Report - microsoft.leanden.co.uk/login.php/

Report Overview

Submitted URL
microsoft.leanden.co.uk/login.php/
IP
69.49.228.234
ASN
#19871 NETWORK-SOLUTIONS-HOSTING
Submitted
2024-04-18 22:24:55
Access
public
Website Title
Sign in to your Microsoft account
Final URL
microsoft.leanden.co.uk/login.php/#wa=wsignin1.0&rpsnv=13&ct=1539585327&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d715d44a2-2f11-4282-f625-a066679e96e2&id=292841&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Tags
microsoft phishing
urlquery detections
Phishing - Microsoft

Detections

urlquery
10
Network Intrusion Detection
0
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
microsoft.leanden.co.uk	unknown	unknown	No data	No data	4.6 kB	30 kB	69.49.228.234

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (1)

	URL	Size	First Seen	Last Seen
	microsoft.leanden.co.uk/login.php/	0 B	2023-03-07	2024-05-02
Pretty URL microsoft.leanden.co.uk/login.php/ IP 69.49.228.234 ASN #19871 NETWORK-SOLUTIONS-HOSTING Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-02 04:21:26 Times Seen37262066 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

HTTP Transactions (9)

URL IP Response Size

microsoft.leanden.co.uk/login.php/

69.49.228.234

200 OK

3.0 kB

URL User Request GET HTTP/1.1
microsoft.leanden.co.uk/login.php/
IP
69.49.228.234:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Certificate
IssuerLet's Encrypt
Subjectwww.microsoft.leanden.co.uk
Fingerprint83:20:1D:1A:8D:B7:53:A5:4C:97:6A:F5:05:30:34:78:FF:5D:41:75
ValidityThu, 18 Apr 2024 14:19:10 GMT - Wed, 17 Jul 2024 14:19:09 GMT

File type
HTML document, Unicode text, UTF-8 text
Size
3.0 kB (2952 bytes)
Hash
9d30c331c12016cf882be6f4192f1d8b
30f69c3855162106e52efc1064fe70e52582109e
456de2430d551bd4824ad70f0f02a20db06fd787ac4fd8e62212d609a85d58ec

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /login.php/ HTTP/1.1
Host: microsoft.leanden.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 18 Apr 2024 22:24:30 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=93a354bdc96a127c69a5a0f23f22ea0a; path=/
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

microsoft.leanden.co.uk/login.php/assets/css/bootstrap.css

69.49.228.234

200 OK

3.0 kB

URL GET HTTP/1.1
microsoft.leanden.co.uk/login.php/assets/css/bootstrap.css
IP
69.49.228.234:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Requested by
https://microsoft.leanden.co.uk/login.php/
Certificate
IssuerLet's Encrypt
Subjectwww.microsoft.leanden.co.uk
Fingerprint83:20:1D:1A:8D:B7:53:A5:4C:97:6A:F5:05:30:34:78:FF:5D:41:75
ValidityThu, 18 Apr 2024 14:19:10 GMT - Wed, 17 Jul 2024 14:19:09 GMT

File type
HTML document, Unicode text, UTF-8 text
Size
3.0 kB (2976 bytes)
Hash
6929ddc8796faf645cfb7ef19acfd84b
fbc226a1f77eccdffd1e6c471b033724a40b0178
9abb4adc53e615c8cc3314f1adda30d84c0da6cbc99708a763556b7138db082b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /login.php/assets/css/bootstrap.css HTTP/1.1
Host: microsoft.leanden.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://microsoft.leanden.co.uk/login.php/
Cookie: PHPSESSID=93a354bdc96a127c69a5a0f23f22ea0a
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 18 Apr 2024 22:24:31 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

microsoft.leanden.co.uk/login.php/assets/css/login.css

69.49.228.234

200 OK

3.0 kB

URL GET HTTP/1.1
microsoft.leanden.co.uk/login.php/assets/css/login.css
IP
69.49.228.234:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Requested by
https://microsoft.leanden.co.uk/login.php/
Certificate
IssuerLet's Encrypt
Subjectwww.microsoft.leanden.co.uk
Fingerprint83:20:1D:1A:8D:B7:53:A5:4C:97:6A:F5:05:30:34:78:FF:5D:41:75
ValidityThu, 18 Apr 2024 14:19:10 GMT - Wed, 17 Jul 2024 14:19:09 GMT

File type
HTML document, Unicode text, UTF-8 text
Size
3.0 kB (2972 bytes)
Hash
702f34759734bf63d349b8bfebd7d408
f2938dd25b60ebea95ad402a65dfc48202921450
f5f6970e756856c52af97902c5ec60e8b1529c313b71cec99b6951aaae1be2d6

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /login.php/assets/css/login.css HTTP/1.1
Host: microsoft.leanden.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://microsoft.leanden.co.uk/login.php/
Cookie: PHPSESSID=93a354bdc96a127c69a5a0f23f22ea0a
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 18 Apr 2024 22:24:31 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

microsoft.leanden.co.uk/login.php/assets/js/jquery.min.js

69.49.228.234

200 OK

3.0 kB

URL GET HTTP/1.1
microsoft.leanden.co.uk/login.php/assets/js/jquery.min.js
IP
69.49.228.234:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Requested by
https://microsoft.leanden.co.uk/login.php/
Certificate
IssuerLet's Encrypt
Subjectwww.microsoft.leanden.co.uk
Fingerprint83:20:1D:1A:8D:B7:53:A5:4C:97:6A:F5:05:30:34:78:FF:5D:41:75
ValidityThu, 18 Apr 2024 14:19:10 GMT - Wed, 17 Jul 2024 14:19:09 GMT

File type
HTML document, Unicode text, UTF-8 text
Size
3.0 kB (2975 bytes)
Hash
33099491e5f694509742c5f3c504893d
f83f532a32867efaf26156cec08af3894bc97311
48225f96581dcd44a0dfc0956058397735b1de1170b99f51c21fb3669a92957a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /login.php/assets/js/jquery.min.js HTTP/1.1
Host: microsoft.leanden.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://microsoft.leanden.co.uk/login.php/
Cookie: PHPSESSID=93a354bdc96a127c69a5a0f23f22ea0a
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 18 Apr 2024 22:24:31 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

microsoft.leanden.co.uk/login.php/assets/js/bootstrap.min.js

69.49.228.234

200 OK

3.0 kB

URL GET HTTP/1.1
microsoft.leanden.co.uk/login.php/assets/js/bootstrap.min.js
IP
69.49.228.234:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Requested by
https://microsoft.leanden.co.uk/login.php/
Certificate
IssuerLet's Encrypt
Subjectwww.microsoft.leanden.co.uk
Fingerprint83:20:1D:1A:8D:B7:53:A5:4C:97:6A:F5:05:30:34:78:FF:5D:41:75
ValidityThu, 18 Apr 2024 14:19:10 GMT - Wed, 17 Jul 2024 14:19:09 GMT

File type
HTML document, Unicode text, UTF-8 text
Size
3.0 kB (2978 bytes)
Hash
40133866deb74d59f8eb41c2b3f55bf9
b2b7a3d80476e79e6312459172152e5c26b8c362
f105e541b93740ab5acb5edee38eaa016071239d9ae52d79a78cb1c019e6f7e3

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /login.php/assets/js/bootstrap.min.js HTTP/1.1
Host: microsoft.leanden.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://microsoft.leanden.co.uk/login.php/
Cookie: PHPSESSID=93a354bdc96a127c69a5a0f23f22ea0a
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 18 Apr 2024 22:24:31 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

microsoft.leanden.co.uk/login.php/assets/js/popper.min.js

69.49.228.234

200 OK

3.0 kB

URL GET HTTP/1.1
microsoft.leanden.co.uk/login.php/assets/js/popper.min.js
IP
69.49.228.234:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Requested by
https://microsoft.leanden.co.uk/login.php/
Certificate
IssuerLet's Encrypt
Subjectwww.microsoft.leanden.co.uk
Fingerprint83:20:1D:1A:8D:B7:53:A5:4C:97:6A:F5:05:30:34:78:FF:5D:41:75
ValidityThu, 18 Apr 2024 14:19:10 GMT - Wed, 17 Jul 2024 14:19:09 GMT

File type
HTML document, Unicode text, UTF-8 text
Size
3.0 kB (2975 bytes)
Hash
64babf4f1bd1d570ffe564331a3544a0
a9365a9818e720c7eef0ddc2a7a9413d75220473
b135a0ccafa9100314a522ea6f8d285680cec45ce2ad69f63b4631d32dcd456c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /login.php/assets/js/popper.min.js HTTP/1.1
Host: microsoft.leanden.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://microsoft.leanden.co.uk/login.php/
Cookie: PHPSESSID=93a354bdc96a127c69a5a0f23f22ea0a
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 18 Apr 2024 22:24:31 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

microsoft.leanden.co.uk/login.php/assets/images/ellipsis_white.svg

69.49.228.234

200 OK

3.0 kB

URL GET HTTP/1.1
microsoft.leanden.co.uk/login.php/assets/images/ellipsis_white.svg
IP
69.49.228.234:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Requested by
https://microsoft.leanden.co.uk/login.php/
Certificate
IssuerLet's Encrypt
Subjectwww.microsoft.leanden.co.uk
Fingerprint83:20:1D:1A:8D:B7:53:A5:4C:97:6A:F5:05:30:34:78:FF:5D:41:75
ValidityThu, 18 Apr 2024 14:19:10 GMT - Wed, 17 Jul 2024 14:19:09 GMT

File type
HTML document, Unicode text, UTF-8 text
Size
3.0 kB (2984 bytes)
Hash
aaeed362a42f44d3d3af767ccd0d6658
5297b7253ed3df467360dfc3c44030b91c49a5fd
54105154030a40d08cf0359c03d06f0cd93e2c4da8decaa44de97dc5b0d64e89

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /login.php/assets/images/ellipsis_white.svg HTTP/1.1
Host: microsoft.leanden.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://microsoft.leanden.co.uk/login.php/
Cookie: PHPSESSID=93a354bdc96a127c69a5a0f23f22ea0a
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 18 Apr 2024 22:24:31 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

microsoft.leanden.co.uk/login.php/assets/images/logo.svg

69.49.228.234

200 OK

3.0 kB

URL GET HTTP/1.1
microsoft.leanden.co.uk/login.php/assets/images/logo.svg
IP
69.49.228.234:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Requested by
https://microsoft.leanden.co.uk/login.php/
Certificate
IssuerLet's Encrypt
Subjectwww.microsoft.leanden.co.uk
Fingerprint83:20:1D:1A:8D:B7:53:A5:4C:97:6A:F5:05:30:34:78:FF:5D:41:75
ValidityThu, 18 Apr 2024 14:19:10 GMT - Wed, 17 Jul 2024 14:19:09 GMT

File type
HTML document, Unicode text, UTF-8 text
Size
3.0 kB (2974 bytes)
Hash
d764e2c6774fd80490bae00ab0264b69
e73ce5e783a32ba84b711f07171ed9a4cdcd64c9
827833c70d5017371aa9157d0322a0070f05ef1422bc4f497faa275b12b127b7

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /login.php/assets/images/logo.svg HTTP/1.1
Host: microsoft.leanden.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://microsoft.leanden.co.uk/login.php/
Cookie: PHPSESSID=93a354bdc96a127c69a5a0f23f22ea0a
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 18 Apr 2024 22:24:31 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

microsoft.leanden.co.uk/login.php/assets/images/favicon.ico

69.49.228.234

200 OK

3.0 kB

URL GET HTTP/1.1
microsoft.leanden.co.uk/login.php/assets/images/favicon.ico
IP
69.49.228.234:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Requested by
https://microsoft.leanden.co.uk/login.php/
Certificate
IssuerLet's Encrypt
Subjectwww.microsoft.leanden.co.uk
Fingerprint83:20:1D:1A:8D:B7:53:A5:4C:97:6A:F5:05:30:34:78:FF:5D:41:75
ValidityThu, 18 Apr 2024 14:19:10 GMT - Wed, 17 Jul 2024 14:19:09 GMT

File type
HTML document, Unicode text, UTF-8 text
Size
3.0 kB (2977 bytes)
Hash
7742e2ddde29c4867a74c0f3a2ba7a49
503bce7c111806095a897fa93247e5e2eb422158
78158581346ced9bcf1fb3fb0b8a785a5671855fa5d36754c5fe4fc2304daa80

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /login.php/assets/images/favicon.ico HTTP/1.1
Host: microsoft.leanden.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://microsoft.leanden.co.uk/login.php/
Cookie: PHPSESSID=93a354bdc96a127c69a5a0f23f22ea0a
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 18 Apr 2024 22:24:32 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (1)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (9)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size