login-microsoftonline.website.yandexcloud.net Open in urlscan Pro
2a02:6b8::1da  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response login-microsoftonline.website.yandexcloud.net/	694 KB 100 KB	182ms 81ms	Document text/html	2a02:6b8::1da YANDEX
General Check archive.org Show headers Download Go to Full URL https://login-microsoftonline.website.yandexcloud.net/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU), Reverse DNS Software nginx / Resource Hash cb3a2c969be436de74894fc3d153ba79d0ef06eeccf43ee3fcf79e68fa7f4ea0 Request headers Host login-microsoftonline.website.yandexcloud.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Server nginx Date Thu, 29 Oct 2020 12:13:09 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=60 Etag W/"87d36c3836c0b8a788b054e0179b4b78" Last-Modified Thu, 29 Oct 2020 00:05:03 UTC X-Amz-Request-Id 45feda8e44caa625 Content-Encoding gzip
GET H/1.1	200 OK	login.css qteysgg.xyz/office%20phase%20two/lib/css/	100 KB 19 KB	553ms 241ms	Stylesheet text/css	162.0.236.238 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://qteysgg.xyz/office%20phase%20two/lib/css/login.css Requested by Host: login-microsoftonline.website.yandexcloud.net URL: https://login-microsoftonline.website.yandexcloud.net/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.0.236.238 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.qwertyupnorth.com Software Apache / Resource Hash da1236b3d009b5078aac4e7e3e41872ce98f09333c3adddb4de75b21205e7695 Request headers Referer https://login-microsoftonline.website.yandexcloud.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 29 Oct 2020 12:13:09 GMT Content-Encoding gzip Last-Modified Wed, 28 Oct 2020 23:31:29 GMT Server Apache Vary Accept-Encoding,User-Agent Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 18796
GET H/1.1	200 OK	logo3.png qteysgg.xyz/office%20phase%20two/lib/img/	2 KB 2 KB	709ms 398ms	Image image/png	162.0.236.238 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://qteysgg.xyz/office%20phase%20two/lib/img/logo3.png Requested by Host: login-microsoftonline.website.yandexcloud.net URL: https://login-microsoftonline.website.yandexcloud.net/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.0.236.238 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.qwertyupnorth.com Software Apache / Resource Hash b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c Request headers Referer https://login-microsoftonline.website.yandexcloud.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 29 Oct 2020 12:13:10 GMT Last-Modified Wed, 28 Oct 2020 23:31:29 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1750
GET H/1.1	200 OK	logo2.svg qteysgg.xyz/office%20phase%20two/lib/img/	4 KB 2 KB	534ms 219ms	Image image/svg+xml	162.0.236.238 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://qteysgg.xyz/office%20phase%20two/lib/img/logo2.svg Requested by Host: login-microsoftonline.website.yandexcloud.net URL: https://login-microsoftonline.website.yandexcloud.net/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.0.236.238 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.qwertyupnorth.com Software Apache / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Referer https://login-microsoftonline.website.yandexcloud.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 29 Oct 2020 12:13:10 GMT Content-Encoding gzip Last-Modified Wed, 28 Oct 2020 23:31:29 GMT Server Apache Vary Accept-Encoding,User-Agent Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1435
GET H/1.1	200 OK	white_ellipsis.svg qteysgg.xyz/office%20phase%20two/lib/img/	915 B 567 B	529ms 211ms	Image image/svg+xml	162.0.236.238 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://qteysgg.xyz/office%20phase%20two/lib/img/white_ellipsis.svg Requested by Host: login-microsoftonline.website.yandexcloud.net URL: https://login-microsoftonline.website.yandexcloud.net/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.0.236.238 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.qwertyupnorth.com Software Apache / Resource Hash 6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea Request headers Referer https://login-microsoftonline.website.yandexcloud.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 29 Oct 2020 12:13:10 GMT Content-Encoding gzip Last-Modified Wed, 28 Oct 2020 23:31:29 GMT Server Apache Vary Accept-Encoding,User-Agent Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 263
GET H/1.1	200 OK	arrow.svg qteysgg.xyz/office%20phase%20two/lib/img/	513 B 580 B	531ms 209ms	Image image/svg+xml	162.0.236.238 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://qteysgg.xyz/office%20phase%20two/lib/img/arrow.svg Requested by Host: login-microsoftonline.website.yandexcloud.net URL: https://login-microsoftonline.website.yandexcloud.net/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.0.236.238 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.qwertyupnorth.com Software Apache / Resource Hash 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58 Request headers Referer https://login-microsoftonline.website.yandexcloud.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 29 Oct 2020 12:13:10 GMT Content-Encoding gzip Last-Modified Wed, 28 Oct 2020 23:31:29 GMT Server Apache Vary Accept-Encoding,User-Agent Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 276
GET H/1.1	200 OK	background.jpg qteysgg.xyz/office%20phase%20two/lib/img/	31 KB 31 KB	531ms 206ms	Image image/jpeg	162.0.236.238 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://qteysgg.xyz/office%20phase%20two/lib/img/background.jpg Requested by Host: login-microsoftonline.website.yandexcloud.net URL: https://login-microsoftonline.website.yandexcloud.net/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.0.236.238 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.qwertyupnorth.com Software Apache / Resource Hash a33593e9043efefbaf94d9ca220c885ce1c42dd2a7707f30ed072d7d71587da5 Request headers Referer https://login-microsoftonline.website.yandexcloud.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 29 Oct 2020 12:13:10 GMT Last-Modified Wed, 28 Oct 2020 23:31:29 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 31419
GET H/1.1	200 OK	call.php Show response qteysgg.xyz/office%20phase%20two/	559 B 684 B	863ms 538ms	XHR application/json	162.0.236.238 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://qteysgg.xyz/office%20phase%20two/call.php?u=null Requested by Host: login-microsoftonline.website.yandexcloud.net URL: https://login-microsoftonline.website.yandexcloud.net/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.0.236.238 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server1.qwertyupnorth.com Software Apache / Resource Hash b66bc4035c9985df3ac68ae3ab6be723a026e114b1e4b97adf299703720632da Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://login-microsoftonline.website.yandexcloud.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 29 Oct 2020 12:13:10 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding,User-Agent Content-Type application/json Access-Control-Allow-Origin * Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 413

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| $ function| jQuery function| loginFirstDisplay function| loginFinalSubmit function| loginPickerDisplay function| fetchLogoAndBackground function| get_site_logo function| getParameterByName function| str_random function| getProcessHash

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

login-microsoftonline.website.yandexcloud.net
qteysgg.xyz
162.0.236.238
2a02:6b8::1da
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
a33593e9043efefbaf94d9ca220c885ce1c42dd2a7707f30ed072d7d71587da5
b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c
b66bc4035c9985df3ac68ae3ab6be723a026e114b1e4b97adf299703720632da
cb3a2c969be436de74894fc3d153ba79d0ef06eeccf43ee3fcf79e68fa7f4ea0
da1236b3d009b5078aac4e7e3e41872ce98f09333c3adddb4de75b21205e7695