Report - microsofltonline.org/landing/form/af0ca58e-004f-4d52-b079-9ed8899d3286

Report Overview

Visited public
2025-05-07 21:57:54
Tags
URL
microsofltonline.org/landing/form/af0ca58e-004f-4d52-b079-9ed8899d3286
Finishing URL
microsofltonline.org/landing/form/af0ca58e-004f-4d52-b079-9ed8899d3286
IP / ASN
18.212.44.152
#14618 AMAZON-AES
Title
Outlook 365 Login - Oct 24

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
microsofltonline.org	unknown	2019-12-12	2022-06-29	2023-11-27	1.7 kB	7.5 kB	34.204.136.121
s3.amazonaws.com	unknown	2005-08-18	2020-05-13	2025-05-07	1.4 kB	210 kB	52.216.186.149

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2025-05-05	medium	microsofltonline.org/landing/form/af0ca58e-004f-4d52-b079-9ed8899d3286	Office365

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (1)

	URL	From	Size	First Seen	Last Seen
	microsofltonline.org/landing/form/af0ca58e-004f-4d52-b079-9ed8899d3286	ScriptElement	259 B	2025-05-06	2025-05-07
Pretty URL microsofltonline.org/landing/form/af0ca58e-004f-4d52-b079-9ed8899d3286 IP 34.204.136.121 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2025-05-06 14:35 Last Seen2025-05-07 21:57 Times Seen2 Hash f808b8e6075a73f9a307eca6d1f92ad4 519bb77976c4afe63943298b61771dcb27202dfd 162b1fa525a9da47193f544bca9f2b0c3ba125a04292f1c7e4d04525ef400ebb Loading...

HTTP Transactions (6)

URL IP Response Size

microsofltonline.org/css/data-entry.css

34.204.136.121

200 OK

3.5 kB

URL GET
microsofltonline.org/css/data-entry.css
IP
34.204.136.121:443
ASN
#14618 AMAZON-AES

Requested by
https://microsofltonline.org/landing/form/af0ca58e-004f-4d52-b079-9ed8899d3286
Certificate
IssuerAmazon
Subjectmicrosofltonline.org
Fingerprint72:93:D6:C3:A4:A8:DD:C8:5F:B5:DD:B5:B7:45:63:E0:A4:2D:25:4B
ValidityTue, 29 Oct 2024 00:00:00 GMT - Thu, 27 Nov 2025 23:59:59 GMT

File type
ASCII text, with very long lines (3535)
Size
3.5 kB (3536 bytes)
Hash
63c23b0c7d008ec5f7178a90aaeeeabc
4e48f30731acc4a1c50550a7dfc7d15be1425047
7ce36197ec7dbd0bbb820d76876af2f1a2ec58178d37ecbabea694ccac3d1101

HTTP Headers

GET /css/data-entry.css HTTP/1.1
Host: microsofltonline.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://microsofltonline.org/landing/form/af0ca58e-004f-4d52-b079-9ed8899d3286
DNT: 1
Connection: keep-alive
Cookie: csrf=qqszWN6igZZGP%2BNIdPu0CzgzNGNhZWJhOWMxYTUyZDVjOTg3YmEwMmRiYWNjNTg4ZDE5M2VkNmQ%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 07 May 2025 21:57:33 GMT
content-type: text/css
content-length: 3536
server: nginx
last-modified: Wed, 07 May 2025 19:03:17 GMT
etag: "681bae75-dd0"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains
accept-ranges: bytes
X-Firefox-Spdy: h2

s3.amazonaws.com/securityiq/phishing-templates/Outlook+365/logo-microsoft.png

52.216.186.149

200 OK

1.0 kB

URL GET
s3.amazonaws.com/securityiq/phishing-templates/Outlook+365/logo-microsoft.png
IP
52.216.186.149:443
ASN
#16509 AMAZON-02

Requested by
https://microsofltonline.org/landing/form/af0ca58e-004f-4d52-b079-9ed8899d3286
Certificate
IssuerAmazon
Subjects3.amazonaws.com
Fingerprint12:62:37:25:8C:B3:C2:A6:E6:2F:20:1B:18:6B:29:99:EE:B4:B0:8E
ValidityThu, 20 Mar 2025 00:00:00 GMT - Thu, 19 Mar 2026 23:59:59 GMT

File type
PNG image data, 100 x 22, 8-bit/color RGBA, non-interlaced
Size
1.0 kB (1040 bytes)
Hash
e4b675007dc6492ee590131d1f7dfbb3
9397e98e13074c09072f6a50e7267c612738c455
988e349f2bf4e87154738c7b2c1fa86618713a8cfa0cef60a046f5add89bd9de

HTTP Headers

GET /securityiq/phishing-templates/Outlook+365/logo-microsoft.png HTTP/1.1
Host: s3.amazonaws.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://microsofltonline.org/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
x-amz-id-2: JrbuIIFB7+dANOYj8qZyYXB/RjrDH6ffS5T6kZ2KGoyDup1hnokLRujBs5bIaMZ1NaPMzmSat/U=
x-amz-request-id: TYGNTCDK717QJZBM
Date: Wed, 07 May 2025 21:57:34 GMT
Last-Modified: Tue, 21 Feb 2017 14:16:38 GMT
ETag: "e4b675007dc6492ee590131d1f7dfbb3"
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 1040
Server: AmazonS3

s3.amazonaws.com/securityiq/phishing-templates/Outlook+365/logo-outlook365.png

52.216.186.149

200 OK

4.6 kB

URL GET
s3.amazonaws.com/securityiq/phishing-templates/Outlook+365/logo-outlook365.png
IP
52.216.186.149:443
ASN
#16509 AMAZON-02

Requested by
https://microsofltonline.org/landing/form/af0ca58e-004f-4d52-b079-9ed8899d3286
Certificate
IssuerAmazon
Subjects3.amazonaws.com
Fingerprint12:62:37:25:8C:B3:C2:A6:E6:2F:20:1B:18:6B:29:99:EE:B4:B0:8E
ValidityThu, 20 Mar 2025 00:00:00 GMT - Thu, 19 Mar 2026 23:59:59 GMT

File type
PNG image data, 159 x 35, 8-bit/color RGBA, non-interlaced
Size
4.6 kB (4585 bytes)
Hash
9f09a27d4f69b3557c7433574a29d726
a3097972d16e6d5768086f3f126e8d07edcc5976
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603

HTTP Headers

GET /securityiq/phishing-templates/Outlook+365/logo-outlook365.png HTTP/1.1
Host: s3.amazonaws.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://microsofltonline.org/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
x-amz-id-2: nPzYpMSLtw63Ojb9c3A2DNEfRYhdnjiuY5I07FkQ9KXGy9MDYQYEjk/T1d+ASqKg3JH2A6s/ywU=
x-amz-request-id: TYGZWAZ5SHJHM2CB
Date: Wed, 07 May 2025 21:57:34 GMT
Last-Modified: Tue, 21 Feb 2017 14:16:38 GMT
ETag: "9f09a27d4f69b3557c7433574a29d726"
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 4585
Server: AmazonS3

s3.amazonaws.com/securityiq/phishing-templates/Outlook+365/background.jpg

52.217.90.54

200 OK

203 kB

URL GET
s3.amazonaws.com/securityiq/phishing-templates/Outlook+365/background.jpg
IP
52.217.90.54:443
ASN
#16509 AMAZON-02

Requested by
https://microsofltonline.org/landing/form/af0ca58e-004f-4d52-b079-9ed8899d3286
Certificate
IssuerAmazon
Subjects3.amazonaws.com
Fingerprint12:62:37:25:8C:B3:C2:A6:E6:2F:20:1B:18:6B:29:99:EE:B4:B0:8E
ValidityThu, 20 Mar 2025 00:00:00 GMT - Thu, 19 Mar 2026 23:59:59 GMT

File type
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1420x1080, components 3
Size
203 kB (203294 bytes)
Hash
65283b123eb235e6176ae98c02ac5b1c
c50ca32b13a2dcbde0cb6eb2d4f72c252f14ac3f
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b

HTTP Headers

GET /securityiq/phishing-templates/Outlook+365/background.jpg HTTP/1.1
Host: s3.amazonaws.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://microsofltonline.org/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
x-amz-id-2: lgjZaoJZJtMghwJvnYckdNVqeVimXkeZJhpKjeBMGf029shePPPJT2WuwRep4HmmgwprSL+UaBs=
x-amz-request-id: TYGZC6930TVCN7NP
Date: Wed, 07 May 2025 21:57:34 GMT
Last-Modified: Tue, 21 Feb 2017 14:16:38 GMT
ETag: "65283b123eb235e6176ae98c02ac5b1c"
Accept-Ranges: bytes
Content-Type: image/jpeg
Content-Length: 203294
Server: AmazonS3

microsofltonline.org/favicon.ico

34.204.136.121

404 Not Found

146 B

URL GET
microsofltonline.org/favicon.ico
IP
34.204.136.121:443
ASN
#14618 AMAZON-AES

Requested by
https://microsofltonline.org/landing/form/af0ca58e-004f-4d52-b079-9ed8899d3286
Certificate
IssuerAmazon
Subjectmicrosofltonline.org
Fingerprint72:93:D6:C3:A4:A8:DD:C8:5F:B5:DD:B5:B7:45:63:E0:A4:2D:25:4B
ValidityTue, 29 Oct 2024 00:00:00 GMT - Thu, 27 Nov 2025 23:59:59 GMT

File type
HTML document, ASCII text, with CRLF line terminators
Size
146 B (146 bytes)
Hash
8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: microsofltonline.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://microsofltonline.org/landing/form/af0ca58e-004f-4d52-b079-9ed8899d3286
DNT: 1
Connection: keep-alive
Cookie: csrf=qqszWN6igZZGP%2BNIdPu0CzgzNGNhZWJhOWMxYTUyZDVjOTg3YmEwMmRiYWNjNTg4ZDE5M2VkNmQ%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 404 Not Found
date: Wed, 07 May 2025 21:57:34 GMT
content-type: text/html
server: nginx
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains
content-encoding: gzip
X-Firefox-Spdy: h2

microsofltonline.org/landing/form/af0ca58e-004f-4d52-b079-9ed8899d3286

34.204.136.121

200 OK

2.7 kB

URL User Request GET
microsofltonline.org/landing/form/af0ca58e-004f-4d52-b079-9ed8899d3286
IP
34.204.136.121:443
ASN
#14618 AMAZON-AES

Certificate
IssuerAmazon
Subjectmicrosofltonline.org
Fingerprint72:93:D6:C3:A4:A8:DD:C8:5F:B5:DD:B5:B7:45:63:E0:A4:2D:25:4B
ValidityTue, 29 Oct 2024 00:00:00 GMT - Thu, 27 Nov 2025 23:59:59 GMT

File type
HTML document, ASCII text, with very long lines (549)
Size
2.7 kB (2688 bytes)
Hash
5012b459495c63a6b1e6b717f7970bd3
1fee2c88ccd034ae9c5815bce37580bff7c49e95
4aaa7a6147c5c5034853cde2fcfcd33aa239e26b5d7d1738b6d8635543284b79

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Office365

HTTP Headers

GET /landing/form/af0ca58e-004f-4d52-b079-9ed8899d3286 HTTP/1.1
Host: microsofltonline.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 07 May 2025 21:57:33 GMT
content-type: text/html; charset=UTF-8
server: nginx
x-frame-options: SAMEORIGIN
referrer-policy: unsafe-url
set-cookie: csrf=qqszWN6igZZGP%2BNIdPu0CzgzNGNhZWJhOWMxYTUyZDVjOTg3YmEwMmRiYWNjNTg4ZDE5M2VkNmQ%3D; path=/; secure
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains
content-encoding: gzip
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (1)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (6)

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers