portal.hrsupportint.com
Open in
urlscan Pro
52.168.52.134
Malicious Activity!
Public Scan
Submission: On April 30 via manual from DE
Summary
This is the only time portal.hrsupportint.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 52.168.52.134 52.168.52.134 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
14 | 2 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
portal.hrsupportint.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
hrsupportint.com
portal.hrsupportint.com |
225 KB |
0 |
microsoftonline-p.com
Failed
secure.aadcdn.microsoftonline-p.com Failed |
|
14 | 2 |
Domain | Requested by | |
---|---|---|
9 | portal.hrsupportint.com |
portal.hrsupportint.com
|
0 | secure.aadcdn.microsoftonline-p.com Failed |
portal.hrsupportint.com
|
14 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 2 frames:
Primary Page:
http://portal.hrsupportint.com/?id=a78QuTg9bZaYijj1JxYWx8Eqa92fj2grCOR8jVCYsxozjPKdqAWiBdO0FJ6yhTWT8N9pKrbntd%2BPQJnB8RhRkEdFWaNiDX40%2FlMZg8CUSL%2BnZt8fxOtiapTeZzed2COw1XKQ%2Fj3f2peXcj4NXnNhFnZmg08i1uwt%2BR1uco0b0bXfbR6THes5psqG0CpSFDXxkaaFiav47sMnqb%2B3OTQ7JFTvmSgB8aIHrok%2BCtYVH6wtOQmXQ4sK94ZH7%2F118NpGuNtF%2B%2BpZWZFcoWWWdCRdXCGzt8lv2zDmA%2FcNS7hXDxY49Am%2Fkr1mMIrkHwexXRO4zih8faLGZBAN6qHQnULBsjJ%2FNjQAp3hbuQAikp%2BHBuk%3D
Frame ID: EEA6D876121F0824DAEFE91429C1863F
Requests: 13 HTTP requests in this frame
Frame:
http://portal.hrsupportint.com/Content/newSignInFiles/prefetch.html
Frame ID: 16460C9D75067E8BFC7FE2DF742229C2
Requests: 1 HTTP requests in this frame
Screenshot
Detected technologies
Windows Server (Operating Systems) ExpandDetected patterns
- headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
IIS (Web Servers) Expand
Detected patterns
- headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
portal.hrsupportint.com/ |
27 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
firstScript.js
portal.hrsupportint.com/Content/newSignInFiles/ |
53 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
converged.login.min.css
portal.hrsupportint.com/Content/newSignInFiles/ |
86 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
convergedlogin_pcore.min.js
portal.hrsupportint.com/Content/newSignInFiles/ |
440 KB 155 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
convergedloginpaginatedstrings-en.min.js
portal.hrsupportint.com/Content/newSignInFiles/ |
12 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jsonjs.js
portal.hrsupportint.com/Content/newSignInFiles/ |
10 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
morescript.js
portal.hrsupportint.com/Content/newSignInFiles/ |
331 B 697 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
microsoft_logo.svg
portal.hrsupportint.com/Content/newSignInFiles/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ellipsis_white.svg
portal.hrsupportint.com/Content/newSignInFiles/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
ellipsis_grey.svg
portal.hrsupportint.com/Content/newSignInFiles/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
watsonsupport.min.js
secure.aadcdn.microsoftonline-p.com/ests/2.1.7362.11/content/cdnbundles/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
prefetch.html
portal.hrsupportint.com/Content/newSignInFiles/ Frame 1646 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
0-small.jpg
portal.hrsupportint.com/Content/newSignInFiles/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
0.jpg
portal.hrsupportint.com/Content/newSignInFiles/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- portal.hrsupportint.com
- URL
- http://portal.hrsupportint.com/Content/newSignInFiles/ellipsis_white.svg
- Domain
- portal.hrsupportint.com
- URL
- http://portal.hrsupportint.com/Content/newSignInFiles/ellipsis_grey.svg
- Domain
- secure.aadcdn.microsoftonline-p.com
- URL
- https://secure.aadcdn.microsoftonline-p.com/ests/2.1.7362.11/content/cdnbundles/watsonsupport.min.js
- Domain
- portal.hrsupportint.com
- URL
- http://portal.hrsupportint.com/Content/newSignInFiles/0-small.jpg
- Domain
- portal.hrsupportint.com
- URL
- http://portal.hrsupportint.com/Content/newSignInFiles/0.jpg
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
portal.hrsupportint.com
secure.aadcdn.microsoftonline-p.com
portal.hrsupportint.com
secure.aadcdn.microsoftonline-p.com
52.168.52.134
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
3c49e5eeb628e98c3dfc5282c440d21b38a0d42bf45d8e281c1a7478d200c793
71eb8e5c44c27a46a180c5b1fc4a3e32105f90adb93b1f0a616a27beca3aadc4
8176927c483b9c3c64aedb655264870a59e608a653ed5045c3091382829b4f89
9379ff0c77be162cf90c75a24bf557433ae2612e05594988317f7fb4f164bda9
b975857eea84eb27fe2effc01b4045800b81d6e358b37a7a876ba813351745ce
c2c2dfa12f4ae05a703ad8941653ee940273585579bc7d862b579c9a99b8e626