Submitted URL: https://recaptcha.net.admin-mcas-gov.ms/
Effective URL: https://recaptcha.net/
Submission Tags: phishingrod
Submission: On May 10 via api from DE — Scanned from DE

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 5 HTTP transactions. The main IP is 2a00:1450:4001:801::2003, located in Frankfurt am Main, Germany and belongs to GOOGLE, US. The main domain is recaptcha.net. The Cisco Umbrella rank of the primary domain is 1426.
TLS certificate: Issued by GTS CA 1C3 on April 24th 2023. Valid for: 3 months.
This is the only time recaptcha.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 52.245.224.234 8075 (MICROSOFT...)
3 2a02:26f0:480... 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
5 3
Apex Domain
Subdomains
Transfer
3 azureedge.net
mcasproxy.azureedge.net — Cisco Umbrella Rank: 42739
44 KB
1 recaptcha.net
recaptcha.net — Cisco Umbrella Rank: 1426
398 B
1 admin-mcas-gov.ms
recaptcha.net.admin-mcas-gov.ms
887 B
5 3
Domain Requested by
3 mcasproxy.azureedge.net recaptcha.net.admin-mcas-gov.ms
mcasproxy.azureedge.net
1 recaptcha.net
1 recaptcha.net.admin-mcas-gov.ms
5 3

This site contains no links.

Subject Issuer Validity Valid
*.net.mcas-gov.ms
Microsoft Azure TLS Issuing CA 02
2023-05-01 -
2024-04-25
a year crt.sh
*.azureedge.net
Microsoft Azure ECC TLS Issuing CA 01
2022-07-27 -
2023-07-22
a year crt.sh
misc.google.com
GTS CA 1C3
2023-04-24 -
2023-07-17
3 months crt.sh

This page contains 2 frames:

Primary Page: https://recaptcha.net/
Frame ID: D7DD734B48DA5CFD59D2BF81D1635352
Requests: 3 HTTP requests in this frame

Frame: https://mcasproxy.azureedge.net/proxyweb/1.31.18/html/session-context-restore.html
Frame ID: 6117B41538C507E0F7279531A5392C6D
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

Not Found

Page URL History Show full URLs

  1. https://recaptcha.net.admin-mcas-gov.ms/ Page URL
  2. https://recaptcha.net/ Page URL

Page Statistics

5
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

45 kB
Transfer

44 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://recaptcha.net.admin-mcas-gov.ms/ Page URL
  2. https://recaptcha.net/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
recaptcha.net.admin-mcas-gov.ms/
1 KB
887 B
Document
General
Full URL
https://recaptcha.net.admin-mcas-gov.ms/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.245.224.234 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
openresty /
Resource Hash
de1c32643042e7d6383d9b3d89ec8ec13da4c9973e32c290c962d9bbb040e17f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=0, no-cache, no-store
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Wed, 10 May 2023 03:58:41 GMT
expires
Mon, 01-Jan-1990 00:00:00 GMT
pragma
no-cache
server
openresty
strict-transport-security
max-age=31536000
x-mcas-cache-status
MISS
x-mcas-processing-time
2
x-mcas-request-id
864bd4f4b148438968039db8604f30b6
x-mcas-upstream-time
n/a
session-context-store-helper.min.js
mcasproxy.azureedge.net/proxyweb/1.31.18/js/
5 KB
5 KB
Script
General
Full URL
https://mcasproxy.azureedge.net/proxyweb/1.31.18/js/session-context-store-helper.min.js
Requested by
Host: recaptcha.net.admin-mcas-gov.ms
URL: https://recaptcha.net.admin-mcas-gov.ms/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:15::213:7e61 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
5f7add0638c6207d7a84267735b9eed3fee3a68696e3ec755fafd5283db0b8f3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://recaptcha.net.admin-mcas-gov.ms/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Wed, 10 May 2023 03:58:41 GMT
last-modified
Tue, 18 Apr 2023 12:41:20 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5
Dor7jY9XuhzpOAkbPbiHoQ==
etag
0x8DB400A365D4E0C
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
7c2b96f4-701e-0029-2b03-72b11c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=29673435
x-ms-version
2009-09-19
content-length
4832
session-context-restore.html
mcasproxy.azureedge.net/proxyweb/1.31.18/html/ Frame 6117
209 B
659 B
Document
General
Full URL
https://mcasproxy.azureedge.net/proxyweb/1.31.18/html/session-context-restore.html
Requested by
Host: mcasproxy.azureedge.net
URL: https://mcasproxy.azureedge.net/proxyweb/1.31.18/js/session-context-store-helper.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:15::213:7e61 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
a3c954e6d1422643abfe41e74b726918caa087460903ec4267bc4e5293132451

Request headers

Referer
https://recaptcha.net.admin-mcas-gov.ms/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-origin
*
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=29672691
content-length
209
content-md5
xcQ/+x+i42xZPwR88wJc4A==
content-type
text/html
date
Wed, 10 May 2023 03:58:41 GMT
etag
0x8DB400A34295AFF
last-modified
Tue, 18 Apr 2023 12:41:17 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-blob-type
BlockBlob
x-ms-lease-status
unlocked
x-ms-request-id
6c8bb3c8-301e-0011-6601-72c81c000000
x-ms-version
2009-09-19
session-context-restore.min.js
mcasproxy.azureedge.net/proxyweb/1.31.18/js/ Frame 6117
38 KB
38 KB
Script
General
Full URL
https://mcasproxy.azureedge.net/proxyweb/1.31.18/js/session-context-restore.min.js
Requested by
Host: mcasproxy.azureedge.net
URL: https://mcasproxy.azureedge.net/proxyweb/1.31.18/html/session-context-restore.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:15::213:7e61 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
cc35e2c7b862e7d4eb69325685b62bcaad43b56df1ab0daf8f3a7626a15b494a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://mcasproxy.azureedge.net/proxyweb/1.31.18/html/session-context-restore.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Wed, 10 May 2023 03:58:41 GMT
last-modified
Tue, 18 Apr 2023 12:41:21 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5
MAQASHEG29aeiGE05FVduQ==
etag
0x8DB400A36725994
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
e42e95b9-401e-0022-6801-72940b000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=29672671
x-ms-version
2009-09-19
content-length
38676
Primary Request /
recaptcha.net/
141 B
398 B
Document
General
Full URL
https://recaptcha.net/?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
3a987926ce1b782e9c95771444a98336801741c07ff44bf75bfc8a38fccbdf98
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://recaptcha.net.admin-mcas-gov.ms/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-encoding
gzip
content-length
117
content-security-policy
frame-ancestors 'self'
content-type
text/html; charset=UTF-8
date
Wed, 10 May 2023 03:58:41 GMT
expires
Wed, 10 May 2023 03:58:41 GMT
server
GSE
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: https://recaptcha.net/?
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000