login.outlook.test.home.bertoldi.au Open in urlscan Pro
159.196.72.112  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response login.outlook.test.home.bertoldi.au/	25 KB 27 KB	712ms 364ms	Document text/html	159.196.72.112 WIDEBAND-AS-AP Au...
General Check archive.org Show headers Download Go to Full URL https://login.outlook.test.home.bertoldi.au/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 159.196.72.112 Melbourne, Australia, ASN4764 (WIDEBAND-AS-AP Aussie Broadband, AU), Reverse DNS 159-196-72-112.9fc448.mel.nbn.aussiebb.net Software / Resource Hash cb2e52f8fb7cd09876511e5b23780bd6f31fa6513531f53506feb4498ece4686 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers Cache-Control no-store, max-age=0 Connection close Content-Type text/html; charset=utf-8 Date Tue, 08 Nov 2022 07:06:27 GMT Expires Tue, 08 Nov 2022 07:05:27 GMT Link <https://logincdn.msauth.net>; rel=preconnect; crossorigin <https://acctcdn.msauth.net>; rel=preconnect; crossorigin <https://acctcdn.msftauth.net>; rel=preconnect; crossorigin <https://acctcdn.msauth.net/>; rel=dns-prefetch <https://acctcdn.msftauth.net/>; rel=dns-prefetch <https://acctcdnmsftuswe2.azureedge.net/>; rel=dns-prefetch <https://acctcdnvzeuno.azureedge.net/>; rel=dns-prefetch <https://logincdn.msauth.net/>; rel=dns-prefetch <https://lgincdnvzeuno.azureedge.net/>; rel=dns-prefetch <https://lgincdnmsftuswe2.azureedge.net/>; rel=dns-prefetch P3p CP="DSP CUR OTPi IND OTRi ONL FIN" Ppserver PPV: 30 H: BY1PEPF00004191 V: 0 Referrer-Policy strict-origin-when-cross-origin Transfer-Encoding chunked Vary Accept-Encoding X-Dns-Prefetch-Control on X-Ms-Request-Id 3f0ad8e3-57a1-442b-ab55-51fec9ae854c X-Ms-Route-Info R3_BAY
GET H2	200	Converged_v21033_yaWpJTZkqpsZZoIUf0uvMg2.css logincdn.msauth.net/16.000/	107 KB 20 KB	409ms 99ms	Stylesheet text/css	152.199.40.6 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://logincdn.msauth.net/16.000/Converged_v21033_yaWpJTZkqpsZZoIUf0uvMg2.css Requested by Host: login.outlook.test.home.bertoldi.au URL: https://login.outlook.test.home.bertoldi.au/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.40.6 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (nwa/E7D4) / Resource Hash 14c3c9b62afa97c469912f917fac3916af1b3679000a8e000e0a5b094ee7f37f Request headers accept-language en-AU,en;q=0.9 Referer https://login.outlook.test.home.bertoldi.au/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 08 Nov 2022 07:06:28 GMT content-encoding gzip content-md5 1E17/9ElUQsAQHh4Vnx2tg== age 1150274 x-cache HIT content-length 19996 x-ms-lease-status unlocked last-modified Thu, 20 Oct 2022 20:59:08 GMT server ECAcc (nwa/E7D4) etag 0x8DAB2DDEE989003 vary Accept-Encoding content-type text/css access-control-allow-origin * x-ms-request-id 17fcfb28-801e-0082-77ca-e82bad000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	ConvergedLoginPaginatedStrings.en_89xJKlaCFgs_vP8Z99qYWw2.js Show response logincdn.msauth.net/16.000/content/js/	35 KB 10 KB	394ms 99ms	Script application/x-javascript	152.199.40.6 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en_89xJKlaCFgs_vP8Z99qYWw2.js Requested by Host: login.outlook.test.home.bertoldi.au URL: https://login.outlook.test.home.bertoldi.au/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.40.6 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (nwa/E7B8) / Resource Hash 49ea48d969a08d2a38cd42741968e08de0fe64a36c57d371db2d7530a704b3ba Request headers Referer https://login.outlook.test.home.bertoldi.au/ Origin https://login.outlook.test.home.bertoldi.au accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 08 Nov 2022 07:06:28 GMT content-encoding gzip content-md5 VVj93h3G+SUWuttRYpRBwg== age 1150272 x-cache HIT content-length 9409 x-ms-lease-status unlocked last-modified Thu, 20 Oct 2022 21:07:20 GMT server ECAcc (nwa/E7B8) etag 0x8DAB2DF13DBB8BE vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 5aedd836-e01e-001e-6fca-e8a043000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	ConvergedLogin_PCore_hb3hZVIvL6Uim6XUIFcQZg2.js Show response logincdn.msauth.net/shared/1.0/content/js/	381 KB 108 KB	99ms 98ms	Script application/x-javascript	152.199.40.6 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_hb3hZVIvL6Uim6XUIFcQZg2.js Requested by Host: login.outlook.test.home.bertoldi.au URL: https://login.outlook.test.home.bertoldi.au/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.40.6 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (nwa/E7AB) / Resource Hash 1c8353fd9d46a0aba776aa1ccfcdec65ce4cd80f8de54a8b2a560d967740142a Request headers Referer https://login.outlook.test.home.bertoldi.au/ Origin https://login.outlook.test.home.bertoldi.au accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 08 Nov 2022 07:06:28 GMT content-encoding gzip content-md5 4KB7d6c26tpT2558jN0Wqw== age 1150683 x-cache HIT content-length 110511 x-ms-lease-status unlocked last-modified Thu, 20 Oct 2022 01:42:19 GMT server ECAcc (nwa/E7AB) etag 0x8DAB23C53593979 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 9d2bcefc-201e-007d-02c9-e8d1d0000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	oneDs_8363475333f6d315e7ae.js Show response logincdn.msauth.net/shared/1.0/content/js/	81 KB 27 KB	101ms 101ms	Script application/x-javascript	152.199.40.6 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://logincdn.msauth.net/shared/1.0/content/js/oneDs_8363475333f6d315e7ae.js Requested by Host: logincdn.msauth.net URL: https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_hb3hZVIvL6Uim6XUIFcQZg2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.40.6 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (nwa/E7CE) / Resource Hash 4cc1914204beca4a34eac1ed055f49f42ad77f143d97271fafa00e4810383fef Request headers accept-language en-AU,en;q=0.9 Referer https://login.outlook.test.home.bertoldi.au/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 08 Nov 2022 07:06:29 GMT content-encoding gzip content-md5 UwrgfpGF/r6JSUQzMXfC0A== age 11920523 x-cache HIT content-length 27455 x-ms-lease-status unlocked last-modified Sat, 04 Jun 2022 01:22:32 GMT server ECAcc (nwa/E7CE) etag 0x8DA45C8B34736C8 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 85972499-c01e-0068-75d5-867b59000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	2_bc3d32a696895f78c19df6c717586a5d.svg logincdn.msauth.net/shared/1.0/content/images/backgrounds/	2 KB 892 B	99ms 98ms	Image image/svg+xml	152.199.40.6 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://logincdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.40.6 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (nwa/E7B3) / Resource Hash 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68 Request headers accept-language en-AU,en;q=0.9 Referer https://login.outlook.test.home.bertoldi.au/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 08 Nov 2022 07:06:29 GMT content-encoding gzip content-md5 DhdidjYrlCeaRJJRG/y9mA== age 5053750 x-cache HIT content-length 673 x-ms-lease-status unlocked last-modified Wed, 12 Feb 2020 22:01:42 GMT server ECAcc (nwa/E7B3) etag 0x8D7B00724D9E930 vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id fdef7846-c01e-000c-4c49-c51206000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg logincdn.msauth.net/shared/1.0/content/images/	4 KB 2 KB	101ms 101ms	Image image/svg+xml	152.199.40.6 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://logincdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.40.6 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (nwa/E794) / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers accept-language en-AU,en;q=0.9 Referer https://login.outlook.test.home.bertoldi.au/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 08 Nov 2022 07:06:29 GMT content-encoding gzip content-md5 nzaLxFgP7ZB3dfMcaybWzw== age 20150912 x-cache HIT content-length 1435 x-ms-lease-status unlocked last-modified Wed, 22 Jan 2020 00:32:50 GMT server ECAcc (nwa/E794) etag 0x8D79ED29CF0C29A vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id bf249467-001e-0081-7ffb-3bd8cd000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg logincdn.msauth.net/shared/1.0/content/images/	2 KB 758 B	101ms 101ms	Image image/svg+xml	152.199.40.6 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://logincdn.msauth.net/shared/1.0/content/images/documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.40.6 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (nwa/E7A9) / Resource Hash a76c08e9cdc3bb87bfb57627ad8f6b46f0e5ef826cc7f046dfbaf25d7b7958ea Request headers accept-language en-AU,en;q=0.9 Referer https://login.outlook.test.home.bertoldi.au/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 08 Nov 2022 07:06:29 GMT content-encoding gzip content-md5 6dTbAT1RVL9d6geobv3IJg== age 1585193 x-cache HIT content-length 606 x-ms-lease-status unlocked last-modified Wed, 22 Jan 2020 00:32:48 GMT server ECAcc (nwa/E7A9) etag 0x8D79ED29BA5E089 vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 3f33e3ae-b01e-009c-08d5-e4556b000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	signin-options_4e48046ce74f4b89d45037c90576bfac.svg logincdn.msauth.net/shared/1.0/content/images/	2 KB 773 B	101ms 100ms	Image image/svg+xml	152.199.40.6 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://logincdn.msauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.40.6 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (nwa/E7C3) / Resource Hash 8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93 Request headers accept-language en-AU,en;q=0.9 Referer https://login.outlook.test.home.bertoldi.au/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 08 Nov 2022 07:06:29 GMT content-encoding gzip content-md5 R2FAVxfpONfnQAuxVxXbHg== age 24035112 x-cache HIT content-length 621 x-ms-lease-status unlocked last-modified Tue, 10 Nov 2020 03:41:25 GMT server ECAcc (nwa/E7C3) etag 0x8D8852A7FCCA219 vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id cae1574e-601e-005e-3aa7-185ce1000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| PROOF function| $Loader object| $Do function| $DepLoader object| g_dtFirstByte object| g_objPageMode number| g_iSRSFailed string| g_sSRSSuccess function| SRSRetry object| ServerData object| UXResourceDependencies function| WhenAllLoaded object| StringRepository boolean| __ConvergedLoginPaginatedStrings object| webpackJsonp object| ko boolean| __ConvergedLogin_PCore object| Telemetry object| telemetry_webpackJsonp

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.login.outlook.test.home.bertoldi.au/	1969-12-31 23:59:59	Name: uaid Value: 1caefe75a9014ed49ad073ed014eb40b
			.login.outlook.test.home.bertoldi.au/	1969-12-31 23:59:59	Name: MSPRequ Value: id=N&lt=1667891187&co=1
			.login.outlook.test.home.bertoldi.au/	1970-01-20 16:39:47	Name: MSCC Value: 159.196.72.112-AU
			.login.outlook.test.home.bertoldi.au/	1969-12-31 23:59:59	Name: MSPOK Value: $uuid-f67fb695-53e6-42b8-a166-aaf6c8e5767c
			.login.outlook.test.home.bertoldi.au/	1969-12-31 23:59:59	Name: OParams Value: 11O.DaeW96*49sOCoNqa2b1vhApjAzZgu9cs!65dByLju4DW60eTeghL461LoAj*sSaA!aiM4jGKdcOf7QyfxQnvp3CO3okIkxdxZetNHVVaAszF25dOUgZkAzGF0tWVeyc7Cg$$

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

login.outlook.test.home.bertoldi.au
logincdn.msauth.net
152.199.40.6
159.196.72.112
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
14c3c9b62afa97c469912f917fac3916af1b3679000a8e000e0a5b094ee7f37f
1c8353fd9d46a0aba776aa1ccfcdec65ce4cd80f8de54a8b2a560d967740142a
49ea48d969a08d2a38cd42741968e08de0fe64a36c57d371db2d7530a704b3ba
4cc1914204beca4a34eac1ed055f49f42ad77f143d97271fafa00e4810383fef
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
a76c08e9cdc3bb87bfb57627ad8f6b46f0e5ef826cc7f046dfbaf25d7b7958ea
cb2e52f8fb7cd09876511e5b23780bd6f31fa6513531f53506feb4498ece4686