login-onedriverrniiccrrossotffserve.tiiny.site Open in urlscan Pro
99.84.108.34 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://login-onedriverrniiccrrossotffserve.tiiny.site/?common=PIUO6ZGJSPP4RQ3PJ7MN7SQ3V6NWO&oauth2=11131b0a392C46975Aa617bcC98286366&authorize=3b90477...
Submission: On July 27 via api (July 27th 2024, 3:18:55 am UTC) from US — Scanned from CA

Summary HTTP 13 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 6 domains to perform 13 HTTP transactions. The main IP is 99.84.108.34, located in United States and belongs to AMAZON-02, US. The main domain is login-onedriverrniiccrrossotffserve.tiiny.site.
TLS certificate: Issued by Amazon RSA 2048 M02 on January 11th 2024. Valid for: a year.

This is the only time login-onedriverrniiccrrossotffserve.tiiny.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	99.84.108.34 99.84.108.34	16509 (AMAZON-02) (AMAZON-02)
1	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.71.121.197 52.71.121.197	14618 (AMAZON-AES) (AMAZON-AES)
1	104.26.4.15 104.26.4.15	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	13.107.246.40 13.107.246.40	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	152.195.19.97 152.195.19.97	15133 (EDGECAST) (EDGECAST)
13	6

1 99.84.108.34 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-108-34.iad79.r.cloudfront.net

login-onedriverrniiccrrossotffserve.tiiny.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.71.121.197 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-71-121-197.compute-1.amazonaws.com

daffy-first-fiber.glitch.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.26.4.15 (None, )

ASN13335 (CLOUDFLARENET, US)

api.db-ip.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 13.107.246.40 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 152.195.19.97 (San Jose, United States)

ASN15133 (EDGECAST, US)

aadcdn.msftauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	msauth.net aadcdn.msauth.net — Cisco Umbrella Rank: 2218	48 KB
1	msftauth.net aadcdn.msftauth.net — Cisco Umbrella Rank: 2274	2 KB
1	db-ip.com api.db-ip.com — Cisco Umbrella Rank: 146975	686 B
1	glitch.me daffy-first-fiber.glitch.me	95 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 336	29 KB
1	tiiny.site login-onedriverrniiccrrossotffserve.tiiny.site	4 KB
13	6

	Domain	Requested by
8	aadcdn.msauth.net	daffy-first-fiber.glitch.me login-onedriverrniiccrrossotffserve.tiiny.site
1	aadcdn.msftauth.net	login-onedriverrniiccrrossotffserve.tiiny.site
1	api.db-ip.com	cdnjs.cloudflare.com
1	daffy-first-fiber.glitch.me	login-onedriverrniiccrrossotffserve.tiiny.site
1	cdnjs.cloudflare.com	login-onedriverrniiccrrossotffserve.tiiny.site
1	login-onedriverrniiccrrossotffserve.tiiny.site
13	6

This site contains links to these domains. Also see Links.

Domain
signup.live.com
go.microsoft.com

Subject Issuer	Validity	Valid
*.tiiny.site Amazon RSA 2048 M02	`2024-01-11` - `2025-02-07`	a year	crt.sh
cdnjs.cloudflare.com E1	`2024-06-02` - `2024-08-31`	3 months	crt.sh
glitch.com Amazon RSA 2048 M03	`2023-12-04` - `2025-01-01`	a year	crt.sh
db-ip.com WE1	`2024-07-13` - `2024-10-11`	3 months	crt.sh
aadcdn.msauth.net DigiCert SHA2 Secure Server CA	`2024-04-30` - `2025-04-30`	a year	crt.sh
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA	`2024-05-25` - `2025-05-25`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://login-onedriverrniiccrrossotffserve.tiiny.site/?common=PIUO6ZGJSPP4RQ3PJ7MN7SQ3V6NWO&oauth2=11131b0a392C46975Aa617bcC98286366&authorize=3b904779ccC0B8c31669C2cacc736C
Frame ID: BAA85C5BE49BC37DD117CC173D99A36C
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your account

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

178 kB
Transfer

333 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://signup.live.com/signup?contextid=FB2A4AE87A4785C5&bk=1674444508&ru=https://login.live.com/login.srf%3fcontextid%3dFB2A4AE87A4785C5%26mkt%3dEN-US%26lc%3d1033%26bk%3d1674444508%26uaid%3d7df079e1db12426fa65f7fb024b7b26f&uiflavor=web&lic=1&mkt=EN-US&lc=1033&uaid=7df079e1db12426fa65f7fb024b7b26f
Title: Create one!

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/p/?LinkId=708614
Title: More information

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
login-onedriverrniiccrrossotffserve.tiiny.site/ 3 KB
4 KB 485ms
266ms Document
text/html 99.84.108.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://login-onedriverrniiccrrossotffserve.tiiny.site/?common=PIUO6ZGJSPP4RQ3PJ7MN7SQ3V6NWO&oauth2=11131b0a392C46975Aa617bcC98286366&authorize=3b904779ccC0B8c31669C2cacc736C
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.108.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-108-34.iad79.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 60017dbc43727bb42b87b46eae00f25e49e031f28a65a28987a313bbed365cad

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-length: 3469
content-type: text/html
date: Sat, 27 Jul 2024 03:18:49 GMT
etag: "d131a06b11c79a8f704387bd81349dcc"
last-modified: Mon, 22 Jul 2024 11:03:12 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 cd3b189d4dff15bd0a2ccf14f97ffda2.cloudfront.net (CloudFront)
x-amz-cf-id: IAqz6hrcQasyTzuAT_UdfxpmRgH6LfH_mkPNQwWR0w0g0xr9djRryg==
x-amz-cf-pop: IAD79-C2
x-amz-id-2: Ma/lbZXC8+0lG0o2HNxbuboi8OIlbsfWYjvmAocX8ZT13dQeeqPXYWV4ivmRl9O2Ye1C37HWgYM=
x-amz-request-id: E86VZTPKEQ2Z0YFQ
x-amz-version-id: dntnPE824fnRcRk0tdYfCmYiPm8U8pAZ
x-cache: Miss from cloudfront

GET
H3 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/ 90 KB
29 KB 122ms
46ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.min.js

Requested by

Host: login-onedriverrniiccrrossotffserve.tiiny.site
URL: https://login-onedriverrniiccrrossotffserve.tiiny.site/?common=PIUO6ZGJSPP4RQ3PJ7MN7SQ3V6NWO&oauth2=11131b0a392C46975Aa617bcC98286366&authorize=3b904779ccC0B8c31669C2cacc736C

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://login-onedriverrniiccrrossotffserve.tiiny.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 03:18:48 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 737832
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 29363
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-169d5"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JCuDhMTN7oT4eOycggOT84KXW%2FsVmIbFPTrxYg5OWkgDaderj96O9VUnZiXw4G6DmH5SnzZi%2FNoTRJVnZtXuJZdSKVYuhvs9ZIEW%2BrCsPQCRprv9saTvGFomdGKfZWCmU6a2nMMX"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8a997bf8de3238e2-YYZ
expires: Thu, 17 Jul 2025 03:18:48 GMT

GET
H2 200 script.js Show response
daffy-first-fiber.glitch.me/ 94 KB
95 KB 375ms
185ms Script
application/javascript 52.71.121.197
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://daffy-first-fiber.glitch.me/script.js
Requested by: Host: login-onedriverrniiccrrossotffserve.tiiny.site
URL: https://login-onedriverrniiccrrossotffserve.tiiny.site/?common=PIUO6ZGJSPP4RQ3PJ7MN7SQ3V6NWO&oauth2=11131b0a392C46975Aa617bcC98286366&authorize=3b904779ccC0B8c31669C2cacc736C
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.71.121.197 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-121-197.compute-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 656fc307bee986f6e3bca509444421f6ef799cc932423a6311dd4993b68e416a

Request headers

Referer: https://login-onedriverrniiccrrossotffserve.tiiny.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 03:18:48 GMT
x-amz-version-id: kKrfBnqE4NR8PRnataEV.TeFU.ZrZ5Lm
last-modified: Thu, 06 Jun 2024 18:15:22 GMT
server: AmazonS3
x-amz-request-id: E86QEZJ28TN0H3KD
etag: "424a275da4044fd6773d80dcbd4c8a95"
x-amz-server-side-encryption: AES256
content-type: application/javascript; charset=utf-8
cache-control: no-cache
accept-ranges: bytes
content-length: 96459
x-amz-id-2: C7rzqykm8or3bqrS9WN1e32UpbWFMHo27yDw06F3QBhc5NXwUgmlWM/9sxgX0eetLyMdJiJ2VUo=

GET
H2 200 self Show response
api.db-ip.com/v2/free/ 235 B
686 B 260ms
152ms XHR
application/json 104.26.4.15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.db-ip.com/v2/free/self
Requested by: Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.4.15 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e5761ed2837a09ccf0442a63eeee3a5b15c4c4fccf334d6767bae406365a8019

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://login-onedriverrniiccrrossotffserve.tiiny.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 03:18:49 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Sat, 27 Jul 2024 03:18:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-iplb-request-id: AC4582B2:C8D8_93878F2E:0050_66A46719_1A4E0899:4F34
x-iplb-instance: 59215
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AZ388Rs5YXoYau02MMQRp2CADkWX8lSVs34xV6djC%2F%2FaEsm4icC3fKj8Z6EyLWaDNcS%2F7KDo2Z9L0zb%2B5B9YS5i3Q%2Fxtrpy%2FB7izU6l4pRkamYVQu%2BvLSGr%2Fw5HaSKg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=1800
cf-ray: 8a997bfc7be43702-YYZ
alt-svc: h3=":443"; ma=86400

GET
H2 200 converged.v2.login.min_ziytf8dzt9eg1s6-ohhleg2.css
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ 108 KB
20 KB 569ms
118ms Stylesheet
text/css 13.107.246.40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_ziytf8dzt9eg1s6-ohhleg2.css
Requested by: Host: daffy-first-fiber.glitch.me
URL: https://daffy-first-fiber.glitch.me/script.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 1304c5090f063c677a5b3720fe7b97ef4d9ea102e2bdd837ce399df6057fe385

Request headers

Referer: https://login-onedriverrniiccrrossotffserve.tiiny.site/
Origin: https://login-onedriverrniiccrrossotffserve.tiiny.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 27 Jul 2024 03:18:49 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-cache-info: L1_T2
x-fd-int-roxy-purgeid: 0
content-length: 19953
x-ms-lease-status: unlocked
last-modified: Mon, 18 Apr 2022 21:18:26 GMT
etag: 0x8DA2180FA29F5AF
x-azure-ref: 20240727T031849Z-17fd6bb7c96k68vz0pss28na5n00000002pg000000001teh
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 0f358b86-301e-0051-607b-deadaf000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msftauth.net/ests/2.1/content/images/ 4 KB
2 KB 422ms
39ms Image
image/svg+xml 152.195.19.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Requested by: Host: login-onedriverrniiccrrossotffserve.tiiny.site
URL: https://login-onedriverrniiccrrossotffserve.tiiny.site/?common=PIUO6ZGJSPP4RQ3PJ7MN7SQ3V6NWO&oauth2=11131b0a392C46975Aa617bcC98286366&authorize=3b904779ccC0B8c31669C2cacc736C
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.19.97 San Jose, United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (chd/0799) /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Referer: https://login-onedriverrniiccrrossotffserve.tiiny.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 27 Jul 2024 03:18:49 GMT
content-encoding: gzip
content-md5: nzaLxFgP7ZB3dfMcaybWzw==
age: 109479
x-cache: HIT
content-length: 1435
x-ms-lease-status: unlocked
last-modified: Fri, 02 Nov 2018 20:25:22 GMT
server: ECAcc (chd/0799)
etag: 0x8D64101507E84BD
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 6444079c-201e-0002-4ad4-de7494000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=604800
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 marching_ants_white_166de53471265253ab3a456defe6da23.gif
aadcdn.msauth.net/shared/1.0/content/images/ 3 KB
3 KB 463ms
47ms Image
image/gif 13.107.246.40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif
Requested by: Host: login-onedriverrniiccrrossotffserve.tiiny.site
URL: https://login-onedriverrniiccrrossotffserve.tiiny.site/?common=PIUO6ZGJSPP4RQ3PJ7MN7SQ3V6NWO&oauth2=11131b0a392C46975Aa617bcC98286366&authorize=3b904779ccC0B8c31669C2cacc736C
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13

Request headers

Referer: https://login-onedriverrniiccrrossotffserve.tiiny.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 27 Jul 2024 03:18:49 GMT
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 0
content-length: 2672
x-ms-lease-status: unlocked
last-modified: Fri, 17 Jan 2020 19:28:37 GMT
etag: 0x8D79B83739984DD
x-azure-ref: 20240727T031849Z-17fd6bb7c96ks7ft3dmnknuwvs00000002g0000000007rqr
content-type: image/gif
access-control-allow-origin: *
x-ms-request-id: 21156f28-601e-0075-2588-dedfc5000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
aadcdn.msauth.net/shared/1.0/content/images/ 513 B
816 B 463ms
48ms Image
image/svg+xml 13.107.246.40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
Requested by: Host: login-onedriverrniiccrrossotffserve.tiiny.site
URL: https://login-onedriverrniiccrrossotffserve.tiiny.site/?common=PIUO6ZGJSPP4RQ3PJ7MN7SQ3V6NWO&oauth2=11131b0a392C46975Aa617bcC98286366&authorize=3b904779ccC0B8c31669C2cacc736C
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

Request headers

Referer: https://login-onedriverrniiccrrossotffserve.tiiny.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 27 Jul 2024 03:18:49 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 0
content-length: 276
x-ms-lease-status: unlocked
last-modified: Fri, 17 Jan 2020 19:28:34 GMT
etag: 0x8D79B8371B97A82
x-azure-ref: 20240727T031849Z-17fd6bb7c96ks7ft3dmnknuwvs00000002g0000000007rqs
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: a0b9758b-801e-006d-218c-de00a2000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg
aadcdn.msauth.net/shared/1.0/content/images/ 7 KB
3 KB 464ms
49ms Image
image/svg+xml 13.107.246.40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg
Requested by: Host: login-onedriverrniiccrrossotffserve.tiiny.site
URL: https://login-onedriverrniiccrrossotffserve.tiiny.site/?common=PIUO6ZGJSPP4RQ3PJ7MN7SQ3V6NWO&oauth2=11131b0a392C46975Aa617bcC98286366&authorize=3b904779ccC0B8c31669C2cacc736C
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8

Request headers

Referer: https://login-onedriverrniiccrrossotffserve.tiiny.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 27 Jul 2024 03:18:49 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 0
content-length: 2407
x-ms-lease-status: unlocked
last-modified: Fri, 11 Mar 2022 11:11:29 GMT
etag: 0x8DA034FE445C10D
x-azure-ref: 20240727T031849Z-17fd6bb7c96ks7ft3dmnknuwvs00000002g0000000007rqu
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 08a845b6-501e-002f-078c-defdb2000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg
aadcdn.msauth.net/shared/1.0/content/images/ 3 KB
2 KB 463ms
48ms Image
image/svg+xml 13.107.246.40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg
Requested by: Host: login-onedriverrniiccrrossotffserve.tiiny.site
URL: https://login-onedriverrniiccrrossotffserve.tiiny.site/?common=PIUO6ZGJSPP4RQ3PJ7MN7SQ3V6NWO&oauth2=11131b0a392C46975Aa617bcC98286366&authorize=3b904779ccC0B8c31669C2cacc736C
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1

Request headers

Referer: https://login-onedriverrniiccrrossotffserve.tiiny.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 27 Jul 2024 03:18:49 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 0
content-length: 1173
x-ms-lease-status: unlocked
last-modified: Fri, 17 Jan 2020 19:28:39 GMT
etag: 0x8D79B83749623C9
x-azure-ref: 20240727T031849Z-17fd6bb7c96ks7ft3dmnknuwvs00000002g0000000007rqt
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 5ae4f542-e01e-0054-4e8c-de2aa5000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 signin-options_4e48046ce74f4b89d45037c90576bfac.svg
aadcdn.msauth.net/shared/1.0/content/images/ 2 KB
1 KB 461ms
47ms Image
image/svg+xml 13.107.246.40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg
Requested by: Host: login-onedriverrniiccrrossotffserve.tiiny.site
URL: https://login-onedriverrniiccrrossotffserve.tiiny.site/?common=PIUO6ZGJSPP4RQ3PJ7MN7SQ3V6NWO&oauth2=11131b0a392C46975Aa617bcC98286366&authorize=3b904779ccC0B8c31669C2cacc736C
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93

Request headers

Referer: https://login-onedriverrniiccrrossotffserve.tiiny.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 27 Jul 2024 03:18:49 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 0
content-length: 621
x-ms-lease-status: unlocked
last-modified: Tue, 10 Nov 2020 03:41:24 GMT
etag: 0x8D8852A7FA6B761
x-azure-ref: 20240727T031849Z-17fd6bb7c96ks7ft3dmnknuwvs00000002g0000000007rqp
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 8722f5c5-501e-0003-10fc-de9898000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 2_bc3d32a696895f78c19df6c717586a5d.svg
aadcdn.msauth.net/shared/1.0/content/images/backgrounds/ 2 KB
1 KB 422ms
46ms Image
image/svg+xml 13.107.246.40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Requested by: Host: login-onedriverrniiccrrossotffserve.tiiny.site
URL: https://login-onedriverrniiccrrossotffserve.tiiny.site/?common=PIUO6ZGJSPP4RQ3PJ7MN7SQ3V6NWO&oauth2=11131b0a392C46975Aa617bcC98286366&authorize=3b904779ccC0B8c31669C2cacc736C
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

Referer: https://login-onedriverrniiccrrossotffserve.tiiny.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 27 Jul 2024 03:18:49 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 0
content-length: 673
x-ms-lease-status: unlocked
last-modified: Wed, 12 Feb 2020 22:01:30 GMT
etag: 0x8D7B0071D86E386
x-azure-ref: 20240727T031849Z-17fd6bb7c96ks7ft3dmnknuwvs00000002g0000000007rqq
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 74cf03e5-201e-0030-287c-dec48f000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 favicon_a_eupayfgghqiai7k9sol6lg2.ico
aadcdn.msauth.net/shared/1.0/content/images/ 17 KB
17 KB 80ms
79ms Other
image/x-icon 13.107.246.40
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 13.107.246.40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

Request headers

Referer: https://login-onedriverrniiccrrossotffserve.tiiny.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 27 Jul 2024 03:18:49 GMT
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 0
content-length: 17174
x-ms-lease-status: unlocked
last-modified: Sun, 18 Oct 2020 03:02:03 GMT
etag: 0x8D8731230C851A6
x-azure-ref: 20240727T031849Z-17fd6bb7c96ks7ft3dmnknuwvs00000002g0000000007rr3
content-type: image/x-icon
access-control-allow-origin: *
x-ms-request-id: 12bd2ddd-f01e-003a-468d-deae91000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://login-onedriverrniiccrrossotffserve.tiiny.site/?common=PIUO6ZGJSPP4RQ3PJ7MN7SQ3V6NWO&oauth2=11131b0a392C46975Aa617bcC98286366&authorize=3b904779ccC0B8c31669C2cacc736C Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
aadcdn.msftauth.net
api.db-ip.com
cdnjs.cloudflare.com
daffy-first-fiber.glitch.me
login-onedriverrniiccrrossotffserve.tiiny.site
104.17.25.14
104.26.4.15
13.107.246.40
152.195.19.97
52.71.121.197
99.84.108.34
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
1304c5090f063c677a5b3720fe7b97ef4d9ea102e2bdd837ce399df6057fe385
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1
60017dbc43727bb42b87b46eae00f25e49e031f28a65a28987a313bbed365cad
656fc307bee986f6e3bca509444421f6ef799cc932423a6311dd4993b68e416a
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13
a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
e5761ed2837a09ccf0442a63eeee3a5b15c4c4fccf334d6767bae406365a8019

login-onedriverrniiccrrossotffserve.tiiny.site Open in urlscan Pro 99.84.108.34 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

0 %IPv6

6 Domains

6 Subdomains

6 IPs

2 Countries

178 kBTransfer

333 kBSize

0 Cookies

2 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

22 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

login-onedriverrniiccrrossotffserve.tiiny.site Open in urlscan Pro
99.84.108.34 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

178 kB
Transfer

333 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!