877d0eadfcc967
112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960
1232bbdbc5d205f3c5a40efa5ed92839c79e7879d5168445cc47645bb93f7d1b
22b4df5c33045b645cafa45b04685f4752e471a2e933bff5bf14324d87deee12
2cd3ef7b5b677b7827bfbe5b926a283e7ca687ddb6b021fa4289630671ebd061
2d118489673523294b9508495dcbd741cb6a1b9904e386714ef5f0ce2b2dae48
36943fad2df3e04ba5a4f6f79064f8ba96026857ffdfd0ea8b4a2a08966a40f3
39bcdfd243ddbabbba3b0e5891f10d8d85eb8faa29c63fe0303e30d0e7ee6f04
3aeb702d542adff15de4de96b866ee317a8f35a4e8dea6a97be316cf6fc95d56
3c81876e873c09b16821fbf22db91c76d99df502aaa3d934eb01714e7d4d21d3
4d9481536dbf3b0823d5254b666466873a2f577f1222a19aec88cd6157781f2c
4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b
57febfbad63b722a38bc668e67bc7c2dc02eca221f26db3a9303c1bd584a1a42
633894cf845287f205f1b5bd26b7667dda186695fce3d789306f30c5fbdb14b5
71edbbdac41799addbc0f83b2286b4544e98215614a132708bcbd4f618cdcb80
76dff1fbf807bfc22d4801d7cc2b14ad6ee39422b5dd81996b3fcc899bc56425
8154b1e1c9cacc02391ffc8b8949764d60286f85be618b2ca575a1e907a49fe1
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9fd3a530b39604a0c08cc3c90d0a47be6e20ab0b40f683ddec27a1c1ea67c242
a6633e2428cfc1dccefa5fbc04631e29aba45754d68b1d443af23aa30596770d
a6b4512ebf7f02b8cc5aa165f44bf817ab86b214a0818e4823e38300d01c9fcd
accd908652b032a6495fc0db0d19234e7ab3b949e6cbc05201e444ea45ab84ab
bb232fd09a6696ce21ec10a43b89933e12ad866dfde30a4a6a08e08082e6557d
bf9578346260d4c6405e2d4e8066997964c3e3336edde6188c6e91e86eb31a42
c90cafabb2155e331e8f2ddee5620e45f41759017488bcd1e33b07085c9d8703
d87d0a7a7fe2c36d1dc093bfe56e9b81b311988789dbd3b65abf811d551ef02f
d89bb86fe481803aa172b1cd9a3993fe59f23cffcc938bd2b827c9d2e0997ca4
dc0caf9d8bbf46e089d391303e81d355e8a3824a878c93b24ff48fe5f52062dc
e294ff513ce1f0d15ae99d887d3bf236759ea8639e3f46df8f09f8a8d2984b95
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855