auxrapp.com
Open in
urlscan Pro
2a02:4780:3:383:0:aab:eb94:1
Malicious Activity!
Public Scan
Effective URL: https://auxrapp.com/BODY222/MicrosoftAccount.html
Submission: On December 01 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by R3 on November 20th 2021. Valid for: 3 months.
This is the only time auxrapp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Office 365 (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 2a02:4780:3:3... 2a02:4780:3:383:0:aab:eb94:1 | 47583 (AS-HOSTINGER) (AS-HOSTINGER) | |
2 | 129.215.55.224 129.215.55.224 | 786 (JANET Jis...) (JANET Jisc Services Limited) | |
2 | 2403:e800:e80... 2403:e800:e803:1790::35c1 | 4637 (ASN-TELST...) (ASN-TELSTRA-GLOBAL Telstra Global) | |
1 | 141.193.213.20 141.193.213.20 | 209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare) | |
6 | 4 |
ASN786 (JANET Jisc Services Limited, GB)
PTR: edadfed.ed.ac.uk
edadfed.ed.ac.uk |
ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK)
secure.aadcdn.microsoftonline-p.com |
ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)
blogs.microsoft.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com |
204 KB |
2 |
ed.ac.uk
edadfed.ed.ac.uk |
189 KB |
2 |
auxrapp.com
1 redirects
auxrapp.com |
5 KB |
1 |
microsoft.com
blogs.microsoft.com |
42 KB |
6 | 4 |
Domain | Requested by | |
---|---|---|
2 | secure.aadcdn.microsoftonline-p.com |
auxrapp.com
|
2 | edadfed.ed.ac.uk |
auxrapp.com
|
2 | auxrapp.com | 1 redirects |
1 | blogs.microsoft.com |
auxrapp.com
|
6 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
auxrapp.com R3 |
2021-11-20 - 2022-02-18 |
3 months | crt.sh |
edadfed.ed.ac.uk GEANT OV RSA CA 4 |
2021-11-11 - 2022-11-11 |
a year | crt.sh |
secure.aadcdn.microsoftonline-p.com Microsoft RSA TLS CA 01 |
2020-12-22 - 2021-12-22 |
a year | crt.sh |
blogs.microsoft.com Microsoft RSA TLS CA 02 |
2021-11-05 - 2022-11-05 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://auxrapp.com/BODY222/MicrosoftAccount.html
Frame ID: AA46A2124D6754F177B56F795DF8ED83
Requests: 6 HTTP requests in this frame
Screenshot
Page Title
Sign InAccount VerificationPage URL History Show full URLs
-
http://auxrapp.com/BODY222/MicrosoftAccount.html
HTTP 301
https://auxrapp.com/BODY222/MicrosoftAccount.html Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://auxrapp.com/BODY222/MicrosoftAccount.html
HTTP 301
https://auxrapp.com/BODY222/MicrosoftAccount.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
MicrosoftAccount.html
auxrapp.com/BODY222/ Redirect Chain
|
17 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
edadfed.ed.ac.uk/adfs/portal/css/ |
8 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
heroillustration
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-6ybrougjmflxqw910ieyohr7wb4x4-yvoixrlaidmz4/appbranding/askzfdsqe20i-bcjwporaywega7vbt4acqnn1hiliiw/0/ |
199 KB 199 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bannerlogo
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-6ybrougjmflxqw910ieyohr7wb4x4-yvoixrlaidmz4/appbranding/askzfdsqe20i-bcjwporaywega7vbt4acqnn1hiliiw/0/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
8867.Microsoft_5F00_Logo_2D00_for_2D00_screen.jpg
blogs.microsoft.com/wp-content/uploads/2012/08/ |
41 KB 42 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
illustration.jpg
edadfed.ed.ac.uk/adfs/portal/illustration/ |
185 KB 186 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Office 365 (Online)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| InputUtil function| validateForm function| SelectOption function| Login undefined| emails undefined| msViewportStyle undefined| viewport function| getStyle function| computeLoadIllustration0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | upgrade-insecure-requests |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
auxrapp.com
blogs.microsoft.com
edadfed.ed.ac.uk
secure.aadcdn.microsoftonline-p.com
129.215.55.224
141.193.213.20
2403:e800:e803:1790::35c1
2a02:4780:3:383:0:aab:eb94:1
47c8b22935bc876849dbb14cbe8e2e5166bed47df9e72dfd5a4050e80efc46e8
545a890c02df6d162184db5d5c76ddaf945c773d76c83f3a4e54d431a1d6cbd0
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
8c1b3f4cc67d8d1ab753ec816a270820908bd1bbcf24650bb92977864c188e5d
cf5edf607626ff9059a47a7a955b02ce097c255f75bc54232650a0db0fb9d794
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603