login.microsoftonline.com
2603:1026:3000:158::3
Public Scan
Open in
urlscan Pro
Effective URL: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=9199bf20-a13f-4107-85dc-02114787ef48&scope=https%3A%2F%2F... 13yr old
Submission: On July 17 via api from US — Scanned from FI
Summary
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on May 25th 2025. Valid for: 6mo.
This is the only time login.microsoftonline.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 2603:1026:c0d... 2603:1026:c0d:c2d::8 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 3 | 2603:1026:c0d... 2603:1026:c0d:102b::2 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 9 | 2a02:26f0:350... 2a02:26f0:3500:3::b818:4d2f | 20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.) | |
| 1 | 23.48.23.40 23.48.23.40 | 20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.) | |
| 1 1 | 2603:1026:300... 2603:1026:3000:150::a | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 1 | 2603:1026:300... 2603:1026:3000:158::3 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 1 | 20.190.160.14 20.190.160.14 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 13 | 2620:1ec:29:1... 2620:1ec:29:1::45 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 1 | 40.126.32.74 40.126.32.74 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 2 | 20.50.201.200 20.50.201.200 | () () | |
| 33 | 9 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
| autodiscover.processandserve.com 9mo old |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
| outlook.office365.com 9yr old |
ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
| res.public.onecdn.static.microsoft 2yr old |
ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a23-48-23-40.deploy.static.akamaitechnologies.com
| res.public.onecdn.static.microsoft 2yr old |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
| login.microsoftonline.com 13yr old |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
| login.microsoftonline.com 13yr old |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
| login.live.com 13yr old |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
| aadcdn.msauth.net 7yr old |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
| login.live.com 13yr old |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 13 |
msauth.net
aadcdn.msauth.net — Cisco Umbrella Rank: 802 7yr old |
387 KB |
| 10 |
static.microsoft
res.public.onecdn.static.microsoft — Cisco Umbrella Rank: 181 2yr old |
2 MB |
| 3 |
office365.com
outlook.office365.com — Cisco Umbrella Rank: 33 9yr old |
19 KB |
| 2 |
live.com
login.live.com — Cisco Umbrella Rank: 51 13yr old |
2 KB |
| 2 |
microsoft.com
browser.events.data.microsoft.com Failed 7yr old eu-mobile.events.data.microsoft.com 4yr old |
427 B |
| 2 |
microsoftonline.com
1 redirects
login.microsoftonline.com — Cisco Umbrella Rank: 11 13yr old |
20 KB |
| 1 |
processandserve.com
1 redirects
autodiscover.processandserve.com 9mo old |
553 B |
| 33 | 7 |
| Domain | Requested by | |
|---|---|---|
| 13 | aadcdn.msauth.net |
login.microsoftonline.com
aadcdn.msauth.net |
| 10 | res.public.onecdn.static.microsoft |
outlook.office365.com
|
| 3 | outlook.office365.com |
res.public.onecdn.static.microsoft
|
| 2 | eu-mobile.events.data.microsoft.com |
aadcdn.msauth.net
|
| 2 | login.live.com |
login.microsoftonline.com
aadcdn.msauth.net |
| 2 | login.microsoftonline.com |
1 redirects
res.public.onecdn.static.microsoft
|
| 1 | autodiscover.processandserve.com | 1 redirects |
| 0 | browser.events.data.microsoft.com Failed |
res.public.onecdn.static.microsoft
|
| 33 | 8 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| login.live.com |
| www.microsoft.com |
| privacy.microsoft.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| outlook.com DigiCert Cloud Services CA-1 |
2025-03-29 - 2026-03-28 |
1yr | crt.sh |
| *.public.onecdn.static.microsoft Microsoft Azure ECC TLS Issuing CA 07 |
2024-12-16 - 2025-12-11 |
1yr | crt.sh |
| stamp2.login.microsoftonline.com DigiCert SHA2 Secure Server CA |
2025-05-25 - 2025-11-25 |
6mo | crt.sh |
| login.live.com DigiCert SHA2 Secure Server CA |
2025-05-29 - 2025-11-29 |
6mo | crt.sh |
| aadcdn.msauth.net DigiCert SHA2 Secure Server CA |
2024-10-29 - 2025-10-29 |
1yr | crt.sh |
| *.events.data.microsoft.com Microsoft Azure RSA TLS Issuing CA 03 |
2025-07-02 - 2025-12-29 |
6mo | crt.sh |
This page contains 3 frames:
Primary Page:
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=9199bf20-a13f-4107-85dc-02114787ef48&scope=https%3A%2F%2Foutlook.office.com%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foutlook.office365.com%2Fmail%2F&client-request-id=2e43dbc9-363f-a49e-3ae6-1662bc2553fb&response_mode=fragment&client_info=1&prompt=select_account&nonce=019815eb-82ae-7b10-9484-9840e964770b&state=eyJpZCI6IjAxOTgxNWViLTgyYWUtNzQxNC1hZDA4LWUyYmZkNzgxNzNmYyIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoicmVkaXJlY3QifX0%3D&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=msal.js.browser&x-client-VER=4.12.0&response_type=code&code_challenge=iTkPP10xmCT7UhvQYduQXVrWP5xLC-9_iVdAxzocfYY&code_challenge_method=S256
Frame ID: C345CC1EE47D2F72188E41CEE092C853
Requests: 30 HTTP requests in this frame
Frame:
https://outlook.office365.com/mail/oauthRedirect.html
Frame ID: ABD70D811D23A0ADD1659B147D2AA419
Requests: 1 HTTP requests in this frame
Frame:
https://login.live.com/Me.htm?v=3
Frame ID: 08B651DE85CF7B3F4A7CF6D26E9574EA
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Kirjaudu sisään tiliisiPage URL History Show full URLs
-
http://autodiscover.processandserve.com/
HTTP 307
https://autodiscover.processandserve.com/ HTTP 307
http://autodiscover.processandserve.com/ HTTP 301
https://outlook.office365.com/mail/?realm=processandserve.com&vd=autodiscover Page URL
- https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=9199bf20-a13f-4107-85dc-02114787ef48&... Page URL
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: Luo sellainen!
Search URL Search Domain Scan URL
Title: Käyttöehdot
Search URL Search Domain Scan URL
Title: Tietosuoja ja evästeet
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://autodiscover.processandserve.com/
HTTP 307
https://autodiscover.processandserve.com/ HTTP 307
http://autodiscover.processandserve.com/ HTTP 301
https://outlook.office365.com/mail/?realm=processandserve.com&vd=autodiscover Page URL
- https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=9199bf20-a13f-4107-85dc-02114787ef48&scope=https%3A%2F%2Foutlook.office.com%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foutlook.office365.com%2Fmail%2F&client-request-id=2e43dbc9-363f-a49e-3ae6-1662bc2553fb&response_mode=fragment&client_info=1&prompt=select_account&nonce=019815eb-82ae-7b10-9484-9840e964770b&state=eyJpZCI6IjAxOTgxNWViLTgyYWUtNzQxNC1hZDA4LWUyYmZkNzgxNzNmYyIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoicmVkaXJlY3QifX0%3D&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=msal.js.browser&x-client-VER=4.12.0&response_type=code&code_challenge=iTkPP10xmCT7UhvQYduQXVrWP5xLC-9_iVdAxzocfYY&code_challenge_method=S256 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://autodiscover.processandserve.com/ HTTP 307
- https://autodiscover.processandserve.com/ HTTP 307
- http://autodiscover.processandserve.com/ HTTP 301
- https://outlook.office365.com/mail/?realm=processandserve.com&vd=autodiscover
- https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=9199bf20-a13f-4107-85dc-02114787ef48&scope=https%3A%2F%2Foutlook.office.com%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foutlook.office365.com%2Fmail%2FoauthRedirect.html&client-request-id=2e43dbc9-363f-a49e-3ae6-1662bc2553fb&response_mode=fragment&client_info=1&prompt=none&nonce=019815eb-80f3-75ce-9d53-5afc031c9341&state=eyJpZCI6IjAxOTgxNWViLTgwZjMtNzg0My1hNmVmLTU1N2Q3YTE1MTFlZiIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=msal.js.browser&x-client-VER=4.12.0&response_type=code&code_challenge=BcNN9yjEj_BePAgk6Np2ppJsZiuP_1LRdV3k_gwuCL8&code_challenge_method=S256 HTTP 302
- https://outlook.office365.com/mail/oauthRedirect.html
33 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
/
outlook.office365.com/mail/ Redirect Chain
|
12 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
owa.mail.runtime.8e4bea7e.js
res.public.onecdn.static.microsoft/owamail/hashed-v1/scripts/ |
223 KB 125 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
owa.mailindex.3111ad78.js
res.public.onecdn.static.microsoft/owamail/hashed-v1/scripts/ |
364 KB 119 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
owa.21744.m.1020d70f.js
res.public.onecdn.static.microsoft/owamail/hashed-v1/scripts/ |
3 MB 678 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
owa.471.m.a45d460d.js
res.public.onecdn.static.microsoft/owamail/hashed-v1/scripts/ |
19 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
owa.AppBoot.m.8b9da4fe.css
res.public.onecdn.static.microsoft/owamail/hashed-v1/scripts/ |
115 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
owa.AppBoot.m.b948233a.js
res.public.onecdn.static.microsoft/owamail/hashed-v1/scripts/ |
2 MB 518 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
owa.15509.m.c29b4020.js
res.public.onecdn.static.microsoft/owamail/hashed-v1/scripts/ |
17 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
owa.94868.m.211888ef.js
res.public.onecdn.static.microsoft/owamail/hashed-v1/scripts/ |
294 KB 68 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
owa.MsalAuth.m.eae6c33a.js
res.public.onecdn.static.microsoft/owamail/hashed-v1/scripts/ |
25 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
microsoft.svg
res.public.onecdn.static.microsoft/assets/framework/ |
3 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
014deded-86c1-49a7-ae1c-9b1c8142baf4
https://outlook.office365.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon.ico
outlook.office365.com/mail/ |
8 KB 8 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
oauthRedirect.html
outlook.office365.com/mail/ Frame ABD7 Redirect Chain
|
2 KB 967 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
authorize
login.microsoftonline.com/common/oauth2/v2.0/ |
45 KB 18 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST |
/
browser.events.data.microsoft.com/OneCollector/1.0/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Me.htm
login.live.com/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
converged.v2.login.min_wyfpxtvrgudp2mrjlpyxva2.css
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ |
111 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ConvergedLogin_PCore_Rs7tMB_3QFRW_ArXlMd2Ag2.js
aadcdn.msauth.net/shared/1.0/content/js/ |
450 KB 123 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ux.converged.login.strings-fi.min_yre-njbjlobxycbuyyppcw2.js
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ |
63 KB 18 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
oneDs_f891683d1850d7ab47e8.js
aadcdn.msauth.net/shared/1.0/content/js/ |
186 KB 60 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
convergedlogin_pcustomizationloader_23ef905c40c591d8d403.js
aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/ |
397 KB 114 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon_a_eupayfgghqiai7k9sol6lg2.ico
aadcdn.msauth.net/shared/1.0/content/images/ |
17 KB 1 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
convergedlogin_pfetchsessionsprogress_8b91e9d11baffe6473fb.js
aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/ |
15 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
aadcdn.msauth.net/shared/1.0/content/images/ |
3 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
aadcdn.msauth.net/shared/1.0/content/images/ |
4 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
aadcdn.msauth.net/shared/1.0/content/images/backgrounds/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
aadcdn.msauth.net/shared/1.0/content/images/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Me.htm
login.live.com/ Frame 08B6 |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
convergedlogin_pstringcustomizationhelper_754c5f5e6fb1302ec276.js
aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/ |
111 KB 35 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
aadcdn.msauth.net/shared/1.0/content/images/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
/
eu-mobile.events.data.microsoft.com/OneCollector/1.0/ |
153 B 427 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
OPTIONS H2 |
/
eu-mobile.events.data.microsoft.com/OneCollector/1.0/ Frame |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- outlook.office365.com
- URL
- blob:https://outlook.office365.com/014deded-86c1-49a7-ae1c-9b1c8142baf4
- Domain
- browser.events.data.microsoft.com
- URL
- https://browser.events.data.microsoft.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-4.3.6&apikey=d634483c08244c1ca09af2b2d952c92e-ab2bba03-2ba3-49d8-a82c-ef6da750d8ab-7725&upload-time=1752714412721&time-delta-to-apply-millis=use-collector-delta&w=0&NoResponseBody=true
Verdicts & Comments Add Verdict or Comment
24 JavaScript Window variables
These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.
object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B function| AddListener function| ClickEventListenerById function| ClickEventListenerByName object| ServerData object| webpackJsonp object| ko object| PROOF object| StringRepository object| Telemetry object| telemetry_webpackJsonp boolean| __ConvergedLogin_PCore boolean| __ boolean| __convergedlogin_pcustomizationloader_23ef905c40c591d8d403 boolean| __convergedlogin_pfetchsessionsprogress_8b91e9d11baffe6473fb boolean| __convergedlogin_pstringcustomizationhelper_754c5f5e6fb1302ec27615 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| outlook.office365.com/ | Name: ClientId Value: 3A593E89F94D479DBC8D02251E1729F7 |
|
| outlook.office365.com/ | Name: msal.cache.encryption Value: %7B%22id%22%3A%22019815eb-80df-70b9-97a0-d472447ce326%22%2C%22key%22%3A%22Z4ph7S5uMj1GX7Uj9mGYMMduDDPL-Qfbml2B5pfXjPA%22%7D |
|
| login.microsoftonline.com/ | Name: x-ms-gateway-slice Value: estsfd |
|
| login.microsoftonline.com/ | Name: stsservicecookie Value: estsfd |
|
| login.microsoftonline.com/ | Name: buid Value: 1.AVwAMe_N-B6jSkuT5F9XHpElWiC_mZE_oQdBhdwCEUeH70gBAABcAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEfsFOeaJbBmyEG2pOArBpIBWYvM1maxdZ862KBngHxge8MnMusXCjYb1lke1AaedP7KuMXi6K-NimHKD-CVp_wXbTjCK4mAWrMpdFBu0XREMgAA |
|
| .login.microsoftonline.com/ | Name: esctx Value: PAQABBwEAAABVrSpeuWamRam2jAF1XRQELxGJhSniiVr_jGtird7HKBboqMCje_dY6M4NsKEcStKqVI1LKmU5zXmK4Db63CK74Exr871JK4cFbaD5cdTqeC4IXqdXVXNPfrG1F3SGbsSu8FfReB57DZOe6Afe_vTsEXi2Tw7PGDX-9GU1oEDCWuIJAn5OIpD5BqN_AkxlJWAgAA |
|
| .login.microsoftonline.com/ | Name: esctx-tXBumXDFwiY Value: AQABCQEAAABVrSpeuWamRam2jAF1XRQEgwus2uT65mNblngZG6GJSSA-P9lYRGt5dyw1-eZZQl6iX5AAbYpPdsHurW8NwFKu55AzM-FDT2Mi2OeQAQ_agO7On4wQQkKfrimm7Rb3cte6WmWq3ZSdc0oPM8GwmkPgvyfdUGQEWJrnkGU9JenL0SAA |
|
| login.microsoftonline.com/ | Name: fpc Value: AoFVIfoMZPFIvB3DSEhPPQ3ZRKGgAgAAAKtDCuAOAAAA |
|
| .microsoft.com/ | Name: MC1 Value: GUID=d48542627a6b444081a79355760b3f0b&HASH=d485&LV=202507&V=4&LU=1752714413366 |
|
| .microsoft.com/ | Name: MS0 Value: 1b97714a06ae48d18242da4fa5b91d94 |
|
| login.microsoftonline.com/ | Name: MicrosoftApplicationsTelemetryDeviceId Value: 166f4f36-05a8-438d-b95f-55299796dbef |
|
| .login.microsoftonline.com/ | Name: brcap Value: 0 |
|
| .login.live.com/ | Name: uaid Value: 1b64daaf1fa841cf9b37e65d7502f724 |
|
| .login.live.com/ | Name: MSPRequ Value: id=N<=1752714414&co=2 |
|
| login.microsoftonline.com/ | Name: ai_session Value: sujc3+OhL2kmWgNLmWaBDE|1752714414650|1752714414650 |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Content-Security-Policy | default-src *.res.office365.com *.fluidpreview.office.net *.cdn.office.net *.df.onecdn.static.microsoft *.public.onecdn.static.microsoft swx.cdn.skype.com 'self'; script-src 'nonce-QKvucUqhmi1YUmlfHofB8g==' *.res.office365.com *.fluidpreview.office.net *.cdn.office.net *.df.onecdn.static.microsoft *.public.onecdn.static.microsoft wss://*.delve.office.com:443 shellprod.msocdn.com amcdn.msauth.net amcdn.msftauth.net *.skype.com *.skypeassets.com *.delve.office.com *.cdn.office.net *.df.onecdn.static.microsoft *.public.onecdn.static.microsoft static.teams.microsoft.com teams.microsoft.com cdn.forms.office.net blob: 'report-sample' 'self' 'wasm-unsafe-eval' *.yammer.com; style-src *.res.office365.com *.fluidpreview.office.net *.cdn.office.net *.df.onecdn.static.microsoft *.public.onecdn.static.microsoft shellprod.msocdn.com *.skype.com 'self' 'report-sample' 'unsafe-inline' *.yammer.com *.engage.cloud.microsoft 'unsafe-inline'; img-src * data: blob: filesystem: cid:; connect-src blob: data: *.res.office365.com *.fluidpreview.office.net *.cdn.office.net *.df.onecdn.static.microsoft *.public.onecdn.static.microsoft *.services.web.outlook.com login.live.com login.microsoftonline.com spoprod-a.akamaihd.net shellprod.msocdn.com *.bing.com *.office.net *.office.com *.office365.com *.officeapps.live.com *.skype.com *.skypeassets.com *.spoppe.com *.onedrive.com my.microsoftpersonalcontent.com browser.pipe.aria.microsoft.com *.gateway.messenger.live.com dev.virtualearth.net *.trouter.skype.com *.trouter.io wss://*.trouter.skype.com wss://*.trouter.skype.com:443 wss://*.trouter.io:443 media.licdn.com *.facebook.com onerm.olsvc.com *.qas.binginternal.com *.qas.bing.net wss://*.qas.bing.net:443 wss://*.platform.bing.com wss://*.botframework.com:443 wss://augloop.office.com wss://*.augloop.office.com outlook.live.com graph.microsoft.com *.graph.microsoft.com *.office.microsoft.com api.box.com api.dropboxapi.com *.users.storage.live.com www.onenote.com *.storage.msn.com wss://*.pushd.svc.ms wss://*.pushs.svc.ms wss://*.pushb.svc.ms wss://*.pushp.svc.ms wss://*.svc.ms nleditor.osi.officeppe.net pptservicescast.officeapps.live.com *.sharepoint-df.com *.sharepoint.com wss://*.delve.office.com:443 wss://*.loki.delve.office.com:443 wss://*.loki.delve.office.com *.delve.office.com *.loki.delve.office.com web.vortex.data.microsoft.com *.events.data.microsoft.com *.online.lync.com *.infra.lync.com wss://*.cortana.ai *.cortana.ai fs.microsoft.com newspro.microsoft.com 'self' login.microsoftonline.com outlook.office365.com teams.microsoft.com *.teams.microsoft.com *.yammer.com *.svc.ms *.licdn.com o365auditrealtimeingestion.manage.officeppe.com o365auditrealtimeingestion.manage.officeppe.com:445 o365auditrealtimeingestion.manage.office.com o365auditrealtimeingestion.manage.office.com:445 files.yammerusercontent.com *.engage.cloud.microsoft wss://augloop-dogfood.officeppe.com wss://*.augloop-dogfood.officeppe.com wss://augloop-gcc.office.com wss://*.augloop-gcc.office.com wss://augloop.office.com wss://*.augloop.office.com wss://augloop.svc.cloud.microsoft wss://*.augloop.svc.cloud.microsoft aesir.office.com *.oscs.protection.outlook.com *.safelinks.protection.outlook.com arc.msn.com *.dynamics.com *.mos.microsoft.com ris.api.iris.microsoft.com services.bingapis.com prod-autodetect.outlookmobile.com *.googleapis.com admin.microsoft.com admin.microsoft.com *.bpa.microsoft.com teams.cloud.microsoft api.tenor.com attachment.outlook.live.net *.msedge.net app.whiteboard.microsoft.com whiteboard.office.com whiteboard.cloud.microsoft outlook.cloud.microsoft identity.osi.office.net wss://substrate.office.com *.adnxs.com wss://*.trouter.teams.microsoft.com api.flow.microsoft.com *.sharepoint.de; base-uri browser.pipe.aria.microsoft.com 'self'; form-action *.officeapps.live.com *.sharepoint-df.com *.sharepoint.com *.odwebp.svc.ms login.microsoftonline.com *.sharepoint.de; object-src *.office.net 'self' attachments.office.net attachment.outlook.live.net blob:; frame-ancestors 'self' teams.microsoft.com; font-src data: *.res.office365.com *.fluidpreview.office.net *.cdn.office.net *.df.onecdn.static.microsoft *.public.onecdn.static.microsoft spoprod-a.akamaihd.net *.skype.com ms-appx-web: sharepointonline.com *.sharepointonline.com *.delve.office.com fs.microsoft.com 'self' *.yammer.com *.engage.cloud.microsoft; media-src blob: data: *.res.office365.com *.cdn.office.net *.df.onecdn.static.microsoft *.public.onecdn.static.microsoft *.sharepoint-df.com *.skype.com *.office.net *.office365.net *.office365-net.us *.office.com 'self' *.yammer.com *.engage.cloud.microsoft attachments.office.net attachment.outlook.live.net *.sharepoint.com *.sharepoint.de; frame-src * data: mailto: blob:; manifest-src 'self'; worker-src 'self' blob: *.office.com; child-src 'self' blob: *.office.com; report-uri https://csp.microsoft.com/report/OutlookWeb-Mail-PROD; upgrade-insecure-requests; |
| Strict-Transport-Security | max-age=31536000; includeSubDomains |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msauth.net
autodiscover.processandserve.com
browser.events.data.microsoft.com
eu-mobile.events.data.microsoft.com
login.live.com
login.microsoftonline.com
outlook.office365.com
res.public.onecdn.static.microsoft
browser.events.data.microsoft.com
outlook.office365.com
20.190.160.14
20.50.201.200
23.48.23.40
2603:1026:3000:150::a
2603:1026:3000:158::3
2603:1026:c0d:102b::2
2603:1026:c0d:c2d::8
2620:1ec:29:1::45
2a02:26f0:3500:3::b818:4d2f
40.126.32.74
00d1719bc3156d6c0b76ecbc47c2c0e17686661c779ffd722d67990e139696a0
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
06ab0f4758162e73c01186b8cc589187ef09b3f4fa5ee12eee77c3758f383d8c
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
1129d40ae5f61e0e0b303bca8b55a2b3c6fe3ee397527cace073471d03a2d2c7
1a714d40c45302285643e984127f5b09f55004ea20937af81b63893745779af1
1d2cde2e778a731cbd158758f735e1bcc2508a8252720d261d94068aff45aacc
2f9bd9a5867ed5d297c3c84907ef5f2e96c7536232b28380a97c4aa7cd14092a
376ebb19c09f2fc2d545ce179ac5db4f9ac91809e5ca11ef88e7f34d4a3076d9
3f0cc3f1b202b1bdfaf2666418285fc9abaf4e87b8b2f3946a7325695581d487
46525d507ca84e260688d836135c92df5b0404ecc366f6bade59872e47b36ff4
6e43da4537db9febe2802bd80172c98727c9e9b4c928d23df6a4a5abc4738daf
79007aa9a48dd5d3a315ef4f1b244b1a74b61c29467a278174f7c366ee7b1ca1
797bda35d13e5130fe5a14e0069c31b46ec1af6ea47f2d300309803bb4d2608c
7a00a0e431aa5525a5975fcbef7b3b4c3f7cc6bb7e491b385e0a04f80f44bb6d
7c6acd96757dc5287d4ebec17b5f34198ea3bb9253350ae8270747afb9a28fb9
7d64746e6531ec338ea289538987b3069ccf0f117474041b8c6032184340b5fe
7f25312f8532dd2796fcdf074c4a1c88c88b5e5fed913ddc907c13f655fcf521
81989cd160649d2243a028b673ad52ddc56bd13bb581dbb916aa486c47aa0cdc
8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13
a765eb44b2f3948f6bd02fa3e440952ed09bdb94a3157d7e6e28c46c40e34a67
bd3bbb78a066671082717ee1d8849faad9255020e9905d7d265f9c65a5821aec
dbe4a1fabc02c7f7b462356fe8f76e27621d5de50d472e4fa10ab5d789c1d4b6
e2e06fd13b71e25d4b4e767df88cfd8b0e311b964fc29a5b101dbd1b091e83e6
e35d94b76894d6eca96ff5b1a12d94dfe73485ef3c52cb5b4395be8ffac1cb45
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f26bcef91c9b693e1df854b8ba94b961040617fa5b1b4091e091f10b97bf9eeb
