secure-login-office.pages.dev Open in urlscan Pro
2606:4700:310c::ac42:2c77  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request / Show response secure-login-office.pages.dev/	5 KB 2 KB	98ms 67ms	Document text/html	2606:4700:310c::ac42:2c77 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://secure-login-office.pages.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:310c::ac42:2c77 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7e325d7869784c74eb7c964b77e433ade988fdc982cc89f7947853c5b34f8931 Security Headers Name Value X-Content-Type-Options nosniff Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.4 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-origin * alt-svc h3=":443"; ma=86400 cache-control public, max-age=0, must-revalidate cf-ray 86cb1fa58ac31d9c-FRA content-encoding br content-type text/html; charset=utf-8 date Sat, 30 Mar 2024 21:16:56 GMT etag W/"16afd024b834fb34d1359978828bd82a" nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jXSFD%2BepxCnRzhvecK1KzNrqTFa3wQ0MYhVGjueEvmzQ9Dzko4M8xs7tbZm7OBD%2BqV1fd59XjuPo%2FUe5StpM6p%2B%2Fqd%2F9TAg4WQPnJG9knhJMGk2YacUmkMWq3ZunVIfx8Fi%2F8BKsr%2BL2t74ohFInqg8cm8VSzQ8GqcLU7g%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-content-type-options nosniff
GET H3	200	app.css secure-login-office.pages.dev/assets/	5 KB 2 KB	50ms 49ms	Stylesheet text/css	2606:4700:310c::ac42:2c77 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://secure-login-office.pages.dev/assets/app.css Requested by Host: secure-login-office.pages.dev URL: https://secure-login-office.pages.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:310c::ac42:2c77 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3ca0b548ae6810e936e345bd49af8748405d29c7d1c9852212ec545f6ca387f9 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://secure-login-office.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.4 Safari/537.36 Response headers date Sat, 30 Mar 2024 21:16:56 GMT content-encoding br referrer-policy strict-origin-when-cross-origin x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"38abda349d2e714b69b460458aebe27b" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BjIY9bScj8ybQOrS9yxAqRFvkQ52ZopSJuVGKXFgPFa3uArgCsEZoqjkwbwzrKZJTGhVemmL4GNXhkVUI3JQLEG2OTfCd2gcEN%2BBLVbzujDjb27GQ1eoE0LYzJqROO4RohhzZJYWmhNoAaEWC2Y9zaGJgJqJ8lYfu7YokA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=0, must-revalidate cf-ray 86cb1fa5fb3e1d9c-FRA alt-svc h3=":443"; ma=86400
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.5.1/	87 KB 31 KB	34ms 8ms	Script text/javascript	2a00:1450:4001:82a::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js Requested by Host: secure-login-office.pages.dev URL: https://secure-login-office.pages.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://secure-login-office.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.4 Safari/537.36 Response headers date Fri, 29 Mar 2024 18:59:34 GMT content-encoding gzip x-content-type-options nosniff age 94642 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31021 x-xss-protection 0 last-modified Fri, 08 May 2020 07:05:03 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Sat, 29 Mar 2025 18:59:34 GMT
GET H2	200	email.min.js Show response cdn.emailjs.com/dist/	10 KB 3 KB	42ms 7ms	Script text/javascript	151.101.65.195 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.emailjs.com/dist/email.min.js Requested by Host: secure-login-office.pages.dev URL: https://secure-login-office.pages.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.65.195 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 15ca57b6eed6f0072717f2137c99f6aff32eb9c954873f9b5e1a1f16b6e7d6a6 Security Headers Name Value Strict-Transport-Security max-age=31556926 Request headers accept-language de-DE,de;q=0.9 Referer https://secure-login-office.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.4 Safari/537.36 Response headers x-served-by cache-fra-etou8220144-FRA strict-transport-security max-age=31556926 content-encoding br date Sat, 30 Mar 2024 21:16:56 GMT last-modified Thu, 29 Feb 2024 15:56:50 GMT x-timer S1711833417.673951,VS0,VE1 etag "af6e3f45307ee993cff68ec3ccc29fcc91c8510e7531d2e336e3cef949958183-br" vary x-fh-requested-host, accept-encoding x-cache HIT content-type text/javascript; charset=utf-8 cache-control max-age=31536000 accept-ranges bytes alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length 3059 x-cache-hits 1
GET H3	200	pageBossSender.js Show response secure-login-office.pages.dev/assets/	12 KB 3 KB	47ms 47ms	Script text/javascript	2606:4700:310c::ac42:2c77 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://secure-login-office.pages.dev/assets/pageBossSender.js Requested by Host: secure-login-office.pages.dev URL: https://secure-login-office.pages.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:310c::ac42:2c77 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 29fa7bd932dc45d06c1cc983595acfe7ada66cf2d81da820f129e8c658717e73 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://secure-login-office.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.4 Safari/537.36 Response headers date Sat, 30 Mar 2024 21:16:56 GMT content-encoding br referrer-policy strict-origin-when-cross-origin x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"9df1e471a3e0e22212e2a388fe031680" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SlbIN56wcbmCRBVXIck6QCW%2FXW%2FSv7h1w1O33Me1Kq%2Fzik3w1zZqZmkSJFx7uTb4D9kNRCZZkPEaciHp0t9FPhhUBeYKXpTfTOWRm%2FZn1XoCYpEe6c%2FngLWU4uVHrDKLUdK0dPRGVrr7ihqTO09YD8vV8CTlmlpM7wze%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=0, must-revalidate cf-ray 86cb1fa5fb401d9c-FRA alt-svc h3=":443"; ma=86400
GET H3	200	logo.svg secure-login-office.pages.dev/assets/	4 KB 2 KB	59ms 59ms	Image image/svg+xml	2606:4700:310c::ac42:2c77 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://secure-login-office.pages.dev/assets/logo.svg Requested by Host: secure-login-office.pages.dev URL: https://secure-login-office.pages.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:310c::ac42:2c77 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://secure-login-office.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.4 Safari/537.36 Response headers date Sat, 30 Mar 2024 21:16:56 GMT content-encoding br referrer-policy strict-origin-when-cross-origin x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"b4d7a556445aa167d4959571a81c93db" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nZRjyhiBhGYZhqUzukJyU11W1MFmez0MjCxD9564W5zL9uyYmqPji62im5C14fWSKARH%2FwuH8qcVLJjdhT%2FcrA7%2FOa2fmsPEfTfUDDpmsphqyKYiJd8IiuC0v5%2FYrVcY%2FTgXDmRmpf057N71tigPnXASpzBvHOdiFmCR7Q%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=0, must-revalidate cf-ray 86cb1fa5fb411d9c-FRA alt-svc h3=":443"; ma=86400
GET H3	200	key.png secure-login-office.pages.dev/assets/	727 B 1 KB	85ms 85ms	Image image/png	2606:4700:310c::ac42:2c77 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://secure-login-office.pages.dev/assets/key.png Requested by Host: secure-login-office.pages.dev URL: https://secure-login-office.pages.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:310c::ac42:2c77 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 40ecb8832f6a9a8aaa0cc6e1287e867a4fca38433d091d86c6cab1f28fbab652 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://secure-login-office.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.4 Safari/537.36 Response headers date Sat, 30 Mar 2024 21:16:56 GMT referrer-policy strict-origin-when-cross-origin x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "f932cffc43a4a88d162ba92b1584965c" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JT7diwIqBOwveUAto70WUGIUyfeuF7fMxlmz2UbhuDpzkFMGOVus%2BPNbTnZt0d1s%2FK2sl5bucVePAgRaxtOWMoFBkYO7eJbMGRlt2PbZneKNE2W2wANP9X9hzR9kDKQoo91i5TeY5Ul%2BPeX9Kjk9JctEdyEG8DTweCJOpg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png access-control-allow-origin * cache-control public, max-age=0, must-revalidate cf-ray 86cb1fa5fb421d9c-FRA alt-svc h3=":443"; ma=86400 content-length 727
GET H3	200	back.png secure-login-office.pages.dev/assets/	231 B 735 B	46ms 46ms	Image image/png	2606:4700:310c::ac42:2c77 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://secure-login-office.pages.dev/assets/back.png Requested by Host: secure-login-office.pages.dev URL: https://secure-login-office.pages.dev/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:310c::ac42:2c77 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 70e32b2db3f079bb0295a85a0db15ed9e5926294dd947938d6cfa595f5ab18b4 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://secure-login-office.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.4 Safari/537.36 Response headers date Sat, 30 Mar 2024 21:16:56 GMT referrer-policy strict-origin-when-cross-origin x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "7801112419d0cf1a2055a329e6703e16" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OpTU5sqTLhKEzoNCUiWv%2BV0xwC6M3SBmivJ7uAn6bB0PTK38bu%2FUUFoy5WP1fjA1hLQfWtefiiGfw6zoEyjtIAbRCf1HoY%2B7c2%2FL88MtjzWVDOwmbmB%2Bxix7BYnSzne8y9tHlqKE%2Begt2W6FnWjOM7Rb3i6Ql4qLO29H0w%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png access-control-allow-origin * cache-control public, max-age=0, must-revalidate cf-ray 86cb1fa65b991d9c-FRA alt-svc h3=":443"; ma=86400 content-length 231
GET H3	200	favicon.ico secure-login-office.pages.dev/assets/	17 KB 999 B	88ms 88ms	Other image/x-icon	2606:4700:310c::ac42:2c77 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://secure-login-office.pages.dev/assets/favicon.ico Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:310c::ac42:2c77 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://secure-login-office.pages.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.4 Safari/537.36 Response headers date Sat, 30 Mar 2024 21:16:56 GMT content-encoding br referrer-policy strict-origin-when-cross-origin x-content-type-options nosniff nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"b52ae8d8fe9d158bb668e6c4d9c14505" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uZZstcseXmtVpra1LLIShhU9Tor%2BjWVhxzuSz9lxXQyXnKKPgwR7rHWBAtBRsJwjgu3fjn5aTuCe1RrnqQR22OYFSOKx9QXhMt5V5iXiZ5jMj7WHKsTBD8OKOWjEhuRpcvFVK7rvvTJxlTwvuznUHsYGUFpj6KVtSF0%2FqQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/x-icon access-control-allow-origin * cache-control public, max-age=0, must-revalidate cf-ray 86cb1fa6abf91d9c-FRA alt-svc h3=":443"; ma=86400

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onpagereveal function| $ function| jQuery object| emailjs boolean| confirmVal boolean| pwdVal

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://secure-login-office.pages.dev/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "new-password"): (More info: https://goo.gl/9p2vKq) %o
recommendation	verbose	URL: https://secure-login-office.pages.dev/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "new-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdn.emailjs.com
secure-login-office.pages.dev
151.101.65.195
2606:4700:310c::ac42:2c77
2a00:1450:4001:82a::200a
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
15ca57b6eed6f0072717f2137c99f6aff32eb9c954873f9b5e1a1f16b6e7d6a6
29fa7bd932dc45d06c1cc983595acfe7ada66cf2d81da820f129e8c658717e73
3ca0b548ae6810e936e345bd49af8748405d29c7d1c9852212ec545f6ca387f9
40ecb8832f6a9a8aaa0cc6e1287e867a4fca38433d091d86c6cab1f28fbab652
70e32b2db3f079bb0295a85a0db15ed9e5926294dd947938d6cfa595f5ab18b4
7e325d7869784c74eb7c964b77e433ade988fdc982cc89f7947853c5b34f8931
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d